# @loma-portal/em-rbac

Permission + role evaluator. Plug into NestJS via `EmRbacModule`; use the pure-TS `policy` helpers anywhere.

## Usage

```ts
import { EmRbacModule, RequirePermissions, RequireRoles } from '@loma-portal/em-rbac';

@Module({ imports: [EmAuthModule.forRoot({ ... }), EmRbacModule] })
export class AppModule {}

@Controller('users')
export class UsersController {
  @RequirePermissions('users.read')
  @Get() list() { ... }

  @RequireRoles('admin', 'system-admin')
  @Delete(':id') remove() { ... }
}
```

## Pure functions

```ts
import { hasPermission, hasAllPermissions, hasAnyRole } from '@loma-portal/em-rbac';
```

Use from non-NestJS code (workers, scripts, frontends after wiring contracts).

## Decorator semantics

- `@RequirePermissions(a, b)` — ALL of `a` AND `b`.
- `@RequireRoles(a, b)` — ANY of `a` OR `b`.
- Combine on the same handler — both must pass.
- Permission/role keys are defined in `apps/web-angular/src/app/core/constants/{permission,role}.constants.ts` and `dotnet/src/Shared/Constants/{PermissionConstants,RoleConstants}.cs`. Keep them in sync.
