@sapl/nestjs 1.0.0

package/dist/EnforceDropWhileDeniedAspect.js

@@ -0,0 +1,108 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var EnforceDropWhileDeniedAspect_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.EnforceDropWhileDeniedAspect = void 0;
+const common_1 = require("@nestjs/common");
+const nestjs_aop_1 = require("@toss/nestjs-aop");
+const nestjs_cls_1 = require("nestjs-cls");
+const rxjs_1 = require("rxjs");
+const EnforceDropWhileDenied_1 = require("./EnforceDropWhileDenied");
+const pdp_service_1 = require("./pdp.service");
+const SubscriptionBuilder_1 = require("./SubscriptionBuilder");
+const ConstraintEnforcementService_1 = require("./constraints/ConstraintEnforcementService");
+let EnforceDropWhileDeniedAspect = EnforceDropWhileDeniedAspect_1 = class EnforceDropWhileDeniedAspect {
+    constructor(pdpService, cls, constraintService) {
+        this.pdpService = pdpService;
+        this.cls = cls;
+        this.constraintService = constraintService;
+        this.logger = new common_1.Logger(EnforceDropWhileDeniedAspect_1.name);
+    }
+    wrap({ method, metadata, methodName, instance }) {
+        const aspect = this;
+        const className = instance.constructor.name;
+        return (...args) => {
+            return new rxjs_1.Observable((subscriber) => {
+                let currentBundle = null;
+                let sourceSubscription = null;
+                let permitted = false;
+                const ctx = (0, SubscriptionBuilder_1.buildContext)(aspect.cls, methodName, className, args);
+                const subscription = (0, SubscriptionBuilder_1.buildSubscriptionFromContext)(metadata, ctx);
+                const decisions$ = aspect.pdpService.decide(subscription);
+                const decisionSub = decisions$.subscribe({
+                    next: (decision) => {
+                        if (decision.decision === 'PERMIT') {
+                            try {
+                                const newBundle = aspect.constraintService.streamingBundleFor(decision);
+                                newBundle.handleOnDecisionConstraints();
+                                currentBundle = newBundle;
+                            }
+                            catch (error) {
+                                aspect.logger.warn(`Obligation handling failed: ${error}`);
+                                permitted = false;
+                                currentBundle = null;
+                                return;
+                            }
+                            permitted = true;
+                            if (!sourceSubscription) {
+                                sourceSubscription = method(...args).subscribe({
+                                    next: (value) => {
+                                        if (!permitted || !currentBundle)
+                                            return;
+                                        try {
+                                            const transformed = currentBundle.handleAllOnNextConstraints(value);
+                                            subscriber.next(transformed);
+                                        }
+                                        catch (error) {
+                                            aspect.logger.warn(`Constraint handling failed on next: ${error}`);
+                                            permitted = false;
+                                            currentBundle = null;
+                                        }
+                                    },
+                                    error: (err) => subscriber.error(err),
+                                    complete: () => {
+                                        currentBundle?.handleOnCompleteConstraints();
+                                        subscriber.complete();
+                                    },
+                                });
+                            }
+                        }
+                        else {
+                            permitted = false;
+                            currentBundle = null;
+                            try {
+                                const bestEffort = aspect.constraintService.streamingBestEffortBundleFor(decision);
+                                bestEffort.handleOnDecisionConstraints();
+                            }
+                            catch {
+                                /* best effort */
+                            }
+                        }
+                    },
+                    error: (err) => subscriber.error(err),
+                });
+                return () => {
+                    currentBundle?.handleOnCancelConstraints();
+                    decisionSub.unsubscribe();
+                    sourceSubscription?.unsubscribe();
+                };
+            });
+        };
+    }
+};
+exports.EnforceDropWhileDeniedAspect = EnforceDropWhileDeniedAspect;
+exports.EnforceDropWhileDeniedAspect = EnforceDropWhileDeniedAspect = EnforceDropWhileDeniedAspect_1 = __decorate([
+    (0, nestjs_aop_1.Aspect)(EnforceDropWhileDenied_1.ENFORCE_DROP_WHILE_DENIED_SYMBOL),
+    __metadata("design:paramtypes", [pdp_service_1.PdpService,
+        nestjs_cls_1.ClsService,
+        ConstraintEnforcementService_1.ConstraintEnforcementService])
+], EnforceDropWhileDeniedAspect);
+//# sourceMappingURL=EnforceDropWhileDeniedAspect.js.map

package/dist/EnforceDropWhileDeniedAspect.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"EnforceDropWhileDeniedAspect.js","sourceRoot":"","sources":["../lib/EnforceDropWhileDeniedAspect.ts"],"names":[],"mappings":";;;;;;;;;;;;;AAAA,2CAAwC;AACxC,iDAAqE;AACrE,2CAAwC;AACxC,+BAAgD;AAChD,qEAA4E;AAE5E,+CAA2C;AAE3C,+DAAmF;AACnF,6FAA0F;AAInF,IAAM,4BAA4B,oCAAlC,MAAM,4BAA4B;IAGvC,YACmB,UAAsB,EACtB,GAAe,EACf,iBAA+C;QAF/C,eAAU,GAAV,UAAU,CAAY;QACtB,QAAG,GAAH,GAAG,CAAY;QACf,sBAAiB,GAAjB,iBAAiB,CAA8B;QALjD,WAAM,GAAG,IAAI,eAAM,CAAC,8BAA4B,CAAC,IAAI,CAAC,CAAC;IAMrE,CAAC;IAEJ,IAAI,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,QAAQ,EAAkD;QAC7F,MAAM,MAAM,GAAG,IAAI,CAAC;QACpB,MAAM,SAAS,GAAG,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC;QAE5C,OAAO,CAAC,GAAG,IAAW,EAAE,EAAE;YACxB,OAAO,IAAI,iBAAU,CAAC,CAAC,UAAU,EAAE,EAAE;gBACnC,IAAI,aAAa,GAA4C,IAAI,CAAC;gBAClE,IAAI,kBAAkB,GAAwB,IAAI,CAAC;gBACnD,IAAI,SAAS,GAAG,KAAK,CAAC;gBAEtB,MAAM,GAAG,GAAG,IAAA,kCAAY,EAAC,MAAM,CAAC,GAAG,EAAE,UAAU,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;gBAClE,MAAM,YAAY,GAAG,IAAA,kDAA4B,EAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;gBACjE,MAAM,UAAU,GAAG,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;gBAE1D,MAAM,WAAW,GAAG,UAAU,CAAC,SAAS,CAAC;oBACvC,IAAI,EAAE,CAAC,QAAQ,EAAE,EAAE;wBACjB,IAAI,QAAQ,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;4BACnC,IAAI,CAAC;gCACH,MAAM,SAAS,GAAG,MAAM,CAAC,iBAAiB,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAC;gCACxE,SAAS,CAAC,2BAA2B,EAAE,CAAC;gCACxC,aAAa,GAAG,SAAS,CAAC;4BAC5B,CAAC;4BAAC,OAAO,KAAK,EAAE,CAAC;gCACf,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,+BAA+B,KAAK,EAAE,CAAC,CAAC;gCAC3D,SAAS,GAAG,KAAK,CAAC;gCAClB,aAAa,GAAG,IAAI,CAAC;gCACrB,OAAO;4BACT,CAAC;4BACD,SAAS,GAAG,IAAI,CAAC;4BAEjB,IAAI,CAAC,kBAAkB,EAAE,CAAC;gCACxB,kBAAkB,GAAG,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,SAAS,CAAC;oCAC7C,IAAI,EAAE,CAAC,KAAU,EAAE,EAAE;wCACnB,IAAI,CAAC,SAAS,IAAI,CAAC,aAAa;4CAAE,OAAO;wCACzC,IAAI,CAAC;4CACH,MAAM,WAAW,GAAG,aAAa,CAAC,0BAA0B,CAAC,KAAK,CAAC,CAAC;4CACpE,UAAU,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;wCAC/B,CAAC;wCAAC,OAAO,KAAK,EAAE,CAAC;4CACf,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,uCAAuC,KAAK,EAAE,CAAC,CAAC;4CACnE,SAAS,GAAG,KAAK,CAAC;4CAClB,aAAa,GAAG,IAAI,CAAC;wCACvB,CAAC;oCACH,CAAC;oCACD,KAAK,EAAE,CAAC,GAAQ,EAAE,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC;oCAC1C,QAAQ,EAAE,GAAG,EAAE;wCACb,aAAa,EAAE,2BAA2B,EAAE,CAAC;wCAC7C,UAAU,CAAC,QAAQ,EAAE,CAAC;oCACxB,CAAC;iCACF,CAAC,CAAC;4BACL,CAAC;wBACH,CAAC;6BAAM,CAAC;4BACN,SAAS,GAAG,KAAK,CAAC;4BAClB,aAAa,GAAG,IAAI,CAAC;4BACrB,IAAI,CAAC;gCACH,MAAM,UAAU,GAAG,MAAM,CAAC,iBAAiB,CAAC,4BAA4B,CAAC,QAAQ,CAAC,CAAC;gCACnF,UAAU,CAAC,2BAA2B,EAAE,CAAC;4BAC3C,CAAC;4BAAC,MAAM,CAAC;gCACP,iBAAiB;4BACnB,CAAC;wBACH,CAAC;oBACH,CAAC;oBACD,KAAK,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC;iBACtC,CAAC,CAAC;gBAEH,OAAO,GAAG,EAAE;oBACV,aAAa,EAAE,yBAAyB,EAAE,CAAC;oBAC3C,WAAW,CAAC,WAAW,EAAE,CAAC;oBAC1B,kBAAkB,EAAE,WAAW,EAAE,CAAC;gBACpC,CAAC,CAAC;YACJ,CAAC,CAAC,CAAC;QACL,CAAC,CAAC;IACJ,CAAC;CAEF,CAAA;AAjFY,oEAA4B;uCAA5B,4BAA4B;IADxC,IAAA,mBAAM,EAAC,yDAAgC,CAAC;qCAKR,wBAAU;QACjB,uBAAU;QACI,2DAA4B;GANvD,4BAA4B,CAiFxC"}

package/dist/EnforceOptions.d.ts

@@ -0,0 +1,42 @@
+import { SubscriptionContext } from './SubscriptionContext';
+import { AuthorizationDecision } from './types';
+/**
+ * A subscription field value: either a literal (sent as-is to the PDP) or a
+ * callback that receives the request-time SubscriptionContext and returns
+ * the value dynamically.
+ *
+ * Examples:
+ *   action: 'read'                                       // literal
+ *   resource: (ctx) => ({ id: ctx.params.id })            // callback
+ *   subject: (ctx) => ctx.request.user                    // callback
+ */
+export type SubscriptionField<T = any> = T | ((ctx: SubscriptionContext) => T);
+/**
+ * Callback invoked when the PDP denies access. Receives the request-time context
+ * and the PDP decision. The return value becomes the HTTP response body (with 200).
+ * If not provided, a ForbiddenException (403) is thrown.
+ *
+ * WARNING: Do not return the raw `decision` object -- it may contain policy internals
+ * (obligations, advice) that should not be exposed to clients. Build a safe response
+ * from specific fields only, or throw a custom HttpException for non-200 responses.
+ */
+export type OnDenyHandler = (ctx: SubscriptionContext, decision: AuthorizationDecision) => any;
+/**
+ * The five SAPL authorization subscription fields.
+ * All fields are optional -- sensible defaults are derived at runtime.
+ */
+export interface SubscriptionOptions {
+    subject?: SubscriptionField;
+    action?: SubscriptionField;
+    resource?: SubscriptionField;
+    environment?: SubscriptionField;
+    secrets?: SubscriptionField;
+}
+/**
+ * Options for @PreEnforce and @PostEnforce decorators.
+ * Extends SubscriptionOptions with a deny handler callback.
+ */
+export interface EnforceOptions extends SubscriptionOptions {
+    onDeny?: OnDenyHandler;
+}
+//# sourceMappingURL=EnforceOptions.d.ts.map

package/dist/EnforceOptions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"EnforceOptions.d.ts","sourceRoot":"","sources":["../lib/EnforceOptions.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAC5D,OAAO,EAAE,qBAAqB,EAAE,MAAM,SAAS,CAAC;AAEhD;;;;;;;;;GASG;AACH,MAAM,MAAM,iBAAiB,CAAC,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,mBAAmB,KAAK,CAAC,CAAC,CAAC;AAE/E;;;;;;;;GAQG;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,GAAG,EAAE,mBAAmB,EAAE,QAAQ,EAAE,qBAAqB,KAAK,GAAG,CAAC;AAE/F;;;GAGG;AACH,MAAM,WAAW,mBAAmB;IAClC,OAAO,CAAC,EAAE,iBAAiB,CAAC;IAC5B,MAAM,CAAC,EAAE,iBAAiB,CAAC;IAC3B,QAAQ,CAAC,EAAE,iBAAiB,CAAC;IAC7B,WAAW,CAAC,EAAE,iBAAiB,CAAC;IAChC,OAAO,CAAC,EAAE,iBAAiB,CAAC;CAC7B;AAED;;;GAGG;AACH,MAAM,WAAW,cAAe,SAAQ,mBAAmB;IACzD,MAAM,CAAC,EAAE,aAAa,CAAC;CACxB"}

package/dist/EnforceOptions.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=EnforceOptions.js.map

package/dist/EnforceOptions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"EnforceOptions.js","sourceRoot":"","sources":["../lib/EnforceOptions.ts"],"names":[],"mappings":""}

package/dist/EnforceRecoverableIfDenied.d.ts

@@ -0,0 +1,4 @@
+import { EnforceRecoverableOptions } from './StreamingEnforceOptions';
+export declare const ENFORCE_RECOVERABLE_SYMBOL: unique symbol;
+export declare const EnforceRecoverableIfDenied: (options?: EnforceRecoverableOptions) => MethodDecorator;
+//# sourceMappingURL=EnforceRecoverableIfDenied.d.ts.map

package/dist/EnforceRecoverableIfDenied.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"EnforceRecoverableIfDenied.d.ts","sourceRoot":"","sources":["../lib/EnforceRecoverableIfDenied.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,yBAAyB,EAAE,MAAM,2BAA2B,CAAC;AAEtE,eAAO,MAAM,0BAA0B,eAA+C,CAAC;AAEvF,eAAO,MAAM,0BAA0B,GAAI,UAAS,yBAA8B,oBAC5B,CAAC"}

package/dist/EnforceRecoverableIfDenied.js

@@ -0,0 +1,8 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.EnforceRecoverableIfDenied = exports.ENFORCE_RECOVERABLE_SYMBOL = void 0;
+const nestjs_aop_1 = require("@toss/nestjs-aop");
+exports.ENFORCE_RECOVERABLE_SYMBOL = Symbol('sapl:enforce-recoverable-if-denied');
+const EnforceRecoverableIfDenied = (options = {}) => (0, nestjs_aop_1.createDecorator)(exports.ENFORCE_RECOVERABLE_SYMBOL, options);
+exports.EnforceRecoverableIfDenied = EnforceRecoverableIfDenied;
+//# sourceMappingURL=EnforceRecoverableIfDenied.js.map

package/dist/EnforceRecoverableIfDenied.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"EnforceRecoverableIfDenied.js","sourceRoot":"","sources":["../lib/EnforceRecoverableIfDenied.ts"],"names":[],"mappings":";;;AAAA,iDAAmD;AAGtC,QAAA,0BAA0B,GAAG,MAAM,CAAC,oCAAoC,CAAC,CAAC;AAEhF,MAAM,0BAA0B,GAAG,CAAC,UAAqC,EAAE,EAAE,EAAE,CACpF,IAAA,4BAAe,EAAC,kCAA0B,EAAE,OAAO,CAAC,CAAC;AAD1C,QAAA,0BAA0B,8BACgB"}

package/dist/EnforceRecoverableIfDeniedAspect.d.ts

@@ -0,0 +1,15 @@
+import { LazyDecorator, WrapParams } from '@toss/nestjs-aop';
+import { ClsService } from 'nestjs-cls';
+import { Observable } from 'rxjs';
+import { EnforceRecoverableOptions } from './StreamingEnforceOptions';
+import { PdpService } from './pdp.service';
+import { ConstraintEnforcementService } from './constraints/ConstraintEnforcementService';
+export declare class EnforceRecoverableIfDeniedAspect implements LazyDecorator<any, EnforceRecoverableOptions> {
+    private readonly pdpService;
+    private readonly cls;
+    private readonly constraintService;
+    private readonly logger;
+    constructor(pdpService: PdpService, cls: ClsService, constraintService: ConstraintEnforcementService);
+    wrap({ method, metadata, methodName, instance }: WrapParams<any, EnforceRecoverableOptions>): (...args: any[]) => Observable<unknown>;
+}
+//# sourceMappingURL=EnforceRecoverableIfDeniedAspect.d.ts.map

package/dist/EnforceRecoverableIfDeniedAspect.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"EnforceRecoverableIfDeniedAspect.d.ts","sourceRoot":"","sources":["../lib/EnforceRecoverableIfDeniedAspect.ts"],"names":[],"mappings":"AACA,OAAO,EAAU,aAAa,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AACrE,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AACxC,OAAO,EAAE,UAAU,EAAgB,MAAM,MAAM,CAAC;AAEhD,OAAO,EAAE,yBAAyB,EAAE,MAAM,2BAA2B,CAAC;AACtE,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAG3C,OAAO,EAAE,4BAA4B,EAAE,MAAM,4CAA4C,CAAC;AAG1F,qBACa,gCAAiC,YAAW,aAAa,CAAC,GAAG,EAAE,yBAAyB,CAAC;IAIlG,OAAO,CAAC,QAAQ,CAAC,UAAU;IAC3B,OAAO,CAAC,QAAQ,CAAC,GAAG;IACpB,OAAO,CAAC,QAAQ,CAAC,iBAAiB;IALpC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAqD;gBAGzD,UAAU,EAAE,UAAU,EACtB,GAAG,EAAE,UAAU,EACf,iBAAiB,EAAE,4BAA4B;IAGlE,IAAI,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,QAAQ,EAAE,EAAE,UAAU,CAAC,GAAG,EAAE,yBAAyB,CAAC,IAIjF,GAAG,MAAM,GAAG,EAAE;CA8FzB"}

package/dist/EnforceRecoverableIfDeniedAspect.js

@@ -0,0 +1,134 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var EnforceRecoverableIfDeniedAspect_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.EnforceRecoverableIfDeniedAspect = void 0;
+const common_1 = require("@nestjs/common");
+const nestjs_aop_1 = require("@toss/nestjs-aop");
+const nestjs_cls_1 = require("nestjs-cls");
+const rxjs_1 = require("rxjs");
+const EnforceRecoverableIfDenied_1 = require("./EnforceRecoverableIfDenied");
+const pdp_service_1 = require("./pdp.service");
+const SubscriptionBuilder_1 = require("./SubscriptionBuilder");
+const ConstraintEnforcementService_1 = require("./constraints/ConstraintEnforcementService");
+let EnforceRecoverableIfDeniedAspect = EnforceRecoverableIfDeniedAspect_1 = class EnforceRecoverableIfDeniedAspect {
+    constructor(pdpService, cls, constraintService) {
+        this.pdpService = pdpService;
+        this.cls = cls;
+        this.constraintService = constraintService;
+        this.logger = new common_1.Logger(EnforceRecoverableIfDeniedAspect_1.name);
+    }
+    wrap({ method, metadata, methodName, instance }) {
+        const aspect = this;
+        const className = instance.constructor.name;
+        return (...args) => {
+            return new rxjs_1.Observable((subscriber) => {
+                let currentBundle = null;
+                let sourceSubscription = null;
+                let accessState = 'initial';
+                const emitter = { next: (v) => subscriber.next(v) };
+                const ctx = (0, SubscriptionBuilder_1.buildContext)(aspect.cls, methodName, className, args);
+                const subscription = (0, SubscriptionBuilder_1.buildSubscriptionFromContext)(metadata, ctx);
+                const decisions$ = aspect.pdpService.decide(subscription);
+                const decisionSub = decisions$.subscribe({
+                    next: (decision) => {
+                        const previousState = accessState;
+                        if (decision.decision === 'PERMIT') {
+                            try {
+                                const newBundle = aspect.constraintService.streamingBundleFor(decision);
+                                newBundle.handleOnDecisionConstraints();
+                                currentBundle = newBundle;
+                            }
+                            catch (error) {
+                                aspect.logger.warn(`Obligation handling failed: ${error}`);
+                                accessState = 'denied';
+                                currentBundle = null;
+                                if (previousState !== 'denied') {
+                                    try {
+                                        metadata.onStreamDeny?.(decision, emitter);
+                                    }
+                                    catch (callbackError) {
+                                        aspect.logger.warn(`onStreamDeny callback failed: ${callbackError}`);
+                                    }
+                                }
+                                return;
+                            }
+                            accessState = 'permitted';
+                            if (previousState === 'denied') {
+                                try {
+                                    metadata.onStreamRecover?.(decision, emitter);
+                                }
+                                catch (callbackError) {
+                                    aspect.logger.warn(`onStreamRecover callback failed: ${callbackError}`);
+                                }
+                            }
+                            if (!sourceSubscription) {
+                                sourceSubscription = method(...args).subscribe({
+                                    next: (value) => {
+                                        if (accessState !== 'permitted' || !currentBundle)
+                                            return;
+                                        try {
+                                            const transformed = currentBundle.handleAllOnNextConstraints(value);
+                                            subscriber.next(transformed);
+                                        }
+                                        catch (error) {
+                                            aspect.logger.warn(`Constraint handling failed on next: ${error}`);
+                                            accessState = 'denied';
+                                            currentBundle = null;
+                                        }
+                                    },
+                                    error: (err) => subscriber.error(err),
+                                    complete: () => {
+                                        currentBundle?.handleOnCompleteConstraints();
+                                        subscriber.complete();
+                                    },
+                                });
+                            }
+                        }
+                        else {
+                            accessState = 'denied';
+                            currentBundle = null;
+                            try {
+                                const bestEffort = aspect.constraintService.streamingBestEffortBundleFor(decision);
+                                bestEffort.handleOnDecisionConstraints();
+                            }
+                            catch {
+                                /* best effort */
+                            }
+                            if (previousState !== 'denied') {
+                                try {
+                                    metadata.onStreamDeny?.(decision, emitter);
+                                }
+                                catch (callbackError) {
+                                    aspect.logger.warn(`onStreamDeny callback failed: ${callbackError}`);
+                                }
+                            }
+                        }
+                    },
+                    error: (err) => subscriber.error(err),
+                });
+                return () => {
+                    currentBundle?.handleOnCancelConstraints();
+                    decisionSub.unsubscribe();
+                    sourceSubscription?.unsubscribe();
+                };
+            });
+        };
+    }
+};
+exports.EnforceRecoverableIfDeniedAspect = EnforceRecoverableIfDeniedAspect;
+exports.EnforceRecoverableIfDeniedAspect = EnforceRecoverableIfDeniedAspect = EnforceRecoverableIfDeniedAspect_1 = __decorate([
+    (0, nestjs_aop_1.Aspect)(EnforceRecoverableIfDenied_1.ENFORCE_RECOVERABLE_SYMBOL),
+    __metadata("design:paramtypes", [pdp_service_1.PdpService,
+        nestjs_cls_1.ClsService,
+        ConstraintEnforcementService_1.ConstraintEnforcementService])
+], EnforceRecoverableIfDeniedAspect);
+//# sourceMappingURL=EnforceRecoverableIfDeniedAspect.js.map

package/dist/EnforceRecoverableIfDeniedAspect.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"EnforceRecoverableIfDeniedAspect.js","sourceRoot":"","sources":["../lib/EnforceRecoverableIfDeniedAspect.ts"],"names":[],"mappings":";;;;;;;;;;;;;AAAA,2CAAwC;AACxC,iDAAqE;AACrE,2CAAwC;AACxC,+BAAgD;AAChD,6EAA0E;AAE1E,+CAA2C;AAE3C,+DAAmF;AACnF,6FAA0F;AAInF,IAAM,gCAAgC,wCAAtC,MAAM,gCAAgC;IAG3C,YACmB,UAAsB,EACtB,GAAe,EACf,iBAA+C;QAF/C,eAAU,GAAV,UAAU,CAAY;QACtB,QAAG,GAAH,GAAG,CAAY;QACf,sBAAiB,GAAjB,iBAAiB,CAA8B;QALjD,WAAM,GAAG,IAAI,eAAM,CAAC,kCAAgC,CAAC,IAAI,CAAC,CAAC;IAMzE,CAAC;IAEJ,IAAI,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,QAAQ,EAA8C;QACzF,MAAM,MAAM,GAAG,IAAI,CAAC;QACpB,MAAM,SAAS,GAAG,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC;QAE5C,OAAO,CAAC,GAAG,IAAW,EAAE,EAAE;YACxB,OAAO,IAAI,iBAAU,CAAC,CAAC,UAAU,EAAE,EAAE;gBACnC,IAAI,aAAa,GAA4C,IAAI,CAAC;gBAClE,IAAI,kBAAkB,GAAwB,IAAI,CAAC;gBACnD,IAAI,WAAW,GAAuC,SAAS,CAAC;gBAChE,MAAM,OAAO,GAAG,EAAE,IAAI,EAAE,CAAC,CAAM,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;gBAEzD,MAAM,GAAG,GAAG,IAAA,kCAAY,EAAC,MAAM,CAAC,GAAG,EAAE,UAAU,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;gBAClE,MAAM,YAAY,GAAG,IAAA,kDAA4B,EAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;gBACjE,MAAM,UAAU,GAAG,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;gBAE1D,MAAM,WAAW,GAAG,UAAU,CAAC,SAAS,CAAC;oBACvC,IAAI,EAAE,CAAC,QAAQ,EAAE,EAAE;wBACjB,MAAM,aAAa,GAAG,WAAW,CAAC;wBAElC,IAAI,QAAQ,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;4BACnC,IAAI,CAAC;gCACH,MAAM,SAAS,GAAG,MAAM,CAAC,iBAAiB,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAC;gCACxE,SAAS,CAAC,2BAA2B,EAAE,CAAC;gCACxC,aAAa,GAAG,SAAS,CAAC;4BAC5B,CAAC;4BAAC,OAAO,KAAK,EAAE,CAAC;gCACf,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,+BAA+B,KAAK,EAAE,CAAC,CAAC;gCAC3D,WAAW,GAAG,QAAQ,CAAC;gCACvB,aAAa,GAAG,IAAI,CAAC;gCACrB,IAAI,aAAa,KAAK,QAAQ,EAAE,CAAC;oCAC/B,IAAI,CAAC;wCACH,QAAQ,CAAC,YAAY,EAAE,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;oCAC7C,CAAC;oCAAC,OAAO,aAAa,EAAE,CAAC;wCACvB,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,iCAAiC,aAAa,EAAE,CAAC,CAAC;oCACvE,CAAC;gCACH,CAAC;gCACD,OAAO;4BACT,CAAC;4BACD,WAAW,GAAG,WAAW,CAAC;4BAE1B,IAAI,aAAa,KAAK,QAAQ,EAAE,CAAC;gCAC/B,IAAI,CAAC;oCACH,QAAQ,CAAC,eAAe,EAAE,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;gCAChD,CAAC;gCAAC,OAAO,aAAa,EAAE,CAAC;oCACvB,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,oCAAoC,aAAa,EAAE,CAAC,CAAC;gCAC1E,CAAC;4BACH,CAAC;4BAED,IAAI,CAAC,kBAAkB,EAAE,CAAC;gCACxB,kBAAkB,GAAG,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,SAAS,CAAC;oCAC7C,IAAI,EAAE,CAAC,KAAU,EAAE,EAAE;wCACnB,IAAI,WAAW,KAAK,WAAW,IAAI,CAAC,aAAa;4CAAE,OAAO;wCAC1D,IAAI,CAAC;4CACH,MAAM,WAAW,GAAG,aAAa,CAAC,0BAA0B,CAAC,KAAK,CAAC,CAAC;4CACpE,UAAU,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;wCAC/B,CAAC;wCAAC,OAAO,KAAK,EAAE,CAAC;4CACf,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,uCAAuC,KAAK,EAAE,CAAC,CAAC;4CACnE,WAAW,GAAG,QAAQ,CAAC;4CACvB,aAAa,GAAG,IAAI,CAAC;wCACvB,CAAC;oCACH,CAAC;oCACD,KAAK,EAAE,CAAC,GAAQ,EAAE,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC;oCAC1C,QAAQ,EAAE,GAAG,EAAE;wCACb,aAAa,EAAE,2BAA2B,EAAE,CAAC;wCAC7C,UAAU,CAAC,QAAQ,EAAE,CAAC;oCACxB,CAAC;iCACF,CAAC,CAAC;4BACL,CAAC;wBACH,CAAC;6BAAM,CAAC;4BACN,WAAW,GAAG,QAAQ,CAAC;4BACvB,aAAa,GAAG,IAAI,CAAC;4BACrB,IAAI,CAAC;gCACH,MAAM,UAAU,GAAG,MAAM,CAAC,iBAAiB,CAAC,4BAA4B,CAAC,QAAQ,CAAC,CAAC;gCACnF,UAAU,CAAC,2BAA2B,EAAE,CAAC;4BAC3C,CAAC;4BAAC,MAAM,CAAC;gCACP,iBAAiB;4BACnB,CAAC;4BAED,IAAI,aAAa,KAAK,QAAQ,EAAE,CAAC;gCAC/B,IAAI,CAAC;oCACH,QAAQ,CAAC,YAAY,EAAE,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;gCAC7C,CAAC;gCAAC,OAAO,aAAa,EAAE,CAAC;oCACvB,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,iCAAiC,aAAa,EAAE,CAAC,CAAC;gCACvE,CAAC;4BACH,CAAC;wBACH,CAAC;oBACH,CAAC;oBACD,KAAK,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC;iBACtC,CAAC,CAAC;gBAEH,OAAO,GAAG,EAAE;oBACV,aAAa,EAAE,yBAAyB,EAAE,CAAC;oBAC3C,WAAW,CAAC,WAAW,EAAE,CAAC;oBAC1B,kBAAkB,EAAE,WAAW,EAAE,CAAC;gBACpC,CAAC,CAAC;YACJ,CAAC,CAAC,CAAC;QACL,CAAC,CAAC;IACJ,CAAC;CAEF,CAAA;AA3GY,4EAAgC;2CAAhC,gCAAgC;IAD5C,IAAA,mBAAM,EAAC,uDAA0B,CAAC;qCAKF,wBAAU;QACjB,uBAAU;QACI,2DAA4B;GANvD,gCAAgC,CA2G5C"}

package/dist/EnforceTillDenied.d.ts

@@ -0,0 +1,4 @@
+import { EnforceTillDeniedOptions } from './StreamingEnforceOptions';
+export declare const ENFORCE_TILL_DENIED_SYMBOL: unique symbol;
+export declare const EnforceTillDenied: (options?: EnforceTillDeniedOptions) => MethodDecorator;
+//# sourceMappingURL=EnforceTillDenied.d.ts.map

package/dist/EnforceTillDenied.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"EnforceTillDenied.d.ts","sourceRoot":"","sources":["../lib/EnforceTillDenied.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,wBAAwB,EAAE,MAAM,2BAA2B,CAAC;AAErE,eAAO,MAAM,0BAA0B,eAAqC,CAAC;AAE7E,eAAO,MAAM,iBAAiB,GAAI,UAAS,wBAA6B,oBAClB,CAAC"}

package/dist/EnforceTillDenied.js

@@ -0,0 +1,8 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.EnforceTillDenied = exports.ENFORCE_TILL_DENIED_SYMBOL = void 0;
+const nestjs_aop_1 = require("@toss/nestjs-aop");
+exports.ENFORCE_TILL_DENIED_SYMBOL = Symbol('sapl:enforce-till-denied');
+const EnforceTillDenied = (options = {}) => (0, nestjs_aop_1.createDecorator)(exports.ENFORCE_TILL_DENIED_SYMBOL, options);
+exports.EnforceTillDenied = EnforceTillDenied;
+//# sourceMappingURL=EnforceTillDenied.js.map

package/dist/EnforceTillDenied.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"EnforceTillDenied.js","sourceRoot":"","sources":["../lib/EnforceTillDenied.ts"],"names":[],"mappings":";;;AAAA,iDAAmD;AAGtC,QAAA,0BAA0B,GAAG,MAAM,CAAC,0BAA0B,CAAC,CAAC;AAEtE,MAAM,iBAAiB,GAAG,CAAC,UAAoC,EAAE,EAAE,EAAE,CAC1E,IAAA,4BAAe,EAAC,kCAA0B,EAAE,OAAO,CAAC,CAAC;AAD1C,QAAA,iBAAiB,qBACyB"}

package/dist/EnforceTillDeniedAspect.d.ts

@@ -0,0 +1,15 @@
+import { LazyDecorator, WrapParams } from '@toss/nestjs-aop';
+import { ClsService } from 'nestjs-cls';
+import { Observable } from 'rxjs';
+import { EnforceTillDeniedOptions } from './StreamingEnforceOptions';
+import { PdpService } from './pdp.service';
+import { ConstraintEnforcementService } from './constraints/ConstraintEnforcementService';
+export declare class EnforceTillDeniedAspect implements LazyDecorator<any, EnforceTillDeniedOptions> {
+    private readonly pdpService;
+    private readonly cls;
+    private readonly constraintService;
+    private readonly logger;
+    constructor(pdpService: PdpService, cls: ClsService, constraintService: ConstraintEnforcementService);
+    wrap({ method, metadata, methodName, instance }: WrapParams<any, EnforceTillDeniedOptions>): (...args: any[]) => Observable<unknown>;
+}
+//# sourceMappingURL=EnforceTillDeniedAspect.d.ts.map

package/dist/EnforceTillDeniedAspect.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"EnforceTillDeniedAspect.d.ts","sourceRoot":"","sources":["../lib/EnforceTillDeniedAspect.ts"],"names":[],"mappings":"AACA,OAAO,EAAU,aAAa,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AACrE,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AACxC,OAAO,EAAE,UAAU,EAAgB,MAAM,MAAM,CAAC;AAEhD,OAAO,EAAE,wBAAwB,EAAE,MAAM,2BAA2B,CAAC;AACrE,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAG3C,OAAO,EAAE,4BAA4B,EAAE,MAAM,4CAA4C,CAAC;AAG1F,qBACa,uBAAwB,YAAW,aAAa,CAAC,GAAG,EAAE,wBAAwB,CAAC;IAIxF,OAAO,CAAC,QAAQ,CAAC,UAAU;IAC3B,OAAO,CAAC,QAAQ,CAAC,GAAG;IACpB,OAAO,CAAC,QAAQ,CAAC,iBAAiB;IALpC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA4C;gBAGhD,UAAU,EAAE,UAAU,EACtB,GAAG,EAAE,UAAU,EACf,iBAAiB,EAAE,4BAA4B;IAGlE,IAAI,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,QAAQ,EAAE,EAAE,UAAU,CAAC,GAAG,EAAE,wBAAwB,CAAC,IAIhF,GAAG,MAAM,GAAG,EAAE;CA6EzB"}

package/dist/EnforceTillDeniedAspect.js

@@ -0,0 +1,119 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var EnforceTillDeniedAspect_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.EnforceTillDeniedAspect = void 0;
+const common_1 = require("@nestjs/common");
+const nestjs_aop_1 = require("@toss/nestjs-aop");
+const nestjs_cls_1 = require("nestjs-cls");
+const rxjs_1 = require("rxjs");
+const EnforceTillDenied_1 = require("./EnforceTillDenied");
+const pdp_service_1 = require("./pdp.service");
+const SubscriptionBuilder_1 = require("./SubscriptionBuilder");
+const ConstraintEnforcementService_1 = require("./constraints/ConstraintEnforcementService");
+let EnforceTillDeniedAspect = EnforceTillDeniedAspect_1 = class EnforceTillDeniedAspect {
+    constructor(pdpService, cls, constraintService) {
+        this.pdpService = pdpService;
+        this.cls = cls;
+        this.constraintService = constraintService;
+        this.logger = new common_1.Logger(EnforceTillDeniedAspect_1.name);
+    }
+    wrap({ method, metadata, methodName, instance }) {
+        const aspect = this;
+        const className = instance.constructor.name;
+        return (...args) => {
+            return new rxjs_1.Observable((subscriber) => {
+                let currentBundle = null;
+                let sourceSubscription = null;
+                let permitted = false;
+                const emitter = { next: (v) => subscriber.next(v) };
+                const ctx = (0, SubscriptionBuilder_1.buildContext)(aspect.cls, methodName, className, args);
+                const subscription = (0, SubscriptionBuilder_1.buildSubscriptionFromContext)(metadata, ctx);
+                const decisions$ = aspect.pdpService.decide(subscription);
+                const decisionSub = decisions$.subscribe({
+                    next: (decision) => {
+                        if (decision.decision === 'PERMIT') {
+                            try {
+                                const newBundle = aspect.constraintService.streamingBundleFor(decision);
+                                newBundle.handleOnDecisionConstraints();
+                                currentBundle = newBundle;
+                            }
+                            catch (error) {
+                                aspect.logger.warn(`Obligation handling failed: ${error}`);
+                                try {
+                                    metadata.onStreamDeny?.(decision, emitter);
+                                }
+                                catch (callbackError) {
+                                    aspect.logger.warn(`onStreamDeny callback failed: ${callbackError}`);
+                                }
+                                subscriber.error(new common_1.ForbiddenException('Access denied by policy'));
+                                return;
+                            }
+                            permitted = true;
+                            if (!sourceSubscription) {
+                                sourceSubscription = method(...args).subscribe({
+                                    next: (value) => {
+                                        if (!permitted || !currentBundle)
+                                            return;
+                                        try {
+                                            const transformed = currentBundle.handleAllOnNextConstraints(value);
+                                            subscriber.next(transformed);
+                                        }
+                                        catch (error) {
+                                            aspect.logger.warn(`Constraint handling failed on next: ${error}`);
+                                            subscriber.error(new common_1.ForbiddenException('Constraint handling failed'));
+                                        }
+                                    },
+                                    error: (err) => subscriber.error(err),
+                                    complete: () => {
+                                        currentBundle?.handleOnCompleteConstraints();
+                                        subscriber.complete();
+                                    },
+                                });
+                            }
+                        }
+                        else {
+                            permitted = false;
+                            try {
+                                const bestEffort = aspect.constraintService.streamingBestEffortBundleFor(decision);
+                                bestEffort.handleOnDecisionConstraints();
+                            }
+                            catch {
+                                /* best effort */
+                            }
+                            try {
+                                metadata.onStreamDeny?.(decision, emitter);
+                            }
+                            catch (callbackError) {
+                                aspect.logger.warn(`onStreamDeny callback failed: ${callbackError}`);
+                            }
+                            subscriber.error(new common_1.ForbiddenException('Access denied by policy'));
+                        }
+                    },
+                    error: (err) => subscriber.error(err),
+                });
+                return () => {
+                    currentBundle?.handleOnCancelConstraints();
+                    decisionSub.unsubscribe();
+                    sourceSubscription?.unsubscribe();
+                };
+            });
+        };
+    }
+};
+exports.EnforceTillDeniedAspect = EnforceTillDeniedAspect;
+exports.EnforceTillDeniedAspect = EnforceTillDeniedAspect = EnforceTillDeniedAspect_1 = __decorate([
+    (0, nestjs_aop_1.Aspect)(EnforceTillDenied_1.ENFORCE_TILL_DENIED_SYMBOL),
+    __metadata("design:paramtypes", [pdp_service_1.PdpService,
+        nestjs_cls_1.ClsService,
+        ConstraintEnforcementService_1.ConstraintEnforcementService])
+], EnforceTillDeniedAspect);
+//# sourceMappingURL=EnforceTillDeniedAspect.js.map

package/dist/EnforceTillDeniedAspect.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"EnforceTillDeniedAspect.js","sourceRoot":"","sources":["../lib/EnforceTillDeniedAspect.ts"],"names":[],"mappings":";;;;;;;;;;;;;AAAA,2CAA4D;AAC5D,iDAAqE;AACrE,2CAAwC;AACxC,+BAAgD;AAChD,2DAAiE;AAEjE,+CAA2C;AAE3C,+DAAmF;AACnF,6FAA0F;AAInF,IAAM,uBAAuB,+BAA7B,MAAM,uBAAuB;IAGlC,YACmB,UAAsB,EACtB,GAAe,EACf,iBAA+C;QAF/C,eAAU,GAAV,UAAU,CAAY;QACtB,QAAG,GAAH,GAAG,CAAY;QACf,sBAAiB,GAAjB,iBAAiB,CAA8B;QALjD,WAAM,GAAG,IAAI,eAAM,CAAC,yBAAuB,CAAC,IAAI,CAAC,CAAC;IAMhE,CAAC;IAEJ,IAAI,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,QAAQ,EAA6C;QACxF,MAAM,MAAM,GAAG,IAAI,CAAC;QACpB,MAAM,SAAS,GAAG,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC;QAE5C,OAAO,CAAC,GAAG,IAAW,EAAE,EAAE;YACxB,OAAO,IAAI,iBAAU,CAAC,CAAC,UAAU,EAAE,EAAE;gBACnC,IAAI,aAAa,GAA4C,IAAI,CAAC;gBAClE,IAAI,kBAAkB,GAAwB,IAAI,CAAC;gBACnD,IAAI,SAAS,GAAG,KAAK,CAAC;gBACtB,MAAM,OAAO,GAAG,EAAE,IAAI,EAAE,CAAC,CAAM,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;gBAEzD,MAAM,GAAG,GAAG,IAAA,kCAAY,EAAC,MAAM,CAAC,GAAG,EAAE,UAAU,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;gBAClE,MAAM,YAAY,GAAG,IAAA,kDAA4B,EAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;gBACjE,MAAM,UAAU,GAAG,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;gBAE1D,MAAM,WAAW,GAAG,UAAU,CAAC,SAAS,CAAC;oBACvC,IAAI,EAAE,CAAC,QAAQ,EAAE,EAAE;wBACjB,IAAI,QAAQ,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;4BACnC,IAAI,CAAC;gCACH,MAAM,SAAS,GAAG,MAAM,CAAC,iBAAiB,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAC;gCACxE,SAAS,CAAC,2BAA2B,EAAE,CAAC;gCACxC,aAAa,GAAG,SAAS,CAAC;4BAC5B,CAAC;4BAAC,OAAO,KAAK,EAAE,CAAC;gCACf,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,+BAA+B,KAAK,EAAE,CAAC,CAAC;gCAC3D,IAAI,CAAC;oCACH,QAAQ,CAAC,YAAY,EAAE,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;gCAC7C,CAAC;gCAAC,OAAO,aAAa,EAAE,CAAC;oCACvB,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,iCAAiC,aAAa,EAAE,CAAC,CAAC;gCACvE,CAAC;gCACD,UAAU,CAAC,KAAK,CAAC,IAAI,2BAAkB,CAAC,yBAAyB,CAAC,CAAC,CAAC;gCACpE,OAAO;4BACT,CAAC;4BACD,SAAS,GAAG,IAAI,CAAC;4BAEjB,IAAI,CAAC,kBAAkB,EAAE,CAAC;gCACxB,kBAAkB,GAAG,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,SAAS,CAAC;oCAC7C,IAAI,EAAE,CAAC,KAAU,EAAE,EAAE;wCACnB,IAAI,CAAC,SAAS,IAAI,CAAC,aAAa;4CAAE,OAAO;wCACzC,IAAI,CAAC;4CACH,MAAM,WAAW,GAAG,aAAa,CAAC,0BAA0B,CAAC,KAAK,CAAC,CAAC;4CACpE,UAAU,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;wCAC/B,CAAC;wCAAC,OAAO,KAAK,EAAE,CAAC;4CACf,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,uCAAuC,KAAK,EAAE,CAAC,CAAC;4CACnE,UAAU,CAAC,KAAK,CAAC,IAAI,2BAAkB,CAAC,4BAA4B,CAAC,CAAC,CAAC;wCACzE,CAAC;oCACH,CAAC;oCACD,KAAK,EAAE,CAAC,GAAQ,EAAE,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC;oCAC1C,QAAQ,EAAE,GAAG,EAAE;wCACb,aAAa,EAAE,2BAA2B,EAAE,CAAC;wCAC7C,UAAU,CAAC,QAAQ,EAAE,CAAC;oCACxB,CAAC;iCACF,CAAC,CAAC;4BACL,CAAC;wBACH,CAAC;6BAAM,CAAC;4BACN,SAAS,GAAG,KAAK,CAAC;4BAClB,IAAI,CAAC;gCACH,MAAM,UAAU,GAAG,MAAM,CAAC,iBAAiB,CAAC,4BAA4B,CAAC,QAAQ,CAAC,CAAC;gCACnF,UAAU,CAAC,2BAA2B,EAAE,CAAC;4BAC3C,CAAC;4BAAC,MAAM,CAAC;gCACP,iBAAiB;4BACnB,CAAC;4BACD,IAAI,CAAC;gCACH,QAAQ,CAAC,YAAY,EAAE,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;4BAC7C,CAAC;4BAAC,OAAO,aAAa,EAAE,CAAC;gCACvB,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,iCAAiC,aAAa,EAAE,CAAC,CAAC;4BACvE,CAAC;4BACD,UAAU,CAAC,KAAK,CAAC,IAAI,2BAAkB,CAAC,yBAAyB,CAAC,CAAC,CAAC;wBACtE,CAAC;oBACH,CAAC;oBACD,KAAK,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC;iBACtC,CAAC,CAAC;gBAEH,OAAO,GAAG,EAAE;oBACV,aAAa,EAAE,yBAAyB,EAAE,CAAC;oBAC3C,WAAW,CAAC,WAAW,EAAE,CAAC;oBAC1B,kBAAkB,EAAE,WAAW,EAAE,CAAC;gBACpC,CAAC,CAAC;YACJ,CAAC,CAAC,CAAC;QACL,CAAC,CAAC;IACJ,CAAC;CAEF,CAAA;AA1FY,0DAAuB;kCAAvB,uBAAuB;IADnC,IAAA,mBAAM,EAAC,8CAA0B,CAAC;qCAKF,wBAAU;QACjB,uBAAU;QACI,2DAA4B;GANvD,uBAAuB,CA0FnC"}

package/dist/MethodInvocationContext.d.ts

@@ -0,0 +1,8 @@
+import { SaplRequest } from './SubscriptionContext';
+export interface MethodInvocationContext {
+    request: SaplRequest;
+    args: any[];
+    methodName: string;
+    className: string;
+}
+//# sourceMappingURL=MethodInvocationContext.d.ts.map

package/dist/MethodInvocationContext.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"MethodInvocationContext.d.ts","sourceRoot":"","sources":["../lib/MethodInvocationContext.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAEpD,MAAM,WAAW,uBAAuB;IACtC,OAAO,EAAE,WAAW,CAAC;IACrB,IAAI,EAAE,GAAG,EAAE,CAAC;IACZ,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;CACnB"}

package/dist/MethodInvocationContext.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=MethodInvocationContext.js.map

package/dist/MethodInvocationContext.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"MethodInvocationContext.js","sourceRoot":"","sources":["../lib/MethodInvocationContext.ts"],"names":[],"mappings":""}

package/dist/PostEnforce.d.ts

@@ -0,0 +1,23 @@
+import { EnforceOptions } from './EnforceOptions';
+export declare const POST_ENFORCE_SYMBOL: unique symbol;
+/**
+ * Decorator that marks a method for SAPL post-enforcement.
+ *
+ * Works on any injectable class method (controllers, services, etc.) via
+ * AOP aspects. The actual authorization check is performed by
+ * PostEnforceAspect, which lets the method execute first, then builds an
+ * authorization subscription (including the method's return value), calls
+ * the PDP, and either returns the result or denies access.
+ *
+ * Important: The method executes before authorization is checked. Any side
+ * effects (database writes, emails, etc.) will occur regardless of the decision.
+ * Use @PreEnforce for methods with side effects that should not execute when
+ * access is denied.
+ *
+ * Example:
+ *   @PostEnforce({ action: 'read', resource: 'patientRecord' })
+ *   @Get('patient/:id')
+ *   async getPatient(@Param('id') id: string) { ... }
+ */
+export declare const PostEnforce: (options?: EnforceOptions) => MethodDecorator;
+//# sourceMappingURL=PostEnforce.d.ts.map

package/dist/PostEnforce.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"PostEnforce.d.ts","sourceRoot":"","sources":["../lib/PostEnforce.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAElD,eAAO,MAAM,mBAAmB,eAA8B,CAAC;AAE/D;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,WAAW,GAAI,UAAS,cAAmB,oBACT,CAAC"}

package/dist/PostEnforce.js

@@ -0,0 +1,27 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PostEnforce = exports.POST_ENFORCE_SYMBOL = void 0;
+const nestjs_aop_1 = require("@toss/nestjs-aop");
+exports.POST_ENFORCE_SYMBOL = Symbol('sapl:post-enforce');
+/**
+ * Decorator that marks a method for SAPL post-enforcement.
+ *
+ * Works on any injectable class method (controllers, services, etc.) via
+ * AOP aspects. The actual authorization check is performed by
+ * PostEnforceAspect, which lets the method execute first, then builds an
+ * authorization subscription (including the method's return value), calls
+ * the PDP, and either returns the result or denies access.
+ *
+ * Important: The method executes before authorization is checked. Any side
+ * effects (database writes, emails, etc.) will occur regardless of the decision.
+ * Use @PreEnforce for methods with side effects that should not execute when
+ * access is denied.
+ *
+ * Example:
+ *   @PostEnforce({ action: 'read', resource: 'patientRecord' })
+ *   @Get('patient/:id')
+ *   async getPatient(@Param('id') id: string) { ... }
+ */
+const PostEnforce = (options = {}) => (0, nestjs_aop_1.createDecorator)(exports.POST_ENFORCE_SYMBOL, options);
+exports.PostEnforce = PostEnforce;
+//# sourceMappingURL=PostEnforce.js.map

package/dist/PostEnforce.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"PostEnforce.js","sourceRoot":"","sources":["../lib/PostEnforce.ts"],"names":[],"mappings":";;;AAAA,iDAAmD;AAGtC,QAAA,mBAAmB,GAAG,MAAM,CAAC,mBAAmB,CAAC,CAAC;AAE/D;;;;;;;;;;;;;;;;;;GAkBG;AACI,MAAM,WAAW,GAAG,CAAC,UAA0B,EAAE,EAAE,EAAE,CAC1D,IAAA,4BAAe,EAAC,2BAAmB,EAAE,OAAO,CAAC,CAAC;AADnC,QAAA,WAAW,eACwB"}