@rhino-dev/rhino-nestjs 4.0.0 → 4.2.1

package/dist/interfaces/rhino-config.interface.d.ts

@@ -36,13 +36,74 @@ export interface ModelRegistration {
         model: string;
     }>;
 }
+/**
+ * Context handed to every lifecycle hook. `routeGroup` is the resolved group
+ * name (or `null`/`undefined` for the legacy/global auth path), `organization`
+ * is present only for tenant groups, `token` is the just-issued JWT for
+ * token-issuing actions (login/register), and `request` is the raw request.
+ */
+export interface AuthHookContext {
+    user: any;
+    routeGroup?: string | null;
+    organization?: any;
+    token?: string;
+    request?: any;
+}
+/**
+ * Per-group lifecycle hooks. Each method runs AFTER the corresponding auth
+ * action succeeds. A method may reject by throwing `RhinoAuthRejected` (or any
+ * error) — for token-issuing actions the controller revokes the issued token
+ * and returns the rejection's status (default 403). All methods are optional;
+ * an absent method is a no-op. Implementations are registered per group via
+ * `RouteGroupConfig.hooks` and resolved from the Nest DI container.
+ */
+export interface AuthLifecycleHooks {
+    afterLogin?(ctx: AuthHookContext): void | Promise<void>;
+    afterLogout?(ctx: AuthHookContext): void | Promise<void>;
+    afterRegister?(ctx: AuthHookContext): void | Promise<void>;
+    afterPasswordRecover?(ctx: AuthHookContext): void | Promise<void>;
+    afterPasswordReset?(ctx: AuthHookContext): void | Promise<void>;
+}
 export interface RouteGroupConfig {
     prefix?: string;
+    /**
+     * Constrain this group to a specific host. Two groups can then share the
+     * same URL prefix and be selected by host.
+     *
+     *   - Omitted → the group matches any host (default; backward compatible).
+     *   - Literal host, e.g. `'admin.example.com'` → requests to that host
+     *     resolve to this group; requests from a non-matching host are rejected.
+     *   - Parameterized host, e.g. `'{organization}.example.com'` → the captured
+     *     `{organization}` subdomain feeds organization resolution, exactly like
+     *     a path-prefix tenant param. Matches Laravel's `Route::domain(...)`.
+     */
+    domain?: string;
     middleware?: Type<NestMiddleware>[];
     /** '*' = all registered models, array = subset by slug */
     models: '*' | string[];
     /** Skip the default JWT guard for this group (for public routes) */
     skipAuth?: boolean;
+    /**
+     * Register the full auth route set (login/logout/password/register) for this
+     * group, tagged with the group's name (Decision 9.A). The legacy unprefixed
+     * `/auth/*` set always remains for the default/global path. Opt-in; default
+     * `false`. The `public` group is never auth-enabled.
+     */
+    auth?: boolean;
+    /**
+     * Optional per-group lifecycle hooks. A class (resolved via Nest DI) or a
+     * plain object implementing {@link AuthLifecycleHooks}. Runs after each auth
+     * action for requests resolved to this group; may reject to revoke the token.
+     */
+    hooks?: Type<AuthLifecycleHooks> | AuthLifecycleHooks;
+    /**
+     * Whether this group is org-scoped (a tenant group). Tenant-group membership
+     * rows require an organization; non-tenant groups (e.g. `admin`, `driver`)
+     * store a NULL org. When omitted, a group is treated as a tenant group iff
+     * multi-tenancy is enabled. Set `tenant: false` for org-less groups even when
+     * multi-tenancy is on.
+     */
+    tenant?: boolean;
 }
 export interface MultiTenantConfig {
     enabled?: boolean;
@@ -66,6 +127,16 @@ export interface AuthConfig {
     userModel?: string;
     passwordField?: string;
     emailField?: string;
+    /**
+     * Master flag (default `false`) gating group-membership enforcement. When
+     * off, behavior is byte-for-byte unchanged: no membership check, permissions
+     * resolve from the org-presence heuristic. When on, an authenticated user
+     * must hold a `user_roles` membership row matching the request's
+     * `route_group` (a NULL row is a wildcard — Decision 9.B) and, for tenant
+     * groups, the resolved org; no match → 403 (Decision 9.C). Permissions then
+     * resolve from the matched row.
+     */
+    enforceGroupMembership?: boolean;
 }
 export interface PostmanConfig {
     roleModel?: string;

package/dist/middleware/domain-route-resolver.d.ts

@@ -0,0 +1,54 @@
+import type { Request, Response, NextFunction } from 'express';
+import type { RhinoConfig } from '../interfaces/rhino-config.interface';
+import type { PrismaClientLike } from '../prisma/prisma.service';
+export interface DomainRouteResolverOptions {
+    /**
+     * When `true` (default), a request whose host matches a parameterized
+     * domain group but whose captured subdomain resolves to no known
+     * organization → HTTP 404. When `false`, the request passes through
+     * unchanged (org simply isn't attached).
+     */
+    strict?: boolean;
+    /**
+     * When `true` (default), after resolving the org the resolver verifies the
+     * authenticated user (if any) is a member. Non-members → 404 (matches the
+     * tenant-route-rewrite contract: cross-tenant = "not found", no
+     * enumeration). When `req.user` is absent the check is skipped (auth runs
+     * later).
+     */
+    enforceMembership?: boolean;
+}
+/**
+ * Factory for an Express-level middleware that implements host-based route
+ * group resolution — the subdomain-multitenancy analogue of
+ * `createTenantRouteRewrite`.
+ *
+ * Context: NestJS serves every model through a single GlobalController, and a
+ * route group is resolved at request time. For a parameterized domain group
+ * (`{organization}.example.com`), the captured subdomain must be turned into a
+ * resolved `req.organization` BEFORE the controller runs — exactly like the
+ * path-based `/api/<slug>/...` rewrite does for the `:organization` prefix.
+ *
+ * Behavior:
+ *
+ *   1. For each route group with a `domain`, compile its pattern.
+ *   2. On each request, match `req.hostname` against those patterns.
+ *      - No domain group matches → next() (plain prefix routing applies).
+ *   3. When a parameterized domain group matches, take the captured
+ *      `{organization}` (or `{org}`) subdomain and:
+ *        - expose it on `req.params.organization`,
+ *        - resolve the org by `organizationIdentifierColumn` (cached),
+ *          strict-404 when unknown,
+ *        - enforce membership when `req.user` is present,
+ *        - attach `req.organization`.
+ *      A literal domain group matches but captures no params, so it only marks
+ *      the host as recognized (no org resolution).
+ *
+ * Intended for raw Express `app.use(createDomainRouteResolver(...))` BEFORE
+ * `applyRhinoRouting(...)`, alongside / instead of `createTenantRouteRewrite`.
+ */
+export declare function createDomainRouteResolver(args: {
+    prisma: PrismaClientLike;
+    config: RhinoConfig;
+    options?: DomainRouteResolverOptions;
+}): (req: Request, res: Response, next: NextFunction) => Promise<void>;

package/dist/middleware/domain-route-resolver.js

@@ -0,0 +1,145 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createDomainRouteResolver = createDomainRouteResolver;
+const domain_pattern_1 = require("../utils/domain-pattern");
+/**
+ * Factory for an Express-level middleware that implements host-based route
+ * group resolution — the subdomain-multitenancy analogue of
+ * `createTenantRouteRewrite`.
+ *
+ * Context: NestJS serves every model through a single GlobalController, and a
+ * route group is resolved at request time. For a parameterized domain group
+ * (`{organization}.example.com`), the captured subdomain must be turned into a
+ * resolved `req.organization` BEFORE the controller runs — exactly like the
+ * path-based `/api/<slug>/...` rewrite does for the `:organization` prefix.
+ *
+ * Behavior:
+ *
+ *   1. For each route group with a `domain`, compile its pattern.
+ *   2. On each request, match `req.hostname` against those patterns.
+ *      - No domain group matches → next() (plain prefix routing applies).
+ *   3. When a parameterized domain group matches, take the captured
+ *      `{organization}` (or `{org}`) subdomain and:
+ *        - expose it on `req.params.organization`,
+ *        - resolve the org by `organizationIdentifierColumn` (cached),
+ *          strict-404 when unknown,
+ *        - enforce membership when `req.user` is present,
+ *        - attach `req.organization`.
+ *      A literal domain group matches but captures no params, so it only marks
+ *      the host as recognized (no org resolution).
+ *
+ * Intended for raw Express `app.use(createDomainRouteResolver(...))` BEFORE
+ * `applyRhinoRouting(...)`, alongside / instead of `createTenantRouteRewrite`.
+ */
+function createDomainRouteResolver(args) {
+    const { strict = true, enforceMembership = true } = args.options ?? {};
+    // FIX 11.2: when group-membership enforcement is ON, an authenticated
+    // non-member must get a 403 from GroupMembershipGuard, which takes precedence
+    // over this resolver's cross-tenant 404. So we resolve & attach the org but
+    // skip the membership-404 here, deferring to the downstream guard. A
+    // genuinely unknown subdomain still 404s (strict). When enforcement is OFF
+    // (default), behavior is byte-for-byte unchanged.
+    const groupMembershipEnforced = args.config.auth?.enforceGroupMembership === true;
+    const orgModel = args.config.multiTenant?.organizationModel ?? 'organization';
+    const userOrgModel = args.config.multiTenant?.userOrganizationModel ?? 'userRole';
+    const idColumn = args.config.multiTenant?.organizationIdentifierColumn ?? 'slug';
+    const compiledGroups = [];
+    for (const [name, group] of Object.entries(args.config.routeGroups ?? {})) {
+        const compiled = (0, domain_pattern_1.compileDomain)(group.domain);
+        if (compiled)
+            compiledGroups.push({ name, group, compiled });
+    }
+    // Cache org lookups by captured subdomain value. `null` = probed, not found.
+    const cache = new Map();
+    const notFound = (res) => {
+        res.status(404).json({ code: 'NOT_FOUND', message: 'Organization not found' });
+    };
+    return async function domainRouteResolver(req, res, next) {
+        if (compiledGroups.length === 0)
+            return next();
+        try {
+            const host = resolveHost(req);
+            if (!host)
+                return next();
+            let matched = null;
+            for (const cg of compiledGroups) {
+                const result = (0, domain_pattern_1.matchDomain)(cg.compiled, host);
+                if (result) {
+                    matched = { group: cg, params: result.params };
+                    break;
+                }
+            }
+            if (!matched)
+                return next();
+            // Mark which group the host resolved to (parity with RouteGroupMiddleware).
+            req.__routeGroup = matched.group.name;
+            if (matched.group.group.skipAuth)
+                req.__skipAuth = true;
+            const rawSubdomain = matched.params.organization ?? matched.params.org;
+            if (rawSubdomain == null) {
+                // Literal domain group — no tenant to resolve.
+                return next();
+            }
+            // DNS hostnames are case-insensitive; orgs are slugged lowercase. Normalize
+            // the captured subdomain before the lookup, the cache key, and the param so
+            // `ACME.example.com` resolves the `acme` org consistently.
+            const subdomain = rawSubdomain.toLowerCase();
+            // Expose the captured subdomain like a path param.
+            req.params = req.params ?? {};
+            if (req.params.organization == null) {
+                req.params.organization = subdomain;
+            }
+            // Resolve the org from the subdomain (cached).
+            if (!cache.has(subdomain)) {
+                const delegate = args.prisma[camel(orgModel)] ?? args.prisma[orgModel];
+                if (!delegate?.findFirst) {
+                    // No org delegate — can't resolve. Pass through.
+                    return next();
+                }
+                const org = await delegate
+                    .findFirst({ where: { [idColumn]: subdomain } })
+                    .catch(() => null);
+                cache.set(subdomain, org ?? null);
+            }
+            const org = cache.get(subdomain);
+            if (!org) {
+                if (strict)
+                    return notFound(res);
+                return next();
+            }
+            // Membership check (cross-tenant → 404, not 403). Skipped when group
+            // membership enforcement is ON — the GroupMembershipGuard returns 403 for
+            // an authenticated non-member, which takes precedence (FIX 11.2).
+            if (enforceMembership && !groupMembershipEnforced && req.user) {
+                const userId = req.user.id;
+                const urDelegate = args.prisma[camel(userOrgModel)] ?? args.prisma[userOrgModel];
+                if (urDelegate?.findFirst) {
+                    const member = await urDelegate
+                        .findFirst({ where: { userId, organizationId: org.id } })
+                        .catch(() => null);
+                    if (!member)
+                        return notFound(res);
+                }
+            }
+            req.organization = org;
+            req.__orgSubdomain = subdomain;
+            return next();
+        }
+        catch (err) {
+            return next(err);
+        }
+    };
+}
+function resolveHost(req) {
+    const fromExpress = req.hostname;
+    if (fromExpress)
+        return String(fromExpress).split(':')[0];
+    const header = req.headers?.host ?? req.host;
+    return header ? String(header).split(':')[0] : undefined;
+}
+function camel(name) {
+    if (!name)
+        return name;
+    return name.charAt(0).toLowerCase() + name.slice(1);
+}
+//# sourceMappingURL=domain-route-resolver.js.map

package/dist/middleware/domain-route-resolver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"domain-route-resolver.js","sourceRoot":"","sources":["../../src/middleware/domain-route-resolver.ts"],"names":[],"mappings":";;AA0DA,8DA8GC;AArKD,4DAA0F;AA0B1F;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,SAAgB,yBAAyB,CAAC,IAIzC;IACC,MAAM,EAAE,MAAM,GAAG,IAAI,EAAE,iBAAiB,GAAG,IAAI,EAAE,GAAG,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC;IAEvE,sEAAsE;IACtE,8EAA8E;IAC9E,4EAA4E;IAC5E,qEAAqE;IACrE,2EAA2E;IAC3E,kDAAkD;IAClD,MAAM,uBAAuB,GAC3B,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,sBAAsB,KAAK,IAAI,CAAC;IAEpD,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,iBAAiB,IAAI,cAAc,CAAC;IAC9E,MAAM,YAAY,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,qBAAqB,IAAI,UAAU,CAAC;IAClF,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,4BAA4B,IAAI,MAAM,CAAC;IAEjF,MAAM,cAAc,GAAoB,EAAE,CAAC;IAC3C,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,IAAI,EAAE,CAAC,EAAE,CAAC;QAC1E,MAAM,QAAQ,GAAG,IAAA,8BAAa,EAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAC7C,IAAI,QAAQ;YAAE,cAAc,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;IAC/D,CAAC;IAED,6EAA6E;IAC7E,MAAM,KAAK,GAAG,IAAI,GAAG,EAAe,CAAC;IAErC,MAAM,QAAQ,GAAG,CAAC,GAAa,EAAE,EAAE;QACjC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,wBAAwB,EAAE,CAAC,CAAC;IACjF,CAAC,CAAC;IAEF,OAAO,KAAK,UAAU,mBAAmB,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB;QACvF,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,EAAE,CAAC;QAC/C,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;YAC9B,IAAI,CAAC,IAAI;gBAAE,OAAO,IAAI,EAAE,CAAC;YAEzB,IAAI,OAAO,GAAoE,IAAI,CAAC;YACpF,KAAK,MAAM,EAAE,IAAI,cAAc,EAAE,CAAC;gBAChC,MAAM,MAAM,GAAG,IAAA,4BAAW,EAAC,EAAE,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;gBAC9C,IAAI,MAAM,EAAE,CAAC;oBACX,OAAO,GAAG,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;oBAC/C,MAAM;gBACR,CAAC;YACH,CAAC;YACD,IAAI,CAAC,OAAO;gBAAE,OAAO,IAAI,EAAE,CAAC;YAE5B,4EAA4E;YAC3E,GAAW,CAAC,YAAY,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC;YAC/C,IAAI,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ;gBAAG,GAAW,CAAC,UAAU,GAAG,IAAI,CAAC;YAEjE,MAAM,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,YAAY,IAAI,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC;YACvE,IAAI,YAAY,IAAI,IAAI,EAAE,CAAC;gBACzB,+CAA+C;gBAC/C,OAAO,IAAI,EAAE,CAAC;YAChB,CAAC;YACD,4EAA4E;YAC5E,4EAA4E;YAC5E,2DAA2D;YAC3D,MAAM,SAAS,GAAG,YAAY,CAAC,WAAW,EAAE,CAAC;YAE7C,mDAAmD;YAClD,GAAW,CAAC,MAAM,GAAI,GAAW,CAAC,MAAM,IAAI,EAAE,CAAC;YAChD,IAAK,GAAW,CAAC,MAAM,CAAC,YAAY,IAAI,IAAI,EAAE,CAAC;gBAC5C,GAAW,CAAC,MAAM,CAAC,YAAY,GAAG,SAAS,CAAC;YAC/C,CAAC;YAED,+CAA+C;YAC/C,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;gBAC1B,MAAM,QAAQ,GACX,IAAI,CAAC,MAAc,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,IAAK,IAAI,CAAC,MAAc,CAAC,QAAQ,CAAC,CAAC;gBAC1E,IAAI,CAAC,QAAQ,EAAE,SAAS,EAAE,CAAC;oBACzB,iDAAiD;oBACjD,OAAO,IAAI,EAAE,CAAC;gBAChB,CAAC;gBACD,MAAM,GAAG,GAAG,MAAM,QAAQ;qBACvB,SAAS,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,SAAS,EAAE,EAAE,CAAC;qBAC/C,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;gBACrB,KAAK,CAAC,GAAG,CAAC,SAAS,EAAE,GAAG,IAAI,IAAI,CAAC,CAAC;YACpC,CAAC;YACD,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YACjC,IAAI,CAAC,GAAG,EAAE,CAAC;gBACT,IAAI,MAAM;oBAAE,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC;gBACjC,OAAO,IAAI,EAAE,CAAC;YAChB,CAAC;YAED,qEAAqE;YACrE,0EAA0E;YAC1E,kEAAkE;YAClE,IAAI,iBAAiB,IAAI,CAAC,uBAAuB,IAAK,GAAW,CAAC,IAAI,EAAE,CAAC;gBACvE,MAAM,MAAM,GAAI,GAAW,CAAC,IAAI,CAAC,EAAE,CAAC;gBACpC,MAAM,UAAU,GACb,IAAI,CAAC,MAAc,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,IAAK,IAAI,CAAC,MAAc,CAAC,YAAY,CAAC,CAAC;gBAClF,IAAI,UAAU,EAAE,SAAS,EAAE,CAAC;oBAC1B,MAAM,MAAM,GAAG,MAAM,UAAU;yBAC5B,SAAS,CAAC,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,cAAc,EAAE,GAAG,CAAC,EAAE,EAAE,EAAE,CAAC;yBACxD,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;oBACrB,IAAI,CAAC,MAAM;wBAAE,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC;gBACpC,CAAC;YACH,CAAC;YAEA,GAAW,CAAC,YAAY,GAAG,GAAG,CAAC;YAC/B,GAAW,CAAC,cAAc,GAAG,SAAS,CAAC;YACxC,OAAO,IAAI,EAAE,CAAC;QAChB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC;QACnB,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAAC,GAAY;IAC/B,MAAM,WAAW,GAAI,GAAW,CAAC,QAAQ,CAAC;IAC1C,IAAI,WAAW;QAAE,OAAO,MAAM,CAAC,WAAW,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1D,MAAM,MAAM,GAAI,GAAG,CAAC,OAAO,EAAE,IAA2B,IAAK,GAAW,CAAC,IAAI,CAAC;IAC9E,OAAO,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC3D,CAAC;AAED,SAAS,KAAK,CAAC,IAAY;IACzB,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AACtD,CAAC"}

package/dist/middleware/route-group.middleware.d.ts

@@ -2,16 +2,60 @@ import { NestMiddleware } from '@nestjs/common';
 import type { NextFunction, Request, Response } from 'express';
 import { RhinoConfigService } from '../rhino.config';
 /**
- * Detects which Rhino route group the current request belongs to
- * (based on URL prefix) and attaches:
+ * Detects which Rhino route group the current request belongs to and attaches:
  *   - `req.__routeGroup`  — the group name
  *   - `req.__skipAuth`    — true when the group has `skipAuth: true`
  *
- * Install this middleware globally BEFORE `JwtAuthGuard` so the guard can
- * read `req.__skipAuth` and short-circuit.
+ * Group selection considers BOTH:
+ *
+ *   1. **Host** — when a group declares a `domain`, it is only eligible for
+ *      requests whose `req.hostname` matches that domain. A literal domain
+ *      (`admin.example.com`) must match exactly; a parameterized domain
+ *      (`{organization}.example.com`) captures the subdomain and exposes it as
+ *      `req.params.organization` so ResolveOrganizationMiddleware can resolve
+ *      the tenant from the host — mirroring Laravel's `Route::domain(...)`.
+ *
+ *   2. **URL prefix** — the existing path-prefix matching, unchanged for groups
+ *      without a `domain`.
+ *
+ * Host-scoped groups take precedence over plain prefix groups when both could
+ * match, so two groups can share the same prefix and be selected by host.
+ *
+ * Enforcement: if the request path targets a model that is ONLY served by
+ * domain-scoped group(s) and the host matches none of them, the request is
+ * rejected with 404 — a wrong-host request must not be served as that group.
+ *
+ * Install this middleware globally BEFORE `JwtAuthGuard` so the guard can read
+ * `req.__skipAuth`, and BEFORE `ResolveOrganizationMiddleware` so a captured
+ * subdomain param is available for org resolution.
  */
 export declare class RouteGroupMiddleware implements NestMiddleware {
     private readonly config;
+    /** Cache compiled domain patterns keyed by group name. */
+    private readonly compiledCache;
     constructor(config: RhinoConfigService);
+    private compileFor;
     use(req: Request & Record<string, any>, _res: Response, next: NextFunction): void;
+    /**
+     * Whether `url` targets one of the auth entry endpoints. These are the
+     * routes that must never be blocked by the JWT guard (login/register/recover)
+     * and that must resolve to the group they belong to. Matches the auth
+     * controller's `@Controller('auth')` action paths under any prefix.
+     */
+    private isAuthEntryPath;
+    /**
+     * Resolve the route group for an auth entry path (FIX 11.1). Precedence:
+     *   1. an auth-enabled DOMAIN group whose host matches (and prefix matches);
+     *   2. an auth-enabled PREFIX group whose prefix matches;
+     *   3. the empty-prefix / default group (auth-enabled preferred, else any);
+     *   4. otherwise leave `__routeGroup` unset (legacy/global auth path).
+     *
+     * `__skipAuth` is ALWAYS set on an auth entry path so the JWT guard never
+     * blocks login/register/recover, regardless of which group wins — even a
+     * host-claiming empty-prefix domain group cannot strip it.
+     */
+    private resolveAuthEntry;
+    private resolveHost;
+    private prefixMatches;
+    private exposeDomainParams;
 }