@rhino-dev/rhino-nestjs 4.0.0 → 4.2.0

package/dist/rhino.module.js

@@ -29,8 +29,11 @@ const nested_service_1 = require("./services/nested.service");
 const scope_service_1 = require("./services/scope.service");
 const auth_service_1 = require("./services/auth.service");
 const invitation_service_1 = require("./services/invitation.service");
+const auth_hooks_service_1 = require("./services/auth-hooks.service");
+const membership_service_1 = require("./services/membership.service");
 const jwt_auth_guard_1 = require("./guards/jwt-auth.guard");
 const resource_policy_guard_1 = require("./guards/resource-policy.guard");
+const group_membership_guard_1 = require("./guards/group-membership.guard");
 const global_controller_1 = require("./controllers/global.controller");
 const auth_controller_1 = require("./controllers/auth.controller");
 const invitation_controller_1 = require("./controllers/invitation.controller");
@@ -132,6 +135,7 @@ let RhinoModule = RhinoModule_1 = class RhinoModule {
     static forRoot(config, options = {}) {
         const normalized = (0, rhino_config_1.normalizeConfig)(config);
         const middlewareFromConfig = RhinoModule_1.collectModelMiddleware(normalized);
+        const hookClasses = RhinoModule_1.collectHookClasses(normalized);
         return RhinoModule_1.build({
             configProviders: [
                 { provide: tokens_1.RHINO_CONFIG, useValue: normalized },
@@ -143,6 +147,7 @@ let RhinoModule = RhinoModule_1 = class RhinoModule {
             imports: [],
             options,
             middlewareClasses: middlewareFromConfig,
+            hookClasses,
         });
     }
     /**
@@ -173,6 +178,8 @@ let RhinoModule = RhinoModule_1 = class RhinoModule {
         const guardProviders = [];
         if (opts.autoAuthGuard)
             guardProviders.push({ provide: core_1.APP_GUARD, useClass: jwt_auth_guard_1.JwtAuthGuard });
+        if (opts.autoMembershipGuard)
+            guardProviders.push({ provide: core_1.APP_GUARD, useClass: group_membership_guard_1.GroupMembershipGuard });
         if (opts.autoPolicyGuard)
             guardProviders.push({ provide: core_1.APP_GUARD, useClass: resource_policy_guard_1.ResourcePolicyGuard });
         return {
@@ -187,9 +194,10 @@ let RhinoModule = RhinoModule_1 = class RhinoModule {
                 ...RhinoModule_1.coreProviders(),
                 jwt_auth_guard_1.JwtAuthGuard,
                 resource_policy_guard_1.ResourcePolicyGuard,
+                group_membership_guard_1.GroupMembershipGuard,
                 route_group_middleware_1.RouteGroupMiddleware,
                 resolve_organization_middleware_1.ResolveOrganizationMiddleware,
-                ...dedupeTypes(args.middlewareClasses),
+                ...dedupeTypes([...args.middlewareClasses, ...(args.hookClasses ?? [])]),
                 ...guardProviders,
             ],
             exports: RhinoModule_1.coreExports(),
@@ -221,8 +229,19 @@ let RhinoModule = RhinoModule_1 = class RhinoModule {
             scope_service_1.ScopeService,
             auth_service_1.AuthService,
             invitation_service_1.InvitationService,
+            auth_hooks_service_1.AuthHooksService,
+            membership_service_1.MembershipService,
         ];
     }
+    static collectHookClasses(config) {
+        const set = new Set();
+        for (const group of Object.values(config.routeGroups ?? {})) {
+            const hooks = group.hooks;
+            if (hooks && typeof hooks === 'function')
+                set.add(hooks);
+        }
+        return Array.from(set);
+    }
     static coreExports() {
         return [
             // Injection tokens (BP-010 — surfaced for consumer middleware/services)
@@ -241,8 +260,11 @@ let RhinoModule = RhinoModule_1 = class RhinoModule {
             scope_service_1.ScopeService,
             auth_service_1.AuthService,
             invitation_service_1.InvitationService,
+            auth_hooks_service_1.AuthHooksService,
+            membership_service_1.MembershipService,
             jwt_auth_guard_1.JwtAuthGuard,
             resource_policy_guard_1.ResourcePolicyGuard,
+            group_membership_guard_1.GroupMembershipGuard,
         ];
     }
 };

package/dist/rhino.module.js.map

@@ -1 +1 @@
-{"version":3,"file":"rhino.module.js","sourceRoot":"","sources":["../src/rhino.module.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,2CAUwB;AACxB,uCAAyC;AACzC,iDAAqE;AACrE,+CAI4B;AAK5B,4DAAwD;AACxD,kEAA8D;AAC9D,4EAAuE;AACvE,sEAAkE;AAClE,sEAAkE;AAClE,0EAAsE;AACtE,4DAAwD;AACxD,8DAA0D;AAC1D,4DAAwD;AACxD,0DAAsD;AACtD,sEAAkE;AAClE,4DAAuD;AACvD,0EAAqE;AACrE,uEAAmE;AACnE,mEAA+D;AAC/D,+EAA2E;AAC3E,uEAAmE;AACnE,gFAA2E;AAC3E,kGAA6F;AAE7F,MAAM,gBAAgB,GAAkC;IACtD,KAAK,EAAE,sBAAa,CAAC,GAAG;IACxB,IAAI,EAAE,sBAAa,CAAC,GAAG;IACvB,KAAK,EAAE,sBAAa,CAAC,IAAI;IACzB,MAAM,EAAE,sBAAa,CAAC,GAAG;IACzB,OAAO,EAAE,sBAAa,CAAC,MAAM;IAC7B,OAAO,EAAE,sBAAa,CAAC,GAAG;IAC1B,OAAO,EAAE,sBAAa,CAAC,IAAI;IAC3B,WAAW,EAAE,sBAAa,CAAC,MAAM;CAClC,CAAC;AAEF,SAAS,UAAU,CAAC,IAAY,EAAE,MAAc;IAC9C,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,OAAO,CAAC;QACb,KAAK,OAAO;YACV,OAAO,IAAI,CAAC;QACd,KAAK,SAAS;YACZ,OAAO,GAAG,IAAI,UAAU,CAAC;QAC3B,KAAK,MAAM,CAAC;QACZ,KAAK,QAAQ,CAAC;QACd,KAAK,SAAS;YACZ,OAAO,GAAG,IAAI,MAAM,CAAC;QACvB,KAAK,SAAS;YACZ,OAAO,GAAG,IAAI,cAAc,CAAC;QAC/B,KAAK,aAAa;YAChB,OAAO,GAAG,IAAI,mBAAmB,CAAC;QACpC;YACE,OAAO,IAAI,CAAC;IAChB,CAAC;AACH,CAAC;AAiBD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAGI,IAAM,WAAW,mBAAjB,MAAM,WAAW;IAEmB;IACQ;IAFjD,YACyC,MAAmB,EACX,OAA2B;QADnC,WAAM,GAAN,MAAM,CAAa;QACX,YAAO,GAAP,OAAO,CAAoB;IACzE,CAAC;IAEJ,SAAS,CAAC,QAA4B;QACpC,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC;QAChC,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC;QACxB,IAAI,CAAC,GAAG;YAAE,OAAO;QAEjB,IAAI,IAAI,CAAC,wBAAwB,KAAK,KAAK,EAAE,CAAC;YAC5C,QAAQ,CAAC,KAAK,CAAC,6CAAoB,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QACtD,CAAC;QAED,IAAI,IAAI,CAAC,mBAAmB,KAAK,KAAK,EAAE,CAAC;YACvC,KAAK,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC,EAAE,CAAC;gBAC3D,MAAM,MAAM,GAAG,CAAC,GAAG,CAAC,UAAU,IAAI,EAAE,CAAgB,CAAC;gBACrD,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBACtB,QAAQ,CAAC,KAAK,CAAC,GAAG,MAAM,CAAC,CAAC,SAAS,CACjC,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,sBAAa,CAAC,GAAG,EAAE,EACzC,EAAE,IAAI,EAAE,GAAG,IAAI,IAAI,EAAE,MAAM,EAAE,sBAAa,CAAC,GAAG,EAAE,CACjD,CAAC;gBACJ,CAAC;gBACD,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,EAAE,CAAC,EAAE,CAAC;oBAC1E,MAAM,IAAI,GAAG,CAAC,MAAM,IAAI,EAAE,CAAgB,CAAC;oBAC3C,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;wBAAE,SAAS;oBAChC,MAAM,MAAM,GAAG,gBAAgB,CAAC,MAAM,CAAC,IAAI,sBAAa,CAAC,GAAG,CAAC;oBAC7D,QAAQ,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;gBAChF,CAAC;YACH,CAAC;QACH,CAAC;QAED,IACE,IAAI,CAAC,oBAAoB,KAAK,KAAK;YACnC,CAAC,GAAG,CAAC,WAAW,EAAE,4BAA4B,IAAI,GAAG,CAAC,WAAW,EAAE,OAAO,CAAC,EAC3E,CAAC;YACD,QAAQ,CAAC,KAAK,CAAC,+DAA6B,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QAC/D,CAAC;IACH,CAAC;IAED;;;OAGG;IACH,MAAM,CAAC,OAAO,CACZ,MAAmB,EACnB,UAA8B,EAAE;QAEhC,MAAM,UAAU,GAAG,IAAA,8BAAe,EAAC,MAAM,CAAC,CAAC;QAC3C,MAAM,oBAAoB,GAAG,aAAW,CAAC,sBAAsB,CAAC,UAAU,CAAC,CAAC;QAC5E,OAAO,aAAW,CAAC,KAAK,CAAC;YACvB,eAAe,EAAE;gBACf,EAAE,OAAO,EAAE,qBAAY,EAAE,QAAQ,EAAE,UAAU,EAAE;gBAC/C;oBACE,OAAO,EAAE,4BAAmB;oBAC5B,QAAQ,EAAE,UAAU,CAAC,YAAY,IAAI,IAAI;iBAC1C;aACF;YACD,OAAO,EAAE,EAAE;YACX,OAAO;YACP,iBAAiB,EAAE,oBAAoB;SACxC,CAAC,CAAC;IACL,CAAC;IAED;;;;OAIG;IACH,MAAM,CAAC,YAAY,CACjB,OAAqD;QAErD,MAAM,cAAc,GAAa;YAC/B,OAAO,EAAE,qBAAY;YACrB,UAAU,EAAE,KAAK,EAAE,GAAG,IAAW,EAAE,EAAE,CAAC,IAAA,8BAAe,EAAC,MAAM,OAAO,CAAC,UAAU,CAAC,GAAG,IAAI,CAAC,CAAC;YACxF,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,EAAE;SAC7B,CAAC;QACF,MAAM,cAAc,GAAa;YAC/B,OAAO,EAAE,4BAAmB;YAC5B,UAAU,EAAE,CAAC,GAAgB,EAAE,EAAE,CAAC,GAAG,CAAC,YAAY,IAAI,IAAI;YAC1D,MAAM,EAAE,CAAC,qBAAY,CAAC;SACvB,CAAC;QACF,OAAO,aAAW,CAAC,KAAK,CAAC;YACvB,eAAe,EAAE,CAAC,cAAc,EAAE,cAAc,CAAC;YACjD,OAAO,EAAE,OAAO,CAAC,OAAO,IAAI,EAAE;YAC9B,OAAO;YACP,iBAAiB,EAAE,CAAC,OAAO,CAAC,UAAU,IAAI,EAAE,CAAgB;SAC7D,CAAC,CAAC;IACL,CAAC;IAEO,MAAM,CAAC,KAAK,CAAC,IAKpB;QACC,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC;QAC1B,MAAM,cAAc,GAAe,EAAE,CAAC;QACtC,IAAI,IAAI,CAAC,aAAa;YAAE,cAAc,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,gBAAS,EAAE,QAAQ,EAAE,6BAAY,EAAE,CAAC,CAAC;QAC5F,IAAI,IAAI,CAAC,eAAe;YAAE,cAAc,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,gBAAS,EAAE,QAAQ,EAAE,2CAAmB,EAAE,CAAC,CAAC;QAErG,OAAO;YACL,MAAM,EAAE,aAAW;YACnB,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,WAAW,EAAE,IAAI,CAAC,mBAAmB,KAAK,KAAK;gBAC7C,CAAC,CAAC,CAAC,oCAAgB,EAAE,gCAAc,EAAE,4CAAoB,EAAE,oCAAgB,CAAC;gBAC5E,CAAC,CAAC,EAAE;YACN,SAAS,EAAE;gBACT,GAAG,IAAI,CAAC,eAAe;gBACvB,EAAE,OAAO,EAAE,6BAAoB,EAAE,QAAQ,EAAE,IAAI,EAAE;gBACjD,GAAG,aAAW,CAAC,aAAa,EAAE;gBAC9B,6BAAY;gBACZ,2CAAmB;gBACnB,6CAAoB;gBACpB,+DAA6B;gBAC7B,GAAG,WAAW,CAAC,IAAI,CAAC,iBAAiB,CAAC;gBACtC,GAAG,cAAc;aAClB;YACD,OAAO,EAAE,aAAW,CAAC,WAAW,EAAE;SACnC,CAAC;IACJ,CAAC;IAEO,MAAM,CAAC,sBAAsB,CAAC,MAAmB;QACvD,MAAM,GAAG,GAAG,IAAI,GAAG,EAAa,CAAC;QACjC,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,EAAE,CAAC;YACrD,KAAK,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,UAAU,IAAI,EAAE,CAAgB;gBAAE,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACpE,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,gBAAgB,IAAI,EAAE,CAAC,EAAE,CAAC;gBAC5D,KAAK,MAAM,EAAE,IAAI,CAAC,GAAG,IAAI,EAAE,CAAgB;oBAAE,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAC3D,CAAC;QACH,CAAC;QACD,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACzB,CAAC;IAEO,MAAM,CAAC,aAAa;QAC1B,OAAO;YACL,iCAAkB;YAClB,8BAAa;YACb,kCAAe;YACf,2CAAmB;YACnB,sCAAiB;YACjB,sCAAiB;YACjB,0CAAmB;YACnB,4BAAY;YACZ,8BAAa;YACb,4BAAY;YACZ,0BAAW;YACX,sCAAiB;SAClB,CAAC;IACJ,CAAC;IAEO,MAAM,CAAC,WAAW;QACxB,OAAO;YACL,wEAAwE;YACxE,qBAAY;YACZ,4BAAmB;YACnB,6BAAoB;YACpB,iCAAkB;YAClB,8BAAa;YACb,kCAAe;YACf,2CAAmB;YACnB,sCAAiB;YACjB,sCAAiB;YACjB,0CAAmB;YACnB,4BAAY;YACZ,8BAAa;YACb,4BAAY;YACZ,0BAAW;YACX,sCAAiB;YACjB,6BAAY;YACZ,2CAAmB;SACpB,CAAC;IACJ,CAAC;CACF,CAAA;AA7KY,kCAAW;sBAAX,WAAW;IAFvB,IAAA,eAAM,GAAE;IACR,IAAA,eAAM,EAAC,EAAE,CAAC;IAGN,WAAA,IAAA,eAAM,EAAC,qBAAY,CAAC,CAAA;IACpB,WAAA,IAAA,eAAM,EAAC,6BAAoB,CAAC,CAAA;;GAHpB,WAAW,CA6KvB;AAED,SAAS,WAAW,CAAC,IAAiB;IACpC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAO,CAAC;IAC5B,MAAM,GAAG,GAAgB,EAAE,CAAC;IAC5B,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;QACrB,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YACjB,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YACZ,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACd,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}
+{"version":3,"file":"rhino.module.js","sourceRoot":"","sources":["../src/rhino.module.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,2CAUwB;AACxB,uCAAyC;AACzC,iDAAqE;AACrE,+CAI4B;AAK5B,4DAAwD;AACxD,kEAA8D;AAC9D,4EAAuE;AACvE,sEAAkE;AAClE,sEAAkE;AAClE,0EAAsE;AACtE,4DAAwD;AACxD,8DAA0D;AAC1D,4DAAwD;AACxD,0DAAsD;AACtD,sEAAkE;AAClE,sEAAiE;AACjE,sEAAkE;AAClE,4DAAuD;AACvD,0EAAqE;AACrE,4EAAuE;AACvE,uEAAmE;AACnE,mEAA+D;AAC/D,+EAA2E;AAC3E,uEAAmE;AACnE,gFAA2E;AAC3E,kGAA6F;AAE7F,MAAM,gBAAgB,GAAkC;IACtD,KAAK,EAAE,sBAAa,CAAC,GAAG;IACxB,IAAI,EAAE,sBAAa,CAAC,GAAG;IACvB,KAAK,EAAE,sBAAa,CAAC,IAAI;IACzB,MAAM,EAAE,sBAAa,CAAC,GAAG;IACzB,OAAO,EAAE,sBAAa,CAAC,MAAM;IAC7B,OAAO,EAAE,sBAAa,CAAC,GAAG;IAC1B,OAAO,EAAE,sBAAa,CAAC,IAAI;IAC3B,WAAW,EAAE,sBAAa,CAAC,MAAM;CAClC,CAAC;AAEF,SAAS,UAAU,CAAC,IAAY,EAAE,MAAc;IAC9C,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,OAAO,CAAC;QACb,KAAK,OAAO;YACV,OAAO,IAAI,CAAC;QACd,KAAK,SAAS;YACZ,OAAO,GAAG,IAAI,UAAU,CAAC;QAC3B,KAAK,MAAM,CAAC;QACZ,KAAK,QAAQ,CAAC;QACd,KAAK,SAAS;YACZ,OAAO,GAAG,IAAI,MAAM,CAAC;QACvB,KAAK,SAAS;YACZ,OAAO,GAAG,IAAI,cAAc,CAAC;QAC/B,KAAK,aAAa;YAChB,OAAO,GAAG,IAAI,mBAAmB,CAAC;QACpC;YACE,OAAO,IAAI,CAAC;IAChB,CAAC;AACH,CAAC;AAuBD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAGI,IAAM,WAAW,mBAAjB,MAAM,WAAW;IAEmB;IACQ;IAFjD,YACyC,MAAmB,EACX,OAA2B;QADnC,WAAM,GAAN,MAAM,CAAa;QACX,YAAO,GAAP,OAAO,CAAoB;IACzE,CAAC;IAEJ,SAAS,CAAC,QAA4B;QACpC,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC;QAChC,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC;QACxB,IAAI,CAAC,GAAG;YAAE,OAAO;QAEjB,IAAI,IAAI,CAAC,wBAAwB,KAAK,KAAK,EAAE,CAAC;YAC5C,QAAQ,CAAC,KAAK,CAAC,6CAAoB,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QACtD,CAAC;QAED,IAAI,IAAI,CAAC,mBAAmB,KAAK,KAAK,EAAE,CAAC;YACvC,KAAK,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC,EAAE,CAAC;gBAC3D,MAAM,MAAM,GAAG,CAAC,GAAG,CAAC,UAAU,IAAI,EAAE,CAAgB,CAAC;gBACrD,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBACtB,QAAQ,CAAC,KAAK,CAAC,GAAG,MAAM,CAAC,CAAC,SAAS,CACjC,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,sBAAa,CAAC,GAAG,EAAE,EACzC,EAAE,IAAI,EAAE,GAAG,IAAI,IAAI,EAAE,MAAM,EAAE,sBAAa,CAAC,GAAG,EAAE,CACjD,CAAC;gBACJ,CAAC;gBACD,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,EAAE,CAAC,EAAE,CAAC;oBAC1E,MAAM,IAAI,GAAG,CAAC,MAAM,IAAI,EAAE,CAAgB,CAAC;oBAC3C,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;wBAAE,SAAS;oBAChC,MAAM,MAAM,GAAG,gBAAgB,CAAC,MAAM,CAAC,IAAI,sBAAa,CAAC,GAAG,CAAC;oBAC7D,QAAQ,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;gBAChF,CAAC;YACH,CAAC;QACH,CAAC;QAED,IACE,IAAI,CAAC,oBAAoB,KAAK,KAAK;YACnC,CAAC,GAAG,CAAC,WAAW,EAAE,4BAA4B,IAAI,GAAG,CAAC,WAAW,EAAE,OAAO,CAAC,EAC3E,CAAC;YACD,QAAQ,CAAC,KAAK,CAAC,+DAA6B,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QAC/D,CAAC;IACH,CAAC;IAED;;;OAGG;IACH,MAAM,CAAC,OAAO,CACZ,MAAmB,EACnB,UAA8B,EAAE;QAEhC,MAAM,UAAU,GAAG,IAAA,8BAAe,EAAC,MAAM,CAAC,CAAC;QAC3C,MAAM,oBAAoB,GAAG,aAAW,CAAC,sBAAsB,CAAC,UAAU,CAAC,CAAC;QAC5E,MAAM,WAAW,GAAG,aAAW,CAAC,kBAAkB,CAAC,UAAU,CAAC,CAAC;QAC/D,OAAO,aAAW,CAAC,KAAK,CAAC;YACvB,eAAe,EAAE;gBACf,EAAE,OAAO,EAAE,qBAAY,EAAE,QAAQ,EAAE,UAAU,EAAE;gBAC/C;oBACE,OAAO,EAAE,4BAAmB;oBAC5B,QAAQ,EAAE,UAAU,CAAC,YAAY,IAAI,IAAI;iBAC1C;aACF;YACD,OAAO,EAAE,EAAE;YACX,OAAO;YACP,iBAAiB,EAAE,oBAAoB;YACvC,WAAW;SACZ,CAAC,CAAC;IACL,CAAC;IAED;;;;OAIG;IACH,MAAM,CAAC,YAAY,CACjB,OAAqD;QAErD,MAAM,cAAc,GAAa;YAC/B,OAAO,EAAE,qBAAY;YACrB,UAAU,EAAE,KAAK,EAAE,GAAG,IAAW,EAAE,EAAE,CAAC,IAAA,8BAAe,EAAC,MAAM,OAAO,CAAC,UAAU,CAAC,GAAG,IAAI,CAAC,CAAC;YACxF,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,EAAE;SAC7B,CAAC;QACF,MAAM,cAAc,GAAa;YAC/B,OAAO,EAAE,4BAAmB;YAC5B,UAAU,EAAE,CAAC,GAAgB,EAAE,EAAE,CAAC,GAAG,CAAC,YAAY,IAAI,IAAI;YAC1D,MAAM,EAAE,CAAC,qBAAY,CAAC;SACvB,CAAC;QACF,OAAO,aAAW,CAAC,KAAK,CAAC;YACvB,eAAe,EAAE,CAAC,cAAc,EAAE,cAAc,CAAC;YACjD,OAAO,EAAE,OAAO,CAAC,OAAO,IAAI,EAAE;YAC9B,OAAO;YACP,iBAAiB,EAAE,CAAC,OAAO,CAAC,UAAU,IAAI,EAAE,CAAgB;SAC7D,CAAC,CAAC;IACL,CAAC;IAEO,MAAM,CAAC,KAAK,CAAC,IAMpB;QACC,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC;QAC1B,MAAM,cAAc,GAAe,EAAE,CAAC;QACtC,IAAI,IAAI,CAAC,aAAa;YAAE,cAAc,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,gBAAS,EAAE,QAAQ,EAAE,6BAAY,EAAE,CAAC,CAAC;QAC5F,IAAI,IAAI,CAAC,mBAAmB;YAAE,cAAc,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,gBAAS,EAAE,QAAQ,EAAE,6CAAoB,EAAE,CAAC,CAAC;QAC1G,IAAI,IAAI,CAAC,eAAe;YAAE,cAAc,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,gBAAS,EAAE,QAAQ,EAAE,2CAAmB,EAAE,CAAC,CAAC;QAErG,OAAO;YACL,MAAM,EAAE,aAAW;YACnB,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,WAAW,EAAE,IAAI,CAAC,mBAAmB,KAAK,KAAK;gBAC7C,CAAC,CAAC,CAAC,oCAAgB,EAAE,gCAAc,EAAE,4CAAoB,EAAE,oCAAgB,CAAC;gBAC5E,CAAC,CAAC,EAAE;YACN,SAAS,EAAE;gBACT,GAAG,IAAI,CAAC,eAAe;gBACvB,EAAE,OAAO,EAAE,6BAAoB,EAAE,QAAQ,EAAE,IAAI,EAAE;gBACjD,GAAG,aAAW,CAAC,aAAa,EAAE;gBAC9B,6BAAY;gBACZ,2CAAmB;gBACnB,6CAAoB;gBACpB,6CAAoB;gBACpB,+DAA6B;gBAC7B,GAAG,WAAW,CAAC,CAAC,GAAG,IAAI,CAAC,iBAAiB,EAAE,GAAG,CAAC,IAAI,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,CAAC;gBACxE,GAAG,cAAc;aAClB;YACD,OAAO,EAAE,aAAW,CAAC,WAAW,EAAE;SACnC,CAAC;IACJ,CAAC;IAEO,MAAM,CAAC,sBAAsB,CAAC,MAAmB;QACvD,MAAM,GAAG,GAAG,IAAI,GAAG,EAAa,CAAC;QACjC,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,EAAE,CAAC;YACrD,KAAK,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,UAAU,IAAI,EAAE,CAAgB;gBAAE,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACpE,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,gBAAgB,IAAI,EAAE,CAAC,EAAE,CAAC;gBAC5D,KAAK,MAAM,EAAE,IAAI,CAAC,GAAG,IAAI,EAAE,CAAgB;oBAAE,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAC3D,CAAC;QACH,CAAC;QACD,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACzB,CAAC;IAEO,MAAM,CAAC,aAAa;QAC1B,OAAO;YACL,iCAAkB;YAClB,8BAAa;YACb,kCAAe;YACf,2CAAmB;YACnB,sCAAiB;YACjB,sCAAiB;YACjB,0CAAmB;YACnB,4BAAY;YACZ,8BAAa;YACb,4BAAY;YACZ,0BAAW;YACX,sCAAiB;YACjB,qCAAgB;YAChB,sCAAiB;SAClB,CAAC;IACJ,CAAC;IAEO,MAAM,CAAC,kBAAkB,CAAC,MAAmB;QACnD,MAAM,GAAG,GAAG,IAAI,GAAG,EAAa,CAAC;QACjC,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,WAAW,IAAI,EAAE,CAAC,EAAE,CAAC;YAC5D,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC;YAC1B,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,UAAU;gBAAE,GAAG,CAAC,GAAG,CAAC,KAAkB,CAAC,CAAC;QACxE,CAAC;QACD,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACzB,CAAC;IAEO,MAAM,CAAC,WAAW;QACxB,OAAO;YACL,wEAAwE;YACxE,qBAAY;YACZ,4BAAmB;YACnB,6BAAoB;YACpB,iCAAkB;YAClB,8BAAa;YACb,kCAAe;YACf,2CAAmB;YACnB,sCAAiB;YACjB,sCAAiB;YACjB,0CAAmB;YACnB,4BAAY;YACZ,8BAAa;YACb,4BAAY;YACZ,0BAAW;YACX,sCAAiB;YACjB,qCAAgB;YAChB,sCAAiB;YACjB,6BAAY;YACZ,2CAAmB;YACnB,6CAAoB;SACrB,CAAC;IACJ,CAAC;CACF,CAAA;AAhMY,kCAAW;sBAAX,WAAW;IAFvB,IAAA,eAAM,GAAE;IACR,IAAA,eAAM,EAAC,EAAE,CAAC;IAGN,WAAA,IAAA,eAAM,EAAC,qBAAY,CAAC,CAAA;IACpB,WAAA,IAAA,eAAM,EAAC,6BAAoB,CAAC,CAAA;;GAHpB,WAAW,CAgMvB;AAED,SAAS,WAAW,CAAC,IAAiB;IACpC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAO,CAAC;IAC5B,MAAM,GAAG,GAAgB,EAAE,CAAC;IAC5B,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;QACrB,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YACjB,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YACZ,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACd,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/services/auth-hooks.service.d.ts

@@ -0,0 +1,27 @@
+import { ModuleRef } from '@nestjs/core';
+import { RhinoConfigService } from '../rhino.config';
+import type { AuthHookContext, AuthLifecycleHooks } from '../interfaces/rhino-config.interface';
+export type AuthHookEvent = 'afterLogin' | 'afterLogout' | 'afterRegister' | 'afterPasswordRecover' | 'afterPasswordReset';
+/**
+ * Resolves a group's optional lifecycle-hooks class/object and runs a single
+ * event (design §7). A hook may reject by throwing — the caller (auth
+ * controller) decides whether to revoke a token. When a group has no `hooks`
+ * config, every event is a silent no-op.
+ *
+ * `ModuleRef` is optional so the service works in lightweight unit tests that
+ * construct it without a Nest container; in that case a `Type` hooks value is
+ * instantiated directly via `new`.
+ */
+export declare class AuthHooksService {
+    private readonly config;
+    private readonly moduleRef?;
+    constructor(config: RhinoConfigService, moduleRef?: ModuleRef);
+    /** Resolve the hooks instance for a group, or `null` when none is configured. */
+    resolve(routeGroup: string | null | undefined): AuthLifecycleHooks | null;
+    /**
+     * Run a single lifecycle event for the resolved group. Returns silently when
+     * the group has no hooks or the specific method is absent. A rejection
+     * propagates to the caller verbatim.
+     */
+    run(event: AuthHookEvent, routeGroup: string | null | undefined, ctx: AuthHookContext): Promise<void>;
+}

package/dist/services/auth-hooks.service.js

@@ -0,0 +1,85 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AuthHooksService = void 0;
+const common_1 = require("@nestjs/common");
+const core_1 = require("@nestjs/core");
+const rhino_config_1 = require("../rhino.config");
+/**
+ * Resolves a group's optional lifecycle-hooks class/object and runs a single
+ * event (design §7). A hook may reject by throwing — the caller (auth
+ * controller) decides whether to revoke a token. When a group has no `hooks`
+ * config, every event is a silent no-op.
+ *
+ * `ModuleRef` is optional so the service works in lightweight unit tests that
+ * construct it without a Nest container; in that case a `Type` hooks value is
+ * instantiated directly via `new`.
+ */
+let AuthHooksService = class AuthHooksService {
+    config;
+    moduleRef;
+    constructor(config, moduleRef) {
+        this.config = config;
+        this.moduleRef = moduleRef;
+    }
+    /** Resolve the hooks instance for a group, or `null` when none is configured. */
+    resolve(routeGroup) {
+        const hooks = this.config.routeGroupHooks(routeGroup);
+        if (!hooks)
+            return null;
+        // Plain object implementing the contract.
+        if (typeof hooks !== 'function')
+            return hooks;
+        // A class/Type: prefer the DI container, fall back to direct construction.
+        const Cls = hooks;
+        if (this.moduleRef) {
+            try {
+                const instance = this.moduleRef.get(Cls, { strict: false });
+                if (instance)
+                    return instance;
+            }
+            catch {
+                /* not registered as a provider — construct directly below */
+            }
+        }
+        try {
+            return new Cls();
+        }
+        catch {
+            return null;
+        }
+    }
+    /**
+     * Run a single lifecycle event for the resolved group. Returns silently when
+     * the group has no hooks or the specific method is absent. A rejection
+     * propagates to the caller verbatim.
+     */
+    async run(event, routeGroup, ctx) {
+        const instance = this.resolve(routeGroup);
+        if (!instance)
+            return;
+        const fn = instance[event];
+        if (typeof fn !== 'function')
+            return;
+        await fn.call(instance, ctx);
+    }
+};
+exports.AuthHooksService = AuthHooksService;
+exports.AuthHooksService = AuthHooksService = __decorate([
+    (0, common_1.Injectable)(),
+    __param(1, (0, common_1.Optional)()),
+    __metadata("design:paramtypes", [rhino_config_1.RhinoConfigService,
+        core_1.ModuleRef])
+], AuthHooksService);
+//# sourceMappingURL=auth-hooks.service.js.map

package/dist/services/auth-hooks.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-hooks.service.js","sourceRoot":"","sources":["../../src/services/auth-hooks.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,2CAAsD;AACtD,uCAAyC;AACzC,kDAAqD;AAarD;;;;;;;;;GASG;AAEI,IAAM,gBAAgB,GAAtB,MAAM,gBAAgB;IAER;IACY;IAF/B,YACmB,MAA0B,EACd,SAAqB;QADjC,WAAM,GAAN,MAAM,CAAoB;QACd,cAAS,GAAT,SAAS,CAAY;IACjD,CAAC;IAEJ,iFAAiF;IACjF,OAAO,CAAC,UAAqC;QAC3C,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC;QACtD,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC;QACxB,0CAA0C;QAC1C,IAAI,OAAO,KAAK,KAAK,UAAU;YAAE,OAAO,KAA2B,CAAC;QACpE,2EAA2E;QAC3E,MAAM,GAAG,GAAG,KAAmD,CAAC;QAChE,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YACnB,IAAI,CAAC;gBACH,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;gBAC5D,IAAI,QAAQ;oBAAE,OAAO,QAAQ,CAAC;YAChC,CAAC;YAAC,MAAM,CAAC;gBACP,6DAA6D;YAC/D,CAAC;QACH,CAAC;QACD,IAAI,CAAC;YACH,OAAO,IAAI,GAAG,EAAE,CAAC;QACnB,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,GAAG,CACP,KAAoB,EACpB,UAAqC,EACrC,GAAoB;QAEpB,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QAC1C,IAAI,CAAC,QAAQ;YAAE,OAAO;QACtB,MAAM,EAAE,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC3B,IAAI,OAAO,EAAE,KAAK,UAAU;YAAE,OAAO;QACrC,MAAM,EAAE,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;IAC/B,CAAC;CACF,CAAA;AA7CY,4CAAgB;2BAAhB,gBAAgB;IAD5B,IAAA,mBAAU,GAAE;IAIR,WAAA,IAAA,iBAAQ,GAAE,CAAA;qCADc,iCAAkB;QACF,gBAAS;GAHzC,gBAAgB,CA6C5B"}

package/dist/services/auth.service.d.ts

@@ -26,8 +26,27 @@ export declare class AuthService {
     verifyToken(token: string): TokenPayload;
     login(email: string, password: string): Promise<LoginResult>;
     logout(_user: any): Promise<void>;
+    /**
+     * Revoke a just-issued token. JWTs are stateless, so "revoking" means
+     * recording the token in a denylist (when the consumer provides a
+     * `RevokedToken` model) so the JwtAuthGuard can reject it on the next
+     * request. Used when a lifecycle hook rejects a login/register: the token is
+     * never returned AND — IF a denylist model exists — can no longer be used
+     * even if it leaked.
+     *
+     * Bounded guarantee: the caller (AuthController) ALWAYS drops the token from
+     * the response on rejection, so an attacker never receives it. Persisting it
+     * to a denylist is the *additional* protection against a leaked token. When
+     * no `RevokedToken` model is configured we log a clear WARNING so operators
+     * know revoke is advisory-only — pair it with short-TTL JWTs (see README /
+     * CLAUDE.md "Group-auth hooks & token revocation").
+     */
+    revokeToken(token: string): Promise<void>;
+    /** Whether a token has been revoked via {@link revokeToken}. */
+    isTokenRevoked(token: string): Promise<boolean>;
     requestPasswordRecovery(email: string): Promise<{
         token: string;
+        user: any;
     } | null>;
     resetPassword(email: string, token: string, newPassword: string): Promise<void>;
 }

package/dist/services/auth.service.js

@@ -90,10 +90,27 @@ let AuthService = AuthService_1 = class AuthService {
     }
     async login(email, password) {
         const auth = this.config.authConfig();
-        const user = await this.userDelegate().findFirst({
-            where: { [auth.emailField]: email },
-            include: { userRoles: { include: { organization: true, role: true } } },
-        }).catch(() => null);
+        // Only eager-load the org membership graph when multi-tenancy is configured.
+        // Single-tenant / org-less apps have no `userRoles` relation on their User
+        // model, so an unconditional include would throw inside Prisma and the
+        // `.catch(() => null)` below would surface as "Invalid credentials" — i.e.
+        // an org-less app could never log a valid user in. Gating the include on
+        // `multiTenantEnabled()` keeps multi-tenant behavior byte-for-byte while
+        // letting org-less apps authenticate. (We still degrade gracefully if the
+        // include fails for any other reason: retry the plain lookup.)
+        const wantsOrg = this.config.multiTenantEnabled();
+        let user = null;
+        if (wantsOrg) {
+            user = await this.userDelegate().findFirst({
+                where: { [auth.emailField]: email },
+                include: { userRoles: { include: { organization: true, role: true } } },
+            }).catch(() => null);
+        }
+        if (!user) {
+            user = await this.userDelegate().findFirst({
+                where: { [auth.emailField]: email },
+            }).catch(() => null);
+        }
         if (!user)
             throw rhino_exception_1.RhinoException.unauthorized('Invalid credentials');
         const hashed = user[auth.passwordField];
@@ -107,6 +124,64 @@ let AuthService = AuthService_1 = class AuthService {
     async logout(_user) {
         // JWT stateless; consumer can add blacklist logic via hooks.
     }
+    /**
+     * Revoke a just-issued token. JWTs are stateless, so "revoking" means
+     * recording the token in a denylist (when the consumer provides a
+     * `RevokedToken` model) so the JwtAuthGuard can reject it on the next
+     * request. Used when a lifecycle hook rejects a login/register: the token is
+     * never returned AND — IF a denylist model exists — can no longer be used
+     * even if it leaked.
+     *
+     * Bounded guarantee: the caller (AuthController) ALWAYS drops the token from
+     * the response on rejection, so an attacker never receives it. Persisting it
+     * to a denylist is the *additional* protection against a leaked token. When
+     * no `RevokedToken` model is configured we log a clear WARNING so operators
+     * know revoke is advisory-only — pair it with short-TTL JWTs (see README /
+     * CLAUDE.md "Group-auth hooks & token revocation").
+     */
+    async revokeToken(token) {
+        if (!token)
+            return;
+        let delegate;
+        try {
+            delegate = this.prisma.model('revokedToken');
+        }
+        catch {
+            this.logger.warn('AuthService.revokeToken: no `RevokedToken` model is configured, so token ' +
+                'revocation is advisory only — the token is dropped from the response but ' +
+                'cannot be denylisted if it has already leaked. Add a `RevokedToken` model ' +
+                '(token, createdAt) to your Prisma schema and use short-TTL JWTs.');
+            return;
+        }
+        try {
+            await delegate.create({ data: { token, createdAt: new Date() } });
+        }
+        catch (err) {
+            // The model exists but the write failed — surface it so a misconfigured
+            // denylist is not silently a no-op.
+            this.logger.warn(`AuthService.revokeToken: failed to persist revoked token (${err.message}).`);
+        }
+    }
+    /** Whether a token has been revoked via {@link revokeToken}. */
+    async isTokenRevoked(token) {
+        if (!token)
+            return false;
+        let delegate;
+        try {
+            delegate = this.prisma.model('revokedToken');
+        }
+        catch {
+            // No denylist model — nothing can be revoked, so nothing is revoked.
+            return false;
+        }
+        try {
+            const row = await delegate.findFirst({ where: { token } });
+            return Boolean(row);
+        }
+        catch {
+            return false;
+        }
+    }
     async requestPasswordRecovery(email) {
         const user = await this.userDelegate().findFirst({ where: { email } }).catch(() => null);
         if (!user)
@@ -123,7 +198,7 @@ let AuthService = AuthService_1 = class AuthService {
             this.logger.warn(`AuthService: could not persist password reset token (${err.message}). ` +
                 'Add a `PasswordResetToken` model to your Prisma schema to enable this feature.');
         }
-        return { token };
+        return { token, user };
     }
     async resetPassword(email, token, newPassword) {
         let reset = null;

package/dist/services/auth.service.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth.service.js","sourceRoot":"","sources":["../../src/services/auth.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,2CAIwB;AACxB,+DAA2D;AAC3D,iDAAmC;AACnC,kDAAoC;AACpC,mCAAqC;AACrC,6DAAyD;AACzD,kDAAqD;AAcrD;;;GAGG;AAEI,IAAM,WAAW,mBAAjB,MAAM,WAAW;IAIH;IACA;IAJF,MAAM,GAAG,IAAI,eAAM,CAAC,aAAW,CAAC,IAAI,CAAC,CAAC;IAEvD,YACmB,MAAqB,EACrB,MAA0B;QAD1B,WAAM,GAAN,MAAM,CAAe;QACrB,WAAM,GAAN,MAAM,CAAoB;IAC1C,CAAC;IAEI,YAAY;QAClB,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC,SAAS,CAAC;QACrD,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IACtC,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,KAAa;QAC9B,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAChC,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,KAAa,EAAE,MAAc;QAC/C,IAAI,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC;QAC1B,OAAO,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IACvC,CAAC;IAED,SAAS,CAAC,OAAqB;QAC7B,MAAM,EAAE,SAAS,EAAE,YAAY,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;QAC7D,OAAO,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,EAAE,EAAE,SAAS,EAAE,YAAY,EAAS,CAAC,CAAC;IAC1E,CAAC;IAED,WAAW,CAAC,KAAa;QACvB,MAAM,EAAE,SAAS,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;QAC/C,IAAI,CAAC;YACH,OAAO,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,SAAS,CAAiB,CAAC;QACtD,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,gCAAc,CAAC,YAAY,CAAC,0BAA0B,CAAC,CAAC;QAChE,CAAC;IACH,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,KAAa,EAAE,QAAgB;QACzC,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC,SAAS,CAAC;YAC/C,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE;YACnC,OAAO,EAAE,EAAE,SAAS,EAAE,EAAE,OAAO,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE;SACxE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QAErB,IAAI,CAAC,IAAI;YAAE,MAAM,gCAAc,CAAC,YAAY,CAAC,qBAAqB,CAAC,CAAC;QACpE,MAAM,MAAM,GAAI,IAAY,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QACjD,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QACtD,IAAI,CAAC,EAAE;YAAE,MAAM,gCAAc,CAAC,YAAY,CAAC,qBAAqB,CAAC,CAAC;QAElE,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAG,IAAY,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;QAC/D,MAAM,gBAAgB,GAAI,IAAY,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC;QAC1E,OAAO,EAAE,KAAK,EAAE,gBAAgB,EAAE,IAAI,EAAE,CAAC;IAC3C,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,KAAU;QACrB,6DAA6D;IAC/D,CAAC;IAED,KAAK,CAAC,uBAAuB,CAAC,KAAa;QACzC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QACzF,IAAI,CAAC,IAAI;YAAE,OAAO,IAAI,CAAC;QACvB,MAAM,KAAK,GAAG,IAAA,oBAAW,EAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC9C,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC,MAAM,CAAC;gBACnD,KAAK,EAAE,EAAE,KAAK,EAAE;gBAChB,MAAM,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE;gBACxC,MAAM,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE;aAChD,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,wDAAyD,GAAa,CAAC,OAAO,KAAK;gBACjF,gFAAgF,CACnF,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,CAAC;IACnB,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,KAAa,EAAE,KAAa,EAAE,WAAmB;QACnE,IAAI,KAAK,GAAQ,IAAI,CAAC;QACtB,IAAI,CAAC;YACH,KAAK,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC,SAAS,CAAC;gBAC9D,KAAK,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE;aACxB,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,4BAAmB,CAAC,8BAA8B,CAAC,CAAC;QAChE,CAAC;QACD,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,4BAAmB,CAAC,eAAe,CAAC,CAAC;QAC3D,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC;QACpD,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC,MAAM,CAAC;YAC/B,KAAK,EAAE,EAAE,KAAK,EAAE;YAChB,IAAI,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE;SAC3B,CAAC,CAAC;QACH,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;QAC7E,CAAC;QAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;IAC1B,CAAC;CACF,CAAA;AA/FY,kCAAW;sBAAX,WAAW;IADvB,IAAA,mBAAU,GAAE;qCAKgB,8BAAa;QACb,iCAAkB;GALlC,WAAW,CA+FvB"}
+{"version":3,"file":"auth.service.js","sourceRoot":"","sources":["../../src/services/auth.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,2CAIwB;AACxB,+DAA2D;AAC3D,iDAAmC;AACnC,kDAAoC;AACpC,mCAAqC;AACrC,6DAAyD;AACzD,kDAAqD;AAcrD;;;GAGG;AAEI,IAAM,WAAW,mBAAjB,MAAM,WAAW;IAIH;IACA;IAJF,MAAM,GAAG,IAAI,eAAM,CAAC,aAAW,CAAC,IAAI,CAAC,CAAC;IAEvD,YACmB,MAAqB,EACrB,MAA0B;QAD1B,WAAM,GAAN,MAAM,CAAe;QACrB,WAAM,GAAN,MAAM,CAAoB;IAC1C,CAAC;IAEI,YAAY;QAClB,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC,SAAS,CAAC;QACrD,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IACtC,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,KAAa;QAC9B,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAChC,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,KAAa,EAAE,MAAc;QAC/C,IAAI,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC;QAC1B,OAAO,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IACvC,CAAC;IAED,SAAS,CAAC,OAAqB;QAC7B,MAAM,EAAE,SAAS,EAAE,YAAY,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;QAC7D,OAAO,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,EAAE,EAAE,SAAS,EAAE,YAAY,EAAS,CAAC,CAAC;IAC1E,CAAC;IAED,WAAW,CAAC,KAAa;QACvB,MAAM,EAAE,SAAS,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;QAC/C,IAAI,CAAC;YACH,OAAO,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,SAAS,CAAiB,CAAC;QACtD,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,gCAAc,CAAC,YAAY,CAAC,0BAA0B,CAAC,CAAC;QAChE,CAAC;IACH,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,KAAa,EAAE,QAAgB;QACzC,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;QACtC,6EAA6E;QAC7E,2EAA2E;QAC3E,uEAAuE;QACvE,2EAA2E;QAC3E,yEAAyE;QACzE,yEAAyE;QACzE,0EAA0E;QAC1E,+DAA+D;QAC/D,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,kBAAkB,EAAE,CAAC;QAClD,IAAI,IAAI,GAAQ,IAAI,CAAC;QACrB,IAAI,QAAQ,EAAE,CAAC;YACb,IAAI,GAAG,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC,SAAS,CAAC;gBACzC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE;gBACnC,OAAO,EAAE,EAAE,SAAS,EAAE,EAAE,OAAO,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE;aACxE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QACvB,CAAC;QACD,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,IAAI,GAAG,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC,SAAS,CAAC;gBACzC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE;aACpC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QACvB,CAAC;QAED,IAAI,CAAC,IAAI;YAAE,MAAM,gCAAc,CAAC,YAAY,CAAC,qBAAqB,CAAC,CAAC;QACpE,MAAM,MAAM,GAAI,IAAY,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QACjD,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QACtD,IAAI,CAAC,EAAE;YAAE,MAAM,gCAAc,CAAC,YAAY,CAAC,qBAAqB,CAAC,CAAC;QAElE,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAG,IAAY,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;QAC/D,MAAM,gBAAgB,GAAI,IAAY,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC;QAC1E,OAAO,EAAE,KAAK,EAAE,gBAAgB,EAAE,IAAI,EAAE,CAAC;IAC3C,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,KAAU;QACrB,6DAA6D;IAC/D,CAAC;IAED;;;;;;;;;;;;;;OAcG;IACH,KAAK,CAAC,WAAW,CAAC,KAAa;QAC7B,IAAI,CAAC,KAAK;YAAE,OAAO;QACnB,IAAI,QAAa,CAAC;QAClB,IAAI,CAAC;YACH,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;QAC/C,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,2EAA2E;gBACzE,2EAA2E;gBAC3E,4EAA4E;gBAC5E,kEAAkE,CACrE,CAAC;YACF,OAAO;QACT,CAAC;QACD,IAAI,CAAC;YACH,MAAM,QAAQ,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;QACpE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,wEAAwE;YACxE,oCAAoC;YACpC,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,6DAA8D,GAAa,CAAC,OAAO,IAAI,CACxF,CAAC;QACJ,CAAC;IACH,CAAC;IAED,gEAAgE;IAChE,KAAK,CAAC,cAAc,CAAC,KAAa;QAChC,IAAI,CAAC,KAAK;YAAE,OAAO,KAAK,CAAC;QACzB,IAAI,QAAa,CAAC;QAClB,IAAI,CAAC;YACH,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;QAC/C,CAAC;QAAC,MAAM,CAAC;YACP,qEAAqE;YACrE,OAAO,KAAK,CAAC;QACf,CAAC;QACD,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;YAC3D,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC;QACtB,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED,KAAK,CAAC,uBAAuB,CAAC,KAAa;QACzC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QACzF,IAAI,CAAC,IAAI;YAAE,OAAO,IAAI,CAAC;QACvB,MAAM,KAAK,GAAG,IAAA,oBAAW,EAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC9C,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC,MAAM,CAAC;gBACnD,KAAK,EAAE,EAAE,KAAK,EAAE;gBAChB,MAAM,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE;gBACxC,MAAM,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE;aAChD,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,wDAAyD,GAAa,CAAC,OAAO,KAAK;gBACjF,gFAAgF,CACnF,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IACzB,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,KAAa,EAAE,KAAa,EAAE,WAAmB;QACnE,IAAI,KAAK,GAAQ,IAAI,CAAC;QACtB,IAAI,CAAC;YACH,KAAK,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC,SAAS,CAAC;gBAC9D,KAAK,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE;aACxB,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,4BAAmB,CAAC,8BAA8B,CAAC,CAAC;QAChE,CAAC;QACD,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,4BAAmB,CAAC,eAAe,CAAC,CAAC;QAC3D,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC;QACpD,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC,MAAM,CAAC;YAC/B,KAAK,EAAE,EAAE,KAAK,EAAE;YAChB,IAAI,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE;SAC3B,CAAC,CAAC;QACH,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;QAC7E,CAAC;QAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;IAC1B,CAAC;CACF,CAAA;AA1KY,kCAAW;sBAAX,WAAW;IADvB,IAAA,mBAAU,GAAE;qCAKgB,8BAAa;QACb,iCAAkB;GALlC,WAAW,CA0KvB"}

package/dist/services/invitation.service.d.ts

@@ -5,6 +5,8 @@ export interface CreateInvitationInput {
     roleId: number;
     organization: any;
     invitedBy: any;
+    /** The group the invitee will join (design §8). NULL = wildcard membership. */
+    routeGroup?: string | null;
 }
 /**
  * Invitation lifecycle: create/resend/cancel/accept with token-based acceptance.
@@ -16,6 +18,8 @@ export declare class InvitationService {
     constructor(prisma: PrismaService, config: RhinoConfigService);
     private delegate;
     private generateToken;
+    /** Whether the inviter holds a membership row for `routeGroup` (wildcard ok). */
+    private inviterIsMember;
     private expiresAt;
     list(organizationId: number, status?: string): Promise<any>;
     create(input: CreateInvitationInput): Promise<any>;
@@ -26,10 +30,12 @@ export declare class InvitationService {
         organization: any;
         role: any;
         email: any;
+        routeGroup: any;
         accepted?: undefined;
     } | {
         accepted: boolean;
         organization: any;
+        routeGroup: any;
         requiresRegistration?: undefined;
         role?: undefined;
         email?: undefined;

package/dist/services/invitation.service.js

@@ -14,6 +14,7 @@ const common_1 = require("@nestjs/common");
 const crypto_1 = require("crypto");
 const prisma_service_1 = require("../prisma/prisma.service");
 const rhino_config_1 = require("../rhino.config");
+const rhino_exception_1 = require("../errors/rhino-exception");
 /**
  * Invitation lifecycle: create/resend/cancel/accept with token-based acceptance.
  * Mirrors Laravel's InvitationController + OrganizationInvitation model.
@@ -31,6 +32,21 @@ let InvitationService = class InvitationService {
     generateToken() {
         return (0, crypto_1.randomBytes)(32).toString('hex'); // 64 hex chars
     }
+    /** Whether the inviter holds a membership row for `routeGroup` (wildcard ok). */
+    inviterIsMember(inviter, routeGroup, org) {
+        const rows = inviter?.userRoles ?? inviter?.user_roles ?? [];
+        const orgId = org?.id ?? null;
+        for (const ur of rows) {
+            const rg = ur.routeGroup ?? ur.route_group ?? null;
+            if (rg !== null && String(rg) !== routeGroup)
+                continue;
+            const rowOrg = ur.organizationId ?? ur.organization_id ?? null;
+            if (orgId != null && rowOrg != null && rowOrg !== orgId)
+                continue;
+            return true;
+        }
+        return false;
+    }
     expiresAt() {
         const days = this.config.invitationsConfig().expiresDays;
         const d = new Date();
@@ -51,12 +67,35 @@ let InvitationService = class InvitationService {
                 throw new common_1.BadRequestException('Role not allowed for invitations');
             }
         }
+        const routeGroup = input.routeGroup ?? null;
+        // The `public` group has no auth, so it cannot be invited into (design §8).
+        if (routeGroup === 'public') {
+            throw new common_1.BadRequestException('Cannot invite into the public group');
+        }
+        // When enforcement is on, the inviter must themselves be a member of the
+        // group they are inviting into (design §8). NULL (wildcard) skips this — a
+        // wildcard inviter can invite into any group.
+        if (this.config.enforceGroupMembership() && routeGroup != null) {
+            if (!this.inviterIsMember(input.invitedBy, routeGroup, input.organization)) {
+                // Coarse membership denial → 403 for parity with Laravel/Rails
+                // (Decision 9.C), matching the controller's gate.
+                throw rhino_exception_1.RhinoException.membershipDenied('You are not a member of that group');
+            }
+        }
+        // Tenant groups carry an org; non-tenant groups store a NULL org. Default
+        // to using the org (legacy behavior) — only drop it when enforcement is on
+        // AND the group is positively non-tenant, keeping flag-off paths unchanged.
+        const dropOrg = this.config.enforceGroupMembership() &&
+            routeGroup != null &&
+            !this.config.isTenantGroup(routeGroup);
+        const organizationId = dropOrg ? null : input.organization?.id ?? null;
         const token = this.generateToken();
         const invitation = await this.delegate().create({
             data: {
-                organizationId: input.organization.id,
+                organizationId,
                 email: input.email,
                 roleId: input.roleId,
+                routeGroup,
                 token,
                 status: 'pending',
                 invitedById: input.invitedBy.id,
@@ -110,6 +149,7 @@ let InvitationService = class InvitationService {
             await this.delegate().update({ where: { id: inv.id }, data: { status: 'expired' } });
             throw new common_1.BadRequestException('Invitation expired');
         }
+        const routeGroup = inv.routeGroup ?? inv.route_group ?? null;
         if (!userId) {
             // User is unauthenticated — return org/role so client can register
             return {
@@ -117,13 +157,15 @@ let InvitationService = class InvitationService {
                 organization: inv.organization,
                 role: inv.role,
                 email: inv.email,
+                routeGroup,
             };
         }
         await this.prisma.model('userRole').create({
             data: {
                 userId,
-                organizationId: inv.organizationId,
+                organizationId: inv.organizationId ?? null,
                 roleId: inv.roleId,
+                routeGroup,
                 permissions: [],
             },
         });
@@ -131,7 +173,7 @@ let InvitationService = class InvitationService {
             where: { id: inv.id },
             data: { status: 'accepted', acceptedAt: new Date() },
         });
-        return { accepted: true, organization: inv.organization };
+        return { accepted: true, organization: inv.organization, routeGroup };
     }
 };
 exports.InvitationService = InvitationService;

package/dist/services/invitation.service.js.map

@@ -1 +1 @@
-{"version":3,"file":"invitation.service.js","sourceRoot":"","sources":["../../src/services/invitation.service.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,2CAIwB;AACxB,mCAAqC;AACrC,6DAAyD;AACzD,kDAAqD;AASrD;;;GAGG;AAEI,IAAM,iBAAiB,GAAvB,MAAM,iBAAiB;IAET;IACA;IAFnB,YACmB,MAAqB,EACrB,MAA0B;QAD1B,WAAM,GAAN,MAAM,CAAe;QACrB,WAAM,GAAN,MAAM,CAAoB;IAC1C,CAAC;IAEI,QAAQ;QACd,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,wBAAwB,CAAC,CAAC;IACrD,CAAC;IAEO,aAAa;QACnB,OAAO,IAAA,oBAAW,EAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,eAAe;IACzD,CAAC;IAEO,SAAS;QACf,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,iBAAiB,EAAE,CAAC,WAAW,CAAC;QACzD,MAAM,CAAC,GAAG,IAAI,IAAI,EAAE,CAAC;QACrB,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,CAAC;QAC9B,OAAO,CAAC,CAAC;IACX,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,cAAsB,EAAE,MAAe;QAChD,MAAM,KAAK,GAAQ,EAAE,cAAc,EAAE,CAAC;QACtC,IAAI,MAAM,IAAI,MAAM,KAAK,KAAK;YAAE,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC;QACtD,OAAO,IAAI,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;IAC7E,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,KAA4B;QACvC,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,iBAAiB,EAAE,CAAC;QAC5C,IAAI,GAAG,CAAC,YAAY,EAAE,CAAC;YACrB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;YACzF,IAAI,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,QAAQ,CAAE,IAAY,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC5D,MAAM,IAAI,4BAAmB,CAAC,kCAAkC,CAAC,CAAC;YACpE,CAAC;QACH,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,CAAC,aAAa,EAAE,CAAC;QACnC,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC,MAAM,CAAC;YAC9C,IAAI,EAAE;gBACJ,cAAc,EAAE,KAAK,CAAC,YAAY,CAAC,EAAE;gBACrC,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,KAAK;gBACL,MAAM,EAAE,SAAS;gBACjB,WAAW,EAAE,KAAK,CAAC,SAAS,CAAC,EAAE;gBAC/B,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE;aAC5B;SACF,CAAC,CAAC;QACH,IAAI,GAAG,CAAC,mBAAmB,EAAE,CAAC;YAC5B,MAAM,GAAG,CAAC,mBAAmB,CAAC,UAAU,CAAC,CAAC;QAC5C,CAAC;QACD,OAAO,UAAU,CAAC;IACpB,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,EAAU;QACrB,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;QACvE,IAAI,CAAC,UAAU;YAAE,MAAM,IAAI,0BAAiB,CAAC,sBAAsB,CAAC,CAAC;QACrE,IAAK,UAAkB,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAC7C,MAAM,IAAI,4BAAmB,CAAC,wCAAwC,CAAC,CAAC;QAC1E,CAAC;QACD,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC,MAAM,CAAC;YAC7C,KAAK,EAAE,EAAE,EAAE,EAAE;YACb,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,aAAa,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,EAAE;SACnE,CAAC,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,iBAAiB,EAAE,CAAC;QAC5C,IAAI,GAAG,CAAC,mBAAmB;YAAE,MAAM,GAAG,CAAC,mBAAmB,CAAC,SAAS,CAAC,CAAC;QACtE,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,EAAU;QACrB,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;QACvE,IAAI,CAAC,UAAU;YAAE,MAAM,IAAI,0BAAiB,CAAC,sBAAsB,CAAC,CAAC;QACrE,IAAK,UAAkB,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAC7C,MAAM,IAAI,4BAAmB,CAAC,2CAA2C,CAAC,CAAC;QAC7E,CAAC;QACD,OAAO,IAAI,CAAC,QAAQ,EAAE,CAAC,MAAM,CAAC;YAC5B,KAAK,EAAE,EAAE,EAAE,EAAE;YACb,IAAI,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE;SAC9B,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,KAAa,EAAE,MAAe;QACzC,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC,UAAU,CAAC;YAClD,KAAK,EAAE,EAAE,KAAK,EAAE;YAChB,OAAO,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE;SAC5C,CAAC,CAAC;QACH,IAAI,CAAC,UAAU;YAAE,MAAM,IAAI,0BAAiB,CAAC,sBAAsB,CAAC,CAAC;QACrE,MAAM,GAAG,GAAQ,UAAU,CAAC;QAC5B,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS;YAAE,MAAM,IAAI,4BAAmB,CAAC,4BAA4B,CAAC,CAAC;QAC1F,IAAI,GAAG,CAAC,SAAS,GAAG,IAAI,IAAI,EAAE,EAAE,CAAC;YAC/B,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC;YACrF,MAAM,IAAI,4BAAmB,CAAC,oBAAoB,CAAC,CAAC;QACtD,CAAC;QAED,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,mEAAmE;YACnE,OAAO;gBACL,oBAAoB,EAAE,IAAI;gBAC1B,YAAY,EAAE,GAAG,CAAC,YAAY;gBAC9B,IAAI,EAAE,GAAG,CAAC,IAAI;gBACd,KAAK,EAAE,GAAG,CAAC,KAAK;aACjB,CAAC;QACJ,CAAC;QAED,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC;YACzC,IAAI,EAAE;gBACJ,MAAM;gBACN,cAAc,EAAE,GAAG,CAAC,cAAc;gBAClC,MAAM,EAAE,GAAG,CAAC,MAAM;gBAClB,WAAW,EAAE,EAAE;aAChB;SACF,CAAC,CAAC;QACH,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC,MAAM,CAAC;YAC3B,KAAK,EAAE,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE;YACrB,IAAI,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,UAAU,EAAE,IAAI,IAAI,EAAE,EAAE;SACrD,CAAC,CAAC;QACH,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,CAAC,YAAY,EAAE,CAAC;IAC5D,CAAC;CACF,CAAA;AArHY,8CAAiB;4BAAjB,iBAAiB;IAD7B,IAAA,mBAAU,GAAE;qCAGgB,8BAAa;QACb,iCAAkB;GAHlC,iBAAiB,CAqH7B"}
+{"version":3,"file":"invitation.service.js","sourceRoot":"","sources":["../../src/services/invitation.service.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,2CAIwB;AACxB,mCAAqC;AACrC,6DAAyD;AACzD,kDAAqD;AACrD,+DAA2D;AAW3D;;;GAGG;AAEI,IAAM,iBAAiB,GAAvB,MAAM,iBAAiB;IAET;IACA;IAFnB,YACmB,MAAqB,EACrB,MAA0B;QAD1B,WAAM,GAAN,MAAM,CAAe;QACrB,WAAM,GAAN,MAAM,CAAoB;IAC1C,CAAC;IAEI,QAAQ;QACd,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,wBAAwB,CAAC,CAAC;IACrD,CAAC;IAEO,aAAa;QACnB,OAAO,IAAA,oBAAW,EAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,eAAe;IACzD,CAAC;IAED,iFAAiF;IACzE,eAAe,CAAC,OAAY,EAAE,UAAkB,EAAE,GAAQ;QAChE,MAAM,IAAI,GAAG,OAAO,EAAE,SAAS,IAAI,OAAO,EAAE,UAAU,IAAI,EAAE,CAAC;QAC7D,MAAM,KAAK,GAAG,GAAG,EAAE,EAAE,IAAI,IAAI,CAAC;QAC9B,KAAK,MAAM,EAAE,IAAI,IAAI,EAAE,CAAC;YACtB,MAAM,EAAE,GAAG,EAAE,CAAC,UAAU,IAAI,EAAE,CAAC,WAAW,IAAI,IAAI,CAAC;YACnD,IAAI,EAAE,KAAK,IAAI,IAAI,MAAM,CAAC,EAAE,CAAC,KAAK,UAAU;gBAAE,SAAS;YACvD,MAAM,MAAM,GAAG,EAAE,CAAC,cAAc,IAAI,EAAE,CAAC,eAAe,IAAI,IAAI,CAAC;YAC/D,IAAI,KAAK,IAAI,IAAI,IAAI,MAAM,IAAI,IAAI,IAAI,MAAM,KAAK,KAAK;gBAAE,SAAS;YAClE,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAEO,SAAS;QACf,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,iBAAiB,EAAE,CAAC,WAAW,CAAC;QACzD,MAAM,CAAC,GAAG,IAAI,IAAI,EAAE,CAAC;QACrB,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,CAAC;QAC9B,OAAO,CAAC,CAAC;IACX,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,cAAsB,EAAE,MAAe;QAChD,MAAM,KAAK,GAAQ,EAAE,cAAc,EAAE,CAAC;QACtC,IAAI,MAAM,IAAI,MAAM,KAAK,KAAK;YAAE,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC;QACtD,OAAO,IAAI,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;IAC7E,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,KAA4B;QACvC,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,iBAAiB,EAAE,CAAC;QAC5C,IAAI,GAAG,CAAC,YAAY,EAAE,CAAC;YACrB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;YACzF,IAAI,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,QAAQ,CAAE,IAAY,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC5D,MAAM,IAAI,4BAAmB,CAAC,kCAAkC,CAAC,CAAC;YACpE,CAAC;QACH,CAAC;QACD,MAAM,UAAU,GAAG,KAAK,CAAC,UAAU,IAAI,IAAI,CAAC;QAC5C,4EAA4E;QAC5E,IAAI,UAAU,KAAK,QAAQ,EAAE,CAAC;YAC5B,MAAM,IAAI,4BAAmB,CAAC,qCAAqC,CAAC,CAAC;QACvE,CAAC;QACD,yEAAyE;QACzE,2EAA2E;QAC3E,8CAA8C;QAC9C,IAAI,IAAI,CAAC,MAAM,CAAC,sBAAsB,EAAE,IAAI,UAAU,IAAI,IAAI,EAAE,CAAC;YAC/D,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,SAAS,EAAE,UAAU,EAAE,KAAK,CAAC,YAAY,CAAC,EAAE,CAAC;gBAC3E,+DAA+D;gBAC/D,kDAAkD;gBAClD,MAAM,gCAAc,CAAC,gBAAgB,CAAC,oCAAoC,CAAC,CAAC;YAC9E,CAAC;QACH,CAAC;QACD,0EAA0E;QAC1E,2EAA2E;QAC3E,4EAA4E;QAC5E,MAAM,OAAO,GACX,IAAI,CAAC,MAAM,CAAC,sBAAsB,EAAE;YACpC,UAAU,IAAI,IAAI;YAClB,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,UAAU,CAAC,CAAC;QACzC,MAAM,cAAc,GAAG,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,YAAY,EAAE,EAAE,IAAI,IAAI,CAAC;QACvE,MAAM,KAAK,GAAG,IAAI,CAAC,aAAa,EAAE,CAAC;QACnC,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC,MAAM,CAAC;YAC9C,IAAI,EAAE;gBACJ,cAAc;gBACd,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,UAAU;gBACV,KAAK;gBACL,MAAM,EAAE,SAAS;gBACjB,WAAW,EAAE,KAAK,CAAC,SAAS,CAAC,EAAE;gBAC/B,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE;aAC5B;SACF,CAAC,CAAC;QACH,IAAI,GAAG,CAAC,mBAAmB,EAAE,CAAC;YAC5B,MAAM,GAAG,CAAC,mBAAmB,CAAC,UAAU,CAAC,CAAC;QAC5C,CAAC;QACD,OAAO,UAAU,CAAC;IACpB,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,EAAU;QACrB,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;QACvE,IAAI,CAAC,UAAU;YAAE,MAAM,IAAI,0BAAiB,CAAC,sBAAsB,CAAC,CAAC;QACrE,IAAK,UAAkB,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAC7C,MAAM,IAAI,4BAAmB,CAAC,wCAAwC,CAAC,CAAC;QAC1E,CAAC;QACD,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC,MAAM,CAAC;YAC7C,KAAK,EAAE,EAAE,EAAE,EAAE;YACb,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,aAAa,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,EAAE;SACnE,CAAC,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,iBAAiB,EAAE,CAAC;QAC5C,IAAI,GAAG,CAAC,mBAAmB;YAAE,MAAM,GAAG,CAAC,mBAAmB,CAAC,SAAS,CAAC,CAAC;QACtE,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,EAAU;QACrB,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;QACvE,IAAI,CAAC,UAAU;YAAE,MAAM,IAAI,0BAAiB,CAAC,sBAAsB,CAAC,CAAC;QACrE,IAAK,UAAkB,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAC7C,MAAM,IAAI,4BAAmB,CAAC,2CAA2C,CAAC,CAAC;QAC7E,CAAC;QACD,OAAO,IAAI,CAAC,QAAQ,EAAE,CAAC,MAAM,CAAC;YAC5B,KAAK,EAAE,EAAE,EAAE,EAAE;YACb,IAAI,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE;SAC9B,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,KAAa,EAAE,MAAe;QACzC,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC,UAAU,CAAC;YAClD,KAAK,EAAE,EAAE,KAAK,EAAE;YAChB,OAAO,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE;SAC5C,CAAC,CAAC;QACH,IAAI,CAAC,UAAU;YAAE,MAAM,IAAI,0BAAiB,CAAC,sBAAsB,CAAC,CAAC;QACrE,MAAM,GAAG,GAAQ,UAAU,CAAC;QAC5B,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS;YAAE,MAAM,IAAI,4BAAmB,CAAC,4BAA4B,CAAC,CAAC;QAC1F,IAAI,GAAG,CAAC,SAAS,GAAG,IAAI,IAAI,EAAE,EAAE,CAAC;YAC/B,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC;YACrF,MAAM,IAAI,4BAAmB,CAAC,oBAAoB,CAAC,CAAC;QACtD,CAAC;QAED,MAAM,UAAU,GAAG,GAAG,CAAC,UAAU,IAAI,GAAG,CAAC,WAAW,IAAI,IAAI,CAAC;QAE7D,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,mEAAmE;YACnE,OAAO;gBACL,oBAAoB,EAAE,IAAI;gBAC1B,YAAY,EAAE,GAAG,CAAC,YAAY;gBAC9B,IAAI,EAAE,GAAG,CAAC,IAAI;gBACd,KAAK,EAAE,GAAG,CAAC,KAAK;gBAChB,UAAU;aACX,CAAC;QACJ,CAAC;QAED,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC;YACzC,IAAI,EAAE;gBACJ,MAAM;gBACN,cAAc,EAAE,GAAG,CAAC,cAAc,IAAI,IAAI;gBAC1C,MAAM,EAAE,GAAG,CAAC,MAAM;gBAClB,UAAU;gBACV,WAAW,EAAE,EAAE;aAChB;SACF,CAAC,CAAC;QACH,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC,MAAM,CAAC;YAC3B,KAAK,EAAE,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE;YACrB,IAAI,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,UAAU,EAAE,IAAI,IAAI,EAAE,EAAE;SACrD,CAAC,CAAC;QACH,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,CAAC,YAAY,EAAE,UAAU,EAAE,CAAC;IACxE,CAAC;CACF,CAAA;AA/JY,8CAAiB;4BAAjB,iBAAiB;IAD7B,IAAA,mBAAU,GAAE;qCAGgB,8BAAa;QACb,iCAAkB;GAHlC,iBAAiB,CA+J7B"}

package/dist/services/membership.service.d.ts

@@ -0,0 +1,56 @@
+import { RhinoConfigService } from '../rhino.config';
+/**
+ * A single `user_roles` membership row, normalized across snake_case /
+ * camelCase shapes (Prisma vs raw SQL). `routeGroup === null` is a WILDCARD
+ * (Decision 9.B) — the row is a member of every group.
+ */
+export interface MembershipRow {
+    routeGroup: string | null;
+    organizationId: number | string | null;
+    permissions: unknown;
+    role?: any;
+}
+/**
+ * Membership enforcement & permission resolution (design §6).
+ *
+ * Gated entirely by `auth.enforceGroupMembership`:
+ *  - OFF (default): {@link enabled} is `false`; callers skip every check and
+ *    fall back to the legacy org-presence heuristic. Behavior is unchanged.
+ *  - ON: a user must hold a `user_roles` row whose `route_group` matches the
+ *    request's group (a NULL row is a wildcard) and — for tenant groups — whose
+ *    organization matches the resolved org. Permissions then resolve from that
+ *    matched row only.
+ *
+ * Membership is a COARSE gate (may you enter the group); the ResourcePolicy
+ * remains the FINE check. They run in sequence and are never merged.
+ */
+export declare class MembershipService {
+    private readonly config;
+    constructor(config: RhinoConfigService);
+    /** Whether membership enforcement is active at all. */
+    enabled(): boolean;
+    private userRoles;
+    /**
+     * Find the membership rows that admit `user` into `routeGroup` for the given
+     * organization. A row matches when:
+     *   - its `route_group` is NULL (wildcard) OR equals `routeGroup`, AND
+     *   - for tenant groups, its organization equals the resolved org's id
+     *     (NULL-org wildcard rows still match); for non-tenant groups the org is
+     *     ignored entirely.
+     */
+    matchingRows(user: any, routeGroup: string | null | undefined, organization: {
+        id: number | string;
+    } | null | undefined, isTenant: boolean): MembershipRow[];
+    /**
+     * Whether `user` is a member of `routeGroup` (for the resolved org, when the
+     * group is a tenant group). Only meaningful when {@link enabled}.
+     */
+    isMember(user: any, routeGroup: string | null | undefined, organization: {
+        id: number | string;
+    } | null | undefined, isTenant: boolean): boolean;
+    /**
+     * Permissions granted to the user from the matched membership rows only
+     * (design §6: "permissions then resolve from that matching membership row").
+     */
+    permissionsFromRows(rows: MembershipRow[]): string[];
+}