nestjs-authz

Enforce authorization in @dudousxd/nestjs-authz with the @Can and @Roles guards and the programmatic Gate. @Can('update', Post) resolves a Post instance via the ResourceResolver and runs PostPolicy.update; @Can('create', Post, { classLevel: true }) skips loading; @Can('access-admin') hits an ad-hoc gate. @Roles('admin','teacher') is the coarse role check. Both guards are auto-registered as APP_GUARD and are inert on un-annotated routes. Covers the ResourceResolver seam (default IdParamResourceResolver reads :id vs a real ORM resolver bound to RESOURCE_RESOLVER) and the Gate API: authorize/allows/denies/allowsMany, forUser(user) BoundGate, define(ability, fn), hasRole/hasAnyRole.

Write authorization policies for @dudousxd/nestjs-authz the Laravel way. Use the @Policy(Resource) decorator to map a class to a resource; its methods are abilities dispatched by name (view/update/create...) receiving (user, resource). Covers the optional before(user, ability) short-circuit hook (true=allow, false=deny, undefined=fall through), class-level abilities that omit the resource, returning a deny message via PolicyResponse ({ allowed, message }) instead of a bare boolean, and the global superAdmin / after hooks with their override semantics (after can only fill in when the policy returned nullish; default-deny on no opinion).

Filter collections to the rows a user may access with @dudousxd/nestjs-authz query scopes — the accessibleBy / Pundit policy_scope / Cerbos query-plan concept. gate.scope( Entity, ability='viewAny') returns an ORM-neutral ScopeConstraint AST built from scopeAll / scopeNone and the where(field, op, value) / eq(field, value) / and(...) / or(...) helpers (operators eq, ne, gt, gte, lt, lte, in, nin, isNull, isNotNull). A @Policy scope( user, Entity) method produces it (returning true=allow-all, false/nullish=deny-all sugar); an ORM adapter such as @dudousxd/nestjs-authz-typeorm's applyScope / applyScopeConstraint compiles it to a parameterized, identifier-safe WHERE. Mirrors the Gate's grant order: super-admin / permission-provider grant → allow-all; anonymous / no scope → deny-all.

Add persisted roles & permissions to @dudousxd/nestjs-authz through its optional, grant-only seams. PERMISSION_PROVIDER (a PermissionProvider with hasPermission and an optional getPermissions) is the Laravel/spatie Gate::before grant — when the user holds a named permission the ability is allowed regardless of policies; getPermissions enables segment wildcard matching (granted posts.* satisfies posts.update, * satisfies anything). ROLE_PROVIDER (a RoleProvider.getRoles) feeds coarse checks gate.hasRole / @Roles, unioned with the user-object defaultRoleResolver (reads user.roles / user.role). Both tokens are capability symbols the ORM adapters (@dudousxd/nestjs-authz-typeorm / -prisma / -mikro-orm) register via AuthzRbacModule; seams are grant-only — a false result never DENIES, it falls through. Covers resolveRoles override and zero-table role checks.

Set up @dudousxd/nestjs-authz in a NestJS app — install, peer deps, and wire AuthzModule.forRoot / forRootAsync (global module that registers the Gate, CanGuard + RolesGuard as APP_GUARD, PolicyRegistry, default IdParamResourceResolver, and the opt-in POST /authz/can endpoint). Covers the optional @dudousxd/nestjs-context peer (CONTEXT_ACCESSOR) for the current user, and the load-bearing resolveUser hook that hydrates the full user entity from a UserRef ({type,id}) so superAdmin and policy checks like user.isAdmin / post.authorId === user.id actually see real columns.