@rhino-dev/rhino-nestjs 0.2.5

package/dist/interceptors/hidden-columns.interceptor.js

@@ -0,0 +1,66 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.HiddenColumnsInterceptor = void 0;
+const common_1 = require("@nestjs/common");
+const operators_1 = require("rxjs/operators");
+const rhino_config_1 = require("../rhino.config");
+const serializer_service_1 = require("../services/serializer.service");
+/**
+ * Applies serializer filtering (base hidden, additional hidden, policy-driven
+ * whitelist/blacklist, computed attributes) when a non-serialized record is
+ * returned from a handler.
+ *
+ * Order with ResponseInterceptor: register this interceptor BEFORE
+ * ResponseInterceptor in the provider chain.
+ */
+let HiddenColumnsInterceptor = class HiddenColumnsInterceptor {
+    config;
+    serializer;
+    constructor(config, serializer) {
+        this.config = config;
+        this.serializer = serializer;
+    }
+    intercept(context, next) {
+        const req = context.switchToHttp().getRequest();
+        const modelSlug = req.params?.modelSlug;
+        const reg = modelSlug ? this.config.model(modelSlug) : null;
+        if (!reg)
+            return next.handle();
+        // BP-007: pass {user, organization} so role-keyed policies resolve properly.
+        const ctx = { user: req.user, organization: req.organization };
+        return next.handle().pipe((0, operators_1.map)((body) => {
+            if (!body)
+                return body;
+            // Preserve paginated envelope shape if present
+            if (body.__rhinoPaginated) {
+                return {
+                    ...body,
+                    items: this.serializer.serializeMany(body.items, reg, ctx),
+                };
+            }
+            if (body.data && Array.isArray(body.data)) {
+                return { ...body, data: this.serializer.serializeMany(body.data, reg, ctx) };
+            }
+            if (Array.isArray(body)) {
+                return this.serializer.serializeMany(body, reg, ctx);
+            }
+            return this.serializer.serializeOne(body, reg, ctx);
+        }));
+    }
+};
+exports.HiddenColumnsInterceptor = HiddenColumnsInterceptor;
+exports.HiddenColumnsInterceptor = HiddenColumnsInterceptor = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [rhino_config_1.RhinoConfigService,
+        serializer_service_1.SerializerService])
+], HiddenColumnsInterceptor);
+//# sourceMappingURL=hidden-columns.interceptor.js.map

package/dist/interceptors/hidden-columns.interceptor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hidden-columns.interceptor.js","sourceRoot":"","sources":["../../src/interceptors/hidden-columns.interceptor.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,2CAKwB;AAExB,8CAAqC;AACrC,kDAAqD;AACrD,uEAAmE;AAEnE;;;;;;;GAOG;AAEI,IAAM,wBAAwB,GAA9B,MAAM,wBAAwB;IAEhB;IACA;IAFnB,YACmB,MAA0B,EAC1B,UAA6B;QAD7B,WAAM,GAAN,MAAM,CAAoB;QAC1B,eAAU,GAAV,UAAU,CAAmB;IAC7C,CAAC;IAEJ,SAAS,CAAC,OAAyB,EAAE,IAAiB;QACpD,MAAM,GAAG,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,UAAU,EAAE,CAAC;QAChD,MAAM,SAAS,GAAG,GAAG,CAAC,MAAM,EAAE,SAAS,CAAC;QACxC,MAAM,GAAG,GAAG,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAC5D,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,CAAC,MAAM,EAAE,CAAC;QAC/B,6EAA6E;QAC7E,MAAM,GAAG,GAAG,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,YAAY,EAAE,GAAG,CAAC,YAAY,EAAE,CAAC;QAE/D,OAAO,IAAI,CAAC,MAAM,EAAE,CAAC,IAAI,CACvB,IAAA,eAAG,EAAC,CAAC,IAAS,EAAE,EAAE;YAChB,IAAI,CAAC,IAAI;gBAAE,OAAO,IAAI,CAAC;YACvB,+CAA+C;YAC/C,IAAI,IAAI,CAAC,gBAAgB,EAAE,CAAC;gBAC1B,OAAO;oBACL,GAAG,IAAI;oBACP,KAAK,EAAE,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,CAAC;iBAC3D,CAAC;YACJ,CAAC;YACD,IAAI,IAAI,CAAC,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC1C,OAAO,EAAE,GAAG,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC,EAAE,CAAC;YAC/E,CAAC;YACD,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;gBACxB,OAAO,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;YACvD,CAAC;YACD,OAAO,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;QACtD,CAAC,CAAC,CACH,CAAC;IACJ,CAAC;CACF,CAAA;AAlCY,4DAAwB;mCAAxB,wBAAwB;IADpC,IAAA,mBAAU,GAAE;qCAGgB,iCAAkB;QACd,sCAAiB;GAHrC,wBAAwB,CAkCpC"}

package/dist/interceptors/response.interceptor.d.ts

@@ -0,0 +1,19 @@
+import { CallHandler, ExecutionContext, NestInterceptor } from '@nestjs/common';
+import { Observable } from 'rxjs';
+export interface PaginatedShape {
+    __rhinoPaginated: true;
+    items: any[];
+    total: number;
+    page: number;
+    perPage: number;
+    lastPage: number;
+}
+export declare function paginated(items: any[], total: number, page: number, perPage: number): PaginatedShape;
+/**
+ * Response envelope interceptor. Two output modes:
+ *   - `paginated()` result  → `{data: [...]}` + X-Current-Page/X-Last-Page/X-Per-Page/X-Total headers
+ *   - anything else         → pass-through (single record, 204, etc.)
+ */
+export declare class ResponseInterceptor implements NestInterceptor {
+    intercept(context: ExecutionContext, next: CallHandler): Observable<any>;
+}

package/dist/interceptors/response.interceptor.js

@@ -0,0 +1,47 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ResponseInterceptor = void 0;
+exports.paginated = paginated;
+const common_1 = require("@nestjs/common");
+const operators_1 = require("rxjs/operators");
+function paginated(items, total, page, perPage) {
+    return {
+        __rhinoPaginated: true,
+        items,
+        total,
+        page,
+        perPage,
+        lastPage: Math.max(1, Math.ceil(total / perPage)),
+    };
+}
+/**
+ * Response envelope interceptor. Two output modes:
+ *   - `paginated()` result  → `{data: [...]}` + X-Current-Page/X-Last-Page/X-Per-Page/X-Total headers
+ *   - anything else         → pass-through (single record, 204, etc.)
+ */
+let ResponseInterceptor = class ResponseInterceptor {
+    intercept(context, next) {
+        const res = context.switchToHttp().getResponse();
+        return next.handle().pipe((0, operators_1.map)((body) => {
+            if (body && body.__rhinoPaginated) {
+                res.setHeader('X-Current-Page', body.page);
+                res.setHeader('X-Last-Page', body.lastPage);
+                res.setHeader('X-Per-Page', body.perPage);
+                res.setHeader('X-Total', body.total);
+                return { data: body.items };
+            }
+            return body;
+        }));
+    }
+};
+exports.ResponseInterceptor = ResponseInterceptor;
+exports.ResponseInterceptor = ResponseInterceptor = __decorate([
+    (0, common_1.Injectable)()
+], ResponseInterceptor);
+//# sourceMappingURL=response.interceptor.js.map

package/dist/interceptors/response.interceptor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"response.interceptor.js","sourceRoot":"","sources":["../../src/interceptors/response.interceptor.ts"],"names":[],"mappings":";;;;;;;;;AAkBA,8BASC;AA3BD,2CAKwB;AAExB,8CAAqC;AAWrC,SAAgB,SAAS,CAAC,KAAY,EAAE,KAAa,EAAE,IAAY,EAAE,OAAe;IAClF,OAAO;QACL,gBAAgB,EAAE,IAAI;QACtB,KAAK;QACL,KAAK;QACL,IAAI;QACJ,OAAO;QACP,QAAQ,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,CAAC;KAClD,CAAC;AACJ,CAAC;AAED;;;;GAIG;AAEI,IAAM,mBAAmB,GAAzB,MAAM,mBAAmB;IAC9B,SAAS,CAAC,OAAyB,EAAE,IAAiB;QACpD,MAAM,GAAG,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,WAAW,EAAE,CAAC;QACjD,OAAO,IAAI,CAAC,MAAM,EAAE,CAAC,IAAI,CACvB,IAAA,eAAG,EAAC,CAAC,IAAI,EAAE,EAAE;YACX,IAAI,IAAI,IAAI,IAAI,CAAC,gBAAgB,EAAE,CAAC;gBAClC,GAAG,CAAC,SAAS,CAAC,gBAAgB,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;gBAC3C,GAAG,CAAC,SAAS,CAAC,aAAa,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;gBAC5C,GAAG,CAAC,SAAS,CAAC,YAAY,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;gBAC1C,GAAG,CAAC,SAAS,CAAC,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;gBACrC,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC;YAC9B,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC,CAAC,CACH,CAAC;IACJ,CAAC;CACF,CAAA;AAhBY,kDAAmB;8BAAnB,mBAAmB;IAD/B,IAAA,mBAAU,GAAE;GACA,mBAAmB,CAgB/B"}

package/dist/interfaces/rhino-config.interface.d.ts

@@ -0,0 +1,103 @@
+import type { Type } from '@nestjs/common';
+import type { NestMiddleware } from '@nestjs/common';
+import type { ZodSchema } from 'zod';
+import type { ResourcePolicy } from '../policies/resource-policy';
+import type { PrismaClientLike } from '../prisma/prisma.service';
+export interface ModelRegistration {
+    /** Prisma model name (camelCase or PascalCase — matches the delegate on prisma client) */
+    model: string;
+    policy?: Type<ResourcePolicy>;
+    validation?: ZodSchema;
+    validationStore?: ZodSchema | Record<string, ZodSchema>;
+    validationUpdate?: ZodSchema | Record<string, ZodSchema>;
+    allowedFilters?: string[];
+    allowedSorts?: string[];
+    defaultSort?: string;
+    allowedFields?: string[];
+    allowedIncludes?: string[];
+    allowedSearch?: string[];
+    exceptActions?: string[];
+    paginationEnabled?: boolean;
+    perPage?: number;
+    softDeletes?: boolean;
+    middleware?: Type<NestMiddleware>[];
+    actionMiddleware?: Record<string, Type<NestMiddleware>[]>;
+    owner?: string;
+    belongsToOrganization?: boolean;
+    hasAuditTrail?: boolean;
+    hasUuid?: boolean;
+    additionalHiddenColumns?: string[];
+    auditExclude?: string[];
+    computedAttributes?: (record: any, user: any) => Record<string, any>;
+    scopes?: Type<any>[];
+    /** Foreign-key constraints to verify against the current organization. */
+    fkConstraints?: Array<{
+        field: string;
+        model: string;
+    }>;
+}
+export interface RouteGroupConfig {
+    prefix?: string;
+    middleware?: Type<NestMiddleware>[];
+    /** '*' = all registered models, array = subset by slug */
+    models: '*' | string[];
+    /** Skip the default JWT guard for this group (for public routes) */
+    skipAuth?: boolean;
+}
+export interface MultiTenantConfig {
+    enabled?: boolean;
+    organizationIdentifierColumn?: 'id' | 'slug' | 'uuid' | string;
+    organizationModel?: string;
+    userOrganizationModel?: string;
+}
+export interface NestedConfig {
+    path?: string;
+    maxOperations?: number;
+    allowedModels?: string[] | null;
+}
+export interface InvitationConfig {
+    expiresDays?: number;
+    allowedRoles?: string[] | null;
+    notificationHandler?: (invitation: any) => Promise<void> | void;
+}
+export interface AuthConfig {
+    jwtSecret?: string;
+    jwtExpiresIn?: string;
+    userModel?: string;
+    passwordField?: string;
+    emailField?: string;
+}
+export interface PostmanConfig {
+    roleModel?: string;
+    userRoleModel?: string;
+    userModel?: string;
+}
+export interface RhinoConfig {
+    /**
+     * The consuming app's PrismaClient instance. Optional at the interface level
+     * so tests can construct a config without Prisma, but `RhinoModule.forRoot`
+     * expects it in production use.
+     */
+    prismaClient?: PrismaClientLike;
+    models: Record<string, ModelRegistration>;
+    routeGroups?: Record<string, RouteGroupConfig>;
+    multiTenant?: MultiTenantConfig;
+    nested?: NestedConfig;
+    invitations?: InvitationConfig;
+    auth?: AuthConfig;
+    postman?: PostmanConfig;
+    clientPath?: string;
+    mobilePath?: string;
+    testFramework?: 'jest' | 'vitest';
+}
+export interface RhinoModuleAsyncOptions {
+    imports?: any[];
+    inject?: any[];
+    useFactory: (...args: any[]) => Promise<RhinoConfig> | RhinoConfig;
+    /**
+     * Middleware classes referenced in `models[*].middleware` / `actionMiddleware`.
+     * NestJS requires providers be declared synchronously, so for async config
+     * the user must list them here to enable auto-wiring.
+     */
+    middleware?: Type<NestMiddleware>[];
+}

package/dist/interfaces/rhino-config.interface.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=rhino-config.interface.js.map

package/dist/interfaces/rhino-config.interface.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rhino-config.interface.js","sourceRoot":"","sources":["../../src/interfaces/rhino-config.interface.ts"],"names":[],"mappings":""}

package/dist/interfaces/rhino-request.interface.d.ts

@@ -0,0 +1,12 @@
+import type { Request } from 'express';
+/**
+ * Typed shape of the Express request after Rhino middleware has run.
+ * Internal keys are prefixed `__` to avoid collisions with app data.
+ */
+export interface RhinoRequest<TUser = any, TOrg = any> extends Request {
+    user?: TUser;
+    organization?: TOrg;
+    __routeGroup?: string;
+    __skipAuth?: boolean;
+    __action?: string;
+}

package/dist/interfaces/rhino-request.interface.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=rhino-request.interface.js.map

package/dist/interfaces/rhino-request.interface.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rhino-request.interface.js","sourceRoot":"","sources":["../../src/interfaces/rhino-request.interface.ts"],"names":[],"mappings":""}

package/dist/middleware/resolve-organization.middleware.d.ts

@@ -0,0 +1,15 @@
+import { NestMiddleware } from '@nestjs/common';
+import { NextFunction, Request, Response } from 'express';
+import { OrganizationService } from '../services/organization.service';
+/**
+ * Resolves the `:organization` route parameter and attaches the org
+ * to `req.organization`. Ensures the authenticated user belongs to it.
+ */
+export declare class ResolveOrganizationMiddleware implements NestMiddleware {
+    private readonly orgService;
+    constructor(orgService: OrganizationService);
+    use(req: Request & {
+        user?: any;
+        organization?: any;
+    }, _res: Response, next: NextFunction): Promise<void>;
+}

package/dist/middleware/resolve-organization.middleware.js

@@ -0,0 +1,38 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ResolveOrganizationMiddleware = void 0;
+const common_1 = require("@nestjs/common");
+const organization_service_1 = require("../services/organization.service");
+/**
+ * Resolves the `:organization` route parameter and attaches the org
+ * to `req.organization`. Ensures the authenticated user belongs to it.
+ */
+let ResolveOrganizationMiddleware = class ResolveOrganizationMiddleware {
+    orgService;
+    constructor(orgService) {
+        this.orgService = orgService;
+    }
+    async use(req, _res, next) {
+        const identifier = req.params.organization ?? req.params.org;
+        if (!identifier)
+            return next();
+        const org = await this.orgService.resolve(identifier, req.user);
+        req.organization = org;
+        next();
+    }
+};
+exports.ResolveOrganizationMiddleware = ResolveOrganizationMiddleware;
+exports.ResolveOrganizationMiddleware = ResolveOrganizationMiddleware = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [organization_service_1.OrganizationService])
+], ResolveOrganizationMiddleware);
+//# sourceMappingURL=resolve-organization.middleware.js.map

package/dist/middleware/resolve-organization.middleware.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve-organization.middleware.js","sourceRoot":"","sources":["../../src/middleware/resolve-organization.middleware.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,2CAA4D;AAE5D,2EAAuE;AAEvE;;;GAGG;AAEI,IAAM,6BAA6B,GAAnC,MAAM,6BAA6B;IACX;IAA7B,YAA6B,UAA+B;QAA/B,eAAU,GAAV,UAAU,CAAqB;IAAG,CAAC;IAEhE,KAAK,CAAC,GAAG,CAAC,GAAiD,EAAE,IAAc,EAAE,IAAkB;QAC7F,MAAM,UAAU,GAAI,GAAG,CAAC,MAAc,CAAC,YAAY,IAAK,GAAG,CAAC,MAAc,CAAC,GAAG,CAAC;QAC/E,IAAI,CAAC,UAAU;YAAE,OAAO,IAAI,EAAE,CAAC;QAC/B,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,UAAU,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;QAChE,GAAG,CAAC,YAAY,GAAG,GAAG,CAAC;QACvB,IAAI,EAAE,CAAC;IACT,CAAC;CACF,CAAA;AAVY,sEAA6B;wCAA7B,6BAA6B;IADzC,IAAA,mBAAU,GAAE;qCAE8B,0CAAmB;GADjD,6BAA6B,CAUzC"}

package/dist/middleware/route-group.middleware.d.ts

@@ -0,0 +1,17 @@
+import { NestMiddleware } from '@nestjs/common';
+import type { NextFunction, Request, Response } from 'express';
+import { RhinoConfigService } from '../rhino.config';
+/**
+ * Detects which Rhino route group the current request belongs to
+ * (based on URL prefix) and attaches:
+ *   - `req.__routeGroup`  — the group name
+ *   - `req.__skipAuth`    — true when the group has `skipAuth: true`
+ *
+ * Install this middleware globally BEFORE `JwtAuthGuard` so the guard can
+ * read `req.__skipAuth` and short-circuit.
+ */
+export declare class RouteGroupMiddleware implements NestMiddleware {
+    private readonly config;
+    constructor(config: RhinoConfigService);
+    use(req: Request & Record<string, any>, _res: Response, next: NextFunction): void;
+}

package/dist/middleware/route-group.middleware.js

@@ -0,0 +1,60 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RouteGroupMiddleware = void 0;
+const common_1 = require("@nestjs/common");
+const rhino_config_1 = require("../rhino.config");
+/**
+ * Detects which Rhino route group the current request belongs to
+ * (based on URL prefix) and attaches:
+ *   - `req.__routeGroup`  — the group name
+ *   - `req.__skipAuth`    — true when the group has `skipAuth: true`
+ *
+ * Install this middleware globally BEFORE `JwtAuthGuard` so the guard can
+ * read `req.__skipAuth` and short-circuit.
+ */
+let RouteGroupMiddleware = class RouteGroupMiddleware {
+    config;
+    constructor(config) {
+        this.config = config;
+    }
+    use(req, _res, next) {
+        // BP-006: `req.url` is stripped to the middleware's mount-point when
+        // registered via NestModule.configure(consumer).forRoutes('*'), so it
+        // collapses to `/` for every request. `req.originalUrl` carries the full
+        // request URL verbatim — use that for prefix matching.
+        const url = String(req.originalUrl ?? req.url ?? '').split('?')[0];
+        const groups = this.config.routeGroups();
+        let match = null;
+        for (const [name, group] of Object.entries(groups)) {
+            const prefix = group.prefix ?? '';
+            if (!prefix)
+                continue;
+            if (prefix.startsWith(':'))
+                continue; // dynamic tenant prefix — handled by ResolveOrganizationMiddleware
+            if (url.includes(`/${prefix}/`) || url.endsWith(`/${prefix}`)) {
+                match = { name, prefix };
+                if (group.skipAuth)
+                    req.__skipAuth = true;
+                break;
+            }
+        }
+        if (match)
+            req.__routeGroup = match.name;
+        next();
+    }
+};
+exports.RouteGroupMiddleware = RouteGroupMiddleware;
+exports.RouteGroupMiddleware = RouteGroupMiddleware = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [rhino_config_1.RhinoConfigService])
+], RouteGroupMiddleware);
+//# sourceMappingURL=route-group.middleware.js.map

package/dist/middleware/route-group.middleware.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"route-group.middleware.js","sourceRoot":"","sources":["../../src/middleware/route-group.middleware.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,2CAA4D;AAE5D,kDAAqD;AAErD;;;;;;;;GAQG;AAEI,IAAM,oBAAoB,GAA1B,MAAM,oBAAoB;IACF;IAA7B,YAA6B,MAA0B;QAA1B,WAAM,GAAN,MAAM,CAAoB;IAAG,CAAC;IAE3D,GAAG,CAAC,GAAkC,EAAE,IAAc,EAAE,IAAkB;QACxE,qEAAqE;QACrE,sEAAsE;QACtE,yEAAyE;QACzE,uDAAuD;QACvD,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,WAAW,IAAI,GAAG,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACnE,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;QACzC,IAAI,KAAK,GAA4C,IAAI,CAAC;QAC1D,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YACnD,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,IAAI,EAAE,CAAC;YAClC,IAAI,CAAC,MAAM;gBAAE,SAAS;YACtB,IAAI,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC;gBAAE,SAAS,CAAC,mEAAmE;YACzG,IAAI,GAAG,CAAC,QAAQ,CAAC,IAAI,MAAM,GAAG,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,IAAI,MAAM,EAAE,CAAC,EAAE,CAAC;gBAC9D,KAAK,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;gBACzB,IAAI,KAAK,CAAC,QAAQ;oBAAE,GAAG,CAAC,UAAU,GAAG,IAAI,CAAC;gBAC1C,MAAM;YACR,CAAC;QACH,CAAC;QACD,IAAI,KAAK;YAAE,GAAG,CAAC,YAAY,GAAG,KAAK,CAAC,IAAI,CAAC;QACzC,IAAI,EAAE,CAAC;IACT,CAAC;CACF,CAAA;AAxBY,oDAAoB;+BAApB,oBAAoB;IADhC,IAAA,mBAAU,GAAE;qCAE0B,iCAAkB;GAD5C,oBAAoB,CAwBhC"}

package/dist/middleware/tenant-route-rewrite.d.ts

@@ -0,0 +1,76 @@
+import type { Request, Response, NextFunction } from 'express';
+import type { RhinoConfig } from '../interfaces/rhino-config.interface';
+import type { PrismaClientLike } from '../prisma/prisma.service';
+export interface TenantRouteRewriteOptions {
+    /**
+     * Global API prefix used by the consumer (matches
+     * `applyRhinoRouting({ prefix })`). Defaults to `'api'`.
+     */
+    apiPrefix?: string;
+    /**
+     * Path segments to treat as non-tenant even when they match an org slug
+     * (they sit at the api root). Defaults cover the library's built-in
+     * public/auth endpoints plus `nested`.
+     */
+    reservedSegments?: string[];
+    /**
+     * When `true` (default), a URL that looks tenant-shaped but whose first
+     * segment doesn't match any known organization → HTTP 404. When `false`
+     * the request passes through unchanged (GlobalController then treats the
+     * segment as a model slug and likely returns its own UNKNOWN_RESOURCE
+     * 404).
+     */
+    strict?: boolean;
+    /**
+     * When `true` (default), after resolving the org the middleware checks
+     * that the authenticated user (if any) is a member. Non-members produce
+     * a 404 (intentional — matches Laravel "Organization not found"). If
+     * `req.user` is absent the check is skipped (auth runs later).
+     */
+    enforceMembership?: boolean;
+}
+/**
+ * Factory for an Express-level middleware that implements the
+ * `routeGroups.tenant.prefix: ':organization'` contract promised by
+ * RhinoConfig.
+ *
+ * Context (BP-001): NestJS controllers are declared with static
+ * `@Controller(...)` paths, so the library cannot dynamically prefix them
+ * with a runtime `:organization` segment. NestModule.configure() middleware
+ * runs AFTER Nest has matched the handler, so a middleware registered there
+ * cannot rewrite the URL in time. This factory returns a handler intended
+ * for raw Express `app.use(tenantRouteRewrite(...))` BEFORE calling
+ * `applyRhinoRouting(...)`.
+ *
+ * Behavior:
+ *
+ *   1. Match `/{apiPrefix}/<slug>/<rest>`. If no match → next().
+ *   2. If `<slug>` is a reserved segment (auth/invitations/nested) → next().
+ *   3. Look up the organization by slug (with an in-process cache).
+ *      - Not found + strict → 404 CROSS_TENANT
+ *      - Not found + non-strict → next() (treated as a model slug)
+ *   4. When the request is authenticated, verify membership. Non-member →
+ *      404 CROSS_TENANT (same code as missing org — by design, no user
+ *      enumeration).
+ *   5. Attach the resolved org to `req.organization` and rewrite
+ *      `req.url` / `req.originalUrl` to drop the slug so the GlobalController
+ *      continues to match `/{apiPrefix}/:modelSlug`.
+ *
+ * Usage:
+ *
+ *   import { createTenantRouteRewrite, RHINO_CONFIG, RHINO_PRISMA_CLIENT } from '@rhino-dev/rhino-nestjs';
+ *
+ *   async function bootstrap() {
+ *     const app = await NestFactory.create(AppModule);
+ *     const prisma = app.get(RHINO_PRISMA_CLIENT);
+ *     const config = app.get(RHINO_CONFIG);
+ *     app.use(createTenantRouteRewrite({ prisma, config }));
+ *     applyRhinoRouting(app, { prefix: 'api' });
+ *     await app.listen(8004);
+ *   }
+ */
+export declare function createTenantRouteRewrite(args: {
+    prisma: PrismaClientLike;
+    config: RhinoConfig;
+    options?: TenantRouteRewriteOptions;
+}): (req: Request, res: Response, next: NextFunction) => Promise<void>;

package/dist/middleware/tenant-route-rewrite.js

@@ -0,0 +1,124 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createTenantRouteRewrite = createTenantRouteRewrite;
+/**
+ * Factory for an Express-level middleware that implements the
+ * `routeGroups.tenant.prefix: ':organization'` contract promised by
+ * RhinoConfig.
+ *
+ * Context (BP-001): NestJS controllers are declared with static
+ * `@Controller(...)` paths, so the library cannot dynamically prefix them
+ * with a runtime `:organization` segment. NestModule.configure() middleware
+ * runs AFTER Nest has matched the handler, so a middleware registered there
+ * cannot rewrite the URL in time. This factory returns a handler intended
+ * for raw Express `app.use(tenantRouteRewrite(...))` BEFORE calling
+ * `applyRhinoRouting(...)`.
+ *
+ * Behavior:
+ *
+ *   1. Match `/{apiPrefix}/<slug>/<rest>`. If no match → next().
+ *   2. If `<slug>` is a reserved segment (auth/invitations/nested) → next().
+ *   3. Look up the organization by slug (with an in-process cache).
+ *      - Not found + strict → 404 CROSS_TENANT
+ *      - Not found + non-strict → next() (treated as a model slug)
+ *   4. When the request is authenticated, verify membership. Non-member →
+ *      404 CROSS_TENANT (same code as missing org — by design, no user
+ *      enumeration).
+ *   5. Attach the resolved org to `req.organization` and rewrite
+ *      `req.url` / `req.originalUrl` to drop the slug so the GlobalController
+ *      continues to match `/{apiPrefix}/:modelSlug`.
+ *
+ * Usage:
+ *
+ *   import { createTenantRouteRewrite, RHINO_CONFIG, RHINO_PRISMA_CLIENT } from '@rhino-dev/rhino-nestjs';
+ *
+ *   async function bootstrap() {
+ *     const app = await NestFactory.create(AppModule);
+ *     const prisma = app.get(RHINO_PRISMA_CLIENT);
+ *     const config = app.get(RHINO_CONFIG);
+ *     app.use(createTenantRouteRewrite({ prisma, config }));
+ *     applyRhinoRouting(app, { prefix: 'api' });
+ *     await app.listen(8004);
+ *   }
+ */
+function createTenantRouteRewrite(args) {
+    const { apiPrefix = 'api', reservedSegments = ['auth', 'invitations', 'nested'], strict = true, enforceMembership = true, } = args.options ?? {};
+    const reserved = new Set(reservedSegments);
+    const orgModel = args.config.multiTenant?.organizationModel ?? 'organization';
+    const userOrgModel = args.config.multiTenant?.userOrganizationModel ?? 'userRole';
+    const idColumn = args.config.multiTenant?.organizationIdentifierColumn ?? 'slug';
+    const knownModelSlugs = new Set(Object.keys(args.config.models ?? {}));
+    // Simple in-memory cache keyed by slug → org record.
+    // `null` = probed and not found (short-circuit on subsequent calls).
+    const cache = new Map();
+    const notFound = (res) => {
+        res.status(404).json({
+            code: 'NOT_FOUND',
+            message: 'Organization not found',
+        });
+    };
+    const prefixPattern = new RegExp(`^/${escapeRegex(apiPrefix)}/([^/]+)(/.*)?$`);
+    return async function tenantRouteRewrite(req, res, next) {
+        try {
+            const raw = String(req.url ?? '').split('?')[0];
+            const query = String(req.url ?? '').slice(raw.length);
+            const m = raw.match(prefixPattern);
+            if (!m)
+                return next();
+            const first = m[1];
+            const rest = m[2] ?? '';
+            // Reserved non-tenant segments (auth, invitations, nested) pass through.
+            if (reserved.has(first))
+                return next();
+            // If the first segment matches a KNOWN model slug, this isn't a tenant
+            // route — the consumer is hitting `/api/<modelSlug>` directly (e.g.
+            // without a tenant prefix). Skip rewriting.
+            if (knownModelSlugs.has(first))
+                return next();
+            // Look up org. Cache null so repeat lookups are fast.
+            if (!cache.has(first)) {
+                const delegate = args.prisma[camel(orgModel)] ?? args.prisma[orgModel];
+                if (!delegate?.findFirst)
+                    return next();
+                const org = await delegate.findFirst({ where: { [idColumn]: first } }).catch(() => null);
+                cache.set(first, org ?? null);
+            }
+            const org = cache.get(first);
+            if (!org) {
+                if (strict)
+                    return notFound(res);
+                return next();
+            }
+            // Membership check (BP-011: cross-tenant → 404, not 403).
+            if (enforceMembership && req.user) {
+                const userId = req.user.id;
+                const urDelegate = args.prisma[camel(userOrgModel)] ?? args.prisma[userOrgModel];
+                if (urDelegate?.findFirst) {
+                    const member = await urDelegate
+                        .findFirst({ where: { userId, organizationId: org.id } })
+                        .catch(() => null);
+                    if (!member)
+                        return notFound(res);
+                }
+            }
+            // Attach + rewrite.
+            req.organization = org;
+            req.__orgSlug = first;
+            req.url = `/${apiPrefix}${rest}${query}`;
+            req.originalUrl = req.url;
+            return next();
+        }
+        catch (err) {
+            return next(err);
+        }
+    };
+}
+function camel(name) {
+    if (!name)
+        return name;
+    return name.charAt(0).toLowerCase() + name.slice(1);
+}
+function escapeRegex(s) {
+    return s.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+}
+//# sourceMappingURL=tenant-route-rewrite.js.map

package/dist/middleware/tenant-route-rewrite.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tenant-route-rewrite.js","sourceRoot":"","sources":["../../src/middleware/tenant-route-rewrite.ts"],"names":[],"mappings":";;AAyEA,4DAoFC;AA5HD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AACH,SAAgB,wBAAwB,CAAC,IAIxC;IACC,MAAM,EACJ,SAAS,GAAG,KAAK,EACjB,gBAAgB,GAAG,CAAC,MAAM,EAAE,aAAa,EAAE,QAAQ,CAAC,EACpD,MAAM,GAAG,IAAI,EACb,iBAAiB,GAAG,IAAI,GACzB,GAAG,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC;IAEvB,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,gBAAgB,CAAC,CAAC;IAC3C,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,iBAAiB,IAAI,cAAc,CAAC;IAC9E,MAAM,YAAY,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,qBAAqB,IAAI,UAAU,CAAC;IAClF,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,4BAA4B,IAAI,MAAM,CAAC;IACjF,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,CAAC;IAEvE,qDAAqD;IACrD,qEAAqE;IACrE,MAAM,KAAK,GAAG,IAAI,GAAG,EAAe,CAAC;IAErC,MAAM,QAAQ,GAAG,CAAC,GAAa,EAAE,EAAE;QACjC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;YACnB,IAAI,EAAE,WAAW;YACjB,OAAO,EAAE,wBAAwB;SAClC,CAAC,CAAC;IACL,CAAC,CAAC;IAEF,MAAM,aAAa,GAAG,IAAI,MAAM,CAAC,KAAK,WAAW,CAAC,SAAS,CAAC,iBAAiB,CAAC,CAAC;IAE/E,OAAO,KAAK,UAAU,kBAAkB,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB;QACtF,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;YAChD,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YACtD,MAAM,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;YACnC,IAAI,CAAC,CAAC;gBAAE,OAAO,IAAI,EAAE,CAAC;YAEtB,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;YACnB,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YAExB,yEAAyE;YACzE,IAAI,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,EAAE,CAAC;YAEvC,uEAAuE;YACvE,oEAAoE;YACpE,4CAA4C;YAC5C,IAAI,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,EAAE,CAAC;YAE9C,sDAAsD;YACtD,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;gBACtB,MAAM,QAAQ,GAAI,IAAI,CAAC,MAAc,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,IAAK,IAAI,CAAC,MAAc,CAAC,QAAQ,CAAC,CAAC;gBACzF,IAAI,CAAC,QAAQ,EAAE,SAAS;oBAAE,OAAO,IAAI,EAAE,CAAC;gBACxC,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;gBACzF,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,IAAI,IAAI,CAAC,CAAC;YAChC,CAAC;YACD,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YAC7B,IAAI,CAAC,GAAG,EAAE,CAAC;gBACT,IAAI,MAAM;oBAAE,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC;gBACjC,OAAO,IAAI,EAAE,CAAC;YAChB,CAAC;YAED,0DAA0D;YAC1D,IAAI,iBAAiB,IAAK,GAAW,CAAC,IAAI,EAAE,CAAC;gBAC3C,MAAM,MAAM,GAAI,GAAW,CAAC,IAAI,CAAC,EAAE,CAAC;gBACpC,MAAM,UAAU,GAAI,IAAI,CAAC,MAAc,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,IAAK,IAAI,CAAC,MAAc,CAAC,YAAY,CAAC,CAAC;gBACnG,IAAI,UAAU,EAAE,SAAS,EAAE,CAAC;oBAC1B,MAAM,MAAM,GAAG,MAAM,UAAU;yBAC5B,SAAS,CAAC,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,cAAc,EAAE,GAAG,CAAC,EAAE,EAAE,EAAE,CAAC;yBACxD,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;oBACrB,IAAI,CAAC,MAAM;wBAAE,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC;gBACpC,CAAC;YACH,CAAC;YAED,oBAAoB;YACnB,GAAW,CAAC,YAAY,GAAG,GAAG,CAAC;YAC/B,GAAW,CAAC,SAAS,GAAG,KAAK,CAAC;YAC/B,GAAG,CAAC,GAAG,GAAG,IAAI,SAAS,GAAG,IAAI,GAAG,KAAK,EAAE,CAAC;YACxC,GAAW,CAAC,WAAW,GAAG,GAAG,CAAC,GAAG,CAAC;YACnC,OAAO,IAAI,EAAE,CAAC;QAChB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC;QACnB,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,KAAK,CAAC,IAAY;IACzB,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AACtD,CAAC;AAED,SAAS,WAAW,CAAC,CAAS;IAC5B,OAAO,CAAC,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;AAClD,CAAC"}