@rhino-dev/rhino-nestjs 4.0.0 → 4.2.1

package/dist/utils/domain-pattern.d.ts

@@ -0,0 +1,36 @@
+/**
+ * Domain pattern matching for route-group `domain` constraints.
+ *
+ * A route group's `domain` can be:
+ *   - a literal host, e.g. `admin.example.com` (exact, case-insensitive match)
+ *   - a parameterized host, e.g. `{organization}.example.com`, where the
+ *     `{name}` segment is captured and exposed so that organization resolution
+ *     can use it (subdomain multitenancy).
+ *
+ * Mirrors Laravel's `Route::domain(...)`, where a `{param}` in the domain is
+ * exposed as a route parameter that flows into ResolveOrganizationFromRoute.
+ */
+export interface CompiledDomain {
+    /** The raw pattern (as configured). */
+    pattern: string;
+    /** Whether the pattern contains at least one `{param}` placeholder. */
+    parameterized: boolean;
+    /** Ordered list of parameter names captured by the pattern. */
+    params: string[];
+    /** Anchored, case-insensitive regex used to test a host. */
+    regex: RegExp;
+}
+/**
+ * Compile a `domain` pattern into a matcher. Returns `null` for an empty /
+ * missing pattern (meaning "match any host").
+ */
+export declare function compileDomain(pattern: string | undefined | null): CompiledDomain | null;
+export interface DomainMatch {
+    /** Captured `{param}` values keyed by name (empty for literal domains). */
+    params: Record<string, string>;
+}
+/**
+ * Test a host against a compiled domain pattern. Returns the captured params
+ * on success, or `null` when the host does not match.
+ */
+export declare function matchDomain(compiled: CompiledDomain, host: string | undefined | null): DomainMatch | null;

package/dist/utils/domain-pattern.js

@@ -0,0 +1,77 @@
+"use strict";
+/**
+ * Domain pattern matching for route-group `domain` constraints.
+ *
+ * A route group's `domain` can be:
+ *   - a literal host, e.g. `admin.example.com` (exact, case-insensitive match)
+ *   - a parameterized host, e.g. `{organization}.example.com`, where the
+ *     `{name}` segment is captured and exposed so that organization resolution
+ *     can use it (subdomain multitenancy).
+ *
+ * Mirrors Laravel's `Route::domain(...)`, where a `{param}` in the domain is
+ * exposed as a route parameter that flows into ResolveOrganizationFromRoute.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.compileDomain = compileDomain;
+exports.matchDomain = matchDomain;
+const PARAM_RE = /\{([A-Za-z_][A-Za-z0-9_]*)\}/g;
+function escapeRegex(s) {
+    return s.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+}
+/**
+ * Compile a `domain` pattern into a matcher. Returns `null` for an empty /
+ * missing pattern (meaning "match any host").
+ */
+function compileDomain(pattern) {
+    if (pattern == null)
+        return null;
+    const trimmed = String(pattern).trim();
+    if (trimmed === '')
+        return null;
+    const params = [];
+    let lastIndex = 0;
+    let source = '';
+    PARAM_RE.lastIndex = 0;
+    let m;
+    while ((m = PARAM_RE.exec(trimmed)) !== null) {
+        // literal text before the placeholder
+        source += escapeRegex(trimmed.slice(lastIndex, m.index));
+        const name = m[1];
+        params.push(name);
+        // a host label cannot contain a dot — capture a single label segment
+        source += `(?<${name}>[^.]+)`;
+        lastIndex = m.index + m[0].length;
+    }
+    source += escapeRegex(trimmed.slice(lastIndex));
+    return {
+        pattern: trimmed,
+        parameterized: params.length > 0,
+        params,
+        regex: new RegExp(`^${source}$`, 'i'),
+    };
+}
+/**
+ * Test a host against a compiled domain pattern. Returns the captured params
+ * on success, or `null` when the host does not match.
+ */
+function matchDomain(compiled, host) {
+    if (host == null)
+        return null;
+    // Strip an optional port (Express `req.hostname` excludes it, but be safe).
+    const cleaned = String(host).split(':')[0];
+    if (cleaned === '')
+        return null;
+    const result = compiled.regex.exec(cleaned);
+    if (!result)
+        return null;
+    const params = {};
+    if (result.groups) {
+        for (const name of compiled.params) {
+            const value = result.groups[name];
+            if (value !== undefined)
+                params[name] = value;
+        }
+    }
+    return { params };
+}
+//# sourceMappingURL=domain-pattern.js.map

package/dist/utils/domain-pattern.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"domain-pattern.js","sourceRoot":"","sources":["../../src/utils/domain-pattern.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;GAWG;;AAuBH,sCA2BC;AAWD,kCAeC;AA/DD,MAAM,QAAQ,GAAG,+BAA+B,CAAC;AAEjD,SAAS,WAAW,CAAC,CAAS;IAC5B,OAAO,CAAC,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;AAClD,CAAC;AAED;;;GAGG;AACH,SAAgB,aAAa,CAAC,OAAkC;IAC9D,IAAI,OAAO,IAAI,IAAI;QAAE,OAAO,IAAI,CAAC;IACjC,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;IACvC,IAAI,OAAO,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IAEhC,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,SAAS,GAAG,CAAC,CAAC;IAClB,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,QAAQ,CAAC,SAAS,GAAG,CAAC,CAAC;IACvB,IAAI,CAAyB,CAAC;IAC9B,OAAO,CAAC,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QAC7C,sCAAsC;QACtC,MAAM,IAAI,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;QACzD,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAClB,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAClB,qEAAqE;QACrE,MAAM,IAAI,MAAM,IAAI,SAAS,CAAC;QAC9B,SAAS,GAAG,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;IACpC,CAAC;IACD,MAAM,IAAI,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC;IAEhD,OAAO;QACL,OAAO,EAAE,OAAO;QAChB,aAAa,EAAE,MAAM,CAAC,MAAM,GAAG,CAAC;QAChC,MAAM;QACN,KAAK,EAAE,IAAI,MAAM,CAAC,IAAI,MAAM,GAAG,EAAE,GAAG,CAAC;KACtC,CAAC;AACJ,CAAC;AAOD;;;GAGG;AACH,SAAgB,WAAW,CAAC,QAAwB,EAAE,IAA+B;IACnF,IAAI,IAAI,IAAI,IAAI;QAAE,OAAO,IAAI,CAAC;IAC9B,4EAA4E;IAC5E,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3C,IAAI,OAAO,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IAChC,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC5C,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,MAAM,MAAM,GAA2B,EAAE,CAAC;IAC1C,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;QAClB,KAAK,MAAM,IAAI,IAAI,QAAQ,CAAC,MAAM,EAAE,CAAC;YACnC,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YAClC,IAAI,KAAK,KAAK,SAAS;gBAAE,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;QAChD,CAAC;IACH,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,CAAC;AACpB,CAAC"}

package/dist/utils/permission-matcher.js

@@ -91,6 +91,14 @@ function resolveUserRoleSlug(user, organizationId) {
 function resolveUserPermissions(user, organizationId) {
     if (!user)
         return [];
+    // Group-membership enforcement (design §6): when the membership layer has
+    // resolved the matching row(s), the permission source switches to that row
+    // only. The guard attaches the resolved list as `__membershipPermissions`.
+    // Absent (enforcement off) → fall through to the legacy heuristic, so
+    // existing behavior is byte-for-byte unchanged.
+    if (Array.isArray(user.__membershipPermissions)) {
+        return coercePermissions(user.__membershipPermissions);
+    }
     if (organizationId != null) {
         const userRoles = user.userRoles ?? user.user_roles ?? [];
         const all = [];

package/dist/utils/permission-matcher.js.map

@@ -1 +1 @@
-{"version":3,"file":"permission-matcher.js","sourceRoot":"","sources":["../../src/utils/permission-matcher.ts"],"names":[],"mappings":";;AAeA,8CAiBC;AAaD,8CAYC;AAMD,kDAUC;AAQD,wDAgBC;AAKD,8CASC;AA/GD;;;;;;;;;;;;;;GAcG;AACH,SAAgB,iBAAiB,CAAC,GAAY;IAC5C,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QAAE,OAAO,GAAe,CAAC;IAC/C,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,EAAE,CAAC;IACvC,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IAC3B,IAAI,OAAO,KAAK,EAAE;QAAE,OAAO,EAAE,CAAC;IAC9B,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAC5B,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YACnC,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;gBAAE,OAAO,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACvD,CAAC;QAAC,MAAM,CAAC;YACP,iCAAiC;QACnC,CAAC;IACH,CAAC;IACD,OAAO,OAAO;SACX,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AACjC,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAgB,iBAAiB,CAC/B,UAAkB,EAClB,OAA6C;IAE7C,MAAM,IAAI,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;IACxC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACpC,MAAM,IAAI,GAAG,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC5C,MAAM,YAAY,GAAG,GAAG,IAAI,IAAI,CAAC;IACjC,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;QACrB,IAAI,CAAC,KAAK,UAAU,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,YAAY;YAAE,OAAO,IAAI,CAAC;IACvE,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;GAGG;AACH,SAAgB,mBAAmB,CAAC,IAAS,EAAE,cAAkD;IAC/F,IAAI,CAAC,IAAI,IAAI,cAAc,IAAI,IAAI;QAAE,OAAO,IAAI,CAAC;IACjD,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,UAAU,IAAI,EAAE,CAAC;IAC1D,KAAK,MAAM,EAAE,IAAI,SAAS,EAAE,CAAC;QAC3B,MAAM,KAAK,GAAG,EAAE,CAAC,cAAc,IAAI,EAAE,CAAC,eAAe,CAAC;QACtD,IAAI,KAAK,KAAK,cAAc,EAAE,CAAC;YAC7B,OAAO,EAAE,CAAC,IAAI,EAAE,IAAI,IAAI,EAAE,CAAC,QAAQ,IAAI,EAAE,CAAC,SAAS,IAAI,IAAI,CAAC;QAC9D,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;GAKG;AACH,SAAgB,sBAAsB,CAAC,IAAS,EAAE,cAAuC;IACvF,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,CAAC;IACrB,IAAI,cAAc,IAAI,IAAI,EAAE,CAAC;QAC3B,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,UAAU,IAAI,EAAE,CAAC;QAC1D,MAAM,GAAG,GAAa,EAAE,CAAC;QACzB,KAAK,MAAM,EAAE,IAAI,SAAS,EAAE,CAAC;YAC3B,MAAM,KAAK,GAAG,EAAE,CAAC,cAAc,IAAI,EAAE,CAAC,eAAe,CAAC;YACtD,IAAI,KAAK,KAAK,cAAc,EAAE,CAAC;gBAC7B,iEAAiE;gBACjE,sEAAsE;gBACtE,KAAK,MAAM,CAAC,IAAI,iBAAiB,CAAC,EAAE,CAAC,WAAW,CAAC;oBAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACjE,CAAC;QACH,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IACD,OAAO,iBAAiB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;AAC7C,CAAC;AAED;;GAEG;AACH,SAAgB,iBAAiB,CAC/B,IAAS,EACT,UAAkB,EAClB,YAA6C;IAE7C,IAAI,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC;IACxB,MAAM,KAAK,GAAG,YAAY,CAAC,CAAC,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IACpD,MAAM,WAAW,GAAG,sBAAsB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACxD,OAAO,iBAAiB,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;AACpD,CAAC"}
+{"version":3,"file":"permission-matcher.js","sourceRoot":"","sources":["../../src/utils/permission-matcher.ts"],"names":[],"mappings":";;AAeA,8CAiBC;AAaD,8CAYC;AAMD,kDAUC;AAQD,wDAwBC;AAKD,8CASC;AAvHD;;;;;;;;;;;;;;GAcG;AACH,SAAgB,iBAAiB,CAAC,GAAY;IAC5C,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QAAE,OAAO,GAAe,CAAC;IAC/C,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,EAAE,CAAC;IACvC,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IAC3B,IAAI,OAAO,KAAK,EAAE;QAAE,OAAO,EAAE,CAAC;IAC9B,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAC5B,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YACnC,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;gBAAE,OAAO,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACvD,CAAC;QAAC,MAAM,CAAC;YACP,iCAAiC;QACnC,CAAC;IACH,CAAC;IACD,OAAO,OAAO;SACX,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AACjC,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAgB,iBAAiB,CAC/B,UAAkB,EAClB,OAA6C;IAE7C,MAAM,IAAI,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;IACxC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACpC,MAAM,IAAI,GAAG,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC5C,MAAM,YAAY,GAAG,GAAG,IAAI,IAAI,CAAC;IACjC,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;QACrB,IAAI,CAAC,KAAK,UAAU,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,YAAY;YAAE,OAAO,IAAI,CAAC;IACvE,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;GAGG;AACH,SAAgB,mBAAmB,CAAC,IAAS,EAAE,cAAkD;IAC/F,IAAI,CAAC,IAAI,IAAI,cAAc,IAAI,IAAI;QAAE,OAAO,IAAI,CAAC;IACjD,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,UAAU,IAAI,EAAE,CAAC;IAC1D,KAAK,MAAM,EAAE,IAAI,SAAS,EAAE,CAAC;QAC3B,MAAM,KAAK,GAAG,EAAE,CAAC,cAAc,IAAI,EAAE,CAAC,eAAe,CAAC;QACtD,IAAI,KAAK,KAAK,cAAc,EAAE,CAAC;YAC7B,OAAO,EAAE,CAAC,IAAI,EAAE,IAAI,IAAI,EAAE,CAAC,QAAQ,IAAI,EAAE,CAAC,SAAS,IAAI,IAAI,CAAC;QAC9D,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;GAKG;AACH,SAAgB,sBAAsB,CAAC,IAAS,EAAE,cAAuC;IACvF,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,CAAC;IACrB,0EAA0E;IAC1E,2EAA2E;IAC3E,2EAA2E;IAC3E,sEAAsE;IACtE,gDAAgD;IAChD,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,uBAAuB,CAAC,EAAE,CAAC;QAChD,OAAO,iBAAiB,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;IACzD,CAAC;IACD,IAAI,cAAc,IAAI,IAAI,EAAE,CAAC;QAC3B,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,UAAU,IAAI,EAAE,CAAC;QAC1D,MAAM,GAAG,GAAa,EAAE,CAAC;QACzB,KAAK,MAAM,EAAE,IAAI,SAAS,EAAE,CAAC;YAC3B,MAAM,KAAK,GAAG,EAAE,CAAC,cAAc,IAAI,EAAE,CAAC,eAAe,CAAC;YACtD,IAAI,KAAK,KAAK,cAAc,EAAE,CAAC;gBAC7B,iEAAiE;gBACjE,sEAAsE;gBACtE,KAAK,MAAM,CAAC,IAAI,iBAAiB,CAAC,EAAE,CAAC,WAAW,CAAC;oBAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACjE,CAAC;QACH,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IACD,OAAO,iBAAiB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;AAC7C,CAAC;AAED;;GAEG;AACH,SAAgB,iBAAiB,CAC/B,IAAS,EACT,UAAkB,EAClB,YAA6C;IAE7C,IAAI,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC;IACxB,MAAM,KAAK,GAAG,YAAY,CAAC,CAAC,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IACpD,MAAM,WAAW,GAAG,sBAAsB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACxD,OAAO,iBAAiB,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;AACpD,CAAC"}

package/dist/utils/route-group-validator.d.ts

@@ -0,0 +1,14 @@
+import type { RhinoConfig } from '../interfaces/rhino-config.interface';
+/**
+ * Thrown at config-normalization (boot) time when two route groups would
+ * resolve to the same routes and silently shadow one another.
+ *
+ * This happens when two groups share the same effective prefix, have
+ * intersecting host-sets (no `domain` = matches every host; identical domain
+ * pattern), and register overlapping models. Failing fast prevents a dangerous
+ * misconfiguration (e.g. a `skipAuth` group shadowing an authenticated one).
+ */
+export declare class RouteGroupConflictError extends Error {
+    constructor(message: string);
+}
+export declare function validateRouteGroups(config: RhinoConfig): void;

package/dist/utils/route-group-validator.js

@@ -0,0 +1,124 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RouteGroupConflictError = void 0;
+exports.validateRouteGroups = validateRouteGroups;
+/**
+ * Thrown at config-normalization (boot) time when two route groups would
+ * resolve to the same routes and silently shadow one another.
+ *
+ * This happens when two groups share the same effective prefix, have
+ * intersecting host-sets (no `domain` = matches every host; identical domain
+ * pattern), and register overlapping models. Failing fast prevents a dangerous
+ * misconfiguration (e.g. a `skipAuth` group shadowing an authenticated one).
+ */
+class RouteGroupConflictError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'RouteGroupConflictError';
+    }
+}
+exports.RouteGroupConflictError = RouteGroupConflictError;
+function normalizePrefix(group) {
+    return String(group.prefix ?? '');
+}
+/** An undefined/blank domain means "any host". */
+function normalizeDomain(group) {
+    const domain = group.domain;
+    if (domain == null || String(domain).trim() === '')
+        return null;
+    return String(domain);
+}
+function hostSetsIntersect(a, b) {
+    const da = normalizeDomain(a);
+    const db = normalizeDomain(b);
+    // A wildcard host (no domain) intersects with any other host-set.
+    if (da === null || db === null)
+        return true;
+    // Two explicit domain patterns intersect only when identical.
+    return da === db;
+}
+function resolveModels(group, allModels) {
+    if (group.models === '*')
+        return Object.keys(allModels ?? {});
+    return group.models ?? [];
+}
+function overlappingModels(a, b, allModels) {
+    const ma = new Set(resolveModels(a, allModels));
+    return resolveModels(b, allModels).filter((slug) => ma.has(slug));
+}
+function buildMessage(aName, bName, a, b, shared) {
+    const prefix = normalizePrefix(a);
+    const prefixLabel = prefix === '' ? '(root)' : `'${prefix}'`;
+    const da = normalizeDomain(a);
+    const db = normalizeDomain(b);
+    const domainLabel = da === null && db === null
+        ? 'no domain'
+        : `domains [${da ?? 'any'}, ${db ?? 'any'}]`;
+    return (`Route groups '${aName}' and '${bName}' conflict: they share prefix ` +
+        `${prefixLabel} with ${domainLabel} and overlapping models (${shared.join(', ')}), ` +
+        `so one would silently shadow the other. Give them distinct prefixes, or ` +
+        `distinguish them with different 'domain' values, or make their 'models' disjoint.`);
+}
+/**
+ * Validate the configured route groups and throw RouteGroupConflictError when
+ * two groups would silently shadow each other.
+ *
+ * A route group's routing identity is the pair (host-set, prefix), per model.
+ * Two groups conflict when ALL of the following hold:
+ *
+ *   1. Their host-sets intersect (a group with no `domain` is a wildcard host).
+ *   2. They share the same effective prefix (undefined/'' is the same root).
+ *   3. Their model sets overlap ('*' expands to every registered model).
+ *
+ * With a distinguishing domain, the prefix is optional (the host disambiguates);
+ * without a domain, the prefix is the only disambiguator, so two or more
+ * overlapping groups must use distinct prefixes.
+ *
+ * Note: conservative static check — exotic cross-pattern overlaps (a literal
+ * host that also satisfies another group's `{param}.example.com`) are not
+ * statically detected.
+ */
+/**
+ * Whether a group registers the legacy/global (empty-prefix, no-domain) auth
+ * route set. Per design §11.1, such an auth-enabled group IS the default auth
+ * path. Two or more of them are genuinely indistinguishable — their auth routes
+ * (and hooks/membership) would collide with no way to tell them apart — so the
+ * validator must reject the config at boot.
+ */
+function isIndistinguishableAuthGroup(group) {
+    return (group.auth === true &&
+        normalizePrefix(group) === '' &&
+        normalizeDomain(group) === null);
+}
+function validateRouteGroups(config) {
+    const groups = config.routeGroups ?? {};
+    const models = config.models ?? {};
+    const names = Object.keys(groups);
+    // FIX 11.1: two+ auth-enabled groups with empty prefix AND no domain are
+    // genuinely indistinguishable — they'd register the same legacy `/auth/*`
+    // routes. The `public` group is never auth-enabled, so it can't collide here.
+    const indistinguishableAuth = names.filter((n) => n !== 'public' && isIndistinguishableAuthGroup(groups[n]));
+    if (indistinguishableAuth.length >= 2) {
+        const [a, b] = indistinguishableAuth;
+        throw new RouteGroupConflictError(`Auth-enabled route groups '${a}' and '${b}' are indistinguishable: ` +
+            `both have an empty prefix and no domain, so they would register the ` +
+            `same legacy auth routes and their hooks/membership could not be told ` +
+            `apart. Give one a distinct 'prefix' or a 'domain', or disable 'auth' ` +
+            `on all but one.`);
+    }
+    for (let i = 0; i < names.length; i++) {
+        for (let j = i + 1; j < names.length; j++) {
+            const a = groups[names[i]];
+            const b = groups[names[j]];
+            if (!hostSetsIntersect(a, b))
+                continue;
+            if (normalizePrefix(a) !== normalizePrefix(b))
+                continue;
+            const shared = overlappingModels(a, b, models);
+            if (shared.length === 0)
+                continue;
+            throw new RouteGroupConflictError(buildMessage(names[i], names[j], a, b, shared));
+        }
+    }
+}
+//# sourceMappingURL=route-group-validator.js.map

package/dist/utils/route-group-validator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"route-group-validator.js","sourceRoot":"","sources":["../../src/utils/route-group-validator.ts"],"names":[],"mappings":";;;AAqHA,kDAsCC;AAtJD;;;;;;;;GAQG;AACH,MAAa,uBAAwB,SAAQ,KAAK;IAChD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,yBAAyB,CAAC;IACxC,CAAC;CACF;AALD,0DAKC;AAED,SAAS,eAAe,CAAC,KAAuB;IAC9C,OAAO,MAAM,CAAC,KAAK,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;AACpC,CAAC;AAED,kDAAkD;AAClD,SAAS,eAAe,CAAC,KAAuB;IAC9C,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;IAC5B,IAAI,MAAM,IAAI,IAAI,IAAI,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IAChE,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC;AACxB,CAAC;AAED,SAAS,iBAAiB,CAAC,CAAmB,EAAE,CAAmB;IACjE,MAAM,EAAE,GAAG,eAAe,CAAC,CAAC,CAAC,CAAC;IAC9B,MAAM,EAAE,GAAG,eAAe,CAAC,CAAC,CAAC,CAAC;IAC9B,kEAAkE;IAClE,IAAI,EAAE,KAAK,IAAI,IAAI,EAAE,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC5C,8DAA8D;IAC9D,OAAO,EAAE,KAAK,EAAE,CAAC;AACnB,CAAC;AAED,SAAS,aAAa,CACpB,KAAuB,EACvB,SAAkC;IAElC,IAAI,KAAK,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO,MAAM,CAAC,IAAI,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC;IAC9D,OAAO,KAAK,CAAC,MAAM,IAAI,EAAE,CAAC;AAC5B,CAAC;AAED,SAAS,iBAAiB,CACxB,CAAmB,EACnB,CAAmB,EACnB,SAAkC;IAElC,MAAM,EAAE,GAAG,IAAI,GAAG,CAAC,aAAa,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC;IAChD,OAAO,aAAa,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;AACpE,CAAC;AAED,SAAS,YAAY,CACnB,KAAa,EACb,KAAa,EACb,CAAmB,EACnB,CAAmB,EACnB,MAAgB;IAEhB,MAAM,MAAM,GAAG,eAAe,CAAC,CAAC,CAAC,CAAC;IAClC,MAAM,WAAW,GAAG,MAAM,KAAK,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,MAAM,GAAG,CAAC;IAE7D,MAAM,EAAE,GAAG,eAAe,CAAC,CAAC,CAAC,CAAC;IAC9B,MAAM,EAAE,GAAG,eAAe,CAAC,CAAC,CAAC,CAAC;IAC9B,MAAM,WAAW,GACf,EAAE,KAAK,IAAI,IAAI,EAAE,KAAK,IAAI;QACxB,CAAC,CAAC,WAAW;QACb,CAAC,CAAC,YAAY,EAAE,IAAI,KAAK,KAAK,EAAE,IAAI,KAAK,GAAG,CAAC;IAEjD,OAAO,CACL,iBAAiB,KAAK,UAAU,KAAK,gCAAgC;QACrE,GAAG,WAAW,SAAS,WAAW,4BAA4B,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK;QACpF,0EAA0E;QAC1E,mFAAmF,CACpF,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH;;;;;;GAMG;AACH,SAAS,4BAA4B,CAAC,KAAuB;IAC3D,OAAO,CACL,KAAK,CAAC,IAAI,KAAK,IAAI;QACnB,eAAe,CAAC,KAAK,CAAC,KAAK,EAAE;QAC7B,eAAe,CAAC,KAAK,CAAC,KAAK,IAAI,CAChC,CAAC;AACJ,CAAC;AAED,SAAgB,mBAAmB,CAAC,MAAmB;IACrD,MAAM,MAAM,GAAG,MAAM,CAAC,WAAW,IAAI,EAAE,CAAC;IACxC,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC;IACnC,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAElC,yEAAyE;IACzE,0EAA0E;IAC1E,8EAA8E;IAC9E,MAAM,qBAAqB,GAAG,KAAK,CAAC,MAAM,CACxC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,QAAQ,IAAI,4BAA4B,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CACjE,CAAC;IACF,IAAI,qBAAqB,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;QACtC,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,qBAAqB,CAAC;QACrC,MAAM,IAAI,uBAAuB,CAC/B,8BAA8B,CAAC,UAAU,CAAC,2BAA2B;YACnE,sEAAsE;YACtE,uEAAuE;YACvE,uEAAuE;YACvE,iBAAiB,CACpB,CAAC;IACJ,CAAC;IAED,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,KAAK,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YAC1C,MAAM,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;YAC3B,MAAM,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;YAE3B,IAAI,CAAC,iBAAiB,CAAC,CAAC,EAAE,CAAC,CAAC;gBAAE,SAAS;YACvC,IAAI,eAAe,CAAC,CAAC,CAAC,KAAK,eAAe,CAAC,CAAC,CAAC;gBAAE,SAAS;YAExD,MAAM,MAAM,GAAG,iBAAiB,CAAC,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC;YAC/C,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;gBAAE,SAAS;YAElC,MAAM,IAAI,uBAAuB,CAC/B,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC,CAC/C,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rhino-dev/rhino-nestjs",
-  "version": "4.0.0",
+  "version": "4.2.1",
   "description": "Rhino for NestJS — auto-generated REST APIs from model definitions.",
   "author": "Bruno Cipolla <bruno@codalio.com>",
   "license": "MIT",