@rhino-dev/rhino-nestjs 0.2.5

package/dist/utils/model-builder.js

@@ -0,0 +1,67 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.defineModel = defineModel;
+function defineModel(def) {
+    const out = {
+        model: def.model,
+        policy: def.policy,
+    };
+    // features
+    if (def.features?.multiTenant)
+        out.belongsToOrganization = true;
+    if (def.features?.softDeletes)
+        out.softDeletes = true;
+    if (def.features?.auditTrail)
+        out.hasAuditTrail = true;
+    if (def.features?.uuid)
+        out.hasUuid = true;
+    // query
+    if (def.query) {
+        if (def.query.filters)
+            out.allowedFilters = def.query.filters;
+        if (def.query.sorts)
+            out.allowedSorts = def.query.sorts;
+        if (def.query.defaultSort)
+            out.defaultSort = def.query.defaultSort;
+        if (def.query.search)
+            out.allowedSearch = def.query.search;
+        if (def.query.includes)
+            out.allowedIncludes = def.query.includes;
+        if (def.query.fields)
+            out.allowedFields = def.query.fields;
+        if (def.query.pagination != null)
+            out.paginationEnabled = def.query.pagination;
+        if (def.query.perPage != null)
+            out.perPage = def.query.perPage;
+    }
+    // validation
+    if (def.validation?.base)
+        out.validation = def.validation.base;
+    if (def.validation?.store)
+        out.validationStore = def.validation.store;
+    if (def.validation?.update)
+        out.validationUpdate = def.validation.update;
+    // response
+    if (def.response?.hidden)
+        out.additionalHiddenColumns = def.response.hidden;
+    if (def.response?.computed)
+        out.computedAttributes = def.response.computed;
+    // restrict
+    if (def.restrict?.except)
+        out.exceptActions = def.restrict.except;
+    // pass-through
+    if (def.middleware)
+        out.middleware = def.middleware;
+    if (def.actionMiddleware)
+        out.actionMiddleware = def.actionMiddleware;
+    if (def.scopes)
+        out.scopes = def.scopes;
+    if (def.fkConstraints)
+        out.fkConstraints = def.fkConstraints;
+    if (def.owner)
+        out.owner = def.owner;
+    if (def.auditExclude)
+        out.auditExclude = def.auditExclude;
+    return out;
+}
+//# sourceMappingURL=model-builder.js.map

package/dist/utils/model-builder.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"model-builder.js","sourceRoot":"","sources":["../../src/utils/model-builder.ts"],"names":[],"mappings":";;AAyEA,kCA6CC;AA7CD,SAAgB,WAAW,CAAC,GAAoB;IAC9C,MAAM,GAAG,GAAsB;QAC7B,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,MAAM,EAAE,GAAG,CAAC,MAAM;KACnB,CAAC;IAEF,WAAW;IACX,IAAI,GAAG,CAAC,QAAQ,EAAE,WAAW;QAAE,GAAG,CAAC,qBAAqB,GAAG,IAAI,CAAC;IAChE,IAAI,GAAG,CAAC,QAAQ,EAAE,WAAW;QAAE,GAAG,CAAC,WAAW,GAAG,IAAI,CAAC;IACtD,IAAI,GAAG,CAAC,QAAQ,EAAE,UAAU;QAAE,GAAG,CAAC,aAAa,GAAG,IAAI,CAAC;IACvD,IAAI,GAAG,CAAC,QAAQ,EAAE,IAAI;QAAE,GAAG,CAAC,OAAO,GAAG,IAAI,CAAC;IAE3C,QAAQ;IACR,IAAI,GAAG,CAAC,KAAK,EAAE,CAAC;QACd,IAAI,GAAG,CAAC,KAAK,CAAC,OAAO;YAAE,GAAG,CAAC,cAAc,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC;QAC9D,IAAI,GAAG,CAAC,KAAK,CAAC,KAAK;YAAE,GAAG,CAAC,YAAY,GAAG,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC;QACxD,IAAI,GAAG,CAAC,KAAK,CAAC,WAAW;YAAE,GAAG,CAAC,WAAW,GAAG,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC;QACnE,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM;YAAE,GAAG,CAAC,aAAa,GAAG,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC;QAC3D,IAAI,GAAG,CAAC,KAAK,CAAC,QAAQ;YAAE,GAAG,CAAC,eAAe,GAAG,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC;QACjE,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM;YAAE,GAAG,CAAC,aAAa,GAAG,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC;QAC3D,IAAI,GAAG,CAAC,KAAK,CAAC,UAAU,IAAI,IAAI;YAAE,GAAG,CAAC,iBAAiB,GAAG,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC;QAC/E,IAAI,GAAG,CAAC,KAAK,CAAC,OAAO,IAAI,IAAI;YAAE,GAAG,CAAC,OAAO,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC;IACjE,CAAC;IAED,aAAa;IACb,IAAI,GAAG,CAAC,UAAU,EAAE,IAAI;QAAE,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC;IAC/D,IAAI,GAAG,CAAC,UAAU,EAAE,KAAK;QAAE,GAAG,CAAC,eAAe,GAAG,GAAG,CAAC,UAAU,CAAC,KAAK,CAAC;IACtE,IAAI,GAAG,CAAC,UAAU,EAAE,MAAM;QAAE,GAAG,CAAC,gBAAgB,GAAG,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC;IAEzE,WAAW;IACX,IAAI,GAAG,CAAC,QAAQ,EAAE,MAAM;QAAE,GAAG,CAAC,uBAAuB,GAAG,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC;IAC5E,IAAI,GAAG,CAAC,QAAQ,EAAE,QAAQ;QAAE,GAAG,CAAC,kBAAkB,GAAG,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC;IAE3E,WAAW;IACX,IAAI,GAAG,CAAC,QAAQ,EAAE,MAAM;QAAE,GAAG,CAAC,aAAa,GAAG,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC;IAElE,eAAe;IACf,IAAI,GAAG,CAAC,UAAU;QAAE,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC,UAAU,CAAC;IACpD,IAAI,GAAG,CAAC,gBAAgB;QAAE,GAAG,CAAC,gBAAgB,GAAG,GAAG,CAAC,gBAAgB,CAAC;IACtE,IAAI,GAAG,CAAC,MAAM;QAAE,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC;IACxC,IAAI,GAAG,CAAC,aAAa;QAAE,GAAG,CAAC,aAAa,GAAG,GAAG,CAAC,aAAa,CAAC;IAC7D,IAAI,GAAG,CAAC,KAAK;QAAE,GAAG,CAAC,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC;IACrC,IAAI,GAAG,CAAC,YAAY;QAAE,GAAG,CAAC,YAAY,GAAG,GAAG,CAAC,YAAY,CAAC;IAE1D,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/utils/permission-matcher.d.ts

@@ -0,0 +1,46 @@
+/**
+ * Coerce a raw permissions value into a string array.
+ *
+ * BP-008 — databases without a native array type (SQLite, older MySQL) must
+ * store permissions as JSON strings or comma-separated lists. Laravel's
+ * Eloquent `$casts = ['permissions' => 'array']` decodes JSON on read;
+ * Prisma has no equivalent. This helper accepts all common shapes so the
+ * matcher works without a consumer-side hydration hack.
+ *
+ * Accepted inputs (in order of preference):
+ *   - string[]              → returned as-is
+ *   - JSON array string     → parsed
+ *   - comma-separated string → split & trimmed
+ *   - null / undefined / other → []
+ */
+export declare function coercePermissions(raw: unknown): string[];
+/**
+ * Match a `{slug}.{action}` permission against a set of granted permissions.
+ *
+ * Supports wildcards identically to the Laravel version:
+ *   - `*`              → grants everything
+ *   - `{slug}.*`       → grants all actions on a specific slug
+ *   - `{slug}.{act}`   → exact match
+ *
+ * The `granted` argument accepts anything `coercePermissions` accepts: a
+ * real array, a JSON-string array, or a comma-separated string.
+ */
+export declare function matchesPermission(permission: string, granted: string[] | string | null | undefined): boolean;
+/**
+ * Resolve the role slug for a user in a specific organization.
+ * Expects a user object shaped like the Laravel user with userRoles relation.
+ */
+export declare function resolveUserRoleSlug(user: any, organizationId: number | string | null | undefined): string | null;
+/**
+ * Resolve permissions granted to a user in an organization context.
+ * Tenant context → aggregates permissions from all user_roles entries
+ *                  matching the organization.
+ * No org context → returns the user's top-level permissions array.
+ */
+export declare function resolveUserPermissions(user: any, organizationId?: number | string | null): string[];
+/**
+ * Top-level permission check mirroring the Laravel `hasPermission` method.
+ */
+export declare function userHasPermission(user: any, permission: string, organization?: {
+    id: number | string;
+} | null): boolean;

package/dist/utils/permission-matcher.js

@@ -0,0 +1,120 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.coercePermissions = coercePermissions;
+exports.matchesPermission = matchesPermission;
+exports.resolveUserRoleSlug = resolveUserRoleSlug;
+exports.resolveUserPermissions = resolveUserPermissions;
+exports.userHasPermission = userHasPermission;
+/**
+ * Coerce a raw permissions value into a string array.
+ *
+ * BP-008 — databases without a native array type (SQLite, older MySQL) must
+ * store permissions as JSON strings or comma-separated lists. Laravel's
+ * Eloquent `$casts = ['permissions' => 'array']` decodes JSON on read;
+ * Prisma has no equivalent. This helper accepts all common shapes so the
+ * matcher works without a consumer-side hydration hack.
+ *
+ * Accepted inputs (in order of preference):
+ *   - string[]              → returned as-is
+ *   - JSON array string     → parsed
+ *   - comma-separated string → split & trimmed
+ *   - null / undefined / other → []
+ */
+function coercePermissions(raw) {
+    if (Array.isArray(raw))
+        return raw;
+    if (typeof raw !== 'string')
+        return [];
+    const trimmed = raw.trim();
+    if (trimmed === '')
+        return [];
+    if (trimmed.startsWith('[')) {
+        try {
+            const parsed = JSON.parse(trimmed);
+            if (Array.isArray(parsed))
+                return parsed.map(String);
+        }
+        catch {
+            /* fall through to comma split */
+        }
+    }
+    return trimmed
+        .split(',')
+        .map((s) => s.trim())
+        .filter((s) => s.length > 0);
+}
+/**
+ * Match a `{slug}.{action}` permission against a set of granted permissions.
+ *
+ * Supports wildcards identically to the Laravel version:
+ *   - `*`              → grants everything
+ *   - `{slug}.*`       → grants all actions on a specific slug
+ *   - `{slug}.{act}`   → exact match
+ *
+ * The `granted` argument accepts anything `coercePermissions` accepts: a
+ * real array, a JSON-string array, or a comma-separated string.
+ */
+function matchesPermission(permission, granted) {
+    const list = coercePermissions(granted);
+    if (list.length === 0)
+        return false;
+    const slug = permission.split('.')[0] ?? '';
+    const slugWildcard = `${slug}.*`;
+    for (const p of list) {
+        if (p === permission || p === '*' || p === slugWildcard)
+            return true;
+    }
+    return false;
+}
+/**
+ * Resolve the role slug for a user in a specific organization.
+ * Expects a user object shaped like the Laravel user with userRoles relation.
+ */
+function resolveUserRoleSlug(user, organizationId) {
+    if (!user || organizationId == null)
+        return null;
+    const userRoles = user.userRoles ?? user.user_roles ?? [];
+    for (const ur of userRoles) {
+        const orgId = ur.organizationId ?? ur.organization_id;
+        if (orgId === organizationId) {
+            return ur.role?.slug ?? ur.roleSlug ?? ur.role_slug ?? null;
+        }
+    }
+    return null;
+}
+/**
+ * Resolve permissions granted to a user in an organization context.
+ * Tenant context → aggregates permissions from all user_roles entries
+ *                  matching the organization.
+ * No org context → returns the user's top-level permissions array.
+ */
+function resolveUserPermissions(user, organizationId) {
+    if (!user)
+        return [];
+    if (organizationId != null) {
+        const userRoles = user.userRoles ?? user.user_roles ?? [];
+        const all = [];
+        for (const ur of userRoles) {
+            const orgId = ur.organizationId ?? ur.organization_id;
+            if (orgId === organizationId) {
+                // BP-008: coerce into an array first — value may arrive as a raw
+                // JSON string from SQLite/MySQL or similar DBs without native arrays.
+                for (const p of coercePermissions(ur.permissions))
+                    all.push(p);
+            }
+        }
+        return all;
+    }
+    return coercePermissions(user.permissions);
+}
+/**
+ * Top-level permission check mirroring the Laravel `hasPermission` method.
+ */
+function userHasPermission(user, permission, organization) {
+    if (!user)
+        return false;
+    const orgId = organization ? organization.id : null;
+    const permissions = resolveUserPermissions(user, orgId);
+    return matchesPermission(permission, permissions);
+}
+//# sourceMappingURL=permission-matcher.js.map

package/dist/utils/permission-matcher.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"permission-matcher.js","sourceRoot":"","sources":["../../src/utils/permission-matcher.ts"],"names":[],"mappings":";;AAeA,8CAiBC;AAaD,8CAYC;AAMD,kDAUC;AAQD,wDAgBC;AAKD,8CASC;AA/GD;;;;;;;;;;;;;;GAcG;AACH,SAAgB,iBAAiB,CAAC,GAAY;IAC5C,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QAAE,OAAO,GAAe,CAAC;IAC/C,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,EAAE,CAAC;IACvC,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IAC3B,IAAI,OAAO,KAAK,EAAE;QAAE,OAAO,EAAE,CAAC;IAC9B,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAC5B,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YACnC,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;gBAAE,OAAO,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACvD,CAAC;QAAC,MAAM,CAAC;YACP,iCAAiC;QACnC,CAAC;IACH,CAAC;IACD,OAAO,OAAO;SACX,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AACjC,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAgB,iBAAiB,CAC/B,UAAkB,EAClB,OAA6C;IAE7C,MAAM,IAAI,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;IACxC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACpC,MAAM,IAAI,GAAG,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC5C,MAAM,YAAY,GAAG,GAAG,IAAI,IAAI,CAAC;IACjC,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;QACrB,IAAI,CAAC,KAAK,UAAU,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,YAAY;YAAE,OAAO,IAAI,CAAC;IACvE,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;GAGG;AACH,SAAgB,mBAAmB,CAAC,IAAS,EAAE,cAAkD;IAC/F,IAAI,CAAC,IAAI,IAAI,cAAc,IAAI,IAAI;QAAE,OAAO,IAAI,CAAC;IACjD,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,UAAU,IAAI,EAAE,CAAC;IAC1D,KAAK,MAAM,EAAE,IAAI,SAAS,EAAE,CAAC;QAC3B,MAAM,KAAK,GAAG,EAAE,CAAC,cAAc,IAAI,EAAE,CAAC,eAAe,CAAC;QACtD,IAAI,KAAK,KAAK,cAAc,EAAE,CAAC;YAC7B,OAAO,EAAE,CAAC,IAAI,EAAE,IAAI,IAAI,EAAE,CAAC,QAAQ,IAAI,EAAE,CAAC,SAAS,IAAI,IAAI,CAAC;QAC9D,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;GAKG;AACH,SAAgB,sBAAsB,CAAC,IAAS,EAAE,cAAuC;IACvF,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,CAAC;IACrB,IAAI,cAAc,IAAI,IAAI,EAAE,CAAC;QAC3B,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,UAAU,IAAI,EAAE,CAAC;QAC1D,MAAM,GAAG,GAAa,EAAE,CAAC;QACzB,KAAK,MAAM,EAAE,IAAI,SAAS,EAAE,CAAC;YAC3B,MAAM,KAAK,GAAG,EAAE,CAAC,cAAc,IAAI,EAAE,CAAC,eAAe,CAAC;YACtD,IAAI,KAAK,KAAK,cAAc,EAAE,CAAC;gBAC7B,iEAAiE;gBACjE,sEAAsE;gBACtE,KAAK,MAAM,CAAC,IAAI,iBAAiB,CAAC,EAAE,CAAC,WAAW,CAAC;oBAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACjE,CAAC;QACH,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IACD,OAAO,iBAAiB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;AAC7C,CAAC;AAED;;GAEG;AACH,SAAgB,iBAAiB,CAC/B,IAAS,EACT,UAAkB,EAClB,YAA6C;IAE7C,IAAI,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC;IACxB,MAAM,KAAK,GAAG,YAAY,CAAC,CAAC,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IACpD,MAAM,WAAW,GAAG,sBAAsB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACxD,OAAO,iBAAiB,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;AACpD,CAAC"}

package/dist/utils/scope-discovery.d.ts

@@ -0,0 +1,34 @@
+import type { RhinoConfig } from '../interfaces/rhino-config.interface';
+export interface ScopeDiscoveryOptions {
+    /**
+     * Absolute or cwd-relative directory to scan. Defaults to `./src/scopes`.
+     */
+    scopesDir?: string;
+    /**
+     * File extensions to probe, in order. Defaults to `['.ts', '.js']`.
+     */
+    extensions?: string[];
+    /**
+     * When true, silently skip models whose scope file cannot be loaded.
+     * When false, throw the underlying require error. Default: true.
+     */
+    silent?: boolean;
+}
+/**
+ * Filesystem-based scope auto-discovery, mirroring Laravel's naming-convention
+ * discovery (`App\Models\Scopes\{Model}Scope`).
+ *
+ * For each model registered in `config.models`, the helper looks for a file
+ * named `{ModelName}Scope.{ts,js}` in `scopesDir`. If found and the file
+ * default-exports a class (or exports a class under `{ModelName}Scope`), that
+ * class is appended to the model's `scopes` array (deduped).
+ *
+ * Usage:
+ *
+ *   const config = autoDiscoverScopes({ models: {...} }, { scopesDir: 'src/scopes' });
+ *   RhinoModule.forRoot(config);
+ *
+ * The function is synchronous and returns a new config object — it does not
+ * mutate the input.
+ */
+export declare function autoDiscoverScopes(config: RhinoConfig, options?: ScopeDiscoveryOptions): RhinoConfig;

package/dist/utils/scope-discovery.js

@@ -0,0 +1,102 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.autoDiscoverScopes = autoDiscoverScopes;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+/**
+ * Filesystem-based scope auto-discovery, mirroring Laravel's naming-convention
+ * discovery (`App\Models\Scopes\{Model}Scope`).
+ *
+ * For each model registered in `config.models`, the helper looks for a file
+ * named `{ModelName}Scope.{ts,js}` in `scopesDir`. If found and the file
+ * default-exports a class (or exports a class under `{ModelName}Scope`), that
+ * class is appended to the model's `scopes` array (deduped).
+ *
+ * Usage:
+ *
+ *   const config = autoDiscoverScopes({ models: {...} }, { scopesDir: 'src/scopes' });
+ *   RhinoModule.forRoot(config);
+ *
+ * The function is synchronous and returns a new config object — it does not
+ * mutate the input.
+ */
+function autoDiscoverScopes(config, options = {}) {
+    const scopesDir = path.resolve(options.scopesDir ?? path.join(process.cwd(), 'src', 'scopes'));
+    const extensions = options.extensions ?? ['.ts', '.js'];
+    const silent = options.silent ?? true;
+    if (!fs.existsSync(scopesDir))
+        return config;
+    const newModels = {};
+    for (const [slug, reg] of Object.entries(config.models ?? {})) {
+        const modelClassName = pascal(reg.model);
+        const scopeClass = loadScopeFile(scopesDir, modelClassName, extensions, silent);
+        if (scopeClass) {
+            const existing = reg.scopes ?? [];
+            const deduped = existing.includes(scopeClass) ? existing : [...existing, scopeClass];
+            newModels[slug] = { ...reg, scopes: deduped };
+        }
+        else {
+            newModels[slug] = reg;
+        }
+    }
+    return { ...config, models: newModels };
+}
+function pascal(name) {
+    return name.charAt(0).toUpperCase() + name.slice(1);
+}
+function loadScopeFile(dir, modelName, extensions, silent) {
+    const basename = `${modelName}Scope`;
+    for (const ext of extensions) {
+        const candidate = path.join(dir, `${basename}${ext}`);
+        if (!fs.existsSync(candidate))
+            continue;
+        try {
+            // eslint-disable-next-line @typescript-eslint/no-var-requires
+            const mod = require(candidate);
+            // Support: `module.exports = Class`, `export default Class`, `export class XScope`
+            if (mod && typeof mod === 'function')
+                return mod;
+            return mod?.default ?? mod?.[basename] ?? null;
+        }
+        catch (err) {
+            if (!silent)
+                throw err;
+            return null;
+        }
+    }
+    return null;
+}
+//# sourceMappingURL=scope-discovery.js.map

package/dist/utils/scope-discovery.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scope-discovery.js","sourceRoot":"","sources":["../../src/utils/scope-discovery.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAqCA,gDAwBC;AA7DD,uCAAyB;AACzB,2CAA6B;AAmB7B;;;;;;;;;;;;;;;;GAgBG;AACH,SAAgB,kBAAkB,CAChC,MAAmB,EACnB,UAAiC,EAAE;IAEnC,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS,IAAI,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC;IAC/F,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IACxD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,IAAI,CAAC;IAEtC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC;QAAE,OAAO,MAAM,CAAC;IAE7C,MAAM,SAAS,GAAsC,EAAE,CAAC;IACxD,KAAK,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,EAAE,CAAC;QAC9D,MAAM,cAAc,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACzC,MAAM,UAAU,GAAG,aAAa,CAAC,SAAS,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC;QAChF,IAAI,UAAU,EAAE,CAAC;YACf,MAAM,QAAQ,GAAG,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC;YAClC,MAAM,OAAO,GAAG,QAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,GAAG,QAAQ,EAAE,UAAU,CAAC,CAAC;YACrF,SAAS,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;QAChD,CAAC;aAAM,CAAC;YACN,SAAS,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC;QACxB,CAAC;IACH,CAAC;IAED,OAAO,EAAE,GAAG,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;AAC1C,CAAC;AAED,SAAS,MAAM,CAAC,IAAY;IAC1B,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AACtD,CAAC;AAED,SAAS,aAAa,CACpB,GAAW,EACX,SAAiB,EACjB,UAAoB,EACpB,MAAe;IAEf,MAAM,QAAQ,GAAG,GAAG,SAAS,OAAO,CAAC;IACrC,KAAK,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;QAC7B,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,GAAG,GAAG,EAAE,CAAC,CAAC;QACtD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC;YAAE,SAAS;QACxC,IAAI,CAAC;YACH,8DAA8D;YAC9D,MAAM,GAAG,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;YAC/B,mFAAmF;YACnF,IAAI,GAAG,IAAI,OAAO,GAAG,KAAK,UAAU;gBAAE,OAAO,GAAG,CAAC;YACjD,OAAO,GAAG,EAAE,OAAO,IAAI,GAAG,EAAE,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC;QACjD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,MAAM;gBAAE,MAAM,GAAG,CAAC;YACvB,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/package.json

@@ -0,0 +1,64 @@
+{
+  "name": "@rhino-dev/rhino-nestjs",
+  "version": "0.2.5",
+  "description": "Rhino for NestJS — auto-generated REST APIs from model definitions.",
+  "author": "Rhino",
+  "license": "MIT",
+  "publishConfig": {
+    "access": "public"
+  },
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "files": [
+    "dist",
+    "stubs",
+    "README.md"
+  ],
+  "bin": {
+    "rhino": "./dist/cli/index.js"
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.build.json",
+    "test": "jest",
+    "test:watch": "jest --watch",
+    "test:cov": "jest --coverage"
+  },
+  "peerDependencies": {
+    "@nestjs/common": "^10.0.0 || ^11.0.0",
+    "@nestjs/core": "^10.0.0 || ^11.0.0",
+    "@prisma/client": "^5.0.0 || ^6.0.0",
+    "reflect-metadata": "^0.1.13 || ^0.2.0",
+    "rxjs": "^7.0.0"
+  },
+  "dependencies": {
+    "@nestjs/passport": "^10.0.3",
+    "bcryptjs": "^2.4.3",
+    "js-yaml": "^4.1.0",
+    "jsonwebtoken": "^9.0.2",
+    "passport": "^0.7.0",
+    "passport-jwt": "^4.0.1",
+    "zod": "^3.23.0"
+  },
+  "devDependencies": {
+    "@nestjs/common": "^10.4.0",
+    "@nestjs/core": "^10.4.0",
+    "@nestjs/platform-express": "^10.4.0",
+    "@nestjs/testing": "^10.4.0",
+    "@prisma/client": "^5.22.0",
+    "@types/bcryptjs": "^2.4.6",
+    "@types/express": "^4.17.21",
+    "@types/jest": "^29.5.12",
+    "@types/js-yaml": "^4.0.9",
+    "@types/jsonwebtoken": "^9.0.6",
+    "@types/node": "^20.11.0",
+    "@types/passport-jwt": "^4.0.1",
+    "@types/supertest": "^6.0.2",
+    "jest": "^29.7.0",
+    "prisma": "^5.22.0",
+    "reflect-metadata": "^0.2.2",
+    "rxjs": "^7.8.1",
+    "supertest": "^7.0.0",
+    "ts-jest": "^29.1.2",
+    "typescript": "^5.4.0"
+  }
+}

package/stubs/skills/rhino-audit.md

@@ -0,0 +1,184 @@
+---
+name: rhino-audit
+description: Enable the audit trail on an Rhino NestJS model — Prisma schema, model registration, exclusions, and tests.
+---
+
+You are enabling the audit trail for one or more models in an Rhino NestJS application.
+
+## Step 1: Read Context
+
+Read:
+- `prisma/schema.prisma` — check if `AuditLog` model already exists.
+- `src/app.module.ts` — current model registrations.
+- `src/services/audit.service.ts` — understand what is logged and how.
+- `CLAUDE.md` — development rules.
+
+## Step 2: Add the AuditLog Prisma Model
+
+If `AuditLog` does not already exist in `prisma/schema.prisma`, add it:
+
+```prisma
+model AuditLog {
+  id             Int       @id @default(autoincrement())
+  auditableType  String
+  auditableId    String
+  action         String    // created | updated | deleted | forceDeleted | restored
+  oldValues      Json?
+  newValues      Json?
+  userId         Int?
+  organizationId Int?
+  ipAddress      String?
+  userAgent      String?
+  createdAt      DateTime  @default(now())
+}
+```
+
+Run migration:
+```bash
+npx prisma migrate dev --name add_audit_logs
+npx prisma generate
+```
+
+## Step 3: Enable Audit Trail on the Model
+
+In `app.module.ts`, set `hasAuditTrail: true` and configure `auditExclude` for any sensitive fields:
+
+```typescript
+users: {
+  model: 'user',
+  hasAuditTrail: true,
+  auditExclude: ['password', 'rememberToken', 'twoFactorSecret'],
+  // ... rest of config
+}
+```
+
+`AuditService` automatically excludes `password` and `rememberToken` by default. The `auditExclude` array adds to this list.
+
+## Step 4: Verify What Gets Logged
+
+The `GlobalController` calls `AuditService.log()` after each mutation. The following events are logged automatically:
+
+| Event | Action recorded | Old values | New values |
+|-------|----------------|------------|------------|
+| `POST /posts` (create) | `created` | `null` | All new fields |
+| `PUT /posts/:id` (update) | `updated` | Changed fields before | Changed fields after |
+| `DELETE /posts/:id` (soft delete) | `deleted` | All fields | `null` |
+| `POST /posts/:id/restore` | `restored` | `null` | All current fields |
+| `DELETE /posts/:id/force-delete` | `forceDeleted` | All fields | `null` |
+
+On update, only the fields that actually changed are recorded (via `AuditService.diff()`).
+
+## Step 5: Query the Audit Trail via API
+
+If `hasAuditTrail: true` is set, the audit endpoint is available automatically:
+
+```bash
+GET /api/:org/posts/:id/audit
+GET /api/:org/posts/:id/audit?page=1&per_page=20
+```
+
+Response:
+```json
+[
+  {
+    "id": 1,
+    "action": "created",
+    "userId": 5,
+    "auditableType": "post",
+    "auditableId": "42",
+    "oldValues": null,
+    "newValues": { "title": "Hello", "status": "draft" },
+    "ipAddress": "192.168.1.1",
+    "createdAt": "2025-01-15T10:30:00Z"
+  }
+]
+```
+
+## Step 6: Write Tests
+
+Create or update the spec file for this model:
+
+```typescript
+describe('Audit trail for posts', () => {
+  it('creates an audit log entry when a post is created', async () => {
+    await request(app.getHttpServer())
+      .post('/api/test-org/posts')
+      .set('Authorization', `Bearer ${adminToken}`)
+      .send({ title: 'Hello', content: 'World' })
+      .expect(201);
+
+    const log = await prisma.client.auditLog.findFirst({
+      where: { auditableType: 'post', action: 'created' },
+      orderBy: { createdAt: 'desc' },
+    });
+    expect(log).not.toBeNull();
+    expect(log.newValues).toMatchObject({ title: 'Hello' });
+    expect(log.oldValues).toBeNull();
+  });
+
+  it('logs only changed fields on update', async () => {
+    const post = await prisma.client.post.create({ data: { title: 'Original', status: 'draft' } });
+
+    await request(app.getHttpServer())
+      .put(`/api/test-org/posts/${post.id}`)
+      .set('Authorization', `Bearer ${adminToken}`)
+      .send({ title: 'Updated' })
+      .expect(200);
+
+    const log = await prisma.client.auditLog.findFirst({
+      where: { auditableType: 'post', action: 'updated', auditableId: String(post.id) },
+      orderBy: { createdAt: 'desc' },
+    });
+    expect(log.oldValues).toMatchObject({ title: 'Original' });
+    expect(log.newValues).toMatchObject({ title: 'Updated' });
+    // status was not changed — should not appear
+    expect(log.oldValues).not.toHaveProperty('status');
+  });
+
+  it('does not log excluded fields', async () => {
+    const user = await prisma.client.user.create({
+      data: { email: 'test@test.com', password: 'hashed' },
+    });
+
+    await request(app.getHttpServer())
+      .put(`/api/admin/users/${user.id}`)
+      .set('Authorization', `Bearer ${adminToken}`)
+      .send({ password: 'newpassword' })
+      .expect(200);
+
+    const log = await prisma.client.auditLog.findFirst({
+      where: { auditableType: 'user', auditableId: String(user.id), action: 'updated' },
+      orderBy: { createdAt: 'desc' },
+    });
+    // password must NEVER appear in audit logs
+    expect(log?.newValues).not.toHaveProperty('password');
+    expect(log?.oldValues).not.toHaveProperty('password');
+  });
+
+  it('records organizationId in the audit log for tenant routes', async () => {
+    await request(app.getHttpServer())
+      .post('/api/test-org/posts')
+      .set('Authorization', `Bearer ${adminToken}`)
+      .send({ title: 'Test' })
+      .expect(201);
+
+    const log = await prisma.client.auditLog.findFirst({
+      where: { action: 'created' },
+      orderBy: { createdAt: 'desc' },
+    });
+    expect(log.organizationId).toBe(testOrg.id);
+  });
+});
+```
+
+Run:
+```bash
+npm test
+```
+
+## Common Mistakes
+
+- **AuditLog model missing**: `AuditService.log()` silently swallows errors if the `auditLog` Prisma model does not exist. Add the model and re-run migrations.
+- **auditExclude not set**: Always exclude `password`, `rememberToken`, and any token/secret fields. The default exclusions only cover `password` and `rememberToken`.
+- **Direct Prisma calls bypass audit**: Only mutations going through `GlobalController` → `AuditService` are logged. If you call `prisma.client.post.update()` directly in a custom service, those changes are NOT audited. Use `ResourceService.update()` instead.
+- **Nested operations**: Mutations via `POST /nested` do NOT currently produce audit logs (known gap — see `MISSING_FEATURES.md`).