53 lines
1.7 KiB
TypeScript
53 lines
1.7 KiB
TypeScript
// roles.guard.ts
|
|
import {
|
|
CanActivate,
|
|
ExecutionContext,
|
|
Injectable,
|
|
ForbiddenException,
|
|
} from '@nestjs/common';
|
|
import { Reflector } from '@nestjs/core';
|
|
import { ROLES_KEY } from '../decorators/roles.decorator';
|
|
import * as jwt from 'jsonwebtoken';
|
|
import { UnauthorizedException } from 'src/exceptions/unauthorized.exception';
|
|
import { MailTypeDTO } from 'src/auth/auth.dto';
|
|
|
|
@Injectable()
|
|
export class RolesGuard implements CanActivate {
|
|
constructor(private reflector: Reflector) { }
|
|
|
|
canActivate(context: ExecutionContext): boolean {
|
|
const requiredRoles = this.reflector.getAllAndOverride<string[]>(ROLES_KEY, [
|
|
context.getHandler(),
|
|
context.getClass(),
|
|
]);
|
|
if (!requiredRoles || requiredRoles.length === 0) return true;
|
|
|
|
const request = context.switchToHttp().getRequest();
|
|
const token = request.cookies?.access_token; // Token is stored as HttpOnly cookie
|
|
|
|
const body = request.body;
|
|
if (body?.P_MAIL_TYPE && body?.P_MAIL_TYPE === MailTypeDTO.FORGOT_PASSWORD) {
|
|
return true;
|
|
}
|
|
|
|
if (!token) {
|
|
throw new UnauthorizedException('Authentication Failed');
|
|
}
|
|
|
|
try {
|
|
const decoded: any = jwt.decode(token);
|
|
|
|
const roles: string[] = decoded?.resource_access?.[process.env.CLIENT_ID || '']?.roles || [];
|
|
const hasRole = requiredRoles.some(role => roles.includes(role));
|
|
|
|
if (!hasRole) {
|
|
throw new ForbiddenException('Unauthorized : Please Request Access for this Resource');
|
|
}
|
|
|
|
return true;
|
|
} catch (err: any) {
|
|
throw new UnauthorizedException('Authentication Failed');
|
|
}
|
|
}
|
|
}
|