29 lines
904 B
TypeScript
29 lines
904 B
TypeScript
import { Injectable, CanActivate, ExecutionContext } from '@nestjs/common';
|
|
import { Reflector } from '@nestjs/core';
|
|
import { Role, satisfiesRole } from '@fiberops/shared';
|
|
import { ROLES_KEY } from '../decorators/roles.decorator';
|
|
|
|
@Injectable()
|
|
export class RolesGuard implements CanActivate {
|
|
constructor(private reflector: Reflector) {}
|
|
|
|
canActivate(context: ExecutionContext): boolean {
|
|
const requiredRoles = this.reflector.getAllAndOverride<Role[]>(ROLES_KEY, [
|
|
context.getHandler(),
|
|
context.getClass(),
|
|
]);
|
|
|
|
if (!requiredRoles || requiredRoles.length === 0) {
|
|
return true;
|
|
}
|
|
|
|
const { user } = context.switchToHttp().getRequest();
|
|
if (!user || !user.roles) {
|
|
return false;
|
|
}
|
|
|
|
// Hierarchy-aware check: user with 'manager' satisfies 'technician' requirement
|
|
return requiredRoles.some((role) => satisfiesRole(user.roles, role));
|
|
}
|
|
}
|