@rhino-dev/rhino-nestjs 4.0.0 → 4.2.1

package/dist/services/auth-hooks.service.d.ts

@@ -0,0 +1,27 @@
+import { ModuleRef } from '@nestjs/core';
+import { RhinoConfigService } from '../rhino.config';
+import type { AuthHookContext, AuthLifecycleHooks } from '../interfaces/rhino-config.interface';
+export type AuthHookEvent = 'afterLogin' | 'afterLogout' | 'afterRegister' | 'afterPasswordRecover' | 'afterPasswordReset';
+/**
+ * Resolves a group's optional lifecycle-hooks class/object and runs a single
+ * event (design §7). A hook may reject by throwing — the caller (auth
+ * controller) decides whether to revoke a token. When a group has no `hooks`
+ * config, every event is a silent no-op.
+ *
+ * `ModuleRef` is optional so the service works in lightweight unit tests that
+ * construct it without a Nest container; in that case a `Type` hooks value is
+ * instantiated directly via `new`.
+ */
+export declare class AuthHooksService {
+    private readonly config;
+    private readonly moduleRef?;
+    constructor(config: RhinoConfigService, moduleRef?: ModuleRef);
+    /** Resolve the hooks instance for a group, or `null` when none is configured. */
+    resolve(routeGroup: string | null | undefined): AuthLifecycleHooks | null;
+    /**
+     * Run a single lifecycle event for the resolved group. Returns silently when
+     * the group has no hooks or the specific method is absent. A rejection
+     * propagates to the caller verbatim.
+     */
+    run(event: AuthHookEvent, routeGroup: string | null | undefined, ctx: AuthHookContext): Promise<void>;
+}

package/dist/services/auth-hooks.service.js

@@ -0,0 +1,85 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AuthHooksService = void 0;
+const common_1 = require("@nestjs/common");
+const core_1 = require("@nestjs/core");
+const rhino_config_1 = require("../rhino.config");
+/**
+ * Resolves a group's optional lifecycle-hooks class/object and runs a single
+ * event (design §7). A hook may reject by throwing — the caller (auth
+ * controller) decides whether to revoke a token. When a group has no `hooks`
+ * config, every event is a silent no-op.
+ *
+ * `ModuleRef` is optional so the service works in lightweight unit tests that
+ * construct it without a Nest container; in that case a `Type` hooks value is
+ * instantiated directly via `new`.
+ */
+let AuthHooksService = class AuthHooksService {
+    config;
+    moduleRef;
+    constructor(config, moduleRef) {
+        this.config = config;
+        this.moduleRef = moduleRef;
+    }
+    /** Resolve the hooks instance for a group, or `null` when none is configured. */
+    resolve(routeGroup) {
+        const hooks = this.config.routeGroupHooks(routeGroup);
+        if (!hooks)
+            return null;
+        // Plain object implementing the contract.
+        if (typeof hooks !== 'function')
+            return hooks;
+        // A class/Type: prefer the DI container, fall back to direct construction.
+        const Cls = hooks;
+        if (this.moduleRef) {
+            try {
+                const instance = this.moduleRef.get(Cls, { strict: false });
+                if (instance)
+                    return instance;
+            }
+            catch {
+                /* not registered as a provider — construct directly below */
+            }
+        }
+        try {
+            return new Cls();
+        }
+        catch {
+            return null;
+        }
+    }
+    /**
+     * Run a single lifecycle event for the resolved group. Returns silently when
+     * the group has no hooks or the specific method is absent. A rejection
+     * propagates to the caller verbatim.
+     */
+    async run(event, routeGroup, ctx) {
+        const instance = this.resolve(routeGroup);
+        if (!instance)
+            return;
+        const fn = instance[event];
+        if (typeof fn !== 'function')
+            return;
+        await fn.call(instance, ctx);
+    }
+};
+exports.AuthHooksService = AuthHooksService;
+exports.AuthHooksService = AuthHooksService = __decorate([
+    (0, common_1.Injectable)(),
+    __param(1, (0, common_1.Optional)()),
+    __metadata("design:paramtypes", [rhino_config_1.RhinoConfigService,
+        core_1.ModuleRef])
+], AuthHooksService);
+//# sourceMappingURL=auth-hooks.service.js.map

package/dist/services/auth-hooks.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-hooks.service.js","sourceRoot":"","sources":["../../src/services/auth-hooks.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,2CAAsD;AACtD,uCAAyC;AACzC,kDAAqD;AAarD;;;;;;;;;GASG;AAEI,IAAM,gBAAgB,GAAtB,MAAM,gBAAgB;IAER;IACY;IAF/B,YACmB,MAA0B,EACd,SAAqB;QADjC,WAAM,GAAN,MAAM,CAAoB;QACd,cAAS,GAAT,SAAS,CAAY;IACjD,CAAC;IAEJ,iFAAiF;IACjF,OAAO,CAAC,UAAqC;QAC3C,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC;QACtD,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC;QACxB,0CAA0C;QAC1C,IAAI,OAAO,KAAK,KAAK,UAAU;YAAE,OAAO,KAA2B,CAAC;QACpE,2EAA2E;QAC3E,MAAM,GAAG,GAAG,KAAmD,CAAC;QAChE,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YACnB,IAAI,CAAC;gBACH,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;gBAC5D,IAAI,QAAQ;oBAAE,OAAO,QAAQ,CAAC;YAChC,CAAC;YAAC,MAAM,CAAC;gBACP,6DAA6D;YAC/D,CAAC;QACH,CAAC;QACD,IAAI,CAAC;YACH,OAAO,IAAI,GAAG,EAAE,CAAC;QACnB,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,GAAG,CACP,KAAoB,EACpB,UAAqC,EACrC,GAAoB;QAEpB,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QAC1C,IAAI,CAAC,QAAQ;YAAE,OAAO;QACtB,MAAM,EAAE,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC3B,IAAI,OAAO,EAAE,KAAK,UAAU;YAAE,OAAO;QACrC,MAAM,EAAE,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;IAC/B,CAAC;CACF,CAAA;AA7CY,4CAAgB;2BAAhB,gBAAgB;IAD5B,IAAA,mBAAU,GAAE;IAIR,WAAA,IAAA,iBAAQ,GAAE,CAAA;qCADc,iCAAkB;QACF,gBAAS;GAHzC,gBAAgB,CA6C5B"}

package/dist/services/auth.service.d.ts

@@ -26,8 +26,27 @@ export declare class AuthService {
     verifyToken(token: string): TokenPayload;
     login(email: string, password: string): Promise<LoginResult>;
     logout(_user: any): Promise<void>;
+    /**
+     * Revoke a just-issued token. JWTs are stateless, so "revoking" means
+     * recording the token in a denylist (when the consumer provides a
+     * `RevokedToken` model) so the JwtAuthGuard can reject it on the next
+     * request. Used when a lifecycle hook rejects a login/register: the token is
+     * never returned AND — IF a denylist model exists — can no longer be used
+     * even if it leaked.
+     *
+     * Bounded guarantee: the caller (AuthController) ALWAYS drops the token from
+     * the response on rejection, so an attacker never receives it. Persisting it
+     * to a denylist is the *additional* protection against a leaked token. When
+     * no `RevokedToken` model is configured we log a clear WARNING so operators
+     * know revoke is advisory-only — pair it with short-TTL JWTs (see README /
+     * CLAUDE.md "Group-auth hooks & token revocation").
+     */
+    revokeToken(token: string): Promise<void>;
+    /** Whether a token has been revoked via {@link revokeToken}. */
+    isTokenRevoked(token: string): Promise<boolean>;
     requestPasswordRecovery(email: string): Promise<{
         token: string;
+        user: any;
     } | null>;
     resetPassword(email: string, token: string, newPassword: string): Promise<void>;
 }

package/dist/services/auth.service.js

@@ -90,10 +90,27 @@ let AuthService = AuthService_1 = class AuthService {
     }
     async login(email, password) {
         const auth = this.config.authConfig();
-        const user = await this.userDelegate().findFirst({
-            where: { [auth.emailField]: email },
-            include: { userRoles: { include: { organization: true, role: true } } },
-        }).catch(() => null);
+        // Only eager-load the org membership graph when multi-tenancy is configured.
+        // Single-tenant / org-less apps have no `userRoles` relation on their User
+        // model, so an unconditional include would throw inside Prisma and the
+        // `.catch(() => null)` below would surface as "Invalid credentials" — i.e.
+        // an org-less app could never log a valid user in. Gating the include on
+        // `multiTenantEnabled()` keeps multi-tenant behavior byte-for-byte while
+        // letting org-less apps authenticate. (We still degrade gracefully if the
+        // include fails for any other reason: retry the plain lookup.)
+        const wantsOrg = this.config.multiTenantEnabled();
+        let user = null;
+        if (wantsOrg) {
+            user = await this.userDelegate().findFirst({
+                where: { [auth.emailField]: email },
+                include: { userRoles: { include: { organization: true, role: true } } },
+            }).catch(() => null);
+        }
+        if (!user) {
+            user = await this.userDelegate().findFirst({
+                where: { [auth.emailField]: email },
+            }).catch(() => null);
+        }
         if (!user)
             throw rhino_exception_1.RhinoException.unauthorized('Invalid credentials');
         const hashed = user[auth.passwordField];
@@ -107,6 +124,64 @@ let AuthService = AuthService_1 = class AuthService {
     async logout(_user) {
         // JWT stateless; consumer can add blacklist logic via hooks.
     }
+    /**
+     * Revoke a just-issued token. JWTs are stateless, so "revoking" means
+     * recording the token in a denylist (when the consumer provides a
+     * `RevokedToken` model) so the JwtAuthGuard can reject it on the next
+     * request. Used when a lifecycle hook rejects a login/register: the token is
+     * never returned AND — IF a denylist model exists — can no longer be used
+     * even if it leaked.
+     *
+     * Bounded guarantee: the caller (AuthController) ALWAYS drops the token from
+     * the response on rejection, so an attacker never receives it. Persisting it
+     * to a denylist is the *additional* protection against a leaked token. When
+     * no `RevokedToken` model is configured we log a clear WARNING so operators
+     * know revoke is advisory-only — pair it with short-TTL JWTs (see README /
+     * CLAUDE.md "Group-auth hooks & token revocation").
+     */
+    async revokeToken(token) {
+        if (!token)
+            return;
+        let delegate;
+        try {
+            delegate = this.prisma.model('revokedToken');
+        }
+        catch {
+            this.logger.warn('AuthService.revokeToken: no `RevokedToken` model is configured, so token ' +
+                'revocation is advisory only — the token is dropped from the response but ' +
+                'cannot be denylisted if it has already leaked. Add a `RevokedToken` model ' +
+                '(token, createdAt) to your Prisma schema and use short-TTL JWTs.');
+            return;
+        }
+        try {
+            await delegate.create({ data: { token, createdAt: new Date() } });
+        }
+        catch (err) {
+            // The model exists but the write failed — surface it so a misconfigured
+            // denylist is not silently a no-op.
+            this.logger.warn(`AuthService.revokeToken: failed to persist revoked token (${err.message}).`);
+        }
+    }
+    /** Whether a token has been revoked via {@link revokeToken}. */
+    async isTokenRevoked(token) {
+        if (!token)
+            return false;
+        let delegate;
+        try {
+            delegate = this.prisma.model('revokedToken');
+        }
+        catch {
+            // No denylist model — nothing can be revoked, so nothing is revoked.
+            return false;
+        }
+        try {
+            const row = await delegate.findFirst({ where: { token } });
+            return Boolean(row);
+        }
+        catch {
+            return false;
+        }
+    }
     async requestPasswordRecovery(email) {
         const user = await this.userDelegate().findFirst({ where: { email } }).catch(() => null);
         if (!user)
@@ -123,7 +198,7 @@ let AuthService = AuthService_1 = class AuthService {
             this.logger.warn(`AuthService: could not persist password reset token (${err.message}). ` +
                 'Add a `PasswordResetToken` model to your Prisma schema to enable this feature.');
         }
-        return { token };
+        return { token, user };
     }
     async resetPassword(email, token, newPassword) {
         let reset = null;

package/dist/services/auth.service.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth.service.js","sourceRoot":"","sources":["../../src/services/auth.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,2CAIwB;AACxB,+DAA2D;AAC3D,iDAAmC;AACnC,kDAAoC;AACpC,mCAAqC;AACrC,6DAAyD;AACzD,kDAAqD;AAcrD;;;GAGG;AAEI,IAAM,WAAW,mBAAjB,MAAM,WAAW;IAIH;IACA;IAJF,MAAM,GAAG,IAAI,eAAM,CAAC,aAAW,CAAC,IAAI,CAAC,CAAC;IAEvD,YACmB,MAAqB,EACrB,MAA0B;QAD1B,WAAM,GAAN,MAAM,CAAe;QACrB,WAAM,GAAN,MAAM,CAAoB;IAC1C,CAAC;IAEI,YAAY;QAClB,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC,SAAS,CAAC;QACrD,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IACtC,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,KAAa;QAC9B,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAChC,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,KAAa,EAAE,MAAc;QAC/C,IAAI,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC;QAC1B,OAAO,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IACvC,CAAC;IAED,SAAS,CAAC,OAAqB;QAC7B,MAAM,EAAE,SAAS,EAAE,YAAY,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;QAC7D,OAAO,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,EAAE,EAAE,SAAS,EAAE,YAAY,EAAS,CAAC,CAAC;IAC1E,CAAC;IAED,WAAW,CAAC,KAAa;QACvB,MAAM,EAAE,SAAS,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;QAC/C,IAAI,CAAC;YACH,OAAO,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,SAAS,CAAiB,CAAC;QACtD,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,gCAAc,CAAC,YAAY,CAAC,0BAA0B,CAAC,CAAC;QAChE,CAAC;IACH,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,KAAa,EAAE,QAAgB;QACzC,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC,SAAS,CAAC;YAC/C,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE;YACnC,OAAO,EAAE,EAAE,SAAS,EAAE,EAAE,OAAO,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE;SACxE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QAErB,IAAI,CAAC,IAAI;YAAE,MAAM,gCAAc,CAAC,YAAY,CAAC,qBAAqB,CAAC,CAAC;QACpE,MAAM,MAAM,GAAI,IAAY,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QACjD,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QACtD,IAAI,CAAC,EAAE;YAAE,MAAM,gCAAc,CAAC,YAAY,CAAC,qBAAqB,CAAC,CAAC;QAElE,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAG,IAAY,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;QAC/D,MAAM,gBAAgB,GAAI,IAAY,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC;QAC1E,OAAO,EAAE,KAAK,EAAE,gBAAgB,EAAE,IAAI,EAAE,CAAC;IAC3C,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,KAAU;QACrB,6DAA6D;IAC/D,CAAC;IAED,KAAK,CAAC,uBAAuB,CAAC,KAAa;QACzC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QACzF,IAAI,CAAC,IAAI;YAAE,OAAO,IAAI,CAAC;QACvB,MAAM,KAAK,GAAG,IAAA,oBAAW,EAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC9C,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC,MAAM,CAAC;gBACnD,KAAK,EAAE,EAAE,KAAK,EAAE;gBAChB,MAAM,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE;gBACxC,MAAM,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE;aAChD,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,wDAAyD,GAAa,CAAC,OAAO,KAAK;gBACjF,gFAAgF,CACnF,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,CAAC;IACnB,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,KAAa,EAAE,KAAa,EAAE,WAAmB;QACnE,IAAI,KAAK,GAAQ,IAAI,CAAC;QACtB,IAAI,CAAC;YACH,KAAK,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC,SAAS,CAAC;gBAC9D,KAAK,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE;aACxB,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,4BAAmB,CAAC,8BAA8B,CAAC,CAAC;QAChE,CAAC;QACD,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,4BAAmB,CAAC,eAAe,CAAC,CAAC;QAC3D,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC;QACpD,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC,MAAM,CAAC;YAC/B,KAAK,EAAE,EAAE,KAAK,EAAE;YAChB,IAAI,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE;SAC3B,CAAC,CAAC;QACH,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;QAC7E,CAAC;QAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;IAC1B,CAAC;CACF,CAAA;AA/FY,kCAAW;sBAAX,WAAW;IADvB,IAAA,mBAAU,GAAE;qCAKgB,8BAAa;QACb,iCAAkB;GALlC,WAAW,CA+FvB"}
+{"version":3,"file":"auth.service.js","sourceRoot":"","sources":["../../src/services/auth.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,2CAIwB;AACxB,+DAA2D;AAC3D,iDAAmC;AACnC,kDAAoC;AACpC,mCAAqC;AACrC,6DAAyD;AACzD,kDAAqD;AAcrD;;;GAGG;AAEI,IAAM,WAAW,mBAAjB,MAAM,WAAW;IAIH;IACA;IAJF,MAAM,GAAG,IAAI,eAAM,CAAC,aAAW,CAAC,IAAI,CAAC,CAAC;IAEvD,YACmB,MAAqB,EACrB,MAA0B;QAD1B,WAAM,GAAN,MAAM,CAAe;QACrB,WAAM,GAAN,MAAM,CAAoB;IAC1C,CAAC;IAEI,YAAY;QAClB,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC,SAAS,CAAC;QACrD,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IACtC,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,KAAa;QAC9B,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAChC,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,KAAa,EAAE,MAAc;QAC/C,IAAI,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC;QAC1B,OAAO,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IACvC,CAAC;IAED,SAAS,CAAC,OAAqB;QAC7B,MAAM,EAAE,SAAS,EAAE,YAAY,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;QAC7D,OAAO,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,EAAE,EAAE,SAAS,EAAE,YAAY,EAAS,CAAC,CAAC;IAC1E,CAAC;IAED,WAAW,CAAC,KAAa;QACvB,MAAM,EAAE,SAAS,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;QAC/C,IAAI,CAAC;YACH,OAAO,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,SAAS,CAAiB,CAAC;QACtD,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,gCAAc,CAAC,YAAY,CAAC,0BAA0B,CAAC,CAAC;QAChE,CAAC;IACH,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,KAAa,EAAE,QAAgB;QACzC,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;QACtC,6EAA6E;QAC7E,2EAA2E;QAC3E,uEAAuE;QACvE,2EAA2E;QAC3E,yEAAyE;QACzE,yEAAyE;QACzE,0EAA0E;QAC1E,+DAA+D;QAC/D,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,kBAAkB,EAAE,CAAC;QAClD,IAAI,IAAI,GAAQ,IAAI,CAAC;QACrB,IAAI,QAAQ,EAAE,CAAC;YACb,IAAI,GAAG,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC,SAAS,CAAC;gBACzC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE;gBACnC,OAAO,EAAE,EAAE,SAAS,EAAE,EAAE,OAAO,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE;aACxE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QACvB,CAAC;QACD,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,IAAI,GAAG,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC,SAAS,CAAC;gBACzC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE;aACpC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QACvB,CAAC;QAED,IAAI,CAAC,IAAI;YAAE,MAAM,gCAAc,CAAC,YAAY,CAAC,qBAAqB,CAAC,CAAC;QACpE,MAAM,MAAM,GAAI,IAAY,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QACjD,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QACtD,IAAI,CAAC,EAAE;YAAE,MAAM,gCAAc,CAAC,YAAY,CAAC,qBAAqB,CAAC,CAAC;QAElE,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAG,IAAY,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;QAC/D,MAAM,gBAAgB,GAAI,IAAY,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC;QAC1E,OAAO,EAAE,KAAK,EAAE,gBAAgB,EAAE,IAAI,EAAE,CAAC;IAC3C,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,KAAU;QACrB,6DAA6D;IAC/D,CAAC;IAED;;;;;;;;;;;;;;OAcG;IACH,KAAK,CAAC,WAAW,CAAC,KAAa;QAC7B,IAAI,CAAC,KAAK;YAAE,OAAO;QACnB,IAAI,QAAa,CAAC;QAClB,IAAI,CAAC;YACH,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;QAC/C,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,2EAA2E;gBACzE,2EAA2E;gBAC3E,4EAA4E;gBAC5E,kEAAkE,CACrE,CAAC;YACF,OAAO;QACT,CAAC;QACD,IAAI,CAAC;YACH,MAAM,QAAQ,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;QACpE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,wEAAwE;YACxE,oCAAoC;YACpC,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,6DAA8D,GAAa,CAAC,OAAO,IAAI,CACxF,CAAC;QACJ,CAAC;IACH,CAAC;IAED,gEAAgE;IAChE,KAAK,CAAC,cAAc,CAAC,KAAa;QAChC,IAAI,CAAC,KAAK;YAAE,OAAO,KAAK,CAAC;QACzB,IAAI,QAAa,CAAC;QAClB,IAAI,CAAC;YACH,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;QAC/C,CAAC;QAAC,MAAM,CAAC;YACP,qEAAqE;YACrE,OAAO,KAAK,CAAC;QACf,CAAC;QACD,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;YAC3D,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC;QACtB,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED,KAAK,CAAC,uBAAuB,CAAC,KAAa;QACzC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QACzF,IAAI,CAAC,IAAI;YAAE,OAAO,IAAI,CAAC;QACvB,MAAM,KAAK,GAAG,IAAA,oBAAW,EAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC9C,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC,MAAM,CAAC;gBACnD,KAAK,EAAE,EAAE,KAAK,EAAE;gBAChB,MAAM,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE;gBACxC,MAAM,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE;aAChD,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,wDAAyD,GAAa,CAAC,OAAO,KAAK;gBACjF,gFAAgF,CACnF,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IACzB,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,KAAa,EAAE,KAAa,EAAE,WAAmB;QACnE,IAAI,KAAK,GAAQ,IAAI,CAAC;QACtB,IAAI,CAAC;YACH,KAAK,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC,SAAS,CAAC;gBAC9D,KAAK,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE;aACxB,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,4BAAmB,CAAC,8BAA8B,CAAC,CAAC;QAChE,CAAC;QACD,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,4BAAmB,CAAC,eAAe,CAAC,CAAC;QAC3D,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC;QACpD,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC,MAAM,CAAC;YAC/B,KAAK,EAAE,EAAE,KAAK,EAAE;YAChB,IAAI,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE;SAC3B,CAAC,CAAC;QACH,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;QAC7E,CAAC;QAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;IAC1B,CAAC;CACF,CAAA;AA1KY,kCAAW;sBAAX,WAAW;IADvB,IAAA,mBAAU,GAAE;qCAKgB,8BAAa;QACb,iCAAkB;GALlC,WAAW,CA0KvB"}

package/dist/services/invitation.service.d.ts

@@ -5,6 +5,8 @@ export interface CreateInvitationInput {
     roleId: number;
     organization: any;
     invitedBy: any;
+    /** The group the invitee will join (design §8). NULL = wildcard membership. */
+    routeGroup?: string | null;
 }
 /**
  * Invitation lifecycle: create/resend/cancel/accept with token-based acceptance.
@@ -16,6 +18,8 @@ export declare class InvitationService {
     constructor(prisma: PrismaService, config: RhinoConfigService);
     private delegate;
     private generateToken;
+    /** Whether the inviter holds a membership row for `routeGroup` (wildcard ok). */
+    private inviterIsMember;
     private expiresAt;
     list(organizationId: number, status?: string): Promise<any>;
     create(input: CreateInvitationInput): Promise<any>;
@@ -26,10 +30,12 @@ export declare class InvitationService {
         organization: any;
         role: any;
         email: any;
+        routeGroup: any;
         accepted?: undefined;
     } | {
         accepted: boolean;
         organization: any;
+        routeGroup: any;
         requiresRegistration?: undefined;
         role?: undefined;
         email?: undefined;

package/dist/services/invitation.service.js

@@ -14,6 +14,7 @@ const common_1 = require("@nestjs/common");
 const crypto_1 = require("crypto");
 const prisma_service_1 = require("../prisma/prisma.service");
 const rhino_config_1 = require("../rhino.config");
+const rhino_exception_1 = require("../errors/rhino-exception");
 /**
  * Invitation lifecycle: create/resend/cancel/accept with token-based acceptance.
  * Mirrors Laravel's InvitationController + OrganizationInvitation model.
@@ -31,6 +32,21 @@ let InvitationService = class InvitationService {
     generateToken() {
         return (0, crypto_1.randomBytes)(32).toString('hex'); // 64 hex chars
     }
+    /** Whether the inviter holds a membership row for `routeGroup` (wildcard ok). */
+    inviterIsMember(inviter, routeGroup, org) {
+        const rows = inviter?.userRoles ?? inviter?.user_roles ?? [];
+        const orgId = org?.id ?? null;
+        for (const ur of rows) {
+            const rg = ur.routeGroup ?? ur.route_group ?? null;
+            if (rg !== null && String(rg) !== routeGroup)
+                continue;
+            const rowOrg = ur.organizationId ?? ur.organization_id ?? null;
+            if (orgId != null && rowOrg != null && rowOrg !== orgId)
+                continue;
+            return true;
+        }
+        return false;
+    }
     expiresAt() {
         const days = this.config.invitationsConfig().expiresDays;
         const d = new Date();
@@ -51,12 +67,35 @@ let InvitationService = class InvitationService {
                 throw new common_1.BadRequestException('Role not allowed for invitations');
             }
         }
+        const routeGroup = input.routeGroup ?? null;
+        // The `public` group has no auth, so it cannot be invited into (design §8).
+        if (routeGroup === 'public') {
+            throw new common_1.BadRequestException('Cannot invite into the public group');
+        }
+        // When enforcement is on, the inviter must themselves be a member of the
+        // group they are inviting into (design §8). NULL (wildcard) skips this — a
+        // wildcard inviter can invite into any group.
+        if (this.config.enforceGroupMembership() && routeGroup != null) {
+            if (!this.inviterIsMember(input.invitedBy, routeGroup, input.organization)) {
+                // Coarse membership denial → 403 for parity with Laravel/Rails
+                // (Decision 9.C), matching the controller's gate.
+                throw rhino_exception_1.RhinoException.membershipDenied('You are not a member of that group');
+            }
+        }
+        // Tenant groups carry an org; non-tenant groups store a NULL org. Default
+        // to using the org (legacy behavior) — only drop it when enforcement is on
+        // AND the group is positively non-tenant, keeping flag-off paths unchanged.
+        const dropOrg = this.config.enforceGroupMembership() &&
+            routeGroup != null &&
+            !this.config.isTenantGroup(routeGroup);
+        const organizationId = dropOrg ? null : input.organization?.id ?? null;
         const token = this.generateToken();
         const invitation = await this.delegate().create({
             data: {
-                organizationId: input.organization.id,
+                organizationId,
                 email: input.email,
                 roleId: input.roleId,
+                routeGroup,
                 token,
                 status: 'pending',
                 invitedById: input.invitedBy.id,
@@ -110,6 +149,7 @@ let InvitationService = class InvitationService {
             await this.delegate().update({ where: { id: inv.id }, data: { status: 'expired' } });
             throw new common_1.BadRequestException('Invitation expired');
         }
+        const routeGroup = inv.routeGroup ?? inv.route_group ?? null;
         if (!userId) {
             // User is unauthenticated — return org/role so client can register
             return {
@@ -117,13 +157,15 @@ let InvitationService = class InvitationService {
                 organization: inv.organization,
                 role: inv.role,
                 email: inv.email,
+                routeGroup,
             };
         }
         await this.prisma.model('userRole').create({
             data: {
                 userId,
-                organizationId: inv.organizationId,
+                organizationId: inv.organizationId ?? null,
                 roleId: inv.roleId,
+                routeGroup,
                 permissions: [],
             },
         });
@@ -131,7 +173,7 @@ let InvitationService = class InvitationService {
             where: { id: inv.id },
             data: { status: 'accepted', acceptedAt: new Date() },
         });
-        return { accepted: true, organization: inv.organization };
+        return { accepted: true, organization: inv.organization, routeGroup };
     }
 };
 exports.InvitationService = InvitationService;

package/dist/services/invitation.service.js.map

@@ -1 +1 @@
-{"version":3,"file":"invitation.service.js","sourceRoot":"","sources":["../../src/services/invitation.service.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,2CAIwB;AACxB,mCAAqC;AACrC,6DAAyD;AACzD,kDAAqD;AASrD;;;GAGG;AAEI,IAAM,iBAAiB,GAAvB,MAAM,iBAAiB;IAET;IACA;IAFnB,YACmB,MAAqB,EACrB,MAA0B;QAD1B,WAAM,GAAN,MAAM,CAAe;QACrB,WAAM,GAAN,MAAM,CAAoB;IAC1C,CAAC;IAEI,QAAQ;QACd,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,wBAAwB,CAAC,CAAC;IACrD,CAAC;IAEO,aAAa;QACnB,OAAO,IAAA,oBAAW,EAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,eAAe;IACzD,CAAC;IAEO,SAAS;QACf,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,iBAAiB,EAAE,CAAC,WAAW,CAAC;QACzD,MAAM,CAAC,GAAG,IAAI,IAAI,EAAE,CAAC;QACrB,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,CAAC;QAC9B,OAAO,CAAC,CAAC;IACX,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,cAAsB,EAAE,MAAe;QAChD,MAAM,KAAK,GAAQ,EAAE,cAAc,EAAE,CAAC;QACtC,IAAI,MAAM,IAAI,MAAM,KAAK,KAAK;YAAE,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC;QACtD,OAAO,IAAI,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;IAC7E,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,KAA4B;QACvC,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,iBAAiB,EAAE,CAAC;QAC5C,IAAI,GAAG,CAAC,YAAY,EAAE,CAAC;YACrB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;YACzF,IAAI,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,QAAQ,CAAE,IAAY,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC5D,MAAM,IAAI,4BAAmB,CAAC,kCAAkC,CAAC,CAAC;YACpE,CAAC;QACH,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,CAAC,aAAa,EAAE,CAAC;QACnC,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC,MAAM,CAAC;YAC9C,IAAI,EAAE;gBACJ,cAAc,EAAE,KAAK,CAAC,YAAY,CAAC,EAAE;gBACrC,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,KAAK;gBACL,MAAM,EAAE,SAAS;gBACjB,WAAW,EAAE,KAAK,CAAC,SAAS,CAAC,EAAE;gBAC/B,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE;aAC5B;SACF,CAAC,CAAC;QACH,IAAI,GAAG,CAAC,mBAAmB,EAAE,CAAC;YAC5B,MAAM,GAAG,CAAC,mBAAmB,CAAC,UAAU,CAAC,CAAC;QAC5C,CAAC;QACD,OAAO,UAAU,CAAC;IACpB,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,EAAU;QACrB,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;QACvE,IAAI,CAAC,UAAU;YAAE,MAAM,IAAI,0BAAiB,CAAC,sBAAsB,CAAC,CAAC;QACrE,IAAK,UAAkB,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAC7C,MAAM,IAAI,4BAAmB,CAAC,wCAAwC,CAAC,CAAC;QAC1E,CAAC;QACD,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC,MAAM,CAAC;YAC7C,KAAK,EAAE,EAAE,EAAE,EAAE;YACb,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,aAAa,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,EAAE;SACnE,CAAC,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,iBAAiB,EAAE,CAAC;QAC5C,IAAI,GAAG,CAAC,mBAAmB;YAAE,MAAM,GAAG,CAAC,mBAAmB,CAAC,SAAS,CAAC,CAAC;QACtE,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,EAAU;QACrB,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;QACvE,IAAI,CAAC,UAAU;YAAE,MAAM,IAAI,0BAAiB,CAAC,sBAAsB,CAAC,CAAC;QACrE,IAAK,UAAkB,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAC7C,MAAM,IAAI,4BAAmB,CAAC,2CAA2C,CAAC,CAAC;QAC7E,CAAC;QACD,OAAO,IAAI,CAAC,QAAQ,EAAE,CAAC,MAAM,CAAC;YAC5B,KAAK,EAAE,EAAE,EAAE,EAAE;YACb,IAAI,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE;SAC9B,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,KAAa,EAAE,MAAe;QACzC,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC,UAAU,CAAC;YAClD,KAAK,EAAE,EAAE,KAAK,EAAE;YAChB,OAAO,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE;SAC5C,CAAC,CAAC;QACH,IAAI,CAAC,UAAU;YAAE,MAAM,IAAI,0BAAiB,CAAC,sBAAsB,CAAC,CAAC;QACrE,MAAM,GAAG,GAAQ,UAAU,CAAC;QAC5B,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS;YAAE,MAAM,IAAI,4BAAmB,CAAC,4BAA4B,CAAC,CAAC;QAC1F,IAAI,GAAG,CAAC,SAAS,GAAG,IAAI,IAAI,EAAE,EAAE,CAAC;YAC/B,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC;YACrF,MAAM,IAAI,4BAAmB,CAAC,oBAAoB,CAAC,CAAC;QACtD,CAAC;QAED,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,mEAAmE;YACnE,OAAO;gBACL,oBAAoB,EAAE,IAAI;gBAC1B,YAAY,EAAE,GAAG,CAAC,YAAY;gBAC9B,IAAI,EAAE,GAAG,CAAC,IAAI;gBACd,KAAK,EAAE,GAAG,CAAC,KAAK;aACjB,CAAC;QACJ,CAAC;QAED,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC;YACzC,IAAI,EAAE;gBACJ,MAAM;gBACN,cAAc,EAAE,GAAG,CAAC,cAAc;gBAClC,MAAM,EAAE,GAAG,CAAC,MAAM;gBAClB,WAAW,EAAE,EAAE;aAChB;SACF,CAAC,CAAC;QACH,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC,MAAM,CAAC;YAC3B,KAAK,EAAE,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE;YACrB,IAAI,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,UAAU,EAAE,IAAI,IAAI,EAAE,EAAE;SACrD,CAAC,CAAC;QACH,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,CAAC,YAAY,EAAE,CAAC;IAC5D,CAAC;CACF,CAAA;AArHY,8CAAiB;4BAAjB,iBAAiB;IAD7B,IAAA,mBAAU,GAAE;qCAGgB,8BAAa;QACb,iCAAkB;GAHlC,iBAAiB,CAqH7B"}
+{"version":3,"file":"invitation.service.js","sourceRoot":"","sources":["../../src/services/invitation.service.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,2CAIwB;AACxB,mCAAqC;AACrC,6DAAyD;AACzD,kDAAqD;AACrD,+DAA2D;AAW3D;;;GAGG;AAEI,IAAM,iBAAiB,GAAvB,MAAM,iBAAiB;IAET;IACA;IAFnB,YACmB,MAAqB,EACrB,MAA0B;QAD1B,WAAM,GAAN,MAAM,CAAe;QACrB,WAAM,GAAN,MAAM,CAAoB;IAC1C,CAAC;IAEI,QAAQ;QACd,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,wBAAwB,CAAC,CAAC;IACrD,CAAC;IAEO,aAAa;QACnB,OAAO,IAAA,oBAAW,EAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,eAAe;IACzD,CAAC;IAED,iFAAiF;IACzE,eAAe,CAAC,OAAY,EAAE,UAAkB,EAAE,GAAQ;QAChE,MAAM,IAAI,GAAG,OAAO,EAAE,SAAS,IAAI,OAAO,EAAE,UAAU,IAAI,EAAE,CAAC;QAC7D,MAAM,KAAK,GAAG,GAAG,EAAE,EAAE,IAAI,IAAI,CAAC;QAC9B,KAAK,MAAM,EAAE,IAAI,IAAI,EAAE,CAAC;YACtB,MAAM,EAAE,GAAG,EAAE,CAAC,UAAU,IAAI,EAAE,CAAC,WAAW,IAAI,IAAI,CAAC;YACnD,IAAI,EAAE,KAAK,IAAI,IAAI,MAAM,CAAC,EAAE,CAAC,KAAK,UAAU;gBAAE,SAAS;YACvD,MAAM,MAAM,GAAG,EAAE,CAAC,cAAc,IAAI,EAAE,CAAC,eAAe,IAAI,IAAI,CAAC;YAC/D,IAAI,KAAK,IAAI,IAAI,IAAI,MAAM,IAAI,IAAI,IAAI,MAAM,KAAK,KAAK;gBAAE,SAAS;YAClE,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAEO,SAAS;QACf,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,iBAAiB,EAAE,CAAC,WAAW,CAAC;QACzD,MAAM,CAAC,GAAG,IAAI,IAAI,EAAE,CAAC;QACrB,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,CAAC;QAC9B,OAAO,CAAC,CAAC;IACX,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,cAAsB,EAAE,MAAe;QAChD,MAAM,KAAK,GAAQ,EAAE,cAAc,EAAE,CAAC;QACtC,IAAI,MAAM,IAAI,MAAM,KAAK,KAAK;YAAE,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC;QACtD,OAAO,IAAI,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;IAC7E,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,KAA4B;QACvC,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,iBAAiB,EAAE,CAAC;QAC5C,IAAI,GAAG,CAAC,YAAY,EAAE,CAAC;YACrB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;YACzF,IAAI,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,QAAQ,CAAE,IAAY,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC5D,MAAM,IAAI,4BAAmB,CAAC,kCAAkC,CAAC,CAAC;YACpE,CAAC;QACH,CAAC;QACD,MAAM,UAAU,GAAG,KAAK,CAAC,UAAU,IAAI,IAAI,CAAC;QAC5C,4EAA4E;QAC5E,IAAI,UAAU,KAAK,QAAQ,EAAE,CAAC;YAC5B,MAAM,IAAI,4BAAmB,CAAC,qCAAqC,CAAC,CAAC;QACvE,CAAC;QACD,yEAAyE;QACzE,2EAA2E;QAC3E,8CAA8C;QAC9C,IAAI,IAAI,CAAC,MAAM,CAAC,sBAAsB,EAAE,IAAI,UAAU,IAAI,IAAI,EAAE,CAAC;YAC/D,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,SAAS,EAAE,UAAU,EAAE,KAAK,CAAC,YAAY,CAAC,EAAE,CAAC;gBAC3E,+DAA+D;gBAC/D,kDAAkD;gBAClD,MAAM,gCAAc,CAAC,gBAAgB,CAAC,oCAAoC,CAAC,CAAC;YAC9E,CAAC;QACH,CAAC;QACD,0EAA0E;QAC1E,2EAA2E;QAC3E,4EAA4E;QAC5E,MAAM,OAAO,GACX,IAAI,CAAC,MAAM,CAAC,sBAAsB,EAAE;YACpC,UAAU,IAAI,IAAI;YAClB,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,UAAU,CAAC,CAAC;QACzC,MAAM,cAAc,GAAG,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,YAAY,EAAE,EAAE,IAAI,IAAI,CAAC;QACvE,MAAM,KAAK,GAAG,IAAI,CAAC,aAAa,EAAE,CAAC;QACnC,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC,MAAM,CAAC;YAC9C,IAAI,EAAE;gBACJ,cAAc;gBACd,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,UAAU;gBACV,KAAK;gBACL,MAAM,EAAE,SAAS;gBACjB,WAAW,EAAE,KAAK,CAAC,SAAS,CAAC,EAAE;gBAC/B,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE;aAC5B;SACF,CAAC,CAAC;QACH,IAAI,GAAG,CAAC,mBAAmB,EAAE,CAAC;YAC5B,MAAM,GAAG,CAAC,mBAAmB,CAAC,UAAU,CAAC,CAAC;QAC5C,CAAC;QACD,OAAO,UAAU,CAAC;IACpB,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,EAAU;QACrB,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;QACvE,IAAI,CAAC,UAAU;YAAE,MAAM,IAAI,0BAAiB,CAAC,sBAAsB,CAAC,CAAC;QACrE,IAAK,UAAkB,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAC7C,MAAM,IAAI,4BAAmB,CAAC,wCAAwC,CAAC,CAAC;QAC1E,CAAC;QACD,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC,MAAM,CAAC;YAC7C,KAAK,EAAE,EAAE,EAAE,EAAE;YACb,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,aAAa,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,EAAE;SACnE,CAAC,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,iBAAiB,EAAE,CAAC;QAC5C,IAAI,GAAG,CAAC,mBAAmB;YAAE,MAAM,GAAG,CAAC,mBAAmB,CAAC,SAAS,CAAC,CAAC;QACtE,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,EAAU;QACrB,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;QACvE,IAAI,CAAC,UAAU;YAAE,MAAM,IAAI,0BAAiB,CAAC,sBAAsB,CAAC,CAAC;QACrE,IAAK,UAAkB,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAC7C,MAAM,IAAI,4BAAmB,CAAC,2CAA2C,CAAC,CAAC;QAC7E,CAAC;QACD,OAAO,IAAI,CAAC,QAAQ,EAAE,CAAC,MAAM,CAAC;YAC5B,KAAK,EAAE,EAAE,EAAE,EAAE;YACb,IAAI,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE;SAC9B,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,KAAa,EAAE,MAAe;QACzC,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC,UAAU,CAAC;YAClD,KAAK,EAAE,EAAE,KAAK,EAAE;YAChB,OAAO,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE;SAC5C,CAAC,CAAC;QACH,IAAI,CAAC,UAAU;YAAE,MAAM,IAAI,0BAAiB,CAAC,sBAAsB,CAAC,CAAC;QACrE,MAAM,GAAG,GAAQ,UAAU,CAAC;QAC5B,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS;YAAE,MAAM,IAAI,4BAAmB,CAAC,4BAA4B,CAAC,CAAC;QAC1F,IAAI,GAAG,CAAC,SAAS,GAAG,IAAI,IAAI,EAAE,EAAE,CAAC;YAC/B,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC;YACrF,MAAM,IAAI,4BAAmB,CAAC,oBAAoB,CAAC,CAAC;QACtD,CAAC;QAED,MAAM,UAAU,GAAG,GAAG,CAAC,UAAU,IAAI,GAAG,CAAC,WAAW,IAAI,IAAI,CAAC;QAE7D,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,mEAAmE;YACnE,OAAO;gBACL,oBAAoB,EAAE,IAAI;gBAC1B,YAAY,EAAE,GAAG,CAAC,YAAY;gBAC9B,IAAI,EAAE,GAAG,CAAC,IAAI;gBACd,KAAK,EAAE,GAAG,CAAC,KAAK;gBAChB,UAAU;aACX,CAAC;QACJ,CAAC;QAED,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC;YACzC,IAAI,EAAE;gBACJ,MAAM;gBACN,cAAc,EAAE,GAAG,CAAC,cAAc,IAAI,IAAI;gBAC1C,MAAM,EAAE,GAAG,CAAC,MAAM;gBAClB,UAAU;gBACV,WAAW,EAAE,EAAE;aAChB;SACF,CAAC,CAAC;QACH,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC,MAAM,CAAC;YAC3B,KAAK,EAAE,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE;YACrB,IAAI,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,UAAU,EAAE,IAAI,IAAI,EAAE,EAAE;SACrD,CAAC,CAAC;QACH,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,CAAC,YAAY,EAAE,UAAU,EAAE,CAAC;IACxE,CAAC;CACF,CAAA;AA/JY,8CAAiB;4BAAjB,iBAAiB;IAD7B,IAAA,mBAAU,GAAE;qCAGgB,8BAAa;QACb,iCAAkB;GAHlC,iBAAiB,CA+J7B"}

package/dist/services/membership.service.d.ts

@@ -0,0 +1,56 @@
+import { RhinoConfigService } from '../rhino.config';
+/**
+ * A single `user_roles` membership row, normalized across snake_case /
+ * camelCase shapes (Prisma vs raw SQL). `routeGroup === null` is a WILDCARD
+ * (Decision 9.B) — the row is a member of every group.
+ */
+export interface MembershipRow {
+    routeGroup: string | null;
+    organizationId: number | string | null;
+    permissions: unknown;
+    role?: any;
+}
+/**
+ * Membership enforcement & permission resolution (design §6).
+ *
+ * Gated entirely by `auth.enforceGroupMembership`:
+ *  - OFF (default): {@link enabled} is `false`; callers skip every check and
+ *    fall back to the legacy org-presence heuristic. Behavior is unchanged.
+ *  - ON: a user must hold a `user_roles` row whose `route_group` matches the
+ *    request's group (a NULL row is a wildcard) and — for tenant groups — whose
+ *    organization matches the resolved org. Permissions then resolve from that
+ *    matched row only.
+ *
+ * Membership is a COARSE gate (may you enter the group); the ResourcePolicy
+ * remains the FINE check. They run in sequence and are never merged.
+ */
+export declare class MembershipService {
+    private readonly config;
+    constructor(config: RhinoConfigService);
+    /** Whether membership enforcement is active at all. */
+    enabled(): boolean;
+    private userRoles;
+    /**
+     * Find the membership rows that admit `user` into `routeGroup` for the given
+     * organization. A row matches when:
+     *   - its `route_group` is NULL (wildcard) OR equals `routeGroup`, AND
+     *   - for tenant groups, its organization equals the resolved org's id
+     *     (NULL-org wildcard rows still match); for non-tenant groups the org is
+     *     ignored entirely.
+     */
+    matchingRows(user: any, routeGroup: string | null | undefined, organization: {
+        id: number | string;
+    } | null | undefined, isTenant: boolean): MembershipRow[];
+    /**
+     * Whether `user` is a member of `routeGroup` (for the resolved org, when the
+     * group is a tenant group). Only meaningful when {@link enabled}.
+     */
+    isMember(user: any, routeGroup: string | null | undefined, organization: {
+        id: number | string;
+    } | null | undefined, isTenant: boolean): boolean;
+    /**
+     * Permissions granted to the user from the matched membership rows only
+     * (design §6: "permissions then resolve from that matching membership row").
+     */
+    permissionsFromRows(rows: MembershipRow[]): string[];
+}

package/dist/services/membership.service.js

@@ -0,0 +1,113 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MembershipService = void 0;
+const common_1 = require("@nestjs/common");
+const rhino_config_1 = require("../rhino.config");
+const permission_matcher_1 = require("../utils/permission-matcher");
+function readRouteGroup(ur) {
+    const v = ur.routeGroup ?? ur.route_group;
+    return v == null ? null : String(v);
+}
+function readOrgId(ur) {
+    const v = ur.organizationId ?? ur.organization_id;
+    return v == null ? null : v;
+}
+/**
+ * Membership enforcement & permission resolution (design §6).
+ *
+ * Gated entirely by `auth.enforceGroupMembership`:
+ *  - OFF (default): {@link enabled} is `false`; callers skip every check and
+ *    fall back to the legacy org-presence heuristic. Behavior is unchanged.
+ *  - ON: a user must hold a `user_roles` row whose `route_group` matches the
+ *    request's group (a NULL row is a wildcard) and — for tenant groups — whose
+ *    organization matches the resolved org. Permissions then resolve from that
+ *    matched row only.
+ *
+ * Membership is a COARSE gate (may you enter the group); the ResourcePolicy
+ * remains the FINE check. They run in sequence and are never merged.
+ */
+let MembershipService = class MembershipService {
+    config;
+    constructor(config) {
+        this.config = config;
+    }
+    /** Whether membership enforcement is active at all. */
+    enabled() {
+        return this.config.enforceGroupMembership();
+    }
+    userRoles(user) {
+        if (!user)
+            return [];
+        return user.userRoles ?? user.user_roles ?? [];
+    }
+    /**
+     * Find the membership rows that admit `user` into `routeGroup` for the given
+     * organization. A row matches when:
+     *   - its `route_group` is NULL (wildcard) OR equals `routeGroup`, AND
+     *   - for tenant groups, its organization equals the resolved org's id
+     *     (NULL-org wildcard rows still match); for non-tenant groups the org is
+     *     ignored entirely.
+     */
+    matchingRows(user, routeGroup, organization, isTenant) {
+        const group = routeGroup == null ? null : String(routeGroup);
+        const orgId = organization?.id ?? null;
+        const rows = [];
+        for (const ur of this.userRoles(user)) {
+            const rowGroup = readRouteGroup(ur);
+            // route_group gate: NULL row is a wildcard, else must equal the group.
+            if (rowGroup !== null && group !== null && rowGroup !== group)
+                continue;
+            // (a concrete group request with a non-matching concrete row is rejected
+            // above; a NULL request — legacy/global — matches any row.)
+            const rowOrg = readOrgId(ur);
+            if (isTenant && orgId != null) {
+                // Tenant group with a resolved org: the row must target that org, or be
+                // an org-wildcard (NULL org) row.
+                if (rowOrg !== null && rowOrg !== orgId)
+                    continue;
+            }
+            // Non-tenant group: org is ignored.
+            rows.push({
+                routeGroup: rowGroup,
+                organizationId: rowOrg,
+                permissions: ur.permissions,
+                role: ur.role,
+            });
+        }
+        return rows;
+    }
+    /**
+     * Whether `user` is a member of `routeGroup` (for the resolved org, when the
+     * group is a tenant group). Only meaningful when {@link enabled}.
+     */
+    isMember(user, routeGroup, organization, isTenant) {
+        return this.matchingRows(user, routeGroup, organization, isTenant).length > 0;
+    }
+    /**
+     * Permissions granted to the user from the matched membership rows only
+     * (design §6: "permissions then resolve from that matching membership row").
+     */
+    permissionsFromRows(rows) {
+        const out = [];
+        for (const r of rows) {
+            for (const p of (0, permission_matcher_1.coercePermissions)(r.permissions))
+                out.push(p);
+        }
+        return out;
+    }
+};
+exports.MembershipService = MembershipService;
+exports.MembershipService = MembershipService = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [rhino_config_1.RhinoConfigService])
+], MembershipService);
+//# sourceMappingURL=membership.service.js.map

package/dist/services/membership.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"membership.service.js","sourceRoot":"","sources":["../../src/services/membership.service.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,2CAA4C;AAC5C,kDAAqD;AACrD,oEAAgE;AAchE,SAAS,cAAc,CAAC,EAAO;IAC7B,MAAM,CAAC,GAAG,EAAE,CAAC,UAAU,IAAI,EAAE,CAAC,WAAW,CAAC;IAC1C,OAAO,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;AACtC,CAAC;AAED,SAAS,SAAS,CAAC,EAAO;IACxB,MAAM,CAAC,GAAG,EAAE,CAAC,cAAc,IAAI,EAAE,CAAC,eAAe,CAAC;IAClD,OAAO,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;AAC9B,CAAC;AAED;;;;;;;;;;;;;GAaG;AAEI,IAAM,iBAAiB,GAAvB,MAAM,iBAAiB;IACC;IAA7B,YAA6B,MAA0B;QAA1B,WAAM,GAAN,MAAM,CAAoB;IAAG,CAAC;IAE3D,uDAAuD;IACvD,OAAO;QACL,OAAO,IAAI,CAAC,MAAM,CAAC,sBAAsB,EAAE,CAAC;IAC9C,CAAC;IAEO,SAAS,CAAC,IAAS;QACzB,IAAI,CAAC,IAAI;YAAE,OAAO,EAAE,CAAC;QACrB,OAAO,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,UAAU,IAAI,EAAE,CAAC;IACjD,CAAC;IAED;;;;;;;OAOG;IACH,YAAY,CACV,IAAS,EACT,UAAqC,EACrC,YAAwD,EACxD,QAAiB;QAEjB,MAAM,KAAK,GAAG,UAAU,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QAC7D,MAAM,KAAK,GAAG,YAAY,EAAE,EAAE,IAAI,IAAI,CAAC;QACvC,MAAM,IAAI,GAAoB,EAAE,CAAC;QACjC,KAAK,MAAM,EAAE,IAAI,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;YACtC,MAAM,QAAQ,GAAG,cAAc,CAAC,EAAE,CAAC,CAAC;YACpC,uEAAuE;YACvE,IAAI,QAAQ,KAAK,IAAI,IAAI,KAAK,KAAK,IAAI,IAAI,QAAQ,KAAK,KAAK;gBAAE,SAAS;YACxE,yEAAyE;YACzE,4DAA4D;YAC5D,MAAM,MAAM,GAAG,SAAS,CAAC,EAAE,CAAC,CAAC;YAC7B,IAAI,QAAQ,IAAI,KAAK,IAAI,IAAI,EAAE,CAAC;gBAC9B,wEAAwE;gBACxE,kCAAkC;gBAClC,IAAI,MAAM,KAAK,IAAI,IAAI,MAAM,KAAK,KAAK;oBAAE,SAAS;YACpD,CAAC;YACD,oCAAoC;YACpC,IAAI,CAAC,IAAI,CAAC;gBACR,UAAU,EAAE,QAAQ;gBACpB,cAAc,EAAE,MAAM;gBACtB,WAAW,EAAE,EAAE,CAAC,WAAW;gBAC3B,IAAI,EAAE,EAAE,CAAC,IAAI;aACd,CAAC,CAAC;QACL,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;OAGG;IACH,QAAQ,CACN,IAAS,EACT,UAAqC,EACrC,YAAwD,EACxD,QAAiB;QAEjB,OAAO,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,UAAU,EAAE,YAAY,EAAE,QAAQ,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;IAChF,CAAC;IAED;;;OAGG;IACH,mBAAmB,CAAC,IAAqB;QACvC,MAAM,GAAG,GAAa,EAAE,CAAC;QACzB,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;YACrB,KAAK,MAAM,CAAC,IAAI,IAAA,sCAAiB,EAAC,CAAC,CAAC,WAAW,CAAC;gBAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAChE,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;CACF,CAAA;AA7EY,8CAAiB;4BAAjB,iBAAiB;IAD7B,IAAA,mBAAU,GAAE;qCAE0B,iCAAkB;GAD5C,iBAAiB,CA6E7B"}

package/dist/services/organization.service.js

@@ -36,7 +36,14 @@ let OrganizationService = class OrganizationService {
         const org = await delegate.findFirst({ where: { [column]: value } });
         if (!org)
             throw new common_1.NotFoundException('Organization not found');
-        if (user) {
+        // FIX 11.2: when group-membership enforcement is ON, an authenticated
+        // non-member must receive 403 from GroupMembershipGuard, which takes
+        // precedence over this org-resolution 404. So we DON'T 404 here for a
+        // non-member — we resolve & attach the org and let the downstream guard
+        // decide (allow vs 403). A genuinely non-existent org still 404s above.
+        // When enforcement is OFF (default), behavior is byte-for-byte unchanged:
+        // a non-member still gets the info-hiding 404 here.
+        if (user && !this.config.enforceGroupMembership()) {
             await this.ensureMembership(user, org);
         }
         return org;

package/dist/services/organization.service.js.map

@@ -1 +1 @@
-{"version":3,"file":"organization.service.js","sourceRoot":"","sources":["../../src/services/organization.service.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,2CAA+D;AAC/D,6DAAyD;AACzD,kDAAqD;AAErD;;;GAGG;AAEI,IAAM,mBAAmB,GAAzB,MAAM,mBAAmB;IAEX;IACA;IAFnB,YACmB,MAAqB,EACrB,MAA0B;QAD1B,WAAM,GAAN,MAAM,CAAe;QACrB,WAAM,GAAN,MAAM,CAAoB;IAC1C,CAAC;IAEJ,KAAK,CAAC,OAAO,CAAC,UAA2B,EAAE,IAAU;QACnD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,4BAA4B,EAAE,CAAC;QAC1D,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,iBAAiB,IAAI,cAAc,CAAC;QACrF,MAAM,KAAK,GACT,MAAM,KAAK,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;YACjD,CAAC,CAAC,MAAM,KAAK,IAAI;gBACf,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC;gBACpB,CAAC,CAAC,UAAU;YACd,CAAC,CAAC,UAAU,CAAC;QAEjB,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QAC9C,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;QACrE,IAAI,CAAC,GAAG;YAAE,MAAM,IAAI,0BAAiB,CAAC,wBAAwB,CAAC,CAAC;QAEhE,IAAI,IAAI,EAAE,CAAC;YACT,MAAM,IAAI,CAAC,gBAAgB,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QACzC,CAAC;QAED,OAAO,GAAG,CAAC;IACb,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,IAAS,EAAE,GAAQ;QACxC,MAAM,YAAY,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,qBAAqB,IAAI,UAAU,CAAC;QACxF,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QACjD,MAAM,UAAU,GAAG,MAAM,QAAQ,CAAC,SAAS,CAAC;YAC1C,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,cAAc,EAAE,GAAG,CAAC,EAAE,EAAE;SACnD,CAAC,CAAC;QACH,IAAI,CAAC,UAAU;YAAE,MAAM,IAAI,0BAAiB,CAAC,wBAAwB,CAAC,CAAC;IACzE,CAAC;CACF,CAAA;AAnCY,kDAAmB;8BAAnB,mBAAmB;IAD/B,IAAA,mBAAU,GAAE;qCAGgB,8BAAa;QACb,iCAAkB;GAHlC,mBAAmB,CAmC/B"}
+{"version":3,"file":"organization.service.js","sourceRoot":"","sources":["../../src/services/organization.service.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,2CAA+D;AAC/D,6DAAyD;AACzD,kDAAqD;AAErD;;;GAGG;AAEI,IAAM,mBAAmB,GAAzB,MAAM,mBAAmB;IAEX;IACA;IAFnB,YACmB,MAAqB,EACrB,MAA0B;QAD1B,WAAM,GAAN,MAAM,CAAe;QACrB,WAAM,GAAN,MAAM,CAAoB;IAC1C,CAAC;IAEJ,KAAK,CAAC,OAAO,CAAC,UAA2B,EAAE,IAAU;QACnD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,4BAA4B,EAAE,CAAC;QAC1D,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,iBAAiB,IAAI,cAAc,CAAC;QACrF,MAAM,KAAK,GACT,MAAM,KAAK,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;YACjD,CAAC,CAAC,MAAM,KAAK,IAAI;gBACf,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC;gBACpB,CAAC,CAAC,UAAU;YACd,CAAC,CAAC,UAAU,CAAC;QAEjB,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QAC9C,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;QACrE,IAAI,CAAC,GAAG;YAAE,MAAM,IAAI,0BAAiB,CAAC,wBAAwB,CAAC,CAAC;QAEhE,sEAAsE;QACtE,qEAAqE;QACrE,sEAAsE;QACtE,wEAAwE;QACxE,wEAAwE;QACxE,0EAA0E;QAC1E,oDAAoD;QACpD,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,sBAAsB,EAAE,EAAE,CAAC;YAClD,MAAM,IAAI,CAAC,gBAAgB,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QACzC,CAAC;QAED,OAAO,GAAG,CAAC;IACb,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,IAAS,EAAE,GAAQ;QACxC,MAAM,YAAY,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,qBAAqB,IAAI,UAAU,CAAC;QACxF,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QACjD,MAAM,UAAU,GAAG,MAAM,QAAQ,CAAC,SAAS,CAAC;YAC1C,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,cAAc,EAAE,GAAG,CAAC,EAAE,EAAE;SACnD,CAAC,CAAC;QACH,IAAI,CAAC,UAAU;YAAE,MAAM,IAAI,0BAAiB,CAAC,wBAAwB,CAAC,CAAC;IACzE,CAAC;CACF,CAAA;AA1CY,kDAAmB;8BAAnB,mBAAmB;IAD/B,IAAA,mBAAU,GAAE;qCAGgB,8BAAa;QACb,iCAAkB;GAHlC,mBAAmB,CA0C/B"}

package/dist/services/route-registration.service.d.ts

@@ -33,6 +33,7 @@ export declare function describeRoutes(config: RhinoConfigService): Array<{
     group: string;
     slug: string;
     prefix: string;
+    domain: string | null;
     model: string;
     softDeletes: boolean;
     hasAuditTrail: boolean;