initial

apps/backend/src/auth/guards/permissions.guard.ts

@@ -0,0 +1,68 @@
+import { CanActivate, ExecutionContext, Injectable } from '@nestjs/common';
+import { Reflector } from '@nestjs/core';
+import { ApiError } from '../../common/errors/api-error';
+import { ErrorCode } from '../../common/errors/error-codes';
+import { AppConfigService } from '../../config/config.service';
+import { SessionsService } from '../../sessions/sessions.service';
+import type { Permission } from '../../roles/permissions';
+import { IS_PUBLIC_KEY } from './public.decorator';
+import { REQUIRED_PERMISSIONS_KEY } from './require-permissions.decorator';
+import type { AuthenticatedRequest } from '../authenticated-request';
+
+@Injectable()
+export class PermissionsGuard implements CanActivate {
+  constructor(
+    private readonly reflector: Reflector,
+    private readonly sessions: SessionsService,
+    private readonly config: AppConfigService,
+  ) {}
+
+  async canActivate(context: ExecutionContext): Promise<boolean> {
+    const isPublic = this.reflector.getAllAndOverride<boolean>(IS_PUBLIC_KEY, [
+      context.getHandler(),
+      context.getClass(),
+    ]);
+    const required = this.reflector.getAllAndOverride<Permission[]>(
+      REQUIRED_PERMISSIONS_KEY,
+      [context.getHandler(), context.getClass()],
+    );
+    if (isPublic || !required?.length) {
+      return true;
+    }
+
+    const request = context.switchToHttp().getRequest<AuthenticatedRequest>();
+    const sessionId = request.signedCookies?.[
+      this.config.session.cookieName
+    ] as string | undefined;
+    if (!sessionId) {
+      throw new ApiError(
+        ErrorCode.Unauthorized,
+        'Bitte melden Sie sich an.',
+        401,
+      );
+    }
+
+    const session = await this.sessions.resolveSession(
+      sessionId,
+      request.ip,
+      request.get('user-agent'),
+    );
+    request.user = {
+      id: session.user.id,
+      sessionId,
+      permissions: session.permissions,
+    };
+
+    const allowed = required.every((permission) =>
+      session.permissions.includes(permission),
+    );
+    if (!allowed) {
+      throw new ApiError(
+        ErrorCode.PermissionDenied,
+        'Keine Berechtigung fuer diese Aktion.',
+        403,
+      );
+    }
+    return true;
+  }
+}