@rytass/bpm-core-nestjs-module 0.12.0 → 0.13.0

package/CHANGELOG.md

@@ -1,3 +1,38 @@
+## 0.13.0 (2026-09-03)
+
+### 🚀 Features
+
+- **bpm-auth:** let a host stamp its own route metadata on BPM resolvers ([49bedb7](https://github.com/Rytass/BPMCore/commit/49bedb7))
+- **identity:** let a host turn off the identity GraphQL queries ([33630f8](https://github.com/Rytass/BPMCore/commit/33630f8))
+
+### 🩹 Fixes
+
+- **migrations:** stop dropping extensions this migration may not have created ([88256d1](https://github.com/Rytass/BPMCore/commit/88256d1))
+- **condition:** name the Node version when cel-js cannot be required ([2691e63](https://github.com/Rytass/BPMCore/commit/2691e63))
+- **bpm-auth:** list only real GraphQL handlers, and keep symbol metadata keys ([9cc4593](https://github.com/Rytass/BPMCore/commit/9cc4593))
+- ⚠️  **attachment:** refuse to sign production attachment URLs with the public dev key ([c40ce67](https://github.com/Rytass/BPMCore/commit/c40ce67))
+- **migrations:** explain what to do when CREATE EXTENSION is denied ([a0c9c38](https://github.com/Rytass/BPMCore/commit/a0c9c38))
+- **condition:** load cel-js on first use, not on import ([e2a64c9](https://github.com/Rytass/BPMCore/commit/e2a64c9))
+- **template:** let UpdateApprovalTemplateInput say "keep the category" ([c11c248](https://github.com/Rytass/BPMCore/commit/c11c248))
+- **organization:** let update inputs say "leave this alone", and allow deleting a position ([e09e012](https://github.com/Rytass/BPMCore/commit/e09e012))
+
+### ⚠️  Breaking Changes
+
+- **attachment:** refuse to sign production attachment URLs with the public dev key  ([c40ce67](https://github.com/Rytass/BPMCore/commit/c40ce67))
+  a NODE_ENV=production process that never set
+  attachmentSignedUrlSecret no longer starts. BPMRootModule mounts
+  AttachmentModule unconditionally, so this reaches hosts that serve no
+  attachments at all. Set the secret, or set
+  attachmentAllowInsecureSignedUrlSecret: true to acknowledge that the signing
+  key is public.
+  Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
+  Claude-Session: https://claude.ai/code/session_016VKxnq3cFuySFMLMZhtd2E
+
+### ❤️ Thank You
+
+- Chia Yu Pai @fantasywind
+- Claude Opus 5
+
 ## 0.12.0 (2026-08-27)
 
 ### 🚀 Features

package/README.md

@@ -582,6 +582,62 @@ export class BPMAuthContextFactory {
 > module or a database table) so adding a new BPM tier in a future
 > BPMCore release becomes a one-line addition.
 
+### Coexisting with a host global guard
+
+`APP_GUARD`-registered guards run **before** BPM's own. A guard that decides
+by route metadata therefore judges BPM's resolvers by metadata BPM never
+writes — and `@rytass/member-base-nestjs-module`'s `CasbinGuard` rejects any
+route without `@CheckPermission`:
+
+```json
+{ "errors": [{ "message": "Route has no permission metadata",
+               "path": ["orgUnits"],
+               "extensions": { "code": "FORBIDDEN" } }] }
+```
+
+Every BPM query and mutation fails this way, before BPM's guards run at all.
+BPM cannot import the host's decorator, and a decorator cannot read module
+options — it runs when the class is defined. So BPM's resolvers register
+themselves, and `resolverMetadataFactory` replays your factory over them at
+module wiring time:
+
+```ts
+import { PERMISSION_METADATA_KEY } from '@rytass/member-base-nestjs-module';
+import { BPMRootModule, type BPMResolverMetadataFactory } from '@rytass/bpm-core-nestjs-module';
+
+const HOST_PERMISSIONS: Readonly<Record<string, readonly string[]>> = {
+  admin: ['bpm:admin'],
+  authenticated: ['bpm:use'],
+  designer: ['bpm:design'],
+};
+
+const resolverMetadataFactory: BPMResolverMetadataFactory = ({ access }) => ({
+  [PERMISSION_METADATA_KEY]: HOST_PERMISSIONS[access],
+});
+
+BPMRootModule.forRoot({ resolverMetadataFactory, /* ... */ });
+```
+
+The factory is called once per handler and receives `{ access, resolverName,
+methodName }`. `access` is the authority BPM's own guards require —
+`'admin'`, `'designer'`, or `'authenticated'` — so the common case is one
+lookup table rather than a per-operation list. `methodName` is also the
+GraphQL field name (`orgUnits`, `createOrgUnit`, `member`) when a handful of
+operations need finer grants. Returning `null` leaves a handler untouched.
+
+The returned record is written onto the prototype method, which is exactly
+what Nest hands a guard as `context.getHandler()`; BPM's own guards still run
+afterwards, so both permission models apply.
+
+`listBPMResolverHandlers()` prints every handler the factory will be offered,
+which is the quickest way to build the mapping table:
+
+```ts
+import { listBPMResolverHandlers } from '@rytass/bpm-core-nestjs-module';
+
+console.table([...listBPMResolverHandlers()]);
+```
+
 ## Member Resolver
 
 The package resolves display names, email addresses, and approver candidates
@@ -873,6 +929,7 @@ BPMRootModule.forRootAsync({
 | ------------------------------------------------ | ------------------------------ | -------------------------------------------------------------- |
 | `authContextFactory`                             | `undefined`                    | Reads `BPMAuthContext` from NestJS `ExecutionContext`.         |
 | `memberResolverProvider`                         | required                       | Provider for `BPM_MEMBER_RESOLVER`.                            |
+| `resolverMetadataFactory`                        | `undefined`                    | Stamps the host's own route metadata onto every BPM GraphQL handler. Required when the host installs a global metadata-driven guard — see "Coexisting with a host global guard". |
 | `attachmentStorageProvider`                      | local `.storage/attachments`   | Host-provided `@rytass/storages` adapter.                      |
 | `workflowServiceTaskDispatcherProvider`          | built-in `fetch` dispatcher    | Host provider for executable workflow `WEBHOOK` service tasks. |
 | `businessCalendarProvider`                       | Monday–Friday calendar         | Host provider for `BPM_BUSINESS_CALENDAR`, used by `BUSINESS_DAY` SLAs. BPMCore ships no holiday data. |
@@ -880,9 +937,11 @@ BPMRootModule.forRootAsync({
 | `attachmentRoutePrefix`                          | `/attachments`                 | Drives both the BPM signed URL path and the Nest controller mount path for `AttachmentController`. Must be set at module wiring time (see "Attachment Storage" below). |
 | `attachmentStorageProviderId`                    | `local`                        | Value stored on attachment metadata for the active adapter.    |
 | `attachmentPublicBaseUrl`                        | `http://localhost:17603`       | Public base URL for signed attachment URLs.                    |
-| `attachmentSignedUrlSecret`                      | local development secret       | HMAC secret for signed attachment download/preview tokens.     |
+| `attachmentSignedUrlSecret`                      | local development secret       | HMAC secret for signed attachment download/preview tokens. Under `NODE_ENV=production` BPM refuses to start while this is unset. |
+| `attachmentAllowInsecureSignedUrlSecret`         | `false`                        | Opt-in that lets a `NODE_ENV=production` process boot on the built-in development secret anyway. Only for throwaway environments — the value is published in this package. |
 | `attachmentSignedUrlTtlSeconds`                  | `300`                          | Signed attachment URL lifetime in seconds.                     |
 | `identityMemberMetadataCacheTtlMs`               | `300000`                       | Member metadata cache TTL.                                     |
+| `identityRegisterResolvers`                      | `true`                         | Set to `false` when the host already publishes `member` / `members` / `memberCount` / `searchMembers` GraphQL queries. `IdentityService` stays available either way. |
 | `notificationInAppEnabled`                       | `true`                         | Enables in-app notification records.                           |
 | `notificationEmailEnabled`                       | `auto`                         | Enables email when SMTP settings are complete.                 |
 | `notificationEmailSmtpHost`                      | `null`                         | SMTP host.                                                     |
@@ -919,8 +978,95 @@ BPMRootModule.forRootAsync({
 
 Production deployments should override all local development secrets.
 
+### Mounting a single domain module
+
+`BPMRootModule` is the supported entry point and the only one that wires the
+whole product. A host that wants **one** BPM domain — most often organization
+data, with no workflow, forms, or notifications — can import that domain
+module on its own. These are self-contained: they declare their own
+`TypeOrmModule.forFeature` and their services inject nothing but `DataSource`
+and repositories.
+
+```ts
+import { Module } from '@nestjs/common';
+import { OrganizationModule, OrganizationService } from '@rytass/bpm-core-nestjs-module';
+
+@Module({ imports: [OrganizationModule] })
+export class HostOrganizationModule {}
+```
+
+| Module               | Self-contained | Notes                                                                |
+| -------------------- | -------------- | -------------------------------------------------------------------- |
+| `OrganizationModule` | yes            | Org units, positions, memberships, manager resolution. Mounted alone, `deletePosition` silently skips its approval-template and ad-hoc-directive reference checks (it logs when it does) — those tables are not in the schema. |
+| `FormModule`         | yes            | Form definitions and versions.                                        |
+| `TemplateModule`     | yes            | Approval templates, versions, categories.                             |
+| `ConditionModule`    | yes            | CEL lint and evaluation only.                                         |
+| `IdentityModule`     | no             | Needs `memberResolverProvider`; use `IdentityModule.forRoot(...)`.     |
+| `AttachmentModule`   | no             | Needs storage and signed-URL options; use `AttachmentModule.forRoot(...)`. |
+
+What you still owe them:
+
+- **Migrations.** `BPM_CORE_MIGRATIONS` is one list for the whole package; a
+  single-module host still runs all of it, and still needs the extensions in
+  "Database prerequisites" below.
+- **Auth.** A domain module imported directly does not bring `BPMAuthModule`,
+  so `@BPMAdminOnly()` on its resolvers has no auth context accessor to
+  inject. Either import `BPMAuthModule.forRoot({ contextFactory })` alongside
+  it, or use the domain **service** and publish your own GraphQL surface.
+- **Resolver metadata.** `resolverMetadataFactory` is applied by
+  `BPMRootModule`, which is not in play here. A host that needs it on this path
+  calls `applyBPMResolverMetadata(factory)` itself, once, before the
+  application starts.
+
+The domain services (`OrganizationService` and friends) are the stable part of
+this arrangement; a module's internal wiring is not. If you are here because
+`BPMRootModule` collides with your schema, `identityRegisterResolvers` and
+`resolverMetadataFactory` usually let you keep the supported entry point.
+
+### Testing a host that depends on BPM
+
+BPM loads `cel-js` — ESM-only, with a `chevrotain` dependency whose exports
+map `jest-resolve` cannot follow — lazily, on the first CEL expression it
+parses. Importing anything from the package root does not reach it, so a host
+jest suite needs no `moduleNameMapper` entry and no stub.
+
+A suite that *does* exercise conditions (template validation, workflow
+transitions) will load `cel-js` for real. If your jest version cannot resolve
+it, map it to a stub of your own:
+
+```ts
+// jest.config.ts
+moduleNameMapper: { '^cel-js$': '<rootDir>/test/cel-js.stub.ts' },
+```
+
 ## Database Setup
 
+### Database prerequisites
+
+BPM's first migration enables two PostgreSQL extensions — `uuid-ossp` for
+`uuid_generate_v4()` defaults and `ltree` for the org unit `path` column:
+
+```sql
+CREATE EXTENSION IF NOT EXISTS "uuid-ossp";
+CREATE EXTENSION IF NOT EXISTS "ltree";
+```
+
+`CREATE EXTENSION` needs the CREATE privilege **on the database**, which a
+least-privilege application role normally does not have — including on Rytass
+platforms, where that privilege is revoked by convention. Have a superuser,
+the database owner, or `rds_superuser` run the two statements once before the
+first migration run.
+
+PostgreSQL itself returns early from `CREATE EXTENSION IF NOT EXISTS` when the
+extension is present, so a least-privilege role runs migrations fine once a DBA
+has installed them. What the migration adds is the other case: when they are
+missing and the role cannot create them, it stops with the SQL above and who
+needs to run it, rather than a bare `42501` that says nothing about needing a
+DBA.
+
+The migration's `down()` is deliberately a no-op — the extensions may predate
+BPM and other schemas in the same database may depend on them.
+
 The package exports helpers for Vault-backed TypeORM setup:
 
 ```ts
@@ -1521,14 +1667,25 @@ npm publish --access public
 
 ## Production Notes
 
-- Replace all local fallback secrets before production.
+- **BREAKING (upgrade note).** Replace all local fallback secrets before
+  production. Under `NODE_ENV=production`, `attachmentSignedUrlSecret` is now
+  enforced: BPM refuses to start rather than sign attachment URLs with the
+  value published in this package. `BPMRootModule` mounts `AttachmentModule`
+  unconditionally, so this applies **even to a host that never serves
+  attachments** — an existing production deployment that never set the secret
+  will fail to boot after upgrading. Set the secret, or set
+  `attachmentAllowInsecureSignedUrlSecret: true` to acknowledge that the
+  signing key is public and boot anyway. Never set that flag on anything
+  serving real attachments.
 - Use a production storage adapter instead of local filesystem storage.
 - Keep old signature keys available for verification after key rotation.
 - Keep in-process schedulers disabled in API replicas unless a dedicated worker
   is not available.
 - Do not enable TypeORM `synchronize` in production.
 - Ensure GraphQL auth context is available for protected operations.
-- Run migrations before serving traffic with a new package version.
+- Run migrations before serving traffic with a new package version, and
+  install the PostgreSQL extensions listed under "Database prerequisites"
+  once, with a privileged role, before the first run.
 
 ## License
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rytass/bpm-core-nestjs-module",
-  "version": "0.12.0",
+  "version": "0.13.0",
   "description": "Embeddable NestJS BPM approval workflow module: workflow engine, approval templates, forms, organization/member contracts, attachments, signatures, notifications, delegation, and TypeORM migrations.",
   "keywords": [
     "bpm",
@@ -29,7 +29,7 @@
     "access": "public"
   },
   "engines": {
-    "node": ">=20.0.0"
+    "node": ">=20.19.0"
   },
   "type": "commonjs",
   "main": "./src/index.js",
@@ -155,7 +155,7 @@
     "@nestjs/core": ">=10.0.0",
     "@nestjs/graphql": ">=12.0.0",
     "@nestjs/typeorm": ">=10.0.0",
-    "@rytass/bpm-core-shared": "^0.12.0",
+    "@rytass/bpm-core-shared": "^0.13.0",
     "@rytass/secret-adapter-vault-nestjs": ">=0.4.5",
     "express": ">=4.0.0",
     "graphql": ">=16.0.0",

package/src/lib/attachment/attachment-options.d.ts

@@ -12,6 +12,17 @@ export interface BPMRootAttachmentOptions {
      * signed attachment URLs. Defaults to `/attachments`.
      */
     readonly attachmentRoutePrefix?: string | null;
+    /**
+     * Opt-in escape hatch that lets a `NODE_ENV=production` process boot while
+     * still signing attachment URLs with the built-in development secret.
+     *
+     * Without it, a production process that never set
+     * `attachmentSignedUrlSecret` refuses to start. Set this only for a
+     * throwaway environment that happens to run with `NODE_ENV=production` and
+     * serves no real attachments — the built-in value is published in this
+     * package, so anyone can forge a signed attachment URL against it.
+     */
+    readonly attachmentAllowInsecureSignedUrlSecret?: boolean;
     /**
      * HMAC secret used to sign attachment download and preview tokens.
      */

package/src/lib/attachment/attachment-options.js

@@ -14,12 +14,27 @@ exports.DEFAULT_BPM_ATTACHMENT_OPTIONS = {
 function resolveBPMAttachmentOptions(options = {}) {
     const resolvedSignedUrlSecret = normalizeText(options.attachmentSignedUrlSecret) ??
         exports.DEFAULT_BPM_ATTACHMENT_OPTIONS.signedUrlSecret;
-    // Warn everywhere except an explicit local development run. Gating this on
-    // `NODE_ENV === 'production'` meant a staging host that never set the variable
-    // signed attachment URLs with a constant published in this package — and said
-    // nothing about it. One extra line in a developer's console is the cheaper
-    // trade.
-    if (resolvedSignedUrlSecret === exports.DEFAULT_BPM_ATTACHMENT_OPTIONS.signedUrlSecret &&
+    const usesBuiltInSecret = resolvedSignedUrlSecret === exports.DEFAULT_BPM_ATTACHMENT_OPTIONS.signedUrlSecret;
+    // A console warning is the wrong instrument for a published constant that
+    // makes every signed attachment URL forgeable: in a container it scrolls past
+    // with the boot log and nobody reads it again. Under `NODE_ENV=production`
+    // the process refuses to start instead, and a host that genuinely wants the
+    // development value there has to say so.
+    if (usesBuiltInSecret &&
+        process.env.NODE_ENV === 'production' &&
+        options.attachmentAllowInsecureSignedUrlSecret !== true) {
+        throw new Error([
+            '[@rytass/bpm-core-nestjs-module] attachmentSignedUrlSecret is unset, so BPM would sign attachment URLs with the built-in local development value that ships in this package — anyone could forge one.',
+            'Set BPMRootModuleOptions.attachmentSignedUrlSecret to a strong secret.',
+            'If this service never serves attachments, BPM still mounts AttachmentModule, so set attachmentAllowInsecureSignedUrlSecret: true to acknowledge that the signing key is public and boot anyway.',
+        ].join(' '));
+    }
+    // Outside production, still warn everywhere except an explicit local
+    // development run. Gating the warning on production alone meant a staging
+    // host that never set the variable signed attachment URLs with the published
+    // constant — and said nothing about it. One extra line in a developer's
+    // console is the cheaper trade.
+    if (usesBuiltInSecret &&
         process.env.NODE_ENV !== 'development' &&
         process.env.NODE_ENV !== 'test') {
         // eslint-disable-next-line no-console

package/src/lib/attachment/attachment-options.js.map

@@ -1 +1 @@
-{"version":3,"file":"attachment-options.js","sourceRoot":"","sources":["../../../../../../libs/bpm-core/src/lib/attachment/attachment-options.ts"],"names":[],"mappings":";;;AAoDA,kEAmCC;AAQD,0EAMC;AA5DY,QAAA,sBAAsB,GACjC,MAAM,CAAC,wBAAwB,CAAC,CAAC;AAEtB,QAAA,8BAA8B,GAAiC;IAC1E,aAAa,EAAE,wBAAwB;IACvC,WAAW,EAAE,cAAc;IAC3B,eAAe,EAAE,sCAAsC;IACvD,mBAAmB,EAAE,GAAG;IACxB,iBAAiB,EAAE,OAAO;CAC3B,CAAC;AAEF,SAAgB,2BAA2B,CACzC,UAAoC,EAAE;IAEtC,MAAM,uBAAuB,GAC3B,aAAa,CAAC,OAAO,CAAC,yBAAyB,CAAC;QAChD,sCAA8B,CAAC,eAAe,CAAC;IAEjD,2EAA2E;IAC3E,+EAA+E;IAC/E,8EAA8E;IAC9E,2EAA2E;IAC3E,SAAS;IACT,IACE,uBAAuB,KAAK,sCAA8B,CAAC,eAAe;QAC1E,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,aAAa;QACtC,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,MAAM,EAC/B,CAAC;QACD,sCAAsC;QACtC,OAAO,CAAC,IAAI,CACV,0QAA0Q,CAC3Q,CAAC;IACJ,CAAC;IAED,OAAO;QACL,aAAa,EAAE,sBAAsB,CAAC,OAAO,CAAC,uBAAuB,CAAC;QACtE,WAAW,EAAE,oBAAoB,CAAC,OAAO,CAAC,qBAAqB,CAAC;QAChE,eAAe,EAAE,uBAAuB;QACxC,mBAAmB,EAAE,wBAAwB,CAC3C,OAAO,CAAC,6BAA6B,EACrC,sCAA8B,CAAC,mBAAmB,CACnD;QACD,iBAAiB,EACf,aAAa,CAAC,OAAO,CAAC,2BAA2B,CAAC;YAClD,sCAA8B,CAAC,iBAAiB;KACnD,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAgB,+BAA+B,CAC7C,KAAgC;IAEhC,MAAM,gBAAgB,GAAG,oBAAoB,CAAC,KAAK,CAAC,CAAC;IAErD,OAAO,gBAAgB,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AAC7C,CAAC;AAED,SAAS,sBAAsB,CAAC,KAAgC;IAC9D,MAAM,eAAe,GACnB,aAAa,CAAC,KAAK,CAAC,IAAI,sCAA8B,CAAC,aAAa,CAAC;IAEvE,OAAO,eAAe,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AAC7C,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAgC;IAC5D,MAAM,eAAe,GACnB,aAAa,CAAC,KAAK,CAAC,IAAI,sCAA8B,CAAC,WAAW,CAAC;IACrE,MAAM,gBAAgB,GAAG,eAAe,CAAC,UAAU,CAAC,GAAG,CAAC;QACtD,CAAC,CAAC,eAAe;QACjB,CAAC,CAAC,IAAI,eAAe,EAAE,CAAC;IAE1B,OAAO,gBAAgB,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AAC9C,CAAC;AAED,SAAS,aAAa,CAAC,KAAgC;IACrD,MAAM,YAAY,GAAG,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IAEzC,OAAO,YAAY,IAAI,IAAI,CAAC;AAC9B,CAAC;AAED,SAAS,wBAAwB,CAC/B,KAAyB,EACzB,QAAgB;IAEhB,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,EAAE,CAAC;QACxE,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC"}
+{"version":3,"file":"attachment-options.js","sourceRoot":"","sources":["../../../../../../libs/bpm-core/src/lib/attachment/attachment-options.ts"],"names":[],"mappings":";;;AAgEA,kEAyDC;AAQD,0EAMC;AAlFY,QAAA,sBAAsB,GACjC,MAAM,CAAC,wBAAwB,CAAC,CAAC;AAEtB,QAAA,8BAA8B,GAAiC;IAC1E,aAAa,EAAE,wBAAwB;IACvC,WAAW,EAAE,cAAc;IAC3B,eAAe,EAAE,sCAAsC;IACvD,mBAAmB,EAAE,GAAG;IACxB,iBAAiB,EAAE,OAAO;CAC3B,CAAC;AAEF,SAAgB,2BAA2B,CACzC,UAAoC,EAAE;IAEtC,MAAM,uBAAuB,GAC3B,aAAa,CAAC,OAAO,CAAC,yBAAyB,CAAC;QAChD,sCAA8B,CAAC,eAAe,CAAC;IAEjD,MAAM,iBAAiB,GACrB,uBAAuB,KAAK,sCAA8B,CAAC,eAAe,CAAC;IAE7E,0EAA0E;IAC1E,8EAA8E;IAC9E,2EAA2E;IAC3E,4EAA4E;IAC5E,yCAAyC;IACzC,IACE,iBAAiB;QACjB,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY;QACrC,OAAO,CAAC,sCAAsC,KAAK,IAAI,EACvD,CAAC;QACD,MAAM,IAAI,KAAK,CACb;YACE,uMAAuM;YACvM,wEAAwE;YACxE,iMAAiM;SAClM,CAAC,IAAI,CAAC,GAAG,CAAC,CACZ,CAAC;IACJ,CAAC;IAED,qEAAqE;IACrE,0EAA0E;IAC1E,6EAA6E;IAC7E,wEAAwE;IACxE,gCAAgC;IAChC,IACE,iBAAiB;QACjB,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,aAAa;QACtC,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,MAAM,EAC/B,CAAC;QACD,sCAAsC;QACtC,OAAO,CAAC,IAAI,CACV,0QAA0Q,CAC3Q,CAAC;IACJ,CAAC;IAED,OAAO;QACL,aAAa,EAAE,sBAAsB,CAAC,OAAO,CAAC,uBAAuB,CAAC;QACtE,WAAW,EAAE,oBAAoB,CAAC,OAAO,CAAC,qBAAqB,CAAC;QAChE,eAAe,EAAE,uBAAuB;QACxC,mBAAmB,EAAE,wBAAwB,CAC3C,OAAO,CAAC,6BAA6B,EACrC,sCAA8B,CAAC,mBAAmB,CACnD;QACD,iBAAiB,EACf,aAAa,CAAC,OAAO,CAAC,2BAA2B,CAAC;YAClD,sCAA8B,CAAC,iBAAiB;KACnD,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAgB,+BAA+B,CAC7C,KAAgC;IAEhC,MAAM,gBAAgB,GAAG,oBAAoB,CAAC,KAAK,CAAC,CAAC;IAErD,OAAO,gBAAgB,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AAC7C,CAAC;AAED,SAAS,sBAAsB,CAAC,KAAgC;IAC9D,MAAM,eAAe,GACnB,aAAa,CAAC,KAAK,CAAC,IAAI,sCAA8B,CAAC,aAAa,CAAC;IAEvE,OAAO,eAAe,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AAC7C,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAgC;IAC5D,MAAM,eAAe,GACnB,aAAa,CAAC,KAAK,CAAC,IAAI,sCAA8B,CAAC,WAAW,CAAC;IACrE,MAAM,gBAAgB,GAAG,eAAe,CAAC,UAAU,CAAC,GAAG,CAAC;QACtD,CAAC,CAAC,eAAe;QACjB,CAAC,CAAC,IAAI,eAAe,EAAE,CAAC;IAE1B,OAAO,gBAAgB,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AAC9C,CAAC;AAED,SAAS,aAAa,CAAC,KAAgC;IACrD,MAAM,YAAY,GAAG,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IAEzC,OAAO,YAAY,IAAI,IAAI,CAAC;AAC9B,CAAC;AAED,SAAS,wBAAwB,CAC/B,KAAyB,EACzB,QAAgB;IAEhB,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,EAAE,CAAC;QACxE,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC"}

package/src/lib/attachment/index.d.ts

@@ -3,3 +3,4 @@ export * from './attachment-storage.provider';
 export * from './attachment-storage.token';
 export * from './attachment.module';
 export * from './attachment.service';
+export * from './dto/upload-attachment.input';

package/src/lib/attachment/index.js

@@ -6,4 +6,5 @@ tslib_1.__exportStar(require("./attachment-storage.provider"), exports);
 tslib_1.__exportStar(require("./attachment-storage.token"), exports);
 tslib_1.__exportStar(require("./attachment.module"), exports);
 tslib_1.__exportStar(require("./attachment.service"), exports);
+tslib_1.__exportStar(require("./dto/upload-attachment.input"), exports);
 //# sourceMappingURL=index.js.map

package/src/lib/attachment/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../../libs/bpm-core/src/lib/attachment/index.ts"],"names":[],"mappings":";;;AAAA,+DAAqC;AACrC,wEAA8C;AAC9C,qEAA2C;AAC3C,8DAAoC;AACpC,+DAAqC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../../libs/bpm-core/src/lib/attachment/index.ts"],"names":[],"mappings":";;;AAAA,+DAAqC;AACrC,wEAA8C;AAC9C,qEAA2C;AAC3C,8DAAoC;AACpC,+DAAqC;AACrC,wEAA8C"}

package/src/lib/bpm/bpm-root.module.d.ts

@@ -2,6 +2,7 @@ import { DynamicModule, InjectionToken, Provider } from '@nestjs/common';
 import { ModuleMetadata } from '@nestjs/common/interfaces';
 import { BPMRootAttachmentOptions } from '../attachment/attachment-options';
 import { AttachmentStorage } from '../attachment/attachment-storage.token';
+import { BPMResolverMetadataFactory } from '../bpm-auth/bpm-resolver-metadata';
 import { BPMAuthModuleOptions } from '../bpm-auth/bpm-auth.options';
 import { BPMBusinessCalendar } from '../calendar/business-calendar.token';
 import { BPMFormDataSourceRegistry } from '../form-data-source';
@@ -61,6 +62,22 @@ export interface BPMRootModuleOptions extends Pick<ModuleMetadata, 'imports'>, B
      * `@rytass/bpm-core-nestjs-module` to a specific external identity system.
      */
     readonly memberResolverProvider: Provider<BPMMemberResolver>;
+    /**
+     * Host-supplied factory that stamps the host's own route metadata onto every
+     * BPM GraphQL handler.
+     *
+     * Needed when the host installs a **global** guard that judges routes by
+     * metadata BPM knows nothing about. `@rytass/member-base-nestjs-module`
+     * registers a `CasbinGuard` that rejects any route without
+     * `@CheckPermission` metadata, so without this every BPM query and mutation
+     * fails with `Route has no permission metadata` before BPM's own guards run.
+     *
+     * The factory is called once per handler at module wiring time, receives the
+     * authority BPM itself requires (`admin`, `designer`, `authenticated`) plus
+     * the resolver and method names, and returns the metadata to write. See
+     * `BPMResolverMetadataFactory`.
+     */
+    readonly resolverMetadataFactory?: BPMResolverMetadataFactory;
     /**
      * Host-provided dispatcher for executable workflow service tasks.
      *
@@ -116,6 +133,15 @@ export interface BPMRootModuleAsyncOptions extends Pick<ModuleMetadata, 'imports
      * through its Nest `useFactory`, `useClass`, or `useExisting` definition.
      */
     readonly formDataSourceRegistryProvider?: Provider<BPMFormDataSourceRegistry>;
+    /**
+     * Whether BPM registers its identity GraphQL queries. See
+     * `BPMRootIdentityOptions.identityRegisterResolvers`.
+     *
+     * Set at module wiring time, like `attachmentRoutePrefix`, because Nest
+     * collects resolver providers while building the schema — before the
+     * `useFactory` below has run.
+     */
+    readonly identityRegisterResolvers?: boolean;
     /**
      * Providers injected into `useFactory`.
      *
@@ -131,6 +157,15 @@ export interface BPMRootModuleAsyncOptions extends Pick<ModuleMetadata, 'imports
      * `@rytass/bpm-core-nestjs-module` to a specific external identity system.
      */
     readonly memberResolverProvider: Provider<BPMMemberResolver>;
+    /**
+     * Host-supplied factory that stamps the host's own route metadata onto every
+     * BPM GraphQL handler. See
+     * `BPMRootModuleOptions.resolverMetadataFactory`.
+     *
+     * Read at module wiring time rather than from `useFactory`, because Nest
+     * builds the resolver metadata before any async factory has run.
+     */
+    readonly resolverMetadataFactory?: BPMResolverMetadataFactory;
     /**
      * Host-provided dispatcher for executable workflow service tasks.
      *

package/src/lib/bpm/bpm-root.module.js

@@ -6,6 +6,7 @@ const tslib_1 = require("tslib");
 const common_1 = require("@nestjs/common");
 const attachment_module_1 = require("../attachment/attachment.module");
 const bpm_auth_module_1 = require("../bpm-auth/bpm-auth.module");
+const bpm_resolver_metadata_1 = require("../bpm-auth/bpm-resolver-metadata");
 const calendar_module_1 = require("../calendar/calendar.module");
 const delegation_module_1 = require("../delegation/delegation.module");
 const form_module_1 = require("../form/form.module");
@@ -53,6 +54,9 @@ let BPMRootModule = BPMRootModule_1 = class BPMRootModule {
      * wiring time (no async secret loading needed).
      */
     static forRoot(options) {
+        if (options.resolverMetadataFactory) {
+            (0, bpm_resolver_metadata_1.applyBPMResolverMetadata)(options.resolverMetadataFactory);
+        }
         const featureModules = createBPMFeatureModules(options);
         return {
             exports: [...featureModules],
@@ -73,6 +77,9 @@ let BPMRootModule = BPMRootModule_1 = class BPMRootModule {
      * during application bootstrap.
      */
     static forRootAsync(options) {
+        if (options.resolverMetadataFactory) {
+            (0, bpm_resolver_metadata_1.applyBPMResolverMetadata)(options.resolverMetadataFactory);
+        }
         const authOptions = {
             imports: options.imports,
             inject: options.inject,
@@ -109,6 +116,7 @@ let BPMRootModule = BPMRootModule_1 = class BPMRootModule {
                 }),
                 bpm_auth_module_1.BPMAuthModule.forRootAsync(authOptions),
                 identity_module_1.IdentityModule.forRootAsync({
+                    identityRegisterResolvers: options.identityRegisterResolvers,
                     imports: options.imports,
                     inject: options.inject,
                     memberResolverProvider: options.memberResolverProvider,

package/src/lib/bpm/bpm-root.module.js.map

@@ -1 +1 @@
-{"version":3,"file":"bpm-root.module.js","sourceRoot":"","sources":["../../../../../../libs/bpm-core/src/lib/bpm/bpm-root.module.ts"],"names":[],"mappings":";;;;;AAAA,2CAMwB;AAGxB,uEAAmE;AAEnE,iEAA4D;AAM5D,iEAA6D;AAC7D,uEAAmE;AACnE,qDAAiD;AACjD,0DAI6B;AAE7B,iEAA6D;AAE7D,6EAAyE;AACzE,6FAAwF;AAExF,6EAAyE;AAEzE,oEAAgE;AAChE,iEAA6D;AAC7D,sFAAiF;AA+KjF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEI,IAAM,aAAa,qBAAnB,MAAM,aAAa;IACxB;;;OAGG;IACH,MAAM,CAAC,OAAO,CAAC,OAA6B;QAC1C,MAAM,cAAc,GAAG,uBAAuB,CAAC,OAAO,CAAC,CAAC;QAExD,OAAO;YACL,OAAO,EAAE,CAAC,GAAG,cAAc,CAAC;YAC5B,OAAO,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC,EAAE,GAAG,cAAc,CAAC;YACxD,MAAM,EAAE,eAAa;SACtB,CAAC;IACJ,CAAC;IAED;;;;;;;;;;;OAWG;IACH,MAAM,CAAC,YAAY,CAAC,OAAkC;QACpD,MAAM,WAAW,GAA8B;YAC7C,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,UAAU,EAAE,KAAK,EACf,GAAG,IAAwB,EACI,EAAE;gBACjC,MAAM,WAAW,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC,GAAG,IAAI,CAAC,CAAC;gBAEtD,OAAO,0BAA0B,CAAC,WAAW,CAAC,CAAC;YACjD,CAAC;SACF,CAAC;QAEF,OAAO;YACL,OAAO,EAAE;gBACP,uDAAyB;gBACzB,gCAAc;gBACd,+BAAa;gBACb,gCAAc;gBACd,wCAAkB;gBAClB,oCAAgB;gBAChB,wBAAU;gBACV,uCAAoB;gBACpB,gCAAc;gBACd,oCAAgB;gBAChB,wCAAkB;gBAClB,kCAAe;gBACf,6CAAoB;aACrB;YACD,OAAO,EAAE;gBACP,uDAAyB,CAAC,YAAY,CAAC;oBACrC,OAAO,EAAE,OAAO,CAAC,OAAO;oBACxB,MAAM,EAAE,OAAO,CAAC,MAAM;oBACtB,UAAU,EAAE,OAAO,CAAC,UAAU;iBAC/B,CAAC;gBACF,gCAAc,CAAC,OAAO,CAAC;oBACrB,wBAAwB,EAAE,OAAO,CAAC,wBAAwB;oBAC1D,OAAO,EAAE,OAAO,CAAC,OAAO;iBACzB,CAAC;gBACF,+BAAa,CAAC,YAAY,CAAC,WAAW,CAAC;gBACvC,gCAAc,CAAC,YAAY,CAAC;oBAC1B,OAAO,EAAE,OAAO,CAAC,OAAO;oBACxB,MAAM,EAAE,OAAO,CAAC,MAAM;oBACtB,sBAAsB,EAAE,OAAO,CAAC,sBAAsB;oBACtD,UAAU,EAAE,OAAO,CAAC,UAAU;iBAC/B,CAAC;gBACF,wCAAkB;gBAClB,oCAAgB,CAAC,YAAY,CAAC;oBAC5B,qBAAqB,EAAE,OAAO,CAAC,qBAAqB;oBACpD,OAAO,EAAE,OAAO,CAAC,OAAO;oBACxB,MAAM,EAAE,OAAO,CAAC,MAAM;oBACtB,eAAe,EAAE,OAAO,CAAC,yBAAyB;oBAClD,UAAU,EAAE,OAAO,CAAC,UAAU;iBAC/B,CAAC;gBACF,wBAAU;gBACV,uCAAoB,CAAC,OAAO,CAAC;oBAC3B,OAAO,EAAE,OAAO,CAAC,OAAO;oBACxB,gBAAgB,EAAE,OAAO,CAAC,8BAA8B;iBACnB,CAAC;gBACxC,gCAAc;gBACd,oCAAgB;gBAChB,wCAAkB;gBAClB,kCAAe,CAAC,YAAY,CAAC;oBAC3B,OAAO,EAAE,OAAO,CAAC,OAAO;oBACxB,MAAM,EAAE,OAAO,CAAC,MAAM;oBACtB,UAAU,EAAE,OAAO,CAAC,UAAU;iBAC/B,CAAC;gBACF,6CAAoB,CAAC,OAAO,CAAC;oBAC3B,OAAO,EAAE,OAAO,CAAC,OAAO;oBACxB,6BAA6B,EAC3B,OAAO,CAAC,qCAAqC;iBAChD,CAAC;aACH;YACD,MAAM,EAAE,eAAa;SACtB,CAAC;IACJ,CAAC;CACF,CAAA;AAvGY,sCAAa;wBAAb,aAAa;IADzB,IAAA,eAAM,EAAC,EAAE,CAAC;GACE,aAAa,CAuGzB;AAED,SAAS,uBAAuB,CAC9B,OAA6B;IAE7B,OAAO;QACL,uDAAyB,CAAC,OAAO,CAAC,OAAO,CAAC;QAC1C,gCAAc,CAAC,OAAO,CAAC;YACrB,wBAAwB,EAAE,OAAO,CAAC,wBAAwB;YAC1D,OAAO,EAAE,OAAO,CAAC,OAAO;SACzB,CAAC;QACF,+BAAa,CAAC,OAAO,CAAC,0BAA0B,CAAC,OAAO,CAAC,CAAC;QAC1D,gCAAc,CAAC,OAAO,CAAC;YACrB,GAAG,OAAO;YACV,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,sBAAsB,EAAE,OAAO,CAAC,sBAAsB;SACvD,CAAC;QACF,wCAAkB;QAClB,oCAAgB,CAAC,OAAO,CAAC;YACvB,GAAG,OAAO;YACV,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,eAAe,EAAE,OAAO,CAAC,yBAAyB;SACnD,CAAC;QACF,wBAAU;QACV,uCAAoB,CAAC,OAAO,CAAC;YAC3B,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,gBAAgB,EAAE,OAAO,CAAC,8BAA8B;SACnB,CAAC;QACxC,gCAAc;QACd,oCAAgB;QAChB,wCAAkB;QAClB,kCAAe,CAAC,OAAO,CAAC,OAAO,CAAC;QAChC,6CAAoB,CAAC,OAAO,CAAC;YAC3B,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,6BAA6B,EAC3B,OAAO,CAAC,qCAAqC;SAChD,CAAC;KACH,CAAC;AACJ,CAAC;AAED,SAAS,0BAA0B,CACjC,OAAgE;IAEhE,OAAO;QACL,cAAc,EAAE,OAAO,CAAC,kBAAkB;KAC3C,CAAC;AACJ,CAAC"}
+{"version":3,"file":"bpm-root.module.js","sourceRoot":"","sources":["../../../../../../libs/bpm-core/src/lib/bpm/bpm-root.module.ts"],"names":[],"mappings":";;;;;AAAA,2CAMwB;AAGxB,uEAAmE;AAEnE,iEAA4D;AAC5D,6EAG2C;AAM3C,iEAA6D;AAC7D,uEAAmE;AACnE,qDAAiD;AACjD,0DAI6B;AAE7B,iEAA6D;AAE7D,6EAAyE;AACzE,6FAAwF;AAExF,6EAAyE;AAEzE,oEAAgE;AAChE,iEAA6D;AAC7D,sFAAiF;AAoNjF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEI,IAAM,aAAa,qBAAnB,MAAM,aAAa;IACxB;;;OAGG;IACH,MAAM,CAAC,OAAO,CAAC,OAA6B;QAC1C,IAAI,OAAO,CAAC,uBAAuB,EAAE,CAAC;YACpC,IAAA,gDAAwB,EAAC,OAAO,CAAC,uBAAuB,CAAC,CAAC;QAC5D,CAAC;QAED,MAAM,cAAc,GAAG,uBAAuB,CAAC,OAAO,CAAC,CAAC;QAExD,OAAO;YACL,OAAO,EAAE,CAAC,GAAG,cAAc,CAAC;YAC5B,OAAO,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC,EAAE,GAAG,cAAc,CAAC;YACxD,MAAM,EAAE,eAAa;SACtB,CAAC;IACJ,CAAC;IAED;;;;;;;;;;;OAWG;IACH,MAAM,CAAC,YAAY,CAAC,OAAkC;QACpD,IAAI,OAAO,CAAC,uBAAuB,EAAE,CAAC;YACpC,IAAA,gDAAwB,EAAC,OAAO,CAAC,uBAAuB,CAAC,CAAC;QAC5D,CAAC;QAED,MAAM,WAAW,GAA8B;YAC7C,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,UAAU,EAAE,KAAK,EACf,GAAG,IAAwB,EACI,EAAE;gBACjC,MAAM,WAAW,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC,GAAG,IAAI,CAAC,CAAC;gBAEtD,OAAO,0BAA0B,CAAC,WAAW,CAAC,CAAC;YACjD,CAAC;SACF,CAAC;QAEF,OAAO;YACL,OAAO,EAAE;gBACP,uDAAyB;gBACzB,gCAAc;gBACd,+BAAa;gBACb,gCAAc;gBACd,wCAAkB;gBAClB,oCAAgB;gBAChB,wBAAU;gBACV,uCAAoB;gBACpB,gCAAc;gBACd,oCAAgB;gBAChB,wCAAkB;gBAClB,kCAAe;gBACf,6CAAoB;aACrB;YACD,OAAO,EAAE;gBACP,uDAAyB,CAAC,YAAY,CAAC;oBACrC,OAAO,EAAE,OAAO,CAAC,OAAO;oBACxB,MAAM,EAAE,OAAO,CAAC,MAAM;oBACtB,UAAU,EAAE,OAAO,CAAC,UAAU;iBAC/B,CAAC;gBACF,gCAAc,CAAC,OAAO,CAAC;oBACrB,wBAAwB,EAAE,OAAO,CAAC,wBAAwB;oBAC1D,OAAO,EAAE,OAAO,CAAC,OAAO;iBACzB,CAAC;gBACF,+BAAa,CAAC,YAAY,CAAC,WAAW,CAAC;gBACvC,gCAAc,CAAC,YAAY,CAAC;oBAC1B,yBAAyB,EAAE,OAAO,CAAC,yBAAyB;oBAC5D,OAAO,EAAE,OAAO,CAAC,OAAO;oBACxB,MAAM,EAAE,OAAO,CAAC,MAAM;oBACtB,sBAAsB,EAAE,OAAO,CAAC,sBAAsB;oBACtD,UAAU,EAAE,OAAO,CAAC,UAAU;iBAC/B,CAAC;gBACF,wCAAkB;gBAClB,oCAAgB,CAAC,YAAY,CAAC;oBAC5B,qBAAqB,EAAE,OAAO,CAAC,qBAAqB;oBACpD,OAAO,EAAE,OAAO,CAAC,OAAO;oBACxB,MAAM,EAAE,OAAO,CAAC,MAAM;oBACtB,eAAe,EAAE,OAAO,CAAC,yBAAyB;oBAClD,UAAU,EAAE,OAAO,CAAC,UAAU;iBAC/B,CAAC;gBACF,wBAAU;gBACV,uCAAoB,CAAC,OAAO,CAAC;oBAC3B,OAAO,EAAE,OAAO,CAAC,OAAO;oBACxB,gBAAgB,EAAE,OAAO,CAAC,8BAA8B;iBACnB,CAAC;gBACxC,gCAAc;gBACd,oCAAgB;gBAChB,wCAAkB;gBAClB,kCAAe,CAAC,YAAY,CAAC;oBAC3B,OAAO,EAAE,OAAO,CAAC,OAAO;oBACxB,MAAM,EAAE,OAAO,CAAC,MAAM;oBACtB,UAAU,EAAE,OAAO,CAAC,UAAU;iBAC/B,CAAC;gBACF,6CAAoB,CAAC,OAAO,CAAC;oBAC3B,OAAO,EAAE,OAAO,CAAC,OAAO;oBACxB,6BAA6B,EAC3B,OAAO,CAAC,qCAAqC;iBAChD,CAAC;aACH;YACD,MAAM,EAAE,eAAa;SACtB,CAAC;IACJ,CAAC;CACF,CAAA;AAhHY,sCAAa;wBAAb,aAAa;IADzB,IAAA,eAAM,EAAC,EAAE,CAAC;GACE,aAAa,CAgHzB;AAED,SAAS,uBAAuB,CAC9B,OAA6B;IAE7B,OAAO;QACL,uDAAyB,CAAC,OAAO,CAAC,OAAO,CAAC;QAC1C,gCAAc,CAAC,OAAO,CAAC;YACrB,wBAAwB,EAAE,OAAO,CAAC,wBAAwB;YAC1D,OAAO,EAAE,OAAO,CAAC,OAAO;SACzB,CAAC;QACF,+BAAa,CAAC,OAAO,CAAC,0BAA0B,CAAC,OAAO,CAAC,CAAC;QAC1D,gCAAc,CAAC,OAAO,CAAC;YACrB,GAAG,OAAO;YACV,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,sBAAsB,EAAE,OAAO,CAAC,sBAAsB;SACvD,CAAC;QACF,wCAAkB;QAClB,oCAAgB,CAAC,OAAO,CAAC;YACvB,GAAG,OAAO;YACV,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,eAAe,EAAE,OAAO,CAAC,yBAAyB;SACnD,CAAC;QACF,wBAAU;QACV,uCAAoB,CAAC,OAAO,CAAC;YAC3B,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,gBAAgB,EAAE,OAAO,CAAC,8BAA8B;SACnB,CAAC;QACxC,gCAAc;QACd,oCAAgB;QAChB,wCAAkB;QAClB,kCAAe,CAAC,OAAO,CAAC,OAAO,CAAC;QAChC,6CAAoB,CAAC,OAAO,CAAC;YAC3B,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,6BAA6B,EAC3B,OAAO,CAAC,qCAAqC;SAChD,CAAC;KACH,CAAC;AACJ,CAAC;AAED,SAAS,0BAA0B,CACjC,OAAgE;IAEhE,OAAO;QACL,cAAc,EAAE,OAAO,CAAC,kBAAkB;KAC3C,CAAC;AACJ,CAAC"}

package/src/lib/bpm-auth/bpm-auth.authorization.js

@@ -7,6 +7,7 @@ const tslib_1 = require("tslib");
 const common_1 = require("@nestjs/common");
 const bpm_auth_context_extractor_1 = require("./bpm-auth-context.extractor");
 const bpm_auth_guard_1 = require("./bpm-auth.guard");
+const bpm_resolver_access_decorator_1 = require("./bpm-resolver-access.decorator");
 const ADMIN_PERMISSIONS = new Set([
     'bpm:*',
     'bpm:admin',
@@ -51,9 +52,9 @@ exports.BPMDesignerGuard = BPMDesignerGuard;
 exports.BPMDesignerGuard = BPMDesignerGuard = tslib_1.__decorate([
     (0, common_1.Injectable)()
 ], BPMDesignerGuard);
-const BPMAdminOnly = () => (0, common_1.UseGuards)(bpm_auth_guard_1.BPMAuthenticatedGuard, BPMAdminGuard);
+const BPMAdminOnly = () => (0, bpm_resolver_access_decorator_1.withBPMResolverAccess)('admin', (0, common_1.UseGuards)(bpm_auth_guard_1.BPMAuthenticatedGuard, BPMAdminGuard));
 exports.BPMAdminOnly = BPMAdminOnly;
-const BPMDesignerOnly = () => (0, common_1.UseGuards)(bpm_auth_guard_1.BPMAuthenticatedGuard, BPMDesignerGuard);
+const BPMDesignerOnly = () => (0, bpm_resolver_access_decorator_1.withBPMResolverAccess)('designer', (0, common_1.UseGuards)(bpm_auth_guard_1.BPMAuthenticatedGuard, BPMDesignerGuard));
 exports.BPMDesignerOnly = BPMDesignerOnly;
 function isBPMAdmin(authContext) {
     return (authContext.roles.includes('BPM_ADMIN') ||

package/src/lib/bpm-auth/bpm-auth.authorization.js.map

@@ -1 +1 @@
-{"version":3,"file":"bpm-auth.authorization.js","sourceRoot":"","sources":["../../../../../../libs/bpm-core/src/lib/bpm-auth/bpm-auth.authorization.ts"],"names":[],"mappings":";;;AA8DA,gCAOC;AAED,sCAQC;;AA/ED,2CAMwB;AAExB,6EAAqE;AACrE,qDAAyD;AAEzD,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC;IAChC,OAAO;IACP,WAAW;IACX,WAAW;IACX,aAAa;CACd,CAAC,CAAC;AACH,MAAM,oBAAoB,GAAG,IAAI,GAAG,CAAC;IACnC,OAAO;IACP,WAAW;IACX,WAAW;IACX,aAAa;IACb,YAAY;IACZ,YAAY;IACZ,iBAAiB;IACjB,qBAAqB;IACrB,iBAAiB;IACjB,qBAAqB;CACtB,CAAC,CAAC;AAGI,IAAM,aAAa,GAAnB,MAAM,aAAa;IACxB,WAAW,CAAC,OAAyB;QACnC,MAAM,WAAW,GAAG,IAAA,kDAAqB,EAAC,OAAO,CAAC,CAAC;QAEnD,IAAI,WAAW,IAAI,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;YAC3C,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,IAAI,2BAAkB,CAAC,kCAAkC,CAAC,CAAC;IACnE,CAAC;CACF,CAAA;AAVY,sCAAa;wBAAb,aAAa;IADzB,IAAA,mBAAU,GAAE;GACA,aAAa,CAUzB;AAGM,IAAM,gBAAgB,GAAtB,MAAM,gBAAgB;IAC3B,WAAW,CAAC,OAAyB;QACnC,MAAM,WAAW,GAAG,IAAA,kDAAqB,EAAC,OAAO,CAAC,CAAC;QAEnD,IAAI,WAAW,IAAI,aAAa,CAAC,WAAW,CAAC,EAAE,CAAC;YAC9C,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,IAAI,2BAAkB,CAAC,qCAAqC,CAAC,CAAC;IACtE,CAAC;CACF,CAAA;AAVY,4CAAgB;2BAAhB,gBAAgB;IAD5B,IAAA,mBAAU,GAAE;GACA,gBAAgB,CAU5B;AAEM,MAAM,YAAY,GAAG,GAAqC,EAAE,CACjE,IAAA,kBAAS,EAAC,sCAAqB,EAAE,aAAa,CAAC,CAAC;AADrC,QAAA,YAAY,gBACyB;AAE3C,MAAM,eAAe,GAAG,GAAqC,EAAE,CACpE,IAAA,kBAAS,EAAC,sCAAqB,EAAE,gBAAgB,CAAC,CAAC;AADxC,QAAA,eAAe,mBACyB;AAErD,SAAgB,UAAU,CAAC,WAA2B;IACpD,OAAO,CACL,WAAW,CAAC,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC;QACvC,WAAW,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,EAAE,CAC1C,iBAAiB,CAAC,GAAG,CAAC,UAAU,CAAC,CAClC,CACF,CAAC;AACJ,CAAC;AAED,SAAgB,aAAa,CAAC,WAA2B;IACvD,OAAO,CACL,UAAU,CAAC,WAAW,CAAC;QACvB,WAAW,CAAC,KAAK,CAAC,QAAQ,CAAC,cAAc,CAAC;QAC1C,WAAW,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,EAAE,CAC1C,oBAAoB,CAAC,GAAG,CAAC,UAAU,CAAC,CACrC,CACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"bpm-auth.authorization.js","sourceRoot":"","sources":["../../../../../../libs/bpm-core/src/lib/bpm-auth/bpm-auth.authorization.ts"],"names":[],"mappings":";;;AAqEA,gCAOC;AAED,sCAQC;;AAtFD,2CAMwB;AAExB,6EAAqE;AACrE,qDAAyD;AACzD,mFAAwE;AAExE,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC;IAChC,OAAO;IACP,WAAW;IACX,WAAW;IACX,aAAa;CACd,CAAC,CAAC;AACH,MAAM,oBAAoB,GAAG,IAAI,GAAG,CAAC;IACnC,OAAO;IACP,WAAW;IACX,WAAW;IACX,aAAa;IACb,YAAY;IACZ,YAAY;IACZ,iBAAiB;IACjB,qBAAqB;IACrB,iBAAiB;IACjB,qBAAqB;CACtB,CAAC,CAAC;AAGI,IAAM,aAAa,GAAnB,MAAM,aAAa;IACxB,WAAW,CAAC,OAAyB;QACnC,MAAM,WAAW,GAAG,IAAA,kDAAqB,EAAC,OAAO,CAAC,CAAC;QAEnD,IAAI,WAAW,IAAI,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;YAC3C,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,IAAI,2BAAkB,CAAC,kCAAkC,CAAC,CAAC;IACnE,CAAC;CACF,CAAA;AAVY,sCAAa;wBAAb,aAAa;IADzB,IAAA,mBAAU,GAAE;GACA,aAAa,CAUzB;AAGM,IAAM,gBAAgB,GAAtB,MAAM,gBAAgB;IAC3B,WAAW,CAAC,OAAyB;QACnC,MAAM,WAAW,GAAG,IAAA,kDAAqB,EAAC,OAAO,CAAC,CAAC;QAEnD,IAAI,WAAW,IAAI,aAAa,CAAC,WAAW,CAAC,EAAE,CAAC;YAC9C,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,IAAI,2BAAkB,CAAC,qCAAqC,CAAC,CAAC;IACtE,CAAC;CACF,CAAA;AAVY,4CAAgB;2BAAhB,gBAAgB;IAD5B,IAAA,mBAAU,GAAE;GACA,gBAAgB,CAU5B;AAEM,MAAM,YAAY,GAAG,GAAqC,EAAE,CACjE,IAAA,qDAAqB,EACnB,OAAO,EACP,IAAA,kBAAS,EAAC,sCAAqB,EAAE,aAAa,CAAC,CAChD,CAAC;AAJS,QAAA,YAAY,gBAIrB;AAEG,MAAM,eAAe,GAAG,GAAqC,EAAE,CACpE,IAAA,qDAAqB,EACnB,UAAU,EACV,IAAA,kBAAS,EAAC,sCAAqB,EAAE,gBAAgB,CAAC,CACnD,CAAC;AAJS,QAAA,eAAe,mBAIxB;AAEJ,SAAgB,UAAU,CAAC,WAA2B;IACpD,OAAO,CACL,WAAW,CAAC,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC;QACvC,WAAW,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,EAAE,CAC1C,iBAAiB,CAAC,GAAG,CAAC,UAAU,CAAC,CAClC,CACF,CAAC;AACJ,CAAC;AAED,SAAgB,aAAa,CAAC,WAA2B;IACvD,OAAO,CACL,UAAU,CAAC,WAAW,CAAC;QACvB,WAAW,CAAC,KAAK,CAAC,QAAQ,CAAC,cAAc,CAAC;QAC1C,WAAW,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,EAAE,CAC1C,oBAAoB,CAAC,GAAG,CAAC,UAAU,CAAC,CACrC,CACF,CAAC;AACJ,CAAC"}

package/src/lib/bpm-auth/bpm-auth.decorators.js

@@ -4,7 +4,8 @@ exports.BPMCurrentMemberId = exports.BPMCurrentAuthContext = exports.BPMAuthenti
 const common_1 = require("@nestjs/common");
 const bpm_auth_guard_1 = require("./bpm-auth.guard");
 const bpm_auth_context_extractor_1 = require("./bpm-auth-context.extractor");
-const BPMAuthenticated = () => (0, common_1.UseGuards)(bpm_auth_guard_1.BPMAuthenticatedGuard);
+const bpm_resolver_access_decorator_1 = require("./bpm-resolver-access.decorator");
+const BPMAuthenticated = () => (0, bpm_resolver_access_decorator_1.withBPMResolverAccess)('authenticated', (0, common_1.UseGuards)(bpm_auth_guard_1.BPMAuthenticatedGuard));
 exports.BPMAuthenticated = BPMAuthenticated;
 exports.BPMCurrentAuthContext = (0, common_1.createParamDecorator)((_data, context) => (0, bpm_auth_context_extractor_1.extractBPMAuthContext)(context));
 exports.BPMCurrentMemberId = (0, common_1.createParamDecorator)((_data, context) => (0, bpm_auth_context_extractor_1.extractBPMAuthContext)(context)?.memberId ?? null);

package/src/lib/bpm-auth/bpm-auth.decorators.js.map

@@ -1 +1 @@
-{"version":3,"file":"bpm-auth.decorators.js","sourceRoot":"","sources":["../../../../../../libs/bpm-core/src/lib/bpm-auth/bpm-auth.decorators.ts"],"names":[],"mappings":";;;AAAA,2CAIwB;AACxB,qDAAyD;AACzD,6EAAqE;AAE9D,MAAM,gBAAgB,GAAG,GAAqC,EAAE,CACrE,IAAA,kBAAS,EAAC,sCAAqB,CAAC,CAAC;AADtB,QAAA,gBAAgB,oBACM;AAEtB,QAAA,qBAAqB,GAAG,IAAA,6BAAoB,EACvD,CAAC,KAAc,EAAE,OAAyB,EAAE,EAAE,CAAC,IAAA,kDAAqB,EAAC,OAAO,CAAC,CAC9E,CAAC;AAEW,QAAA,kBAAkB,GAAG,IAAA,6BAAoB,EACpD,CAAC,KAAc,EAAE,OAAyB,EAAE,EAAE,CAC5C,IAAA,kDAAqB,EAAC,OAAO,CAAC,EAAE,QAAQ,IAAI,IAAI,CACnD,CAAC"}
+{"version":3,"file":"bpm-auth.decorators.js","sourceRoot":"","sources":["../../../../../../libs/bpm-core/src/lib/bpm-auth/bpm-auth.decorators.ts"],"names":[],"mappings":";;;AAAA,2CAIwB;AACxB,qDAAyD;AACzD,6EAAqE;AACrE,mFAAwE;AAEjE,MAAM,gBAAgB,GAAG,GAAqC,EAAE,CACrE,IAAA,qDAAqB,EAAC,eAAe,EAAE,IAAA,kBAAS,EAAC,sCAAqB,CAAC,CAAC,CAAC;AAD9D,QAAA,gBAAgB,oBAC8C;AAE9D,QAAA,qBAAqB,GAAG,IAAA,6BAAoB,EACvD,CAAC,KAAc,EAAE,OAAyB,EAAE,EAAE,CAAC,IAAA,kDAAqB,EAAC,OAAO,CAAC,CAC9E,CAAC;AAEW,QAAA,kBAAkB,GAAG,IAAA,6BAAoB,EACpD,CAAC,KAAc,EAAE,OAAyB,EAAE,EAAE,CAC5C,IAAA,kDAAqB,EAAC,OAAO,CAAC,EAAE,QAAQ,IAAI,IAAI,CACnD,CAAC"}

package/src/lib/bpm-auth/bpm-resolver-access.decorator.d.ts

@@ -0,0 +1,13 @@
+import { BPMResolverAccessLevel } from './bpm-resolver-metadata';
+type BPMResolverDecorator = ClassDecorator & MethodDecorator;
+/**
+ * Wraps one of BPM's authorization decorators so the decorated class or method
+ * also lands in the resolver registry.
+ *
+ * The registry is what makes `BPMRootModuleOptions.resolverMetadataFactory`
+ * possible: a decorator runs when the class is defined, long before any module
+ * option exists, so the only way a host can reach these handlers is for BPM to
+ * remember them and replay the host's factory later.
+ */
+export declare function withBPMResolverAccess(access: BPMResolverAccessLevel, decorate: BPMResolverDecorator): BPMResolverDecorator;
+export {};

package/src/lib/bpm-auth/bpm-resolver-access.decorator.js

@@ -0,0 +1,27 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.withBPMResolverAccess = withBPMResolverAccess;
+const bpm_resolver_metadata_1 = require("./bpm-resolver-metadata");
+/**
+ * Wraps one of BPM's authorization decorators so the decorated class or method
+ * also lands in the resolver registry.
+ *
+ * The registry is what makes `BPMRootModuleOptions.resolverMetadataFactory`
+ * possible: a decorator runs when the class is defined, long before any module
+ * option exists, so the only way a host can reach these handlers is for BPM to
+ * remember them and replay the host's factory later.
+ */
+function withBPMResolverAccess(access, decorate) {
+    const applyDecorator = decorate;
+    const decorator = (target, propertyKey, descriptor) => {
+        if (propertyKey === undefined) {
+            (0, bpm_resolver_metadata_1.registerBPMResolverClassAccess)(target, access);
+        }
+        else {
+            (0, bpm_resolver_metadata_1.registerBPMResolverMethodAccess)(target.constructor, String(propertyKey), access);
+        }
+        return applyDecorator(target, propertyKey, descriptor);
+    };
+    return decorator;
+}
+//# sourceMappingURL=bpm-resolver-access.decorator.js.map

package/src/lib/bpm-auth/bpm-resolver-access.decorator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bpm-resolver-access.decorator.js","sourceRoot":"","sources":["../../../../../../libs/bpm-core/src/lib/bpm-auth/bpm-resolver-access.decorator.ts"],"names":[],"mappings":";;AAuBA,sDAyBC;AAhDD,mEAIiC;AAUjC;;;;;;;;GAQG;AACH,SAAgB,qBAAqB,CACnC,MAA8B,EAC9B,QAA8B;IAE9B,MAAM,cAAc,GAAG,QAAuC,CAAC;IAE/D,MAAM,SAAS,GAAqB,CAClC,MAAM,EACN,WAAW,EACX,UAAU,EACJ,EAAE;QACR,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;YAC9B,IAAA,sDAA8B,EAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACjD,CAAC;aAAM,CAAC;YACN,IAAA,uDAA+B,EAC5B,MAA2C,CAAC,WAAW,EACxD,MAAM,CAAC,WAAW,CAAC,EACnB,MAAM,CACP,CAAC;QACJ,CAAC;QAED,OAAO,cAAc,CAAC,MAAM,EAAE,WAAW,EAAE,UAAU,CAAC,CAAC;IACzD,CAAC,CAAC;IAEF,OAAO,SAA4C,CAAC;AACtD,CAAC"}