Enforces tenant-level RBAC for routes annotated with @Can (module-rbac-casl §2.2/§2.3 ·
global-tenancy §9.3 / FR-4). Applied per-route via @UseGuards.
Fail-closed: without an active tenant context the request is rejected outright; a guarded
route additionally requires the ALS-preset member role (丙裁·会话解析点预注入) — missing
role denies. The allow/deny decision itself is delegated to the core-owned
PermissionChecker port, whose reference-app adapter projects the tenant's DB grant
rows (organization_role_grant·module-rbac-dynamic-roles) into a CASL ability. Core imports no
auth / CASL impl (§9.5.4①B).
租户级 RBAC 守卫（对声明了
@Can的路由裁决放行 / 403）。Remarks
Enforces tenant-level RBAC for routes annotated with
@Can(module-rbac-casl §2.2/§2.3 · global-tenancy §9.3 / FR-4). Applied per-route via@UseGuards.Fail-closed: without an active tenant context the request is rejected outright; a guarded route additionally requires the ALS-preset member role (丙裁·会话解析点预注入) — missing role denies. The allow/deny decision itself is delegated to the core-owned
PermissionCheckerport, whose reference-app adapter projects the tenant's DB grant rows (organization_role_grant·module-rbac-dynamic-roles) into a CASL ability. Core imports no auth / CASL impl (§9.5.4①B).