nest-warden

Tenant-aware authorization for NestJS + TypeORM, built on top of @casl/ability.

nest-warden closes four gaps in @casl/ability that bite multi-tenant SaaS:

1. No first-class tenant primitive — forgetting tenantId in a rule's conditions silently leaks data across tenants.
2. No graph-relationship traversal — rules like "Alice is an agent of Merchant M of Tenant X → Alice can approve M's payments" can't be expressed without denormalization or pre-flight queries.
3. No TypeORM adapter for reverse lookups — CASL ships only Mongoose and Prisma adapters; TypeORM users get nothing. CASL also can't answer "which Ys can Alice access?" without loading them all and filtering — O(n) DB I/O.
4. Underspecified conditional authorization — hand-rolled condition translators silently drop conditions when wrong.

Where to start

• Introduction — what nest-warden is and isn't.
• Why nest-warden? — the four gaps in detail.
• Installation — get the package into your project.
• Tenant Context — the central abstraction.
• $relatedTo operator — the headline graph feature.
• NestJS integration — wiring up the module.