35 lines
1.0 KiB
TypeScript
35 lines
1.0 KiB
TypeScript
import {
|
|
ForbiddenException,
|
|
Inject,
|
|
Injectable,
|
|
type CanActivate,
|
|
type ExecutionContext,
|
|
} from '@nestjs/common';
|
|
import { Reflector } from '@nestjs/core';
|
|
|
|
import type { PermissionCode } from '@lehuo/contracts';
|
|
|
|
import { REQUIRED_PERMISSIONS_KEY } from '../common/decorators/require-permissions.decorator';
|
|
import type { RequestContext } from '../common/request-context';
|
|
|
|
@Injectable()
|
|
export class PermissionGuard implements CanActivate {
|
|
constructor(@Inject(Reflector) private readonly reflector: Reflector) {}
|
|
|
|
canActivate(context: ExecutionContext): boolean {
|
|
const required = this.reflector.getAllAndOverride<PermissionCode[]>(REQUIRED_PERMISSIONS_KEY, [
|
|
context.getHandler(),
|
|
context.getClass(),
|
|
]);
|
|
if (!required?.length) return true;
|
|
const request = context.switchToHttp().getRequest<RequestContext>();
|
|
if (
|
|
!request.auth ||
|
|
required.some((permission) => !request.auth?.permissions.includes(permission))
|
|
) {
|
|
throw new ForbiddenException();
|
|
}
|
|
return true;
|
|
}
|
|
}
|