@rhino-dev/rhino-nestjs 4.0.0 → 4.2.0

package/dist/middleware/route-group.middleware.d.ts

@@ -2,16 +2,60 @@ import { NestMiddleware } from '@nestjs/common';
 import type { NextFunction, Request, Response } from 'express';
 import { RhinoConfigService } from '../rhino.config';
 /**
- * Detects which Rhino route group the current request belongs to
- * (based on URL prefix) and attaches:
+ * Detects which Rhino route group the current request belongs to and attaches:
  *   - `req.__routeGroup`  — the group name
  *   - `req.__skipAuth`    — true when the group has `skipAuth: true`
  *
- * Install this middleware globally BEFORE `JwtAuthGuard` so the guard can
- * read `req.__skipAuth` and short-circuit.
+ * Group selection considers BOTH:
+ *
+ *   1. **Host** — when a group declares a `domain`, it is only eligible for
+ *      requests whose `req.hostname` matches that domain. A literal domain
+ *      (`admin.example.com`) must match exactly; a parameterized domain
+ *      (`{organization}.example.com`) captures the subdomain and exposes it as
+ *      `req.params.organization` so ResolveOrganizationMiddleware can resolve
+ *      the tenant from the host — mirroring Laravel's `Route::domain(...)`.
+ *
+ *   2. **URL prefix** — the existing path-prefix matching, unchanged for groups
+ *      without a `domain`.
+ *
+ * Host-scoped groups take precedence over plain prefix groups when both could
+ * match, so two groups can share the same prefix and be selected by host.
+ *
+ * Enforcement: if the request path targets a model that is ONLY served by
+ * domain-scoped group(s) and the host matches none of them, the request is
+ * rejected with 404 — a wrong-host request must not be served as that group.
+ *
+ * Install this middleware globally BEFORE `JwtAuthGuard` so the guard can read
+ * `req.__skipAuth`, and BEFORE `ResolveOrganizationMiddleware` so a captured
+ * subdomain param is available for org resolution.
  */
 export declare class RouteGroupMiddleware implements NestMiddleware {
     private readonly config;
+    /** Cache compiled domain patterns keyed by group name. */
+    private readonly compiledCache;
     constructor(config: RhinoConfigService);
+    private compileFor;
     use(req: Request & Record<string, any>, _res: Response, next: NextFunction): void;
+    /**
+     * Whether `url` targets one of the auth entry endpoints. These are the
+     * routes that must never be blocked by the JWT guard (login/register/recover)
+     * and that must resolve to the group they belong to. Matches the auth
+     * controller's `@Controller('auth')` action paths under any prefix.
+     */
+    private isAuthEntryPath;
+    /**
+     * Resolve the route group for an auth entry path (FIX 11.1). Precedence:
+     *   1. an auth-enabled DOMAIN group whose host matches (and prefix matches);
+     *   2. an auth-enabled PREFIX group whose prefix matches;
+     *   3. the empty-prefix / default group (auth-enabled preferred, else any);
+     *   4. otherwise leave `__routeGroup` unset (legacy/global auth path).
+     *
+     * `__skipAuth` is ALWAYS set on an auth entry path so the JWT guard never
+     * blocks login/register/recover, regardless of which group wins — even a
+     * host-claiming empty-prefix domain group cannot strip it.
+     */
+    private resolveAuthEntry;
+    private resolveHost;
+    private prefixMatches;
+    private exposeDomainParams;
 }

package/dist/middleware/route-group.middleware.js

@@ -12,45 +12,306 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.RouteGroupMiddleware = void 0;
 const common_1 = require("@nestjs/common");
 const rhino_config_1 = require("../rhino.config");
+const domain_pattern_1 = require("../utils/domain-pattern");
 /**
- * Detects which Rhino route group the current request belongs to
- * (based on URL prefix) and attaches:
+ * Detects which Rhino route group the current request belongs to and attaches:
  *   - `req.__routeGroup`  — the group name
  *   - `req.__skipAuth`    — true when the group has `skipAuth: true`
  *
- * Install this middleware globally BEFORE `JwtAuthGuard` so the guard can
- * read `req.__skipAuth` and short-circuit.
+ * Group selection considers BOTH:
+ *
+ *   1. **Host** — when a group declares a `domain`, it is only eligible for
+ *      requests whose `req.hostname` matches that domain. A literal domain
+ *      (`admin.example.com`) must match exactly; a parameterized domain
+ *      (`{organization}.example.com`) captures the subdomain and exposes it as
+ *      `req.params.organization` so ResolveOrganizationMiddleware can resolve
+ *      the tenant from the host — mirroring Laravel's `Route::domain(...)`.
+ *
+ *   2. **URL prefix** — the existing path-prefix matching, unchanged for groups
+ *      without a `domain`.
+ *
+ * Host-scoped groups take precedence over plain prefix groups when both could
+ * match, so two groups can share the same prefix and be selected by host.
+ *
+ * Enforcement: if the request path targets a model that is ONLY served by
+ * domain-scoped group(s) and the host matches none of them, the request is
+ * rejected with 404 — a wrong-host request must not be served as that group.
+ *
+ * Install this middleware globally BEFORE `JwtAuthGuard` so the guard can read
+ * `req.__skipAuth`, and BEFORE `ResolveOrganizationMiddleware` so a captured
+ * subdomain param is available for org resolution.
  */
 let RouteGroupMiddleware = class RouteGroupMiddleware {
     config;
+    /** Cache compiled domain patterns keyed by group name. */
+    compiledCache = new Map();
     constructor(config) {
         this.config = config;
     }
+    compileFor(name, domain) {
+        if (this.compiledCache.has(name))
+            return this.compiledCache.get(name) ?? null;
+        const compiled = (0, domain_pattern_1.compileDomain)(domain);
+        this.compiledCache.set(name, compiled);
+        return compiled;
+    }
     use(req, _res, next) {
         // BP-006: `req.url` is stripped to the middleware's mount-point when
         // registered via NestModule.configure(consumer).forRoutes('*'), so it
         // collapses to `/` for every request. `req.originalUrl` carries the full
         // request URL verbatim — use that for prefix matching.
         const url = String(req.originalUrl ?? req.url ?? '').split('?')[0];
+        const host = this.resolveHost(req);
         const groups = this.config.routeGroups();
-        let match = null;
+        // FIX 11.1 (auth-path resolution): an auth entry path (login/logout/
+        // register/password recover|reset) must resolve to the auth-enabled group
+        // that matches this host/prefix, falling back to the empty-prefix/default
+        // group, and must ALWAYS keep `__skipAuth` so the JWT guard never blocks
+        // login/register/recover. A host-claiming empty-prefix DOMAIN group (which
+        // matches every path) must NOT win the auth path away from the group it
+        // belongs to. This branch is a no-op for apps with no auth-enabled group.
+        if (this.isAuthEntryPath(url) && this.config.authEnabledGroups().length > 0) {
+            this.resolveAuthEntry(req, url, host, groups);
+            return next();
+        }
+        // NOTE: never mutate `req.__skipAuth` inside this loop. Candidate matches
+        // record their group's `skipAuth` flag and the winning match applies it
+        // exactly once below, so a losing prefix group can't leak skipAuth onto a
+        // domain group that wins precedence (BLOCKER 1).
+        let prefixMatch = null;
+        let domainMatch = null;
+        // The empty-prefix, non-domain "default" group (e.g. `default`), if any. It
+        // serves every path that no more-specific prefix/domain group claims, so it
+        // is the fallback `__routeGroup` — making enforcement uniform: even the
+        // default group tags its routes with the group name (parity with
+        // Laravel/Rails). Without this, a null request-group matched ANY membership
+        // row (the route_group dimension was ignored). See FIX 3.
+        let defaultMatch = null;
+        // Tracks whether the URL path targeted a domain-scoped group whose host did
+        // NOT match — used for wrong-host 404 enforcement.
+        let blockedByHost = false;
+        // Tracks whether ANY non-domain group is eligible to serve this request
+        // (matched its prefix, or is a catch-all empty-prefix group). An
+        // empty-prefix domain group matches every path, so it must not 404 a
+        // request that such a non-domain group could serve (BLOCKER 2).
+        let nonDomainEligible = false;
         for (const [name, group] of Object.entries(groups)) {
             const prefix = group.prefix ?? '';
-            if (!prefix)
+            const compiled = this.compileFor(name, group.domain);
+            if (compiled) {
+                // Domain-scoped group: only eligible when the host matches.
+                const hostResult = (0, domain_pattern_1.matchDomain)(compiled, host);
+                const pathMatches = this.prefixMatches(url, prefix);
+                if (!hostResult) {
+                    // Host doesn't match this domain group. If the path would otherwise
+                    // target this group, remember it for wrong-host enforcement (only
+                    // honored below when no other group can serve the request).
+                    if (pathMatches)
+                        blockedByHost = true;
+                    continue;
+                }
+                // Host matches. Require the prefix to match too (empty prefix => match).
+                if (!pathMatches)
+                    continue;
+                if (!domainMatch) {
+                    domainMatch = {
+                        name,
+                        prefix,
+                        params: hostResult.params,
+                        skipAuth: group.skipAuth,
+                    };
+                }
                 continue;
+            }
+            // Plain prefix group (no domain) — original behavior.
             if (prefix.startsWith(':'))
                 continue; // dynamic tenant prefix — handled by ResolveOrganizationMiddleware
-            if (url.includes(`/${prefix}/`) || url.endsWith(`/${prefix}`)) {
-                match = { name, prefix };
-                if (group.skipAuth)
-                    req.__skipAuth = true;
-                break;
+            if (!prefix) {
+                // Catch-all (empty-prefix) non-domain group: eligible for any path, so
+                // a wrong-host domain group must not block requests it could serve. It
+                // becomes the `__routeGroup` only as a FALLBACK (below) — a concrete
+                // prefix or domain group always wins. Recording it lets the default
+                // group tag its routes with the group name so membership enforcement
+                // is uniform across all groups (FIX 3).
+                nonDomainEligible = true;
+                if (!defaultMatch) {
+                    defaultMatch = { name, prefix, skipAuth: group.skipAuth };
+                }
+                continue;
             }
+            if (this.prefixMatches(url, prefix)) {
+                nonDomainEligible = true;
+                if (!prefixMatch) {
+                    prefixMatch = { name, prefix, skipAuth: group.skipAuth };
+                }
+            }
+        }
+        // Host-scoped match takes precedence over a plain prefix match. Apply
+        // `__skipAuth` exactly once, from the winning group only.
+        if (domainMatch) {
+            req.__routeGroup = domainMatch.name;
+            if (domainMatch.skipAuth)
+                req.__skipAuth = true;
+            // Expose captured subdomain params (e.g. {organization}) so that
+            // ResolveOrganizationMiddleware can resolve the tenant from the host.
+            this.exposeDomainParams(req, domainMatch.params);
+            return next();
+        }
+        if (prefixMatch) {
+            req.__routeGroup = prefixMatch.name;
+            if (prefixMatch.skipAuth)
+                req.__skipAuth = true;
+            return next();
+        }
+        // Fallback: an empty-prefix, non-domain "default" group serves whatever no
+        // concrete prefix/domain group claimed. Tag the request with its name so
+        // the default group is a first-class membership dimension (FIX 3). A
+        // wrong-host domain group must not pre-empt a request this group can serve,
+        // so this also resolves the blockedByHost case below.
+        if (defaultMatch) {
+            req.__routeGroup = defaultMatch.name;
+            if (defaultMatch.skipAuth)
+                req.__skipAuth = true;
+            return next();
+        }
+        // No group matched. If a domain-scoped group targeted by the path had a
+        // non-matching host AND no non-domain group is eligible to serve the
+        // request, reject: a wrong-host request must not be served as that group.
+        // (An empty-prefix domain group that would block every path is overridden
+        // here by any eligible non-domain group — BLOCKER 2.)
+        if (blockedByHost && !nonDomainEligible) {
+            return next(new common_1.NotFoundException('Not found'));
         }
-        if (match)
-            req.__routeGroup = match.name;
         next();
     }
+    /**
+     * Whether `url` targets one of the auth entry endpoints. These are the
+     * routes that must never be blocked by the JWT guard (login/register/recover)
+     * and that must resolve to the group they belong to. Matches the auth
+     * controller's `@Controller('auth')` action paths under any prefix.
+     */
+    isAuthEntryPath(url) {
+        return (/(^|\/)auth\/login(\/|$)/.test(url) ||
+            /(^|\/)auth\/logout(\/|$)/.test(url) ||
+            /(^|\/)auth\/register(\/|$)/.test(url) ||
+            /(^|\/)auth\/password\/[^/]+(\/|$)/.test(url));
+    }
+    /**
+     * Resolve the route group for an auth entry path (FIX 11.1). Precedence:
+     *   1. an auth-enabled DOMAIN group whose host matches (and prefix matches);
+     *   2. an auth-enabled PREFIX group whose prefix matches;
+     *   3. the empty-prefix / default group (auth-enabled preferred, else any);
+     *   4. otherwise leave `__routeGroup` unset (legacy/global auth path).
+     *
+     * `__skipAuth` is ALWAYS set on an auth entry path so the JWT guard never
+     * blocks login/register/recover, regardless of which group wins — even a
+     * host-claiming empty-prefix domain group cannot strip it.
+     */
+    resolveAuthEntry(req, url, host, groups) {
+        let authDomain = null;
+        let authPrefix = null;
+        let authDefault = null;
+        let plainDefault = null;
+        for (const [name, group] of Object.entries(groups)) {
+            const prefix = group.prefix ?? '';
+            if (prefix.startsWith(':'))
+                continue; // dynamic tenant prefix
+            const authEnabled = group.auth === true && name !== 'public';
+            const compiled = this.compileFor(name, group.domain);
+            if (compiled) {
+                if (!authEnabled)
+                    continue;
+                const hostResult = (0, domain_pattern_1.matchDomain)(compiled, host);
+                if (!hostResult)
+                    continue;
+                if (!this.prefixMatches(url, prefix))
+                    continue;
+                if (!authDomain)
+                    authDomain = { name, params: hostResult.params };
+                continue;
+            }
+            // Plain (non-domain) group.
+            if (!prefix) {
+                // Empty-prefix / default group: the auth-path fallback.
+                if (authEnabled) {
+                    if (authDefault == null)
+                        authDefault = name;
+                }
+                else if (plainDefault == null) {
+                    plainDefault = name;
+                }
+                continue;
+            }
+            if (authEnabled && this.prefixMatches(url, prefix)) {
+                // Prefer the most specific (longest) matching prefix.
+                if (!authPrefix || prefix.length > authPrefix.prefixLen) {
+                    authPrefix = { name, prefixLen: prefix.length };
+                }
+            }
+        }
+        // Auth entry paths are always exempt from the JWT guard.
+        req.__skipAuth = true;
+        if (authDomain) {
+            req.__routeGroup = authDomain.name;
+            this.exposeDomainParams(req, authDomain.params);
+            return;
+        }
+        if (authPrefix) {
+            req.__routeGroup = authPrefix.name;
+            return;
+        }
+        // Fall back to the default group: an auth-enabled empty-prefix group is the
+        // legacy/global auth path itself (design §11.1), so it adopts the auth
+        // route. If none is auth-enabled, use any empty-prefix default group so the
+        // request still carries a first-class group (parity with FIX 3).
+        const fallback = authDefault ?? plainDefault;
+        if (fallback)
+            req.__routeGroup = fallback;
+        // else: no group claims it → legacy/global auth path (null group).
+    }
+    resolveHost(req) {
+        // Express populates `req.hostname` (port-stripped). Fall back to the Host
+        // header for environments/tests that only set headers.
+        const fromExpress = req.hostname;
+        if (fromExpress)
+            return String(fromExpress);
+        const header = req.headers?.host ?? req.host;
+        return header ? String(header).split(':')[0] : undefined;
+    }
+    prefixMatches(url, prefix) {
+        if (!prefix)
+            return true; // empty prefix => any path under the group
+        if (prefix.startsWith(':'))
+            return false;
+        return url.includes(`/${prefix}/`) || url.endsWith(`/${prefix}`);
+    }
+    exposeDomainParams(req, params) {
+        if (!params || Object.keys(params).length === 0)
+            return;
+        // DNS hostnames are case-insensitive but the regex capture preserves the
+        // host's casing verbatim. Lowercase the captured subdomain params so org
+        // resolution (and the resolver's cache key) is consistent — `ACME` and
+        // `acme` must resolve the same lowercase-slugged org.
+        const normalized = {};
+        for (const [key, value] of Object.entries(params)) {
+            normalized[key] = typeof value === 'string' ? value.toLowerCase() : value;
+        }
+        req.params = req.params ?? {};
+        for (const [key, value] of Object.entries(normalized)) {
+            // Don't clobber an explicit path param of the same name.
+            if (req.params[key] == null)
+                req.params[key] = value;
+        }
+        // Convention: a `{organization}` (or `{org}`) domain param feeds org
+        // resolution exactly like the `:organization` path param does. Surface it
+        // under `organization` so ResolveOrganizationMiddleware reads it uniformly.
+        const orgParam = normalized.organization ?? normalized.org;
+        if (orgParam != null && req.params.organization == null) {
+            req.params.organization = orgParam;
+        }
+        // Also record the (normalized) captured subdomain for downstream/debug use.
+        req.__domainParams = normalized;
+    }
 };
 exports.RouteGroupMiddleware = RouteGroupMiddleware;
 exports.RouteGroupMiddleware = RouteGroupMiddleware = __decorate([

package/dist/middleware/route-group.middleware.js.map

@@ -1 +1 @@
-{"version":3,"file":"route-group.middleware.js","sourceRoot":"","sources":["../../src/middleware/route-group.middleware.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,2CAA4D;AAE5D,kDAAqD;AAErD;;;;;;;;GAQG;AAEI,IAAM,oBAAoB,GAA1B,MAAM,oBAAoB;IACF;IAA7B,YAA6B,MAA0B;QAA1B,WAAM,GAAN,MAAM,CAAoB;IAAG,CAAC;IAE3D,GAAG,CAAC,GAAkC,EAAE,IAAc,EAAE,IAAkB;QACxE,qEAAqE;QACrE,sEAAsE;QACtE,yEAAyE;QACzE,uDAAuD;QACvD,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,WAAW,IAAI,GAAG,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACnE,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;QACzC,IAAI,KAAK,GAA4C,IAAI,CAAC;QAC1D,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YACnD,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,IAAI,EAAE,CAAC;YAClC,IAAI,CAAC,MAAM;gBAAE,SAAS;YACtB,IAAI,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC;gBAAE,SAAS,CAAC,mEAAmE;YACzG,IAAI,GAAG,CAAC,QAAQ,CAAC,IAAI,MAAM,GAAG,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,IAAI,MAAM,EAAE,CAAC,EAAE,CAAC;gBAC9D,KAAK,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;gBACzB,IAAI,KAAK,CAAC,QAAQ;oBAAE,GAAG,CAAC,UAAU,GAAG,IAAI,CAAC;gBAC1C,MAAM;YACR,CAAC;QACH,CAAC;QACD,IAAI,KAAK;YAAE,GAAG,CAAC,YAAY,GAAG,KAAK,CAAC,IAAI,CAAC;QACzC,IAAI,EAAE,CAAC;IACT,CAAC;CACF,CAAA;AAxBY,oDAAoB;+BAApB,oBAAoB;IADhC,IAAA,mBAAU,GAAE;qCAE0B,iCAAkB;GAD5C,oBAAoB,CAwBhC"}
+{"version":3,"file":"route-group.middleware.js","sourceRoot":"","sources":["../../src/middleware/route-group.middleware.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,2CAA+E;AAE/E,kDAAqD;AACrD,4DAA0F;AAE1F;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEI,IAAM,oBAAoB,GAA1B,MAAM,oBAAoB;IAIF;IAH7B,0DAA0D;IACzC,aAAa,GAAG,IAAI,GAAG,EAAiC,CAAC;IAE1E,YAA6B,MAA0B;QAA1B,WAAM,GAAN,MAAM,CAAoB;IAAG,CAAC;IAEnD,UAAU,CAAC,IAAY,EAAE,MAA0B;QACzD,IAAI,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC;QAC9E,MAAM,QAAQ,GAAG,IAAA,8BAAa,EAAC,MAAM,CAAC,CAAC;QACvC,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QACvC,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,GAAG,CAAC,GAAkC,EAAE,IAAc,EAAE,IAAkB;QACxE,qEAAqE;QACrE,sEAAsE;QACtE,yEAAyE;QACzE,uDAAuD;QACvD,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,WAAW,IAAI,GAAG,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACnE,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QACnC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;QAEzC,qEAAqE;QACrE,0EAA0E;QAC1E,0EAA0E;QAC1E,yEAAyE;QACzE,2EAA2E;QAC3E,wEAAwE;QACxE,0EAA0E;QAC1E,IAAI,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,iBAAiB,EAAE,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC5E,IAAI,CAAC,gBAAgB,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;YAC9C,OAAO,IAAI,EAAE,CAAC;QAChB,CAAC;QAED,0EAA0E;QAC1E,wEAAwE;QACxE,0EAA0E;QAC1E,iDAAiD;QACjD,IAAI,WAAW,GAAgE,IAAI,CAAC;QACpF,IAAI,WAAW,GAEJ,IAAI,CAAC;QAChB,4EAA4E;QAC5E,4EAA4E;QAC5E,wEAAwE;QACxE,iEAAiE;QACjE,4EAA4E;QAC5E,0DAA0D;QAC1D,IAAI,YAAY,GAAgE,IAAI,CAAC;QACrF,4EAA4E;QAC5E,mDAAmD;QACnD,IAAI,aAAa,GAAG,KAAK,CAAC;QAC1B,wEAAwE;QACxE,iEAAiE;QACjE,qEAAqE;QACrE,gEAAgE;QAChE,IAAI,iBAAiB,GAAG,KAAK,CAAC;QAE9B,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YACnD,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,IAAI,EAAE,CAAC;YAClC,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;YAErD,IAAI,QAAQ,EAAE,CAAC;gBACb,4DAA4D;gBAC5D,MAAM,UAAU,GAAG,IAAA,4BAAW,EAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;gBAC/C,MAAM,WAAW,GAAG,IAAI,CAAC,aAAa,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;gBACpD,IAAI,CAAC,UAAU,EAAE,CAAC;oBAChB,oEAAoE;oBACpE,kEAAkE;oBAClE,4DAA4D;oBAC5D,IAAI,WAAW;wBAAE,aAAa,GAAG,IAAI,CAAC;oBACtC,SAAS;gBACX,CAAC;gBACD,yEAAyE;gBACzE,IAAI,CAAC,WAAW;oBAAE,SAAS;gBAC3B,IAAI,CAAC,WAAW,EAAE,CAAC;oBACjB,WAAW,GAAG;wBACZ,IAAI;wBACJ,MAAM;wBACN,MAAM,EAAE,UAAU,CAAC,MAAM;wBACzB,QAAQ,EAAE,KAAK,CAAC,QAAQ;qBACzB,CAAC;gBACJ,CAAC;gBACD,SAAS;YACX,CAAC;YAED,sDAAsD;YACtD,IAAI,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC;gBAAE,SAAS,CAAC,mEAAmE;YACzG,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,uEAAuE;gBACvE,uEAAuE;gBACvE,qEAAqE;gBACrE,oEAAoE;gBACpE,qEAAqE;gBACrE,wCAAwC;gBACxC,iBAAiB,GAAG,IAAI,CAAC;gBACzB,IAAI,CAAC,YAAY,EAAE,CAAC;oBAClB,YAAY,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC;gBAC5D,CAAC;gBACD,SAAS;YACX,CAAC;YACD,IAAI,IAAI,CAAC,aAAa,CAAC,GAAG,EAAE,MAAM,CAAC,EAAE,CAAC;gBACpC,iBAAiB,GAAG,IAAI,CAAC;gBACzB,IAAI,CAAC,WAAW,EAAE,CAAC;oBACjB,WAAW,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC;gBAC3D,CAAC;YACH,CAAC;QACH,CAAC;QAED,sEAAsE;QACtE,0DAA0D;QAC1D,IAAI,WAAW,EAAE,CAAC;YAChB,GAAG,CAAC,YAAY,GAAG,WAAW,CAAC,IAAI,CAAC;YACpC,IAAI,WAAW,CAAC,QAAQ;gBAAE,GAAG,CAAC,UAAU,GAAG,IAAI,CAAC;YAChD,iEAAiE;YACjE,sEAAsE;YACtE,IAAI,CAAC,kBAAkB,CAAC,GAAG,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;YACjD,OAAO,IAAI,EAAE,CAAC;QAChB,CAAC;QAED,IAAI,WAAW,EAAE,CAAC;YAChB,GAAG,CAAC,YAAY,GAAG,WAAW,CAAC,IAAI,CAAC;YACpC,IAAI,WAAW,CAAC,QAAQ;gBAAE,GAAG,CAAC,UAAU,GAAG,IAAI,CAAC;YAChD,OAAO,IAAI,EAAE,CAAC;QAChB,CAAC;QAED,2EAA2E;QAC3E,yEAAyE;QACzE,qEAAqE;QACrE,4EAA4E;QAC5E,sDAAsD;QACtD,IAAI,YAAY,EAAE,CAAC;YACjB,GAAG,CAAC,YAAY,GAAG,YAAY,CAAC,IAAI,CAAC;YACrC,IAAI,YAAY,CAAC,QAAQ;gBAAE,GAAG,CAAC,UAAU,GAAG,IAAI,CAAC;YACjD,OAAO,IAAI,EAAE,CAAC;QAChB,CAAC;QAED,wEAAwE;QACxE,qEAAqE;QACrE,0EAA0E;QAC1E,0EAA0E;QAC1E,sDAAsD;QACtD,IAAI,aAAa,IAAI,CAAC,iBAAiB,EAAE,CAAC;YACxC,OAAO,IAAI,CAAC,IAAI,0BAAiB,CAAC,WAAW,CAAC,CAAC,CAAC;QAClD,CAAC;QAED,IAAI,EAAE,CAAC;IACT,CAAC;IAED;;;;;OAKG;IACK,eAAe,CAAC,GAAW;QACjC,OAAO,CACL,yBAAyB,CAAC,IAAI,CAAC,GAAG,CAAC;YACnC,0BAA0B,CAAC,IAAI,CAAC,GAAG,CAAC;YACpC,4BAA4B,CAAC,IAAI,CAAC,GAAG,CAAC;YACtC,mCAAmC,CAAC,IAAI,CAAC,GAAG,CAAC,CAC9C,CAAC;IACJ,CAAC;IAED;;;;;;;;;;OAUG;IACK,gBAAgB,CACtB,GAAkC,EAClC,GAAW,EACX,IAAwB,EACxB,MAAgG;QAEhG,IAAI,UAAU,GAA4D,IAAI,CAAC;QAC/E,IAAI,UAAU,GAA+C,IAAI,CAAC;QAClE,IAAI,WAAW,GAAkB,IAAI,CAAC;QACtC,IAAI,YAAY,GAAkB,IAAI,CAAC;QAEvC,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YACnD,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,IAAI,EAAE,CAAC;YAClC,IAAI,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC;gBAAE,SAAS,CAAC,wBAAwB;YAC9D,MAAM,WAAW,GAAG,KAAK,CAAC,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,QAAQ,CAAC;YAC7D,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;YAErD,IAAI,QAAQ,EAAE,CAAC;gBACb,IAAI,CAAC,WAAW;oBAAE,SAAS;gBAC3B,MAAM,UAAU,GAAG,IAAA,4BAAW,EAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;gBAC/C,IAAI,CAAC,UAAU;oBAAE,SAAS;gBAC1B,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,GAAG,EAAE,MAAM,CAAC;oBAAE,SAAS;gBAC/C,IAAI,CAAC,UAAU;oBAAE,UAAU,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC;gBAClE,SAAS;YACX,CAAC;YAED,4BAA4B;YAC5B,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,wDAAwD;gBACxD,IAAI,WAAW,EAAE,CAAC;oBAChB,IAAI,WAAW,IAAI,IAAI;wBAAE,WAAW,GAAG,IAAI,CAAC;gBAC9C,CAAC;qBAAM,IAAI,YAAY,IAAI,IAAI,EAAE,CAAC;oBAChC,YAAY,GAAG,IAAI,CAAC;gBACtB,CAAC;gBACD,SAAS;YACX,CAAC;YACD,IAAI,WAAW,IAAI,IAAI,CAAC,aAAa,CAAC,GAAG,EAAE,MAAM,CAAC,EAAE,CAAC;gBACnD,sDAAsD;gBACtD,IAAI,CAAC,UAAU,IAAI,MAAM,CAAC,MAAM,GAAG,UAAU,CAAC,SAAS,EAAE,CAAC;oBACxD,UAAU,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;gBAClD,CAAC;YACH,CAAC;QACH,CAAC;QAED,yDAAyD;QACzD,GAAG,CAAC,UAAU,GAAG,IAAI,CAAC;QAEtB,IAAI,UAAU,EAAE,CAAC;YACf,GAAG,CAAC,YAAY,GAAG,UAAU,CAAC,IAAI,CAAC;YACnC,IAAI,CAAC,kBAAkB,CAAC,GAAG,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC;YAChD,OAAO;QACT,CAAC;QACD,IAAI,UAAU,EAAE,CAAC;YACf,GAAG,CAAC,YAAY,GAAG,UAAU,CAAC,IAAI,CAAC;YACnC,OAAO;QACT,CAAC;QACD,4EAA4E;QAC5E,uEAAuE;QACvE,4EAA4E;QAC5E,iEAAiE;QACjE,MAAM,QAAQ,GAAG,WAAW,IAAI,YAAY,CAAC;QAC7C,IAAI,QAAQ;YAAE,GAAG,CAAC,YAAY,GAAG,QAAQ,CAAC;QAC1C,mEAAmE;IACrE,CAAC;IAEO,WAAW,CAAC,GAAkC;QACpD,0EAA0E;QAC1E,uDAAuD;QACvD,MAAM,WAAW,GAAI,GAAW,CAAC,QAAQ,CAAC;QAC1C,IAAI,WAAW;YAAE,OAAO,MAAM,CAAC,WAAW,CAAC,CAAC;QAC5C,MAAM,MAAM,GAAI,GAAG,CAAC,OAAO,EAAE,IAA2B,IAAK,GAAW,CAAC,IAAI,CAAC;QAC9E,OAAO,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC3D,CAAC;IAEO,aAAa,CAAC,GAAW,EAAE,MAAc;QAC/C,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC,CAAC,2CAA2C;QACrE,IAAI,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC;QACzC,OAAO,GAAG,CAAC,QAAQ,CAAC,IAAI,MAAM,GAAG,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,IAAI,MAAM,EAAE,CAAC,CAAC;IACnE,CAAC;IAEO,kBAAkB,CACxB,GAAkC,EAClC,MAA8B;QAE9B,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QACxD,yEAAyE;QACzE,yEAAyE;QACzE,uEAAuE;QACvE,sDAAsD;QACtD,MAAM,UAAU,GAA2B,EAAE,CAAC;QAC9C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YAClD,UAAU,CAAC,GAAG,CAAC,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;QAC5E,CAAC;QACD,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC,MAAM,IAAK,EAAU,CAAC;QACvC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;YACtD,yDAAyD;YACzD,IAAK,GAAG,CAAC,MAAc,CAAC,GAAG,CAAC,IAAI,IAAI;gBAAG,GAAG,CAAC,MAAc,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;QACzE,CAAC;QACD,qEAAqE;QACrE,0EAA0E;QAC1E,4EAA4E;QAC5E,MAAM,QAAQ,GAAG,UAAU,CAAC,YAAY,IAAI,UAAU,CAAC,GAAG,CAAC;QAC3D,IAAI,QAAQ,IAAI,IAAI,IAAK,GAAG,CAAC,MAAc,CAAC,YAAY,IAAI,IAAI,EAAE,CAAC;YAChE,GAAG,CAAC,MAAc,CAAC,YAAY,GAAG,QAAQ,CAAC;QAC9C,CAAC;QACD,4EAA4E;QAC5E,GAAG,CAAC,cAAc,GAAG,UAAU,CAAC;IAClC,CAAC;CACF,CAAA;AA3RY,oDAAoB;+BAApB,oBAAoB;IADhC,IAAA,mBAAU,GAAE;qCAK0B,iCAAkB;GAJ5C,oBAAoB,CA2RhC"}

package/dist/rhino.config.d.ts

@@ -1,4 +1,5 @@
-import type { RhinoConfig, ModelRegistration, RouteGroupConfig } from './interfaces/rhino-config.interface';
+import type { RhinoConfig, ModelRegistration, RouteGroupConfig, AuthLifecycleHooks } from './interfaces/rhino-config.interface';
+import type { Type } from '@nestjs/common';
 /**
  * Injectable accessor for the consuming app's Rhino configuration.
  * Wraps the raw config object with convenience lookup methods.
@@ -17,6 +18,29 @@ export declare class RhinoConfigService {
      * `'*'` expands to every registered model.
      */
     modelsInRouteGroup(name: string): string[];
+    /**
+     * Master flag for group-membership enforcement (Decision 9.A/B/C). Default
+     * `false` → behavior unchanged.
+     */
+    enforceGroupMembership(): boolean;
+    /** Whether a group has opted into per-group auth routes (Decision 9.A). */
+    routeGroupAuthEnabled(name: string | null | undefined): boolean;
+    /** The configured lifecycle-hooks provider/object for a group, if any. */
+    routeGroupHooks(name: string | null | undefined): Type<AuthLifecycleHooks> | AuthLifecycleHooks | undefined;
+    /** Names of all groups with `auth: true` (excludes the `public` group). */
+    authEnabledGroups(): string[];
+    /**
+     * Whether a route group is a tenant (org-scoped) group. A group is a tenant
+     * group when multi-tenancy is enabled AND the group does not opt out via
+     * `belongsToOrganization: false`-style config; here we treat a group as a
+     * tenant group when its declared models include any org-scoped model, or when
+     * the group carries a tenant `domain`/`prefix` param. Conservatively: a group
+     * is non-tenant only when explicitly marked. For membership purposes the org
+     * is only required when the request actually resolved an organization, so the
+     * effective rule is "tenant group ⇒ org must match". We expose the simpler
+     * predicate: multi-tenant enabled and not the public group.
+     */
+    isTenantGroup(name: string | null | undefined): boolean;
     multiTenantEnabled(): boolean;
     organizationIdentifierColumn(): string;
     nestedConfig(): {
@@ -35,6 +59,7 @@ export declare class RhinoConfigService {
         userModel: string;
         emailField: string;
         passwordField: string;
+        enforceGroupMembership: boolean;
     };
 }
 /**

package/dist/rhino.config.js

@@ -16,6 +16,7 @@ exports.RhinoConfigService = void 0;
 exports.normalizeConfig = normalizeConfig;
 const common_1 = require("@nestjs/common");
 const tokens_1 = require("./constants/tokens");
+const route_group_validator_1 = require("./utils/route-group-validator");
 /**
  * Injectable accessor for the consuming app's Rhino configuration.
  * Wraps the raw config object with convenience lookup methods.
@@ -55,6 +56,54 @@ let RhinoConfigService = class RhinoConfigService {
             return Object.keys(this.models());
         return group.models;
     }
+    /**
+     * Master flag for group-membership enforcement (Decision 9.A/B/C). Default
+     * `false` → behavior unchanged.
+     */
+    enforceGroupMembership() {
+        return this.config.auth?.enforceGroupMembership === true;
+    }
+    /** Whether a group has opted into per-group auth routes (Decision 9.A). */
+    routeGroupAuthEnabled(name) {
+        if (!name)
+            return false;
+        return this.routeGroup(name)?.auth === true;
+    }
+    /** The configured lifecycle-hooks provider/object for a group, if any. */
+    routeGroupHooks(name) {
+        if (!name)
+            return undefined;
+        return this.routeGroup(name)?.hooks;
+    }
+    /** Names of all groups with `auth: true` (excludes the `public` group). */
+    authEnabledGroups() {
+        return Object.entries(this.routeGroups())
+            .filter(([name, g]) => g.auth === true && name !== 'public')
+            .map(([name]) => name);
+    }
+    /**
+     * Whether a route group is a tenant (org-scoped) group. A group is a tenant
+     * group when multi-tenancy is enabled AND the group does not opt out via
+     * `belongsToOrganization: false`-style config; here we treat a group as a
+     * tenant group when its declared models include any org-scoped model, or when
+     * the group carries a tenant `domain`/`prefix` param. Conservatively: a group
+     * is non-tenant only when explicitly marked. For membership purposes the org
+     * is only required when the request actually resolved an organization, so the
+     * effective rule is "tenant group ⇒ org must match". We expose the simpler
+     * predicate: multi-tenant enabled and not the public group.
+     */
+    isTenantGroup(name) {
+        if (name === 'public')
+            return false;
+        if (name) {
+            const group = this.routeGroup(name);
+            // Explicit per-group override wins.
+            if (group && typeof group.tenant === 'boolean')
+                return group.tenant;
+        }
+        // Default: a group is org-scoped iff multi-tenancy is enabled.
+        return this.multiTenantEnabled();
+    }
     multiTenantEnabled() {
         const mt = this.config.multiTenant;
         if (!mt)
@@ -89,6 +138,7 @@ let RhinoConfigService = class RhinoConfigService {
             userModel: this.config.auth?.userModel ?? 'user',
             emailField: this.config.auth?.emailField ?? 'email',
             passwordField: this.config.auth?.passwordField ?? 'password',
+            enforceGroupMembership: this.config.auth?.enforceGroupMembership === true,
         };
     }
 };
@@ -102,7 +152,7 @@ exports.RhinoConfigService = RhinoConfigService = __decorate([
  * Normalize a raw config value (defaults applied) — used by the module in forRoot.
  */
 function normalizeConfig(config) {
-    return {
+    const normalized = {
         ...config,
         models: config.models ?? {},
         routeGroups: config.routeGroups ?? {},
@@ -123,8 +173,13 @@ function normalizeConfig(config) {
             userModel: 'user',
             emailField: 'email',
             passwordField: 'password',
+            enforceGroupMembership: false,
             ...(config.auth ?? {}),
         },
     };
+    // Fail fast on route groups that would silently shadow each other (same
+    // prefix + intersecting host-set + overlapping models).
+    (0, route_group_validator_1.validateRouteGroups)(normalized);
+    return normalized;
 }
 //# sourceMappingURL=rhino.config.js.map

package/dist/rhino.config.js.map

@@ -1 +1 @@
-{"version":3,"file":"rhino.config.js","sourceRoot":"","sources":["../src/rhino.config.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AA+FA,0CAyBC;AAxHD,2CAAoD;AACpD,+CAAkD;AAOlD;;;GAGG;AAEI,IAAM,kBAAkB,GAAxB,MAAM,kBAAkB;IACsB;IAAnD,YAAmD,MAAmB;QAAnB,WAAM,GAAN,MAAM,CAAa;IAAG,CAAC;IAE1E,GAAG;QACD,OAAO,IAAI,CAAC,MAAM,CAAC;IACrB,CAAC;IAED,MAAM;QACJ,OAAO,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC;IAClC,CAAC;IAED,KAAK,CAAC,IAAY;QAChB,OAAO,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,CAAC;IACpC,CAAC;IAED,QAAQ,CAAC,IAAY;QACnB,OAAO,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;IAC7C,CAAC;IAED,WAAW;QACT,OAAO,IAAI,CAAC,MAAM,CAAC,WAAW,IAAI,EAAE,CAAC;IACvC,CAAC;IAED,UAAU,CAAC,IAAY;QACrB,OAAO,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,IAAI,CAAC,CAAC;IACzC,CAAC;IAED;;;OAGG;IACH,kBAAkB,CAAC,IAAY;QAC7B,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QACpC,IAAI,CAAC,KAAK;YAAE,OAAO,EAAE,CAAC;QACtB,IAAI,KAAK,CAAC,MAAM,KAAK,GAAG;YAAE,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QAC5D,OAAO,KAAK,CAAC,MAAM,CAAC;IACtB,CAAC;IAED,kBAAkB;QAChB,MAAM,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC;QACnC,IAAI,CAAC,EAAE;YAAE,OAAO,KAAK,CAAC;QACtB,IAAI,EAAE,CAAC,OAAO,KAAK,KAAK;YAAE,OAAO,KAAK,CAAC;QACvC,OAAO,OAAO,CAAC,EAAE,CAAC,4BAA4B,CAAC,IAAI,EAAE,CAAC,OAAO,KAAK,IAAI,CAAC;IACzE,CAAC;IAED,4BAA4B;QAC1B,OAAO,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,4BAA4B,IAAI,IAAI,CAAC;IACvE,CAAC;IAED,YAAY;QACV,OAAO;YACL,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,IAAI,QAAQ;YAC1C,aAAa,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,aAAa,IAAI,EAAE;YACtD,aAAa,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,aAAa,IAAI,IAAI;SACzD,CAAC;IACJ,CAAC;IAED,iBAAiB;QACf,OAAO;YACL,WAAW,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,WAAW,IAAI,CAAC;YACtD,YAAY,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,YAAY,IAAI,IAAI;YAC3D,mBAAmB,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,mBAAmB;SAClE,CAAC;IACJ,CAAC;IAED,UAAU;QACR,OAAO;YACL,SAAS,EACP,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,SAAS;gBAC3B,OAAO,CAAC,GAAG,CAAC,UAAU;gBACtB,yBAAyB;YAC3B,YAAY,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,YAAY,IAAI,IAAI;YACpD,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,SAAS,IAAI,MAAM;YAChD,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,UAAU,IAAI,OAAO;YACnD,aAAa,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,aAAa,IAAI,UAAU;SAC7D,CAAC;IACJ,CAAC;CACF,CAAA;AA7EY,gDAAkB;6BAAlB,kBAAkB;IAD9B,IAAA,mBAAU,GAAE;IAEE,WAAA,IAAA,eAAM,EAAC,qBAAY,CAAC,CAAA;;GADtB,kBAAkB,CA6E9B;AAED;;GAEG;AACH,SAAgB,eAAe,CAAC,MAAmB;IACjD,OAAO;QACL,GAAG,MAAM;QACT,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,EAAE;QAC3B,WAAW,EAAE,MAAM,CAAC,WAAW,IAAI,EAAE;QACrC,WAAW,EAAE,MAAM,CAAC,WAAW,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE;QACrD,MAAM,EAAE;YACN,IAAI,EAAE,QAAQ;YACd,aAAa,EAAE,EAAE;YACjB,aAAa,EAAE,IAAI;YACnB,GAAG,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC;SACzB;QACD,WAAW,EAAE;YACX,WAAW,EAAE,CAAC;YACd,YAAY,EAAE,IAAI;YAClB,GAAG,CAAC,MAAM,CAAC,WAAW,IAAI,EAAE,CAAC;SAC9B;QACD,IAAI,EAAE;YACJ,YAAY,EAAE,IAAI;YAClB,SAAS,EAAE,MAAM;YACjB,UAAU,EAAE,OAAO;YACnB,aAAa,EAAE,UAAU;YACzB,GAAG,CAAC,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;SACvB;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"rhino.config.js","sourceRoot":"","sources":["../src/rhino.config.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAsJA,0CAgCC;AAtLD,2CAAoD;AACpD,+CAAkD;AAQlD,yEAAoE;AAEpE;;;GAGG;AAEI,IAAM,kBAAkB,GAAxB,MAAM,kBAAkB;IACsB;IAAnD,YAAmD,MAAmB;QAAnB,WAAM,GAAN,MAAM,CAAa;IAAG,CAAC;IAE1E,GAAG;QACD,OAAO,IAAI,CAAC,MAAM,CAAC;IACrB,CAAC;IAED,MAAM;QACJ,OAAO,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC;IAClC,CAAC;IAED,KAAK,CAAC,IAAY;QAChB,OAAO,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,CAAC;IACpC,CAAC;IAED,QAAQ,CAAC,IAAY;QACnB,OAAO,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;IAC7C,CAAC;IAED,WAAW;QACT,OAAO,IAAI,CAAC,MAAM,CAAC,WAAW,IAAI,EAAE,CAAC;IACvC,CAAC;IAED,UAAU,CAAC,IAAY;QACrB,OAAO,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,IAAI,CAAC,CAAC;IACzC,CAAC;IAED;;;OAGG;IACH,kBAAkB,CAAC,IAAY;QAC7B,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QACpC,IAAI,CAAC,KAAK;YAAE,OAAO,EAAE,CAAC;QACtB,IAAI,KAAK,CAAC,MAAM,KAAK,GAAG;YAAE,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QAC5D,OAAO,KAAK,CAAC,MAAM,CAAC;IACtB,CAAC;IAED;;;OAGG;IACH,sBAAsB;QACpB,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,sBAAsB,KAAK,IAAI,CAAC;IAC3D,CAAC;IAED,2EAA2E;IAC3E,qBAAqB,CAAC,IAA+B;QACnD,IAAI,CAAC,IAAI;YAAE,OAAO,KAAK,CAAC;QACxB,OAAO,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,IAAI,KAAK,IAAI,CAAC;IAC9C,CAAC;IAED,0EAA0E;IAC1E,eAAe,CACb,IAA+B;QAE/B,IAAI,CAAC,IAAI;YAAE,OAAO,SAAS,CAAC;QAC5B,OAAO,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC;IACtC,CAAC;IAED,2EAA2E;IAC3E,iBAAiB;QACf,OAAO,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;aACtC,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,QAAQ,CAAC;aAC3D,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC;IAC3B,CAAC;IAED;;;;;;;;;;OAUG;IACH,aAAa,CAAC,IAA+B;QAC3C,IAAI,IAAI,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAC;QACpC,IAAI,IAAI,EAAE,CAAC;YACT,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;YACpC,oCAAoC;YACpC,IAAI,KAAK,IAAI,OAAO,KAAK,CAAC,MAAM,KAAK,SAAS;gBAAE,OAAO,KAAK,CAAC,MAAM,CAAC;QACtE,CAAC;QACD,+DAA+D;QAC/D,OAAO,IAAI,CAAC,kBAAkB,EAAE,CAAC;IACnC,CAAC;IAED,kBAAkB;QAChB,MAAM,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC;QACnC,IAAI,CAAC,EAAE;YAAE,OAAO,KAAK,CAAC;QACtB,IAAI,EAAE,CAAC,OAAO,KAAK,KAAK;YAAE,OAAO,KAAK,CAAC;QACvC,OAAO,OAAO,CAAC,EAAE,CAAC,4BAA4B,CAAC,IAAI,EAAE,CAAC,OAAO,KAAK,IAAI,CAAC;IACzE,CAAC;IAED,4BAA4B;QAC1B,OAAO,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,4BAA4B,IAAI,IAAI,CAAC;IACvE,CAAC;IAED,YAAY;QACV,OAAO;YACL,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,IAAI,QAAQ;YAC1C,aAAa,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,aAAa,IAAI,EAAE;YACtD,aAAa,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,aAAa,IAAI,IAAI;SACzD,CAAC;IACJ,CAAC;IAED,iBAAiB;QACf,OAAO;YACL,WAAW,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,WAAW,IAAI,CAAC;YACtD,YAAY,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,YAAY,IAAI,IAAI;YAC3D,mBAAmB,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,mBAAmB;SAClE,CAAC;IACJ,CAAC;IAED,UAAU;QACR,OAAO;YACL,SAAS,EACP,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,SAAS;gBAC3B,OAAO,CAAC,GAAG,CAAC,UAAU;gBACtB,yBAAyB;YAC3B,YAAY,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,YAAY,IAAI,IAAI;YACpD,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,SAAS,IAAI,MAAM;YAChD,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,UAAU,IAAI,OAAO;YACnD,aAAa,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,aAAa,IAAI,UAAU;YAC5D,sBAAsB,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,sBAAsB,KAAK,IAAI;SAC1E,CAAC;IACJ,CAAC;CACF,CAAA;AAjIY,gDAAkB;6BAAlB,kBAAkB;IAD9B,IAAA,mBAAU,GAAE;IAEE,WAAA,IAAA,eAAM,EAAC,qBAAY,CAAC,CAAA;;GADtB,kBAAkB,CAiI9B;AAED;;GAEG;AACH,SAAgB,eAAe,CAAC,MAAmB;IACjD,MAAM,UAAU,GAAgB;QAC9B,GAAG,MAAM;QACT,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,EAAE;QAC3B,WAAW,EAAE,MAAM,CAAC,WAAW,IAAI,EAAE;QACrC,WAAW,EAAE,MAAM,CAAC,WAAW,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE;QACrD,MAAM,EAAE;YACN,IAAI,EAAE,QAAQ;YACd,aAAa,EAAE,EAAE;YACjB,aAAa,EAAE,IAAI;YACnB,GAAG,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC;SACzB;QACD,WAAW,EAAE;YACX,WAAW,EAAE,CAAC;YACd,YAAY,EAAE,IAAI;YAClB,GAAG,CAAC,MAAM,CAAC,WAAW,IAAI,EAAE,CAAC;SAC9B;QACD,IAAI,EAAE;YACJ,YAAY,EAAE,IAAI;YAClB,SAAS,EAAE,MAAM;YACjB,UAAU,EAAE,OAAO;YACnB,aAAa,EAAE,UAAU;YACzB,sBAAsB,EAAE,KAAK;YAC7B,GAAG,CAAC,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;SACvB;KACF,CAAC;IAEF,wEAAwE;IACxE,wDAAwD;IACxD,IAAA,2CAAmB,EAAC,UAAU,CAAC,CAAC;IAEhC,OAAO,UAAU,CAAC;AACpB,CAAC"}

package/dist/rhino.module.d.ts

@@ -13,6 +13,12 @@ export interface RhinoModuleOptions {
     autoModelMiddleware?: boolean;
     /** Wire ResolveOrganizationMiddleware for all routes when multiTenant enabled. Default true. */
     autoTenantMiddleware?: boolean;
+    /**
+     * Install GroupMembershipGuard globally as APP_GUARD. Default false (opt-in).
+     * The guard is a no-op unless `auth.enforceGroupMembership` is on, so this is
+     * safe to enable alongside `autoAuthGuard` when using group membership.
+     */
+    autoMembershipGuard?: boolean;
 }
 /**
  * Rhino NestJS dynamic module.
@@ -57,5 +63,6 @@ export declare class RhinoModule implements NestModule {
     private static build;
     private static collectModelMiddleware;
     private static coreProviders;
+    private static collectHookClasses;
     private static coreExports;
 }