-
Notifications
You must be signed in to change notification settings - Fork 7
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
fix: create application request and role guard introduction (#338)
- Loading branch information
1 parent
af90c36
commit b077b5f
Showing
10 changed files
with
108 additions
and
117 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,8 @@ | ||
| import { SetMetadata } from '@nestjs/common'; | ||
| import { UserRoles } from '../constants/database'; | ||
|
|
||
| // Type definition for allowed values (only values from UserRoles) | ||
| type UserRoleValues = (typeof UserRoles)[keyof typeof UserRoles]; | ||
|
|
||
| // eslint-disable-next-line @typescript-eslint/explicit-function-return-type | ||
| export const Roles = (...roles: UserRoleValues[]) => SetMetadata('roles', roles); |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,49 @@ | ||
| import { Injectable, CanActivate, ExecutionContext } from '@nestjs/common'; | ||
| import { Reflector } from '@nestjs/core'; | ||
| import { GqlExecutionContext } from '@nestjs/graphql'; | ||
| import { JwtService } from '@nestjs/jwt'; | ||
| import { ConfigService } from '@nestjs/config'; | ||
| import { UserRoles } from 'src/common/constants/database'; | ||
|
|
||
| @Injectable() | ||
| export class RolesGuard implements CanActivate { | ||
| constructor( | ||
| private reflector: Reflector, | ||
| private jwtService: JwtService, | ||
| private configService: ConfigService, | ||
| ) {} | ||
|
|
||
| canActivate(context: ExecutionContext): boolean { | ||
| // Fetch required roles from the metadata | ||
| const requiredRoles = this.reflector.getAllAndOverride<(keyof typeof UserRoles)[]>('roles', [ | ||
| context.getHandler(), | ||
| context.getClass(), | ||
| ]); | ||
|
|
||
| if (!requiredRoles || requiredRoles.length === 0) { | ||
| return true; // Allow access if no roles are specified | ||
| } | ||
|
|
||
| const ctx = GqlExecutionContext.create(context); | ||
| const req = ctx.getContext().req; | ||
| const authorizationHeader = req.headers.authorization; | ||
|
|
||
| if (!authorizationHeader || !authorizationHeader.startsWith('Bearer ')) { | ||
| return false; // No or invalid authorization token | ||
| } | ||
|
|
||
| const token = authorizationHeader.split(' ')[1]; | ||
| const secret = this.configService.getOrThrow('JWT_SECRET'); | ||
|
|
||
| try { | ||
| // Decode the JWT token to get the user information | ||
| const decodedToken = this.jwtService.verify(token, { secret }); | ||
| const userRoleId = decodedToken.role; | ||
|
|
||
| // Check if the user's role matches any of the required roles | ||
| return requiredRoles.includes(userRoleId); | ||
| } catch (error) { | ||
| return false; // Invalid token or other error | ||
| } | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.