hqweb端

server/dukang-api/src/common/guards/hq-auth.guard.ts

@@ -0,0 +1,26 @@
+import {
+  CanActivate,
+  ExecutionContext,
+  Injectable,
+  UnauthorizedException,
+} from '@nestjs/common';
+import { ClientApp } from '@dukang/shared-types';
+import { JwtAuthGuard } from './jwt-auth.guard';
+
+@Injectable()
+export class HqAuthGuard extends JwtAuthGuard implements CanActivate {
+  canActivate(context: ExecutionContext): boolean {
+    const ok = super.canActivate(context);
+    if (!ok) return false;
+
+    const req = context.switchToHttp().getRequest();
+    const clientApp = req.headers['x-client-app'] as ClientApp;
+    if (clientApp !== ClientApp.HQ_WEB) {
+      throw new UnauthorizedException('Invalid client app for admin');
+    }
+    if (req.user?.actorType !== 'HQ') {
+      throw new UnauthorizedException('HQ access required');
+    }
+    return true;
+  }
+}

server/dukang-api/src/common/guards/super-admin.guard.ts

@@ -0,0 +1,29 @@
+import {
+  CanActivate,
+  ExecutionContext,
+  ForbiddenException,
+  Injectable,
+} from '@nestjs/common';
+import { PrismaService } from '../prisma/prisma.module';
+import type { AuthUser } from './jwt-auth.guard';
+
+@Injectable()
+export class SuperAdminGuard implements CanActivate {
+  constructor(private readonly prisma: PrismaService) {}
+
+  async canActivate(context: ExecutionContext): Promise<boolean> {
+    const req = context.switchToHttp().getRequest();
+    const user = req.user as AuthUser | undefined;
+    if (!user || user.actorType !== 'HQ') {
+      throw new ForbiddenException('需要 HQ 权限');
+    }
+    const account = await this.prisma.hqAccount.findUnique({
+      where: { id: user.actorId },
+      select: { adminRole: true, status: true },
+    });
+    if (!account || account.status !== 'ACTIVE' || account.adminRole !== 'SUPER_ADMIN') {
+      throw new ForbiddenException('需要超级管理员权限');
+    }
+    return true;
+  }
+}