合伙人 H5 改造

server/dukang-api/src/common/decorators/partner-permission.decorator.ts

@@ -0,0 +1,7 @@
+import { SetMetadata } from '@nestjs/common';
+import type { PartnerPermissionKey } from '@dukang/shared-types';
+
+export const PARTNER_PERMISSIONS_KEY = 'partner_permissions';
+
+export const RequirePartnerPermissions = (...permissions: PartnerPermissionKey[]) =>
+  SetMetadata(PARTNER_PERMISSIONS_KEY, permissions);

server/dukang-api/src/common/guards/partner-permission.guard.ts

@@ -0,0 +1,45 @@
+import {
+  CanActivate,
+  ExecutionContext,
+  ForbiddenException,
+  Injectable,
+} from '@nestjs/common';
+import { Reflector } from '@nestjs/core';
+import type { PartnerPermissionKey } from '@dukang/shared-types';
+import { PARTNER_PERMISSIONS_KEY } from '../decorators/partner-permission.decorator';
+import { PrismaService } from '../prisma/prisma.module';
+import { AuthUser, JwtAuthGuard } from './jwt-auth.guard';
+
+@Injectable()
+export class PartnerPermissionGuard implements CanActivate {
+  constructor(
+    private readonly jwtAuthGuard: JwtAuthGuard,
+    private readonly prisma: PrismaService,
+    private readonly reflector: Reflector,
+  ) {}
+
+  async canActivate(context: ExecutionContext): Promise<boolean> {
+    await this.jwtAuthGuard.canActivate(context);
+    const req = context.switchToHttp().getRequest();
+    const user = req.user as AuthUser;
+    if (user.actorType !== 'PARTNER') {
+      throw new ForbiddenException('仅合伙人可操作');
+    }
+    const account = await this.prisma.partnerAccount.findUniqueOrThrow({
+      where: { id: user.actorId },
+    });
+    if (account.isPrimary === 1) return true;
+
+    const required = this.reflector.getAllAndOverride<PartnerPermissionKey[]>(
+      PARTNER_PERMISSIONS_KEY,
+      [context.getHandler(), context.getClass()],
+    );
+    if (!required?.length) return true;
+
+    const perms = Array.isArray(account.permissions)
+      ? (account.permissions as string[])
+      : [];
+    if (required.some((p) => perms.includes(p))) return true;
+    throw new ForbiddenException('当前子账号无此操作权限');
+  }
+}