@rytass/wms-module-graphql 0.2.0 → 0.4.0

package/README.md

@@ -17,56 +17,100 @@ yarn add @nestjs/common @nestjs/graphql @nestjs/apollo @apollo/server graphql da
 ```ts
 import { Module } from '@nestjs/common';
 import { TypeOrmModule } from '@nestjs/typeorm';
+import { GraphQLModule } from '@nestjs/graphql';
 import { ApolloDriver } from '@nestjs/apollo';
 import { resolve } from 'node:path';
-import { WmsModuleGraphqlModule } from '@rytass/wms-module-graphql';
+import {
+  WmsModuleGraphqlModule,
+  LoaderService,
+  createWmsLoaders,
+} from '@rytass/wms-module-graphql';
 
 @Module({
   imports: [
     TypeOrmModule.forRoot({ /* ...db config... */ }),
-    WmsModuleGraphqlModule.forRootAsync(
-      {
-        useFactory: async () => ({}),
-        defaultLoaderSerialId: 'DEFAULT',
-        defaultLoaderTypeKey: 'DEFAULT',
-        defaultLocationKey: 'DEFAULT',
-      },
-      {
-        driver: ApolloDriver,
-        useFactory: async () => ({
-          autoSchemaFile: resolve(process.cwd(), 'schema.gql'),
-          playground: false,
-          introspection: true,
-          cors: true,
-          autoTransformHttpErrors: true,
+    WmsModuleGraphqlModule.forRootAsync({
+      useFactory: async () => ({}),
+      defaultLoaderSerialId: 'DEFAULT',
+      defaultLoaderTypeKey: 'DEFAULT',
+      defaultLocationKey: 'DEFAULT',
+    }),
+    GraphQLModule.forRootAsync({
+      driver: ApolloDriver,
+      inject: [LoaderService],
+      useFactory: (loaderService: LoaderService) => ({
+        autoSchemaFile: resolve(process.cwd(), 'schema.gql'),
+        playground: false,
+        introspection: true,
+        cors: true,
+        autoTransformHttpErrors: true,
+        context: ({ req }) => ({
+          ...createWmsLoaders(loaderService),
+          // your own context fields stay yours — no silent overwrite
+          user: req.user,
         }),
-      },
-    ),
+      }),
+    }),
   ],
 })
 export class AppModule {}
 ```
 
-The first argument is `WmsModuleCoreModuleAsyncOptions` (merged from `@rytass/wms-module-core` — same shape as `WMSBaseModuleAsyncOptions` plus the three `default*` keys). The second is a standard `@nestjs/graphql` `GqlModuleAsyncOptions` — extend the `useFactory` to override the Apollo config (cors, plugins, custom scalars, etc.).
+`WmsModuleGraphqlModule.forRootAsync` takes a single argument (`WmsModuleCoreModuleAsyncOptions`, re-exported from `@rytass/wms-module-core` — same shape as `WMSBaseModuleAsyncOptions` plus the three `default*` keys). It registers the resolvers/queries/mutations as composable NestJS providers and exposes `LoaderService` as a `@Global()` DI token; it does **not** start Apollo Server.
+
+You register a **single** `GraphQLModule.forRootAsync(...)` of your own, mix your resolvers with the WMS resolvers in the same schema, and own the Apollo / context configuration end-to-end.
 
 `WmsModuleGraphqlModule` internally wires `WmsModuleCoreModule.forRootAsync` so you do not need to import the core module separately when using this package.
 
+## Authorization
+
+Every WMS root `@Query` / `@Mutation` is annotated with `@WmsOperation({ resource, action })` — a **host-neutral** permission requirement enforced by the library's own route-level `WmsAuthGuard`, which delegates the allow/deny decision to an `authChecker` **you** supply. The library never imports your auth system; you map WMS's `resource`/`action` onto whatever you use (Casbin, RBAC, JWT scopes…).
+
+> ⚠️ **Using a global guard (e.g. member-base's `CasbinGuard` as `APP_GUARD`)?** A deny-by-default global guard blankets *every* resolver in the schema, including WMS's, and rejects them all because they carry no host-specific metadata — "every WMS operation is forbidden". WMS fixes this by stamping each operation with a host-skip marker so your global guard **defers**, while `WmsAuthGuard` does the real enforcement. **You do not touch your global guard.**
+
+```ts
+import { WmsModuleGraphqlModule } from '@rytass/wms-module-graphql';
+import { createMemberBaseWmsAuthChecker } from '@rytass/wms-module-graphql/adapters/member-base';
+
+WmsModuleGraphqlModule.forRootAsync({
+  useFactory: async () => ({}),
+  defaultLoaderSerialId: 'DEFAULT',
+  defaultLoaderTypeKey: 'DEFAULT',
+  defaultLocationKey: 'DEFAULT',
+  // optional — omit to stay fully permissive (local dev / demos)
+  authChecker: createMemberBaseWmsAuthChecker({
+    map: ({ resource, action }) => [[`wms:${resource}`, action]],
+  }),
+});
+```
+
+The member-base adapter reuses everything `CasbinGuard` already put on the request (verified `payload`, `enforcer`, your custom `casbinPermissionChecker`) so WMS enforces with the **exact same** policy engine as your own resolvers — with **zero** member-base import on the WMS side. For custom JWT/RBAC, pass your own `authChecker: (ctx, { resource, action }) => boolean`.
+
+➡️ **Full design & recipes: [`docs/authorization.md`](./docs/authorization.md)** (the problem, execution order, member-base / custom-JWT / no-guard recipes, the single coupling point, public API, FAQ).
+
 ## DataLoader context
 
-The module ships a `HelperModule` that provides DataLoader instances for batched entity lookups, automatically injected into the GraphQL context so resolvers can avoid N+1 queries:
+The module ships a `HelperModule` (auto-registered) that provides a singleton `LoaderService`. To avoid N+1 queries, the WMS resolvers expect a per-request DataLoader trio at `context.loaders`:
 
 ```ts
-context: async (contextArg) => ({
-  loaders: {
-    batchSingle: ...,
-    batchMany: ...,
-    batchManyWithPagination: ...,
-  },
-  ...contextArg,
-})
+type WmsLoaders = {
+  batchSingle: DataLoader<...>;
+  batchMany: DataLoader<...>;
+  batchManyWithPagination: DataLoader<...>;
+};
+```
+
+Inject `LoaderService` into your `GraphQLModule.forRootAsync` factory and call `createWmsLoaders(loaderService)` **per request** inside `context`. The helper returns a `{ loaders: WmsLoaders }` fragment that is safe to spread:
+
+```ts
+context: ({ req }) => ({
+  ...createWmsLoaders(loaderService),   // adds `loaders: { batchSingle, ... }`
+  user: req.user,                       // your fields preserved
+  csrfToken: req.headers['x-csrf'],
+}),
 ```
 
-Custom context factories from `gqlOptions.useFactory` are merged with the loaders — your existing context fields survive the wrap.
+Per-request is non-negotiable — DataLoader caches results inside the instance, so reusing one across requests leaks data between callers. `createWmsLoaders` is a thin factory you call from inside `context`, never at module scope.
 
 ## Schema artefacts
 
@@ -79,12 +123,14 @@ Full documentation is shipped inside this package under the `docs/` directory (a
 | Document | Description |
 |---|---|
 | [`docs/integration-guide.md`](./docs/integration-guide.md) | Step-by-step wiring guide for NestJS + Next.js consumers |
+| [`docs/authorization.md`](./docs/authorization.md) | Complete resolver-authorization design & integration recipes (member-base / custom JWT / no-guard) |
 | [`docs/api-reference.md`](./docs/api-reference.md) | Complete export catalog with signatures and usage examples |
 
 GitHub hosted links (always up-to-date):
 
 - [Integration Guide — §4 Backend setup](https://github.com/Rytass/WMS-Module/blob/main/docs/integration-guide.md#4-backend-setup-nestjs--graphql--typeorm)
 - [Integration Guide — §13.1 Existing GraphQLModule co-existence](https://github.com/Rytass/WMS-Module/blob/main/docs/integration-guide.md#13-integrating-into-an-existing-nestjs--nextjs-project)
+- [Authorization — design & recipes](https://github.com/Rytass/WMS-Module/blob/main/libs/graphql/docs/authorization.md)
 - [API Reference — @rytass/wms-module-graphql](https://github.com/Rytass/WMS-Module/blob/main/docs/api-reference.md#rytasswms-module-graphql)
 
 ## License

package/adapters/member-base.d.ts

@@ -0,0 +1,35 @@
+import type { WmsAuthChecker, WmsOperationRequirement } from '../lib/auth';
+/**
+ * A Casbin `[subject, action]` tuple, e.g. `['wms:material', 'read']`.
+ */
+export type CasbinAction = [string, string];
+export interface MemberBaseWmsAuthCheckerOptions {
+    /**
+     * Map a host-neutral WMS requirement onto one or more Casbin
+     * `[subject, action]` tuples. This is where your project's permission naming
+     * convention lives. Returning several tuples means "allow if *any* passes"
+     * (member-base's default checker is OR-based).
+     *
+     * @example
+     * ```ts
+     * map: ({ resource, action }) => [[`wms:${resource}`, action]]
+     * // material:read  ->  enforce(memberId, domain, 'wms:material', 'read')
+     * ```
+     */
+    readonly map: (requirement: WmsOperationRequirement) => CasbinAction[];
+}
+/**
+ * Builds a {@link WmsAuthChecker} that authorizes WMS operations against
+ * `@rytass/member-base-nestjs-module`'s Casbin setup.
+ *
+ * It reuses everything the host's global `CasbinGuard` already prepared on the
+ * request — the verified `payload`, the `enforcer`, and even the consumer's
+ * (possibly customized) `casbinPermissionChecker`. WMS therefore enforces with
+ * the *exact same* policy engine and rules as the host's own resolvers, with no
+ * member-base import on the WMS side.
+ *
+ * Prerequisite: register `MemberBaseModule` with its global guard enabled
+ * (the default), and expose the request on the GraphQL context as `req`
+ * (Apollo's default).
+ */
+export declare const createMemberBaseWmsAuthChecker: (options: MemberBaseWmsAuthCheckerOptions) => WmsAuthChecker;

package/adapters/member-base.js

@@ -0,0 +1,47 @@
+import { GqlExecutionContext } from '@nestjs/graphql';
+
+const extractRequest = (context) => {
+    const gqlContext = GqlExecutionContext.create(context).getContext();
+    return gqlContext?.req;
+};
+/**
+ * Builds a {@link WmsAuthChecker} that authorizes WMS operations against
+ * `@rytass/member-base-nestjs-module`'s Casbin setup.
+ *
+ * It reuses everything the host's global `CasbinGuard` already prepared on the
+ * request — the verified `payload`, the `enforcer`, and even the consumer's
+ * (possibly customized) `casbinPermissionChecker`. WMS therefore enforces with
+ * the *exact same* policy engine and rules as the host's own resolvers, with no
+ * member-base import on the WMS side.
+ *
+ * Prerequisite: register `MemberBaseModule` with its global guard enabled
+ * (the default), and expose the request on the GraphQL context as `req`
+ * (Apollo's default).
+ */
+const createMemberBaseWmsAuthChecker = (options) => {
+    return async (context, requirement) => {
+        const request = extractRequest(context);
+        // No verified member → unauthenticated. CasbinGuard sets `payload` to
+        // undefined when the token is missing or invalid.
+        if (!request?.payload) {
+            return false;
+        }
+        // The enforcer / checker are injected by CasbinGuard. Their absence means
+        // the host did not enable the global guard — fail closed rather than
+        // silently allowing everything.
+        if (!request.enforcer || !request.casbinPermissionChecker) {
+            return false;
+        }
+        const actions = options.map(requirement);
+        if (actions.length === 0) {
+            return false;
+        }
+        return request.casbinPermissionChecker({
+            enforcer: request.enforcer,
+            payload: request.payload,
+            actions,
+        });
+    };
+};
+
+export { createMemberBaseWmsAuthChecker };

package/docs/README.md

@@ -7,7 +7,8 @@ Reference material for consumers of `@rytass/wms-module-{core,graphql,react}`.
 | Document                                       | Description                                                                                       |
 |------------------------------------------------|---------------------------------------------------------------------------------------------------|
 | [Integration Guide](./integration-guide.md)    | Step-by-step instructions for wiring the three packages into a new consumer project (NestJS + Next.js + PostgreSQL). Includes ready-to-paste `_app.tsx`, `app.module.ts`, `next.config.ts`, the 19 Pages Router shell pattern, AuthGuard stub, seed script template, deployment notes, and known issues. |
-| [API Reference](./api-reference.md)            | Complete export catalog for all three packages — every NestJS module, TypeORM entity, GraphQL resolver, DTO, React component, hook, and utility, organized by role with source paths and usage examples. Mirrors the actual `src/index.ts` barrel exports of v0.1.2. |
+| [Authorization](./authorization.md)            | Complete design of the resolver-level authorization protocol (`@WmsOperation` + `WmsAuthGuard` + `authChecker`). Explains the global deny-by-default guard pitfall, execution order, and integration recipes for member-base / Casbin, custom JWT / RBAC, and no-guard setups. Read this if any WMS query/mutation returns *forbidden*. |
+| [API Reference](./api-reference.md)            | Complete export catalog for all three packages — every NestJS module, TypeORM entity, GraphQL resolver, DTO, React component, hook, and utility, organized by role with source paths and usage examples. Mirrors the actual `src/index.ts` barrel exports of `@rytass/wms-module-graphql@0.3.0` and `@rytass/wms-module-{core,react}@0.1.6`. |
 
 ## Quick links
 
@@ -23,11 +24,13 @@ Reference material for consumers of `@rytass/wms-module-{core,graphql,react}`.
 | Look up a specific export's signature                   | [API Reference](./api-reference.md)                                    |
 | Understand why the lib needs `transpilePackages`        | [Integration Guide section 5.3](./integration-guide.md#53-appsclientnextconfigts) |
 | Replace the `AuthGuard` stub with real auth             | [Integration Guide section 8.4](./integration-guide.md#84-real-auth-integration) |
+| Authorize WMS resolvers with member-base / Casbin / RBAC | [Authorization](./authorization.md)                                   |
+| Fix "every WMS query/mutation is forbidden"             | [Authorization section 1](./authorization.md#1-the-problem)            |
 | Decide between PostgreSQL and SQLite                    | [Integration Guide section 9](./integration-guide.md#9-database-support-matrix) |
 | Build a custom UI on top of the lib's GraphQL operations| [Integration Guide section 7.3](./integration-guide.md#73-graphql-operations--typed-hooks) |
 
 ## Versioning
 
-These documents track the **latest published `0.1.x` release**. Anything in `main` that has not yet been released is marked clearly inline; otherwise assume the documented signature matches the current npm-published library.
+These documents track the **latest published versions** — `@rytass/wms-module-graphql@0.3.0` and `@rytass/wms-module-{core,react}@0.1.6` as of this writing. Anything in `main` that has not yet been released is marked clearly inline; otherwise assume the documented signature matches the current npm-published library.
 
-When you upgrade the lib, check each package's `CHANGELOG.md` for breaking changes that may affect the snippets here.
+`@rytass/wms-module-graphql@0.3.0` introduced **breaking changes** to `WmsModuleGraphqlModule.forRootAsync` (single argument; consumer now registers their own `GraphQLModule.forRootAsync`). The integration guide and API reference reflect the post-0.3.0 surface — see each package's `CHANGELOG.md` for the full breaking change list when upgrading.

package/docs/api-reference.md

@@ -6,10 +6,12 @@ Complete export catalog for the three publishable libraries:
 - `@rytass/wms-module-graphql` — GraphQL resolvers, DTOs, DataLoader helpers
 - `@rytass/wms-module-react` — React components, hooks, Apollo client, GraphQL operations
 
-Current versions: **0.1.2** (all three packages).
+Current versions: **0.3.0** (`@rytass/wms-module-graphql`), **0.1.6** (`@rytass/wms-module-core`, `@rytass/wms-module-react`).
 
 This document mirrors the actual `src/index.ts` barrel exports and is generated by static analysis of the lib sources. For runtime behavior changes between versions, see each package's `CHANGELOG.md`.
 
+> **0.3.0 surface change**: `WmsModuleGraphqlModule.forRootAsync(...)` now takes a single argument and exposes resolvers as composable providers — see [`WmsModuleGraphqlModule`](#wmsmodulegraphqlmodule) and the new public exports [`LoaderService`](#loaderservice-injectable), [`createWmsLoaders`](#createwmsloaders) below.
+
 > Companion document — **[Integration Guide](./integration-guide.md)** — step-by-step instructions for wiring the three packages into a new consumer project.
 
 ---
@@ -293,28 +295,158 @@ enum ShipInventoryOrderStatus { PENDING, PARTIAL_SHIPPED, SHIPPED, REMOVED }
 ## NestJS Modules
 
 ### `WmsModuleGraphqlModule`
-- 用途: WMS GraphQL NestJS 動態模組，整合 Apollo GraphQL、DataLoader 與所有 Resolver/Query/Mutation。是消費端 `apps/api` 唯一需要 `imports: [...]` 的 WMS 模組。
+- 用途: WMS GraphQL NestJS 動態模組，**僅註冊 providers**（Resolver / Query / Mutation 與 `LoaderService`），不啟動 Apollo Server。消費端在自己的 `AppModule` 內額外 `imports: [GraphQLModule.forRootAsync(...)]` 統一起 server。
 - 來源: `lib/graphql.module.ts`
 
-**`forRootAsync(options, gqlOptions): DynamicModule`**
+**`forRootAsync(options): DynamicModule`** (since 0.3.0)
 ```ts
 static forRootAsync(
-  options: WmsModuleCoreModuleAsyncOptions,
+  options: WmsModuleGraphqlModuleAsyncOptions,
+  // = WmsModuleCoreModuleAsyncOptions & WmsAuthModuleOptions
+  //
   // WMSBaseModuleAsyncOptions（Vault/DB 選項）
   // + WmsModuleCoreModuleOptions:
   //     defaultLoaderSerialId: string  — 庫存作業預設載具序號
   //     defaultLoaderTypeKey: string   — 預設載具類型 key
   //     defaultLocationKey: string     — 預設儲存位置 key
-  gqlOptions: GqlModuleAsyncOptions,
-  // 標準 @nestjs/graphql GqlModuleAsyncOptions，
-  // 例如 autoSchemaFile、context factory 等
-  // 注意：此方法會自動在 context 中注入 loaders（DataLoader instances）:
-  //   loaders.batchSingle — DataLoader<LoaderOptions<T>, T>
-  //   loaders.batchMany   — DataLoader<LoaderOptions<T>, T[]>
-  //   loaders.batchManyWithPagination — DataLoader<LoaderOptionsWithPagination<T>, { items: T[]; total: number }>
+  // + WmsAuthModuleOptions:
+  //     authChecker?: WmsAuthChecker   — 選填；resolver 授權委派函式（見 Authorization）
 ): DynamicModule
 ```
 
+> **Breaking from 0.2.x**: 0.2.0 took a second `gqlOptions` argument and started Apollo Server internally; 0.3.0 dropped it. Consumers now own `GraphQLModule.forRootAsync(...)` and the GraphQL context factory. Use `createWmsLoaders(loaderService)` inside `context` to provide the WMS DataLoader trio (see below).
+
+> **Authorization (`authChecker`)**: optional. Omit it and the module stays fully permissive. Supply it to authorize every WMS root op against your permission system — see the dedicated [**Authorization**](#authorization) section below and [`docs/authorization.md`](./authorization.md).
+
+### `LoaderService` (`@Injectable()`, since 0.3.0 publicly exported)
+- 用途: 提供 DataLoader 工廠方法（`batchEntity()`、`batchEntities()`、`batchEntitiesWithPagination()`）。每次呼叫產生新的 DataLoader instance — 須在 GraphQL context factory **per request** 呼叫，**勿** 在 module scope 重用。
+- 來源: `lib/helpers/loader.service.ts`
+- 透過 `WmsModuleGraphqlModule.forRootAsync(...)` 自動經 `HelperModule` (`@Global()`) 全域提供，可在任何模組的 factory 內 `inject: [LoaderService]`。
+
+### `createWmsLoaders`
+- 用途: 便利 helper — 呼叫 `LoaderService` 三個 factory 並回傳 spreadable context fragment `{ loaders: { batchSingle, batchMany, batchManyWithPagination } }`。
+- 來源: `lib/helpers/create-wms-loaders.ts`
+
+```ts
+import {
+  createWmsLoaders,
+  LoaderService,
+  type WmsLoaders,
+} from '@rytass/wms-module-graphql';
+
+GraphQLModule.forRootAsync({
+  driver: ApolloDriver,
+  inject: [LoaderService],
+  useFactory: (loaderService: LoaderService) => ({
+    autoSchemaFile: 'schema.gql',
+    context: ({ req }) => ({
+      ...createWmsLoaders(loaderService),  // ← adds `loaders` key
+      user: req.user,                      // your own fields preserved
+    }),
+  }),
+});
+```
+
+```ts
+// Type signature
+export type WmsLoaders = {
+  batchSingle: DataLoader<LoaderOptions<unknown>, unknown>;
+  batchMany: DataLoader<LoaderOptions<unknown>, unknown[]>;
+  batchManyWithPagination: DataLoader<
+    LoaderOptionsWithPagination<unknown>,
+    { items: unknown[]; total: number }
+  >;
+};
+
+export function createWmsLoaders(
+  loaderService: LoaderService,
+): { loaders: WmsLoaders };
+```
+
+Resolvers consume the loaders via the `LoaderType<T>` shape (see [`LoaderType`](#loadertype)) injected through `@Context()`. The helper's return shape (`{ loaders: ... }`) is intentional so it can be spread into a custom context without colliding with consumer fields.
+
+### `LoaderType`
+- 用途: Resolver 端解構 GraphQL context 的型別契約，描述 `context.loaders` 的形狀。
+- 來源: `lib/helpers/dataloader.type.ts`
+
+```ts
+export interface LoaderType<T> {
+  loaders: {
+    batchSingle: DataLoader<LoaderOptions<T>, T>;
+    batchMany: DataLoader<LoaderOptions<T>, T[]>;
+    batchManyWithPagination: DataLoader<
+      LoaderOptionsWithPagination<T>,
+      { items: T[]; total: number }
+    >;
+  };
+}
+
+// 使用範例（resolver 內）
+@ResolveField(() => MaterialEntityClass)
+material(
+  @Parent() stock: StockDto,
+  @Context() { loaders }: LoaderType<MaterialEntityClass>,
+) {
+  return loaders.batchSingle.load({
+    __entity: MaterialEntity,
+    __from: { id: stock.materialId },
+  });
+}
+```
+
+---
+
+## Authorization
+
+Host-neutral, opt-in resolver authorization. Every WMS root `@Query`/`@Mutation` carries `@WmsOperation({ resource, action })`; `WmsAuthGuard` enforces it by delegating to the consumer-supplied `authChecker`. Full design & recipes: [`docs/authorization.md`](./authorization.md).
+
+### Root exports (`@rytass/wms-module-graphql`)
+
+| Export | Kind | Signature / shape |
+|---|---|---|
+| `WmsOperation` | decorator | `(requirement: WmsOperationRequirement) => MethodDecorator` — already applied across the library; add it to any new root op. |
+| `WmsAuthGuard` | `@Injectable()` guard | route-level `CanActivate`; reads the requirement, calls `authChecker`. Auto-registered by `forRootAsync`. |
+| `WmsAuthChecker` | type | `(context: ExecutionContext, requirement: WmsOperationRequirement) => boolean \| Promise<boolean>` |
+| `WmsOperationRequirement` | type | `{ readonly resource: string; readonly action: string }` |
+| `WmsAuthModuleOptions` | type | `{ readonly authChecker?: WmsAuthChecker }` |
+| `WmsModuleGraphqlModuleAsyncOptions` | type | `WmsModuleCoreModuleAsyncOptions & WmsAuthModuleOptions` (the `forRootAsync` arg) |
+| `WMS_AUTH_OPTIONS` | `symbol` | DI token holding the resolved auth options |
+| `WMS_OPERATION_METADATA` | `string` (`'wms:operation'`) | Reflector key carrying the requirement |
+| `HOST_SKIP_METADATA_KEY` | `string` (`'IS_ROUTE_PUBLIC'`) | host-skip metadata key stamped on each op so a global guard defers (default matches member-base) |
+
+### Adapter subpath (`@rytass/wms-module-graphql/adapters/member-base`)
+
+| Export | Kind | Signature / shape |
+|---|---|---|
+| `createMemberBaseWmsAuthChecker` | factory | `(options: MemberBaseWmsAuthCheckerOptions) => WmsAuthChecker` |
+| `MemberBaseWmsAuthCheckerOptions` | type | `{ readonly map: (requirement: WmsOperationRequirement) => CasbinAction[] }` |
+| `CasbinAction` | type | `[string, string]` — a `[subject, action]` tuple |
+
+```ts
+// member-base / Casbin
+import { createMemberBaseWmsAuthChecker } from '@rytass/wms-module-graphql/adapters/member-base';
+
+WmsModuleGraphqlModule.forRootAsync({
+  useFactory: async () => ({}),
+  defaultLoaderSerialId: 'DEFAULT',
+  defaultLoaderTypeKey: 'DEFAULT',
+  defaultLocationKey: 'DEFAULT',
+  authChecker: createMemberBaseWmsAuthChecker({
+    map: ({ resource, action }) => [[`wms:${resource}`, action]],
+  }),
+});
+
+// custom JWT / RBAC
+import type { WmsAuthChecker } from '@rytass/wms-module-graphql';
+
+const authChecker: WmsAuthChecker = (ctx, { resource, action }) => {
+  // read your session off ctx and decide
+  return true;
+};
+```
+
+The adapter imports nothing from member-base — it reads the `payload` / `enforcer` / `casbinPermissionChecker` that `CasbinGuard` attaches to the request at runtime. member-base is therefore **not** a dependency or peer dependency of this package.
+
 ---
 
 ## Resolvers（`@Resolver()` decorator class）