@rhino-dev/rhino-nestjs 4.0.0 → 4.2.0

package/README.md

@@ -169,7 +169,7 @@ That's it. You now have a full REST API for posts:
 | 13 | **Eager Loading** | `?include=author,comments` with nested dot-notation. |
 | 14 | **Multi-Tenancy** | Organization-based data isolation, auto-set `organizationId`, request scoping. |
 | 15 | **Nested Ownership** | Auto-scopes by `organizationId` on the registered model. |
-| 16 | **Route Groups** | Multiple URL prefixes with different middleware/auth (`tenant`, `public`, custom). |
+| 16 | **Route Groups** | Multiple URL prefixes with different middleware/auth (`tenant`, `public`, custom). Optional per-group `domain` constrains a group to a host (literal or `{organization}.example.com` subdomain). |
 | 17 | **Soft Deletes** | Trash, restore, force-delete endpoints with individual permissions. |
 | 18 | **Audit Trail** | Logs all CRUD events with old/new values, user, IP, and org context. |
 | 19 | **Nested Operations** | `POST /nested` for atomic multi-model transactions with `$N.field` references. |
@@ -182,6 +182,37 @@ That's it. You now have a full REST API for posts:
 | 26 | **Generator CLI** | `rhino install`, `rhino generate`, `rhino blueprint`. |
 | 27 | **Postman Export** | Auto-generated Postman Collection v2.1 with all endpoints. |
 | 28 | **Blueprint System** | YAML-to-code generation for models, migrations, policies, tests, and seeders. |
+| 29 | **Group Membership** | Opt-in `auth.enforceGroupMembership` makes a route group an access boundary. Memberships are keyed by `(user, route_group, organization, role)` on `user_roles`; a NULL `route_group` is a wildcard. No match → 403, enforced both at `/auth/login` (non-members can't sign in) and on every resource request. Permissions then resolve from the matched membership row. |
+| 30 | **Group-Aware Auth & Lifecycle Hooks** | Per-group `auth: true` registers the auth route set under the group; per-group `hooks` (a provider implementing `AuthLifecycleHooks`) run `afterLogin/afterLogout/afterRegister/afterPasswordRecover/afterPasswordReset` and may reject (revoking the issued token). Invitations carry the `route_group`; accept populates the membership. See [Group-auth hooks & token revocation](#group-auth-hooks--token-revocation). |
+
+### Group-auth hooks & token revocation
+
+When a lifecycle hook **rejects** a token-issuing action (`afterLogin` /
+`afterRegister`), Rhino does two things:
+
+1. It **drops the issued token from the response** — the client never receives
+   it. This is the bounded, always-on guarantee.
+2. It **attempts to denylist the token** so a copy that already leaked can no
+   longer be used. This step requires a `RevokedToken` Prisma model
+   (`token`, `createdAt`). **If no `RevokedToken` model is configured, revoke is
+   advisory only** — Rhino logs a clear WARNING and the token simply isn't
+   denylisted. Because JWTs are stateless, you should therefore:
+
+   - Provision a `RevokedToken` model if you rely on hook rejection, **and**
+   - Use **short-TTL JWTs** (set `auth.jwtExpiresIn` to a small value) so an
+     un-denylisted token expires quickly.
+
+**Controlling the HTTP status from a hook:** a hook must throw
+`RhinoAuthRejected` (or any NestJS `HttpException`) to control the response
+status (default 403; the hook may set 401/409/etc.). A plain `Error` is **not**
+an `HttpException` and surfaces as a **500** after the token is revoked — so
+always throw `RhinoAuthRejected`/`HttpException`, never a bare `Error`, to reject.
+
+**Password recovery is never an enumeration oracle:** `afterPasswordRecover`
+runs for side effects only — a rejection it throws is swallowed so the recovery
+endpoint always returns the same uniform `{ success: true }` regardless of
+whether the email exists. (Reject semantics are kept for login/register/logout/
+reset.)
 
 ## Configuration Reference
 
@@ -238,9 +269,29 @@ routeGroups: {
     models: ['posts'],
     skipAuth: true,
   },
+  // Domain-aware groups: constrain a group to a specific host. Two groups can
+  // share the same prefix and be selected by host.
+  admin: {
+    domain: 'admin.example.com', // literal host — only this host serves this group
+    models: '*',
+  },
+  hostTenant: {
+    domain: '{organization}.example.com', // parameterized host — the captured
+    models: '*',                          // {organization} subdomain resolves the
+  },                                      // tenant, just like the :organization prefix
 }
 ```
 
+**`domain` (per-group, optional):**
+
+- Omitted → the group matches any host (default; backward compatible).
+- Literal host (`'admin.example.com'`) → only requests to that host resolve to the group; a wrong-host request to the group's models is rejected with `404`.
+- Parameterized host (`'{organization}.example.com'`) → the captured `{organization}` subdomain feeds organization resolution (subdomain multitenancy), exactly like the `:organization` path prefix. Mirrors Laravel's `Route::domain(...)`.
+
+Host-based matching is performed by `RouteGroupMiddleware`. For subdomain → organization resolution at the Express layer (analogous to `createTenantRouteRewrite`), use `createDomainRouteResolver({ prisma, config })` in `main.ts` before `applyRhinoRouting(...)`.
+
+> **Conflicting groups fail fast.** Two groups that share the same prefix **and** overlapping models **and** an intersecting host-set would silently shadow each other. `normalizeConfig` (run by `RhinoModule.forRoot`) throws `RouteGroupConflictError` in that case. Fix it with distinct prefixes, different `domain` values, or disjoint `models`. A group without a `domain` matches every host, so it intersects with all others.
+
 **Reserved group names:**
 
 | Name | Behavior |

package/dist/controllers/auth.controller.d.ts

@@ -2,6 +2,8 @@ import { AuthService } from '../services/auth.service';
 import { InvitationService } from '../services/invitation.service';
 import { PrismaService } from '../prisma/prisma.service';
 import { RhinoConfigService } from '../rhino.config';
+import { AuthHooksService } from '../services/auth-hooks.service';
+import { MembershipService } from '../services/membership.service';
 export interface LoginDto {
     email: string;
     password: string;
@@ -25,31 +27,58 @@ export declare class AuthController {
     private readonly invitationService;
     private readonly prisma;
     private readonly config;
-    constructor(authService: AuthService, invitationService: InvitationService, prisma: PrismaService, config: RhinoConfigService);
-    login(dto: LoginDto): Promise<{
+    private readonly hooks?;
+    private readonly membership?;
+    constructor(authService: AuthService, invitationService: InvitationService, prisma: PrismaService, config: RhinoConfigService, hooks?: AuthHooksService, membership?: MembershipService);
+    /** Group resolved for this auth request (set by RouteGroupMiddleware). */
+    private routeGroup;
+    /**
+     * Run a lifecycle hook for the resolved group. `revokes` flags token-issuing
+     * actions: when the hook rejects, the issued token is dropped (revoked) and
+     * the rejection's status is re-thrown. When no hooks service is wired, this
+     * is a no-op.
+     */
+    private runHook;
+    /**
+     * Enforce group membership at the auth boundary — parity with the
+     * GroupMembershipGuard (resource layer) and the Laravel/Rails AuthControllers.
+     *
+     * When `auth.enforceGroupMembership` is ON, a non-member must be rejected at
+     * `/auth/login` with **403** rather than being allowed to authenticate and
+     * only blocked later on the first resource request. The just-issued token is
+     * revoked (best-effort) and never returned. This is the COARSE gate, so it
+     * runs BEFORE the `afterLogin` hook.
+     *
+     * No-op when: enforcement is off (or the MembershipService isn't wired), the
+     * request skips auth, or the resolved group is `public`.
+     */
+    private assertGroupMembership;
+    login(dto: LoginDto, req?: any): Promise<{
         token: string;
         organization_slug: string;
     }>;
     logout(req: any): Promise<{
         success: boolean;
     }>;
-    recover(dto: RecoverDto): Promise<{
+    recover(dto: RecoverDto, req?: any): Promise<{
         success: boolean;
     }>;
-    reset(dto: ResetDto): Promise<{
+    reset(dto: ResetDto, req?: any): Promise<{
         success: boolean;
     }>;
-    register(dto: RegisterDto): Promise<{
+    register(dto: RegisterDto, req?: any): Promise<{
         requiresRegistration: boolean;
         organization: any;
         role: any;
         email: any;
+        routeGroup: any;
         accepted?: undefined;
         token: string;
         user: any;
     } | {
         accepted: boolean;
         organization: any;
+        routeGroup: any;
         requiresRegistration?: undefined;
         role?: undefined;
         email?: undefined;

package/dist/controllers/auth.controller.js

@@ -18,42 +18,140 @@ const auth_service_1 = require("../services/auth.service");
 const invitation_service_1 = require("../services/invitation.service");
 const prisma_service_1 = require("../prisma/prisma.service");
 const rhino_config_1 = require("../rhino.config");
+const auth_hooks_service_1 = require("../services/auth-hooks.service");
+const membership_service_1 = require("../services/membership.service");
+const rhino_exception_1 = require("../errors/rhino-exception");
 let AuthController = class AuthController {
     authService;
     invitationService;
     prisma;
     config;
-    constructor(authService, invitationService, prisma, config) {
+    hooks;
+    membership;
+    constructor(authService, invitationService, prisma, config, 
+    // Optional so lightweight unit harnesses can omit it (no-op hooks then).
+    hooks, 
+    // Optional for the same reason: when absent, membership enforcement is a
+    // no-op (equivalent to `auth.enforceGroupMembership` being off).
+    membership) {
         this.authService = authService;
         this.invitationService = invitationService;
         this.prisma = prisma;
         this.config = config;
+        this.hooks = hooks;
+        this.membership = membership;
     }
-    async login(dto) {
+    /** Group resolved for this auth request (set by RouteGroupMiddleware). */
+    routeGroup(req) {
+        return req?.__routeGroup ?? null;
+    }
+    /**
+     * Run a lifecycle hook for the resolved group. `revokes` flags token-issuing
+     * actions: when the hook rejects, the issued token is dropped (revoked) and
+     * the rejection's status is re-thrown. When no hooks service is wired, this
+     * is a no-op.
+     */
+    async runHook(event, req, ctx) {
+        if (!this.hooks)
+            return;
+        await this.hooks.run(event, this.routeGroup(req), ctx);
+    }
+    /**
+     * Enforce group membership at the auth boundary — parity with the
+     * GroupMembershipGuard (resource layer) and the Laravel/Rails AuthControllers.
+     *
+     * When `auth.enforceGroupMembership` is ON, a non-member must be rejected at
+     * `/auth/login` with **403** rather than being allowed to authenticate and
+     * only blocked later on the first resource request. The just-issued token is
+     * revoked (best-effort) and never returned. This is the COARSE gate, so it
+     * runs BEFORE the `afterLogin` hook.
+     *
+     * No-op when: enforcement is off (or the MembershipService isn't wired), the
+     * request skips auth, or the resolved group is `public`.
+     */
+    async assertGroupMembership(req, user, token) {
+        if (!this.membership?.enabled())
+            return;
+        // NOTE: we deliberately do NOT bail on `req.__skipAuth` here. Consumers set
+        // that flag on auth entrypoints (login/register) to bypass the JWT guard
+        // (there's no token yet) — it does NOT mean "skip membership". The genuine
+        // skip signal is the `public` group, handled below (matches the guard).
+        const routeGroup = this.routeGroup(req);
+        if (routeGroup === 'public')
+            return;
+        const org = req?.organization ?? null;
+        const isTenant = this.config.isTenantGroup(routeGroup);
+        if (this.membership.isMember(user, routeGroup, org, isTenant))
+            return;
+        await this.authService.revokeToken(token);
+        throw rhino_exception_1.RhinoException.membershipDenied();
+    }
+    async login(dto, req) {
         if (!dto?.email || !dto?.password) {
             throw new common_1.BadRequestException('Email and password required');
         }
-        const { token, organizationSlug } = await this.authService.login(dto.email, dto.password);
+        const { token, organizationSlug, user } = await this.authService.login(dto.email, dto.password);
+        // Coarse membership gate (before the hook): a non-member is rejected here
+        // with 403, matching the resource-layer guard and the Laravel/Rails stacks.
+        await this.assertGroupMembership(req, user, token);
+        const routeGroup = this.routeGroup(req);
+        try {
+            await this.runHook('afterLogin', req, {
+                user,
+                routeGroup,
+                token,
+                request: req,
+            });
+        }
+        catch (err) {
+            // Reject → revoke the just-issued token (never returned to the client).
+            await this.authService.revokeToken(token);
+            throw err;
+        }
         return { token, organization_slug: organizationSlug };
     }
     async logout(req) {
         await this.authService.logout(req.user);
+        await this.runHook('afterLogout', req, {
+            user: req.user,
+            routeGroup: this.routeGroup(req),
+            request: req,
+        });
         return { success: true };
     }
-    async recover(dto) {
+    async recover(dto, req) {
         if (!dto?.email)
             throw new common_1.BadRequestException('Email required');
-        await this.authService.requestPasswordRecovery(dto.email);
+        const result = await this.authService.requestPasswordRecovery(dto.email);
+        // FIX 6: password recovery MUST return a uniform response whether or not the
+        // email exists (no user-enumeration oracle). The hook runs for side effects
+        // only — a rejection is swallowed so it can never change the response and
+        // thereby reveal account existence. (Other actions keep reject semantics.)
+        try {
+            await this.runHook('afterPasswordRecover', req, {
+                user: result?.user ?? null,
+                routeGroup: this.routeGroup(req),
+                request: req,
+            });
+        }
+        catch {
+            /* swallow: recovery response is always uniform */
+        }
         return { success: true };
     }
-    async reset(dto) {
+    async reset(dto, req) {
         if (!dto?.email || !dto?.token || !dto?.password) {
             throw new common_1.BadRequestException('Email, token and password required');
         }
         await this.authService.resetPassword(dto.email, dto.token, dto.password);
+        await this.runHook('afterPasswordReset', req, {
+            user: null,
+            routeGroup: this.routeGroup(req),
+            request: req,
+        });
         return { success: true };
     }
-    async register(dto) {
+    async register(dto, req) {
         if (!dto?.email || !dto?.password || !dto?.invitationToken) {
             throw new common_1.BadRequestException('Email, password and invitationToken required');
         }
@@ -68,6 +166,22 @@ let AuthController = class AuthController {
         });
         const acceptance = await this.invitationService.accept(dto.invitationToken, user.id);
         const token = this.authService.signToken({ sub: user.id, email: dto.email });
+        // Hooks see the group the membership was created for, falling back to the
+        // request's resolved group.
+        const routeGroup = acceptance?.routeGroup ?? this.routeGroup(req);
+        try {
+            await this.runHook('afterRegister', req, {
+                user,
+                routeGroup,
+                organization: acceptance?.organization ?? null,
+                token,
+                request: req,
+            });
+        }
+        catch (err) {
+            await this.authService.revokeToken(token);
+            throw err;
+        }
         return {
             token,
             user,
@@ -79,8 +193,9 @@ exports.AuthController = AuthController;
 __decorate([
     (0, common_1.Post)('login'),
     __param(0, (0, common_1.Body)()),
+    __param(1, (0, common_1.Req)()),
     __metadata("design:type", Function),
-    __metadata("design:paramtypes", [Object]),
+    __metadata("design:paramtypes", [Object, Object]),
     __metadata("design:returntype", Promise)
 ], AuthController.prototype, "login", null);
 __decorate([
@@ -93,22 +208,25 @@ __decorate([
 __decorate([
     (0, common_1.Post)('password/recover'),
     __param(0, (0, common_1.Body)()),
+    __param(1, (0, common_1.Req)()),
     __metadata("design:type", Function),
-    __metadata("design:paramtypes", [Object]),
+    __metadata("design:paramtypes", [Object, Object]),
     __metadata("design:returntype", Promise)
 ], AuthController.prototype, "recover", null);
 __decorate([
     (0, common_1.Post)('password/reset'),
     __param(0, (0, common_1.Body)()),
+    __param(1, (0, common_1.Req)()),
     __metadata("design:type", Function),
-    __metadata("design:paramtypes", [Object]),
+    __metadata("design:paramtypes", [Object, Object]),
     __metadata("design:returntype", Promise)
 ], AuthController.prototype, "reset", null);
 __decorate([
     (0, common_1.Post)('register'),
     __param(0, (0, common_1.Body)()),
+    __param(1, (0, common_1.Req)()),
     __metadata("design:type", Function),
-    __metadata("design:paramtypes", [Object]),
+    __metadata("design:paramtypes", [Object, Object]),
     __metadata("design:returntype", Promise)
 ], AuthController.prototype, "register", null);
 exports.AuthController = AuthController = __decorate([
@@ -116,6 +234,8 @@ exports.AuthController = AuthController = __decorate([
     __metadata("design:paramtypes", [auth_service_1.AuthService,
         invitation_service_1.InvitationService,
         prisma_service_1.PrismaService,
-        rhino_config_1.RhinoConfigService])
+        rhino_config_1.RhinoConfigService,
+        auth_hooks_service_1.AuthHooksService,
+        membership_service_1.MembershipService])
 ], AuthController);
 //# sourceMappingURL=auth.controller.js.map

package/dist/controllers/auth.controller.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth.controller.js","sourceRoot":"","sources":["../../src/controllers/auth.controller.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,2CAMwB;AACxB,2DAAuD;AACvD,uEAAmE;AACnE,6DAAyD;AACzD,kDAAqD;AAsB9C,IAAM,cAAc,GAApB,MAAM,cAAc;IAEN;IACA;IACA;IACA;IAJnB,YACmB,WAAwB,EACxB,iBAAoC,EACpC,MAAqB,EACrB,MAA0B;QAH1B,gBAAW,GAAX,WAAW,CAAa;QACxB,sBAAiB,GAAjB,iBAAiB,CAAmB;QACpC,WAAM,GAAN,MAAM,CAAe;QACrB,WAAM,GAAN,MAAM,CAAoB;IAC1C,CAAC;IAGE,AAAN,KAAK,CAAC,KAAK,CAAS,GAAa;QAC/B,IAAI,CAAC,GAAG,EAAE,KAAK,IAAI,CAAC,GAAG,EAAE,QAAQ,EAAE,CAAC;YAClC,MAAM,IAAI,4BAAmB,CAAC,6BAA6B,CAAC,CAAC;QAC/D,CAAC;QACD,MAAM,EAAE,KAAK,EAAE,gBAAgB,EAAE,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC1F,OAAO,EAAE,KAAK,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,CAAC;IACxD,CAAC;IAGK,AAAN,KAAK,CAAC,MAAM,CAAQ,GAAQ;QAC1B,MAAM,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACxC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;IAGK,AAAN,KAAK,CAAC,OAAO,CAAS,GAAe;QACnC,IAAI,CAAC,GAAG,EAAE,KAAK;YAAE,MAAM,IAAI,4BAAmB,CAAC,gBAAgB,CAAC,CAAC;QACjE,MAAM,IAAI,CAAC,WAAW,CAAC,uBAAuB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAC1D,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;IAGK,AAAN,KAAK,CAAC,KAAK,CAAS,GAAa;QAC/B,IAAI,CAAC,GAAG,EAAE,KAAK,IAAI,CAAC,GAAG,EAAE,KAAK,IAAI,CAAC,GAAG,EAAE,QAAQ,EAAE,CAAC;YACjD,MAAM,IAAI,4BAAmB,CAAC,oCAAoC,CAAC,CAAC;QACtE,CAAC;QACD,MAAM,IAAI,CAAC,WAAW,CAAC,aAAa,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC;QACzE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;IAGK,AAAN,KAAK,CAAC,QAAQ,CAAS,GAAgB;QACrC,IAAI,CAAC,GAAG,EAAE,KAAK,IAAI,CAAC,GAAG,EAAE,QAAQ,IAAI,CAAC,GAAG,EAAE,eAAe,EAAE,CAAC;YAC3D,MAAM,IAAI,4BAAmB,CAAC,8CAA8C,CAAC,CAAC;QAChF,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;QACtC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACjE,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC;YAC1D,IAAI,EAAE;gBACJ,KAAK,EAAE,GAAG,CAAC,KAAK;gBAChB,QAAQ,EAAE,MAAM;gBAChB,IAAI,EAAE,GAAG,CAAC,IAAI,IAAI,EAAE;aACrB;SACF,CAAC,CAAC;QACH,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,GAAG,CAAC,eAAe,EAAG,IAAY,CAAC,EAAE,CAAC,CAAC;QAC9F,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,EAAE,GAAG,EAAG,IAAY,CAAC,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC;QACtF,OAAO;YACL,KAAK;YACL,IAAI;YACJ,GAAG,UAAU;SACd,CAAC;IACJ,CAAC;CACF,CAAA;AA7DY,wCAAc;AASnB;IADL,IAAA,aAAI,EAAC,OAAO,CAAC;IACD,WAAA,IAAA,aAAI,GAAE,CAAA;;;;2CAMlB;AAGK;IADL,IAAA,aAAI,EAAC,QAAQ,CAAC;IACD,WAAA,IAAA,YAAG,GAAE,CAAA;;;;4CAGlB;AAGK;IADL,IAAA,aAAI,EAAC,kBAAkB,CAAC;IACV,WAAA,IAAA,aAAI,GAAE,CAAA;;;;6CAIpB;AAGK;IADL,IAAA,aAAI,EAAC,gBAAgB,CAAC;IACV,WAAA,IAAA,aAAI,GAAE,CAAA;;;;2CAMlB;AAGK;IADL,IAAA,aAAI,EAAC,UAAU,CAAC;IACD,WAAA,IAAA,aAAI,GAAE,CAAA;;;;8CAoBrB;yBA5DU,cAAc;IAD1B,IAAA,mBAAU,EAAC,MAAM,CAAC;qCAGe,0BAAW;QACL,sCAAiB;QAC5B,8BAAa;QACb,iCAAkB;GALlC,cAAc,CA6D1B"}
+{"version":3,"file":"auth.controller.js","sourceRoot":"","sources":["../../src/controllers/auth.controller.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,2CAMwB;AACxB,2DAAuD;AACvD,uEAAmE;AACnE,6DAAyD;AACzD,kDAAqD;AACrD,uEAAsF;AACtF,uEAAmE;AACnE,+DAA2D;AAuBpD,IAAM,cAAc,GAApB,MAAM,cAAc;IAEN;IACA;IACA;IACA;IAEA;IAGA;IATnB,YACmB,WAAwB,EACxB,iBAAoC,EACpC,MAAqB,EACrB,MAA0B;IAC3C,yEAAyE;IACxD,KAAwB;IACzC,yEAAyE;IACzE,iEAAiE;IAChD,UAA8B;QAR9B,gBAAW,GAAX,WAAW,CAAa;QACxB,sBAAiB,GAAjB,iBAAiB,CAAmB;QACpC,WAAM,GAAN,MAAM,CAAe;QACrB,WAAM,GAAN,MAAM,CAAoB;QAE1B,UAAK,GAAL,KAAK,CAAmB;QAGxB,eAAU,GAAV,UAAU,CAAoB;IAC9C,CAAC;IAEJ,0EAA0E;IAClE,UAAU,CAAC,GAAQ;QACzB,OAAQ,GAAG,EAAE,YAAmC,IAAI,IAAI,CAAC;IAC3D,CAAC;IAED;;;;;OAKG;IACK,KAAK,CAAC,OAAO,CACnB,KAAoB,EACpB,GAAQ,EACR,GAAoB;QAEpB,IAAI,CAAC,IAAI,CAAC,KAAK;YAAE,OAAO;QACxB,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC;IACzD,CAAC;IAED;;;;;;;;;;;;OAYG;IACK,KAAK,CAAC,qBAAqB,CACjC,GAAQ,EACR,IAAS,EACT,KAAa;QAEb,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,OAAO,EAAE;YAAE,OAAO;QACxC,4EAA4E;QAC5E,yEAAyE;QACzE,2EAA2E;QAC3E,wEAAwE;QACxE,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;QACxC,IAAI,UAAU,KAAK,QAAQ;YAAE,OAAO;QACpC,MAAM,GAAG,GAAG,GAAG,EAAE,YAAY,IAAI,IAAI,CAAC;QACtC,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,UAAU,CAAC,CAAC;QACvD,IAAI,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,EAAE,UAAU,EAAE,GAAG,EAAE,QAAQ,CAAC;YAAE,OAAO;QACtE,MAAM,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;QAC1C,MAAM,gCAAc,CAAC,gBAAgB,EAAE,CAAC;IAC1C,CAAC;IAGK,AAAN,KAAK,CAAC,KAAK,CAAS,GAAa,EAAS,GAAS;QACjD,IAAI,CAAC,GAAG,EAAE,KAAK,IAAI,CAAC,GAAG,EAAE,QAAQ,EAAE,CAAC;YAClC,MAAM,IAAI,4BAAmB,CAAC,6BAA6B,CAAC,CAAC;QAC/D,CAAC;QACD,MAAM,EAAE,KAAK,EAAE,gBAAgB,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,KAAK,CACpE,GAAG,CAAC,KAAK,EACT,GAAG,CAAC,QAAQ,CACb,CAAC;QACF,0EAA0E;QAC1E,4EAA4E;QAC5E,MAAM,IAAI,CAAC,qBAAqB,CAAC,GAAG,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;QACnD,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;QACxC,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,GAAG,EAAE;gBACpC,IAAI;gBACJ,UAAU;gBACV,KAAK;gBACL,OAAO,EAAE,GAAG;aACb,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,wEAAwE;YACxE,MAAM,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;YAC1C,MAAM,GAAG,CAAC;QACZ,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,CAAC;IACxD,CAAC;IAGK,AAAN,KAAK,CAAC,MAAM,CAAQ,GAAQ;QAC1B,MAAM,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACxC,MAAM,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,GAAG,EAAE;YACrC,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,UAAU,EAAE,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAChC,OAAO,EAAE,GAAG;SACb,CAAC,CAAC;QACH,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;IAGK,AAAN,KAAK,CAAC,OAAO,CAAS,GAAe,EAAS,GAAS;QACrD,IAAI,CAAC,GAAG,EAAE,KAAK;YAAE,MAAM,IAAI,4BAAmB,CAAC,gBAAgB,CAAC,CAAC;QACjE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,uBAAuB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACzE,6EAA6E;QAC7E,4EAA4E;QAC5E,0EAA0E;QAC1E,2EAA2E;QAC3E,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,OAAO,CAAC,sBAAsB,EAAE,GAAG,EAAE;gBAC9C,IAAI,EAAG,MAAc,EAAE,IAAI,IAAI,IAAI;gBACnC,UAAU,EAAE,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;gBAChC,OAAO,EAAE,GAAG;aACb,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,kDAAkD;QACpD,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;IAGK,AAAN,KAAK,CAAC,KAAK,CAAS,GAAa,EAAS,GAAS;QACjD,IAAI,CAAC,GAAG,EAAE,KAAK,IAAI,CAAC,GAAG,EAAE,KAAK,IAAI,CAAC,GAAG,EAAE,QAAQ,EAAE,CAAC;YACjD,MAAM,IAAI,4BAAmB,CAAC,oCAAoC,CAAC,CAAC;QACtE,CAAC;QACD,MAAM,IAAI,CAAC,WAAW,CAAC,aAAa,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC;QACzE,MAAM,IAAI,CAAC,OAAO,CAAC,oBAAoB,EAAE,GAAG,EAAE;YAC5C,IAAI,EAAE,IAAI;YACV,UAAU,EAAE,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAChC,OAAO,EAAE,GAAG;SACb,CAAC,CAAC;QACH,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;IAGK,AAAN,KAAK,CAAC,QAAQ,CAAS,GAAgB,EAAS,GAAS;QACvD,IAAI,CAAC,GAAG,EAAE,KAAK,IAAI,CAAC,GAAG,EAAE,QAAQ,IAAI,CAAC,GAAG,EAAE,eAAe,EAAE,CAAC;YAC3D,MAAM,IAAI,4BAAmB,CAAC,8CAA8C,CAAC,CAAC;QAChF,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;QACtC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACjE,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC;YAC1D,IAAI,EAAE;gBACJ,KAAK,EAAE,GAAG,CAAC,KAAK;gBAChB,QAAQ,EAAE,MAAM;gBAChB,IAAI,EAAE,GAAG,CAAC,IAAI,IAAI,EAAE;aACrB;SACF,CAAC,CAAC;QACH,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,MAAM,CACpD,GAAG,CAAC,eAAe,EAClB,IAAY,CAAC,EAAE,CACjB,CAAC;QACF,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,EAAE,GAAG,EAAG,IAAY,CAAC,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC;QACtF,0EAA0E;QAC1E,4BAA4B;QAC5B,MAAM,UAAU,GACb,UAAkB,EAAE,UAAU,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;QAC1D,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,OAAO,CAAC,eAAe,EAAE,GAAG,EAAE;gBACvC,IAAI;gBACJ,UAAU;gBACV,YAAY,EAAG,UAAkB,EAAE,YAAY,IAAI,IAAI;gBACvD,KAAK;gBACL,OAAO,EAAE,GAAG;aACb,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;YAC1C,MAAM,GAAG,CAAC;QACZ,CAAC;QACD,OAAO;YACL,KAAK;YACL,IAAI;YACJ,GAAG,UAAU;SACd,CAAC;IACJ,CAAC;CACF,CAAA;AAnLY,wCAAc;AAkEnB;IADL,IAAA,aAAI,EAAC,OAAO,CAAC;IACD,WAAA,IAAA,aAAI,GAAE,CAAA;IAAiB,WAAA,IAAA,YAAG,GAAE,CAAA;;;;2CAyBxC;AAGK;IADL,IAAA,aAAI,EAAC,QAAQ,CAAC;IACD,WAAA,IAAA,YAAG,GAAE,CAAA;;;;4CAQlB;AAGK;IADL,IAAA,aAAI,EAAC,kBAAkB,CAAC;IACV,WAAA,IAAA,aAAI,GAAE,CAAA;IAAmB,WAAA,IAAA,YAAG,GAAE,CAAA;;;;6CAiB5C;AAGK;IADL,IAAA,aAAI,EAAC,gBAAgB,CAAC;IACV,WAAA,IAAA,aAAI,GAAE,CAAA;IAAiB,WAAA,IAAA,YAAG,GAAE,CAAA;;;;2CAWxC;AAGK;IADL,IAAA,aAAI,EAAC,UAAU,CAAC;IACD,WAAA,IAAA,aAAI,GAAE,CAAA;IAAoB,WAAA,IAAA,YAAG,GAAE,CAAA;;;;8CAuC9C;yBAlLU,cAAc;IAD1B,IAAA,mBAAU,EAAC,MAAM,CAAC;qCAGe,0BAAW;QACL,sCAAiB;QAC5B,8BAAa;QACb,iCAAkB;QAElB,qCAAgB;QAGX,sCAAiB;GAVtC,cAAc,CAmL1B"}

package/dist/controllers/invitation.controller.d.ts

@@ -1,15 +1,52 @@
 import { InvitationService } from '../services/invitation.service';
+import { RhinoConfigService } from '../rhino.config';
+import { MembershipService } from '../services/membership.service';
 export declare class InvitationController {
     private readonly invitations;
-    constructor(invitations: InvitationService);
-    private assertInvitationPermission;
+    private readonly config;
+    private readonly membership;
+    constructor(invitations: InvitationService, config: RhinoConfigService, membership: MembershipService);
+    /**
+     * Authorize an invitation action.
+     *
+     * - Enforcement OFF (legacy): byte-for-byte the original check —
+     *   `userHasPermission(user, invitations.{action}, org)`; 403 on failure.
+     * - Enforcement ON: a COARSE membership gate runs FIRST — the inviter must be
+     *   a member of the target group (design §8 — "inviter must be a member of the
+     *   group"). A non-member is a **403** for parity with Laravel/Rails
+     *   (Decision 9.C), NOT a 400. A NULL/absent membership row is a wildcard and
+     *   admits the inviter. The fine-grained permission check then runs (also 403
+     *   on failure), resolving via the established heuristic (tenant groups → the
+     *   org's user_roles permissions, non-tenant groups → top-level
+     *   user.permissions). The two checks run in sequence and are never merged.
+     */
+    private assertCanInvite;
+    /** The `public` group (reserved name or any `skipAuth` group) has no auth, so it cannot be invited into. */
+    private isPublicGroup;
+    /**
+     * Reject a `routeGroup` that is neither a configured route group nor the
+     * reserved `public` name. A client could otherwise forge an arbitrary group
+     * value (overriding the resolved group) and create a dormant, unaudited grant
+     * that activates the day that group name is wired up. This guard runs
+     * regardless of enforcement. NULL (wildcard) is always allowed.
+     */
+    private assertKnownGroup;
     index(req: any, status?: string): Promise<{
         data: any;
     }>;
     store(req: any, body: {
         email: string;
         roleId: number;
+        routeGroup?: string | null;
     }): Promise<any>;
+    /**
+     * Whether this invite requires an organization context. We default to YES to
+     * preserve legacy behavior (store always required an org). An invite is only
+     * treated as non-tenant — and thus org-optional — when membership enforcement
+     * is on AND the resolved group is positively a non-tenant group. This keeps
+     * every flag-off code path byte-for-byte unchanged.
+     */
+    private isTenantInvite;
     resend(req: any, id: string): Promise<any>;
     cancel(req: any, id: string): Promise<any>;
     accept(body: {
@@ -19,10 +56,12 @@ export declare class InvitationController {
         organization: any;
         role: any;
         email: any;
+        routeGroup: any;
         accepted?: undefined;
     } | {
         accepted: boolean;
         organization: any;
+        routeGroup: any;
         requiresRegistration?: undefined;
         role?: undefined;
         email?: undefined;

package/dist/controllers/invitation.controller.js

@@ -15,46 +15,129 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.InvitationController = void 0;
 const common_1 = require("@nestjs/common");
 const invitation_service_1 = require("../services/invitation.service");
+const rhino_config_1 = require("../rhino.config");
+const membership_service_1 = require("../services/membership.service");
 const permission_matcher_1 = require("../utils/permission-matcher");
+const rhino_exception_1 = require("../errors/rhino-exception");
 let InvitationController = class InvitationController {
     invitations;
-    constructor(invitations) {
+    config;
+    membership;
+    constructor(invitations, config, membership) {
         this.invitations = invitations;
+        this.config = config;
+        this.membership = membership;
     }
-    assertInvitationPermission(req, action) {
+    /**
+     * Authorize an invitation action.
+     *
+     * - Enforcement OFF (legacy): byte-for-byte the original check —
+     *   `userHasPermission(user, invitations.{action}, org)`; 403 on failure.
+     * - Enforcement ON: a COARSE membership gate runs FIRST — the inviter must be
+     *   a member of the target group (design §8 — "inviter must be a member of the
+     *   group"). A non-member is a **403** for parity with Laravel/Rails
+     *   (Decision 9.C), NOT a 400. A NULL/absent membership row is a wildcard and
+     *   admits the inviter. The fine-grained permission check then runs (also 403
+     *   on failure), resolving via the established heuristic (tenant groups → the
+     *   org's user_roles permissions, non-tenant groups → top-level
+     *   user.permissions). The two checks run in sequence and are never merged.
+     */
+    assertCanInvite(req, routeGroup, action) {
+        if (this.membership.enabled()) {
+            const isTenant = this.config.isTenantGroup(routeGroup ?? undefined);
+            if (!this.membership.isMember(req.user, routeGroup ?? null, req.organization, isTenant)) {
+                throw rhino_exception_1.RhinoException.membershipDenied(`Inviter is not a member of group '${routeGroup ?? '(any)'}'`);
+            }
+        }
         if (!(0, permission_matcher_1.userHasPermission)(req.user, `invitations.${action}`, req.organization)) {
-            const err = new Error('Forbidden');
-            err.status = 403;
-            throw err;
+            throw rhino_exception_1.RhinoException.forbidden();
         }
     }
+    /** The `public` group (reserved name or any `skipAuth` group) has no auth, so it cannot be invited into. */
+    isPublicGroup(routeGroup) {
+        if (routeGroup == null)
+            return false;
+        if (routeGroup === 'public')
+            return true;
+        return this.config.routeGroups()?.[routeGroup]?.skipAuth === true;
+    }
+    /**
+     * Reject a `routeGroup` that is neither a configured route group nor the
+     * reserved `public` name. A client could otherwise forge an arbitrary group
+     * value (overriding the resolved group) and create a dormant, unaudited grant
+     * that activates the day that group name is wired up. This guard runs
+     * regardless of enforcement. NULL (wildcard) is always allowed.
+     */
+    assertKnownGroup(routeGroup) {
+        if (routeGroup == null)
+            return; // NULL wildcard
+        if (routeGroup === 'public')
+            return; // reserved; rejected later by isPublicGroup
+        if (this.config.routeGroups()?.[routeGroup])
+            return; // a configured group
+        throw rhino_exception_1.RhinoException.validationFailed({
+            routeGroup: [`Unknown route group '${routeGroup}'`],
+        });
+    }
     async index(req, status) {
-        this.assertInvitationPermission(req, 'index');
+        this.assertCanInvite(req, req.__routeGroup ?? null, 'index');
         if (!req.organization)
             throw new common_1.BadRequestException('Organization context required');
         const items = await this.invitations.list(req.organization.id, status);
         return { data: items };
     }
     async store(req, body) {
-        this.assertInvitationPermission(req, 'store');
-        if (!req.organization)
-            throw new common_1.BadRequestException('Organization context required');
         if (!body?.email || !body?.roleId) {
             throw new common_1.BadRequestException('email and roleId required');
         }
+        // The invite's group: an explicit body value, else the request's resolved
+        // group (set by RouteGroupMiddleware), else NULL (wildcard).
+        const routeGroup = body.routeGroup !== undefined
+            ? body.routeGroup
+            : req.__routeGroup ?? null;
+        // Reject a forged/unknown route group (422) before any other processing so
+        // a client can never seed a dormant grant for an unconfigured group.
+        this.assertKnownGroup(routeGroup);
+        // The public group has no auth and cannot be invited into.
+        if (this.isPublicGroup(routeGroup)) {
+            throw new common_1.BadRequestException('Cannot invite into the public group');
+        }
+        // Tenant-group invites still require an org context; non-tenant invites
+        // (an explicit NULL/non-tenant group) may proceed without one. This is
+        // checked BEFORE authorization so the legacy "org required" 400 is returned
+        // for org-less tenant invites rather than a permission 403.
+        if (this.isTenantInvite(routeGroup) && !req.organization) {
+            throw new common_1.BadRequestException('Organization context required');
+        }
+        this.assertCanInvite(req, routeGroup, 'store');
         return this.invitations.create({
             email: body.email,
             roleId: body.roleId,
             organization: req.organization,
             invitedBy: req.user,
+            routeGroup,
         });
     }
+    /**
+     * Whether this invite requires an organization context. We default to YES to
+     * preserve legacy behavior (store always required an org). An invite is only
+     * treated as non-tenant — and thus org-optional — when membership enforcement
+     * is on AND the resolved group is positively a non-tenant group. This keeps
+     * every flag-off code path byte-for-byte unchanged.
+     */
+    isTenantInvite(routeGroup) {
+        if (!this.config.enforceGroupMembership())
+            return true;
+        if (routeGroup == null)
+            return true;
+        return this.config.isTenantGroup(routeGroup);
+    }
     async resend(req, id) {
-        this.assertInvitationPermission(req, 'resend');
+        this.assertCanInvite(req, req.__routeGroup ?? null, 'resend');
         return this.invitations.resend(parseInt(id, 10));
     }
     async cancel(req, id) {
-        this.assertInvitationPermission(req, 'cancel');
+        this.assertCanInvite(req, req.__routeGroup ?? null, 'cancel');
         return this.invitations.cancel(parseInt(id, 10));
     }
     async accept(body, req) {
@@ -106,6 +189,8 @@ __decorate([
 ], InvitationController.prototype, "accept", null);
 exports.InvitationController = InvitationController = __decorate([
     (0, common_1.Controller)('invitations'),
-    __metadata("design:paramtypes", [invitation_service_1.InvitationService])
+    __metadata("design:paramtypes", [invitation_service_1.InvitationService,
+        rhino_config_1.RhinoConfigService,
+        membership_service_1.MembershipService])
 ], InvitationController);
 //# sourceMappingURL=invitation.controller.js.map

package/dist/controllers/invitation.controller.js.map

@@ -1 +1 @@
-{"version":3,"file":"invitation.controller.js","sourceRoot":"","sources":["../../src/controllers/invitation.controller.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,2CAUwB;AACxB,uEAAmE;AACnE,oEAAgE;AAGzD,IAAM,oBAAoB,GAA1B,MAAM,oBAAoB;IACF;IAA7B,YAA6B,WAA8B;QAA9B,gBAAW,GAAX,WAAW,CAAmB;IAAG,CAAC;IAEvD,0BAA0B,CAAC,GAAQ,EAAE,MAAc;QACzD,IAAI,CAAC,IAAA,sCAAiB,EAAC,GAAG,CAAC,IAAI,EAAE,eAAe,MAAM,EAAE,EAAE,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC;YAC5E,MAAM,GAAG,GAAG,IAAI,KAAK,CAAC,WAAW,CAAQ,CAAC;YAC1C,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;YACjB,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IAGK,AAAN,KAAK,CAAC,KAAK,CAAQ,GAAQ,EAAmB,MAAe;QAC3D,IAAI,CAAC,0BAA0B,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QAC9C,IAAI,CAAC,GAAG,CAAC,YAAY;YAAE,MAAM,IAAI,4BAAmB,CAAC,+BAA+B,CAAC,CAAC;QACtF,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;QACvE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;IACzB,CAAC;IAGK,AAAN,KAAK,CAAC,KAAK,CAAQ,GAAQ,EAAU,IAAuC;QAC1E,IAAI,CAAC,0BAA0B,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QAC9C,IAAI,CAAC,GAAG,CAAC,YAAY;YAAE,MAAM,IAAI,4BAAmB,CAAC,+BAA+B,CAAC,CAAC;QACtF,IAAI,CAAC,IAAI,EAAE,KAAK,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC;YAClC,MAAM,IAAI,4BAAmB,CAAC,2BAA2B,CAAC,CAAC;QAC7D,CAAC;QACD,OAAO,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC;YAC7B,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,YAAY,EAAE,GAAG,CAAC,YAAY;YAC9B,SAAS,EAAE,GAAG,CAAC,IAAI;SACpB,CAAC,CAAC;IACL,CAAC;IAGK,AAAN,KAAK,CAAC,MAAM,CAAQ,GAAQ,EAAe,EAAU;QACnD,IAAI,CAAC,0BAA0B,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QAC/C,OAAO,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;IACnD,CAAC;IAGK,AAAN,KAAK,CAAC,MAAM,CAAQ,GAAQ,EAAe,EAAU;QACnD,IAAI,CAAC,0BAA0B,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QAC/C,OAAO,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;IACnD,CAAC;IAGK,AAAN,KAAK,CAAC,MAAM,CAAS,IAAuB,EAAS,GAAQ;QAC3D,IAAI,CAAC,IAAI,EAAE,KAAK;YAAE,MAAM,IAAI,4BAAmB,CAAC,gBAAgB,CAAC,CAAC;QAClE,OAAO,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IAC3D,CAAC;CACF,CAAA;AAnDY,oDAAoB;AAYzB;IADL,IAAA,YAAG,GAAE;IACO,WAAA,IAAA,YAAG,GAAE,CAAA;IAAY,WAAA,IAAA,cAAK,EAAC,QAAQ,CAAC,CAAA;;;;iDAK5C;AAGK;IADL,IAAA,aAAI,GAAE;IACM,WAAA,IAAA,YAAG,GAAE,CAAA;IAAY,WAAA,IAAA,aAAI,GAAE,CAAA;;;;iDAYnC;AAGK;IADL,IAAA,aAAI,EAAC,YAAY,CAAC;IACL,WAAA,IAAA,YAAG,GAAE,CAAA;IAAY,WAAA,IAAA,cAAK,EAAC,IAAI,CAAC,CAAA;;;;kDAGzC;AAGK;IADL,IAAA,eAAM,EAAC,KAAK,CAAC;IACA,WAAA,IAAA,YAAG,GAAE,CAAA;IAAY,WAAA,IAAA,cAAK,EAAC,IAAI,CAAC,CAAA;;;;kDAGzC;AAGK;IADL,IAAA,aAAI,EAAC,QAAQ,CAAC;IACD,WAAA,IAAA,aAAI,GAAE,CAAA;IAA2B,WAAA,IAAA,YAAG,GAAE,CAAA;;;;kDAGnD;+BAlDU,oBAAoB;IADhC,IAAA,mBAAU,EAAC,aAAa,CAAC;qCAEkB,sCAAiB;GADhD,oBAAoB,CAmDhC"}
+{"version":3,"file":"invitation.controller.js","sourceRoot":"","sources":["../../src/controllers/invitation.controller.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,2CAUwB;AACxB,uEAAmE;AACnE,kDAAqD;AACrD,uEAAmE;AACnE,oEAAgE;AAChE,+DAA2D;AAGpD,IAAM,oBAAoB,GAA1B,MAAM,oBAAoB;IAEZ;IACA;IACA;IAHnB,YACmB,WAA8B,EAC9B,MAA0B,EAC1B,UAA6B;QAF7B,gBAAW,GAAX,WAAW,CAAmB;QAC9B,WAAM,GAAN,MAAM,CAAoB;QAC1B,eAAU,GAAV,UAAU,CAAmB;IAC7C,CAAC;IAEJ;;;;;;;;;;;;;OAaG;IACK,eAAe,CACrB,GAAQ,EACR,UAAqC,EACrC,MAAc;QAEd,IAAI,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC;YAC9B,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,UAAU,IAAI,SAAS,CAAC,CAAC;YACpE,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,UAAU,IAAI,IAAI,EAAE,GAAG,CAAC,YAAY,EAAE,QAAQ,CAAC,EAAE,CAAC;gBACxF,MAAM,gCAAc,CAAC,gBAAgB,CACnC,qCAAqC,UAAU,IAAI,OAAO,GAAG,CAC9D,CAAC;YACJ,CAAC;QACH,CAAC;QAED,IAAI,CAAC,IAAA,sCAAiB,EAAC,GAAG,CAAC,IAAI,EAAE,eAAe,MAAM,EAAE,EAAE,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC;YAC5E,MAAM,gCAAc,CAAC,SAAS,EAAE,CAAC;QACnC,CAAC;IACH,CAAC;IAED,4GAA4G;IACpG,aAAa,CAAC,UAAqC;QACzD,IAAI,UAAU,IAAI,IAAI;YAAE,OAAO,KAAK,CAAC;QACrC,IAAI,UAAU,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QACzC,OAAO,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,EAAE,CAAC,UAAU,CAAC,EAAE,QAAQ,KAAK,IAAI,CAAC;IACpE,CAAC;IAED;;;;;;OAMG;IACK,gBAAgB,CAAC,UAAqC;QAC5D,IAAI,UAAU,IAAI,IAAI;YAAE,OAAO,CAAC,gBAAgB;QAChD,IAAI,UAAU,KAAK,QAAQ;YAAE,OAAO,CAAC,4CAA4C;QACjF,IAAI,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,EAAE,CAAC,UAAU,CAAC;YAAE,OAAO,CAAC,qBAAqB;QAC1E,MAAM,gCAAc,CAAC,gBAAgB,CAAC;YACpC,UAAU,EAAE,CAAC,wBAAwB,UAAU,GAAG,CAAC;SACpD,CAAC,CAAC;IACL,CAAC;IAGK,AAAN,KAAK,CAAC,KAAK,CAAQ,GAAQ,EAAmB,MAAe;QAC3D,IAAI,CAAC,eAAe,CAAC,GAAG,EAAG,GAAG,CAAC,YAAmC,IAAI,IAAI,EAAE,OAAO,CAAC,CAAC;QACrF,IAAI,CAAC,GAAG,CAAC,YAAY;YAAE,MAAM,IAAI,4BAAmB,CAAC,+BAA+B,CAAC,CAAC;QACtF,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;QACvE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;IACzB,CAAC;IAGK,AAAN,KAAK,CAAC,KAAK,CACF,GAAQ,EACP,IAAmE;QAE3E,IAAI,CAAC,IAAI,EAAE,KAAK,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC;YAClC,MAAM,IAAI,4BAAmB,CAAC,2BAA2B,CAAC,CAAC;QAC7D,CAAC;QACD,0EAA0E;QAC1E,6DAA6D;QAC7D,MAAM,UAAU,GACd,IAAI,CAAC,UAAU,KAAK,SAAS;YAC3B,CAAC,CAAC,IAAI,CAAC,UAAU;YACjB,CAAC,CAAE,GAAG,CAAC,YAAmC,IAAI,IAAI,CAAC;QACvD,2EAA2E;QAC3E,qEAAqE;QACrE,IAAI,CAAC,gBAAgB,CAAC,UAAU,CAAC,CAAC;QAClC,2DAA2D;QAC3D,IAAI,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC,EAAE,CAAC;YACnC,MAAM,IAAI,4BAAmB,CAAC,qCAAqC,CAAC,CAAC;QACvE,CAAC;QACD,wEAAwE;QACxE,uEAAuE;QACvE,4EAA4E;QAC5E,4DAA4D;QAC5D,IAAI,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,CAAC;YACzD,MAAM,IAAI,4BAAmB,CAAC,+BAA+B,CAAC,CAAC;QACjE,CAAC;QACD,IAAI,CAAC,eAAe,CAAC,GAAG,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC;QAC/C,OAAO,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC;YAC7B,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,YAAY,EAAE,GAAG,CAAC,YAAY;YAC9B,SAAS,EAAE,GAAG,CAAC,IAAI;YACnB,UAAU;SACX,CAAC,CAAC;IACL,CAAC;IAED;;;;;;OAMG;IACK,cAAc,CAAC,UAAqC;QAC1D,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,sBAAsB,EAAE;YAAE,OAAO,IAAI,CAAC;QACvD,IAAI,UAAU,IAAI,IAAI;YAAE,OAAO,IAAI,CAAC;QACpC,OAAO,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,UAAU,CAAC,CAAC;IAC/C,CAAC;IAGK,AAAN,KAAK,CAAC,MAAM,CAAQ,GAAQ,EAAe,EAAU;QACnD,IAAI,CAAC,eAAe,CAAC,GAAG,EAAG,GAAG,CAAC,YAAmC,IAAI,IAAI,EAAE,QAAQ,CAAC,CAAC;QACtF,OAAO,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;IACnD,CAAC;IAGK,AAAN,KAAK,CAAC,MAAM,CAAQ,GAAQ,EAAe,EAAU;QACnD,IAAI,CAAC,eAAe,CAAC,GAAG,EAAG,GAAG,CAAC,YAAmC,IAAI,IAAI,EAAE,QAAQ,CAAC,CAAC;QACtF,OAAO,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;IACnD,CAAC;IAGK,AAAN,KAAK,CAAC,MAAM,CAAS,IAAuB,EAAS,GAAQ;QAC3D,IAAI,CAAC,IAAI,EAAE,KAAK;YAAE,MAAM,IAAI,4BAAmB,CAAC,gBAAgB,CAAC,CAAC;QAClE,OAAO,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IAC3D,CAAC;CACF,CAAA;AA3IY,oDAAoB;AAgEzB;IADL,IAAA,YAAG,GAAE;IACO,WAAA,IAAA,YAAG,GAAE,CAAA;IAAY,WAAA,IAAA,cAAK,EAAC,QAAQ,CAAC,CAAA;;;;iDAK5C;AAGK;IADL,IAAA,aAAI,GAAE;IAEJ,WAAA,IAAA,YAAG,GAAE,CAAA;IACL,WAAA,IAAA,aAAI,GAAE,CAAA;;;;iDAiCR;AAgBK;IADL,IAAA,aAAI,EAAC,YAAY,CAAC;IACL,WAAA,IAAA,YAAG,GAAE,CAAA;IAAY,WAAA,IAAA,cAAK,EAAC,IAAI,CAAC,CAAA;;;;kDAGzC;AAGK;IADL,IAAA,eAAM,EAAC,KAAK,CAAC;IACA,WAAA,IAAA,YAAG,GAAE,CAAA;IAAY,WAAA,IAAA,cAAK,EAAC,IAAI,CAAC,CAAA;;;;kDAGzC;AAGK;IADL,IAAA,aAAI,EAAC,QAAQ,CAAC;IACD,WAAA,IAAA,aAAI,GAAE,CAAA;IAA2B,WAAA,IAAA,YAAG,GAAE,CAAA;;;;kDAGnD;+BA1IU,oBAAoB;IADhC,IAAA,mBAAU,EAAC,aAAa,CAAC;qCAGQ,sCAAiB;QACtB,iCAAkB;QACd,sCAAiB;GAJrC,oBAAoB,CA2IhC"}

package/dist/errors/rhino-exception.d.ts

@@ -1,5 +1,5 @@
 import { HttpException } from '@nestjs/common';
-export type RhinoErrorCode = 'VALIDATION_FAILED' | 'FORBIDDEN_FIELDS' | 'CROSS_TENANT' | 'UNAUTHORIZED' | 'FORBIDDEN' | 'NOT_FOUND' | 'ACTION_DISABLED' | 'UNKNOWN_RESOURCE' | 'INVITATION_EXPIRED' | 'INVITATION_USED' | 'INVITATION_INVALID_ROLE' | 'NESTED_OPERATION_FAILED' | 'INCLUDE_NOT_AUTHORIZED';
+export type RhinoErrorCode = 'VALIDATION_FAILED' | 'FORBIDDEN_FIELDS' | 'CROSS_TENANT' | 'UNAUTHORIZED' | 'FORBIDDEN' | 'NOT_FOUND' | 'ACTION_DISABLED' | 'UNKNOWN_RESOURCE' | 'INVITATION_EXPIRED' | 'INVITATION_USED' | 'INVITATION_INVALID_ROLE' | 'NESTED_OPERATION_FAILED' | 'INCLUDE_NOT_AUTHORIZED' | 'AUTH_REJECTED' | 'MEMBERSHIP_DENIED';
 export interface RhinoErrorBody {
     code: RhinoErrorCode;
     message: string;
@@ -21,4 +21,15 @@ export declare class RhinoException extends HttpException {
     static actionDisabled(action: string): RhinoException;
     static unknownResource(slug: string): RhinoException;
     static includeNotAuthorized(slug: string): RhinoException;
+    static authRejected(message?: string, status?: number): RhinoException;
+    static membershipDenied(message?: string): RhinoException;
+}
+/**
+ * Thrown by a lifecycle hook to reject an otherwise-successful auth action.
+ * The controller catches it: for token-issuing actions (login/register) the
+ * just-issued token is revoked; the configured `status` (default 403) is then
+ * returned to the client. A hook may also throw any other error.
+ */
+export declare class RhinoAuthRejected extends RhinoException {
+    constructor(message?: string, status?: number);
 }