46 lines
1.5 KiB
TypeScript
46 lines
1.5 KiB
TypeScript
import {
|
|
CanActivate,
|
|
ExecutionContext,
|
|
ForbiddenException,
|
|
Injectable,
|
|
} from '@nestjs/common';
|
|
import { Reflector } from '@nestjs/core';
|
|
import type { PartnerPermissionKey } from '@dukang/shared-types';
|
|
import { PARTNER_PERMISSIONS_KEY } from '../decorators/partner-permission.decorator';
|
|
import { PrismaService } from '../prisma/prisma.module';
|
|
import { AuthUser, JwtAuthGuard } from './jwt-auth.guard';
|
|
|
|
@Injectable()
|
|
export class PartnerPermissionGuard implements CanActivate {
|
|
constructor(
|
|
private readonly jwtAuthGuard: JwtAuthGuard,
|
|
private readonly prisma: PrismaService,
|
|
private readonly reflector: Reflector,
|
|
) {}
|
|
|
|
async canActivate(context: ExecutionContext): Promise<boolean> {
|
|
await this.jwtAuthGuard.canActivate(context);
|
|
const req = context.switchToHttp().getRequest();
|
|
const user = req.user as AuthUser;
|
|
if (user.actorType !== 'PARTNER') {
|
|
throw new ForbiddenException('仅合伙人可操作');
|
|
}
|
|
const account = await this.prisma.partnerAccount.findUniqueOrThrow({
|
|
where: { id: user.actorId },
|
|
});
|
|
if (account.isPrimary === 1) return true;
|
|
|
|
const required = this.reflector.getAllAndOverride<PartnerPermissionKey[]>(
|
|
PARTNER_PERMISSIONS_KEY,
|
|
[context.getHandler(), context.getClass()],
|
|
);
|
|
if (!required?.length) return true;
|
|
|
|
const perms = Array.isArray(account.permissions)
|
|
? (account.permissions as string[])
|
|
: [];
|
|
if (required.some((p) => perms.includes(p))) return true;
|
|
throw new ForbiddenException('当前子账号无此操作权限');
|
|
}
|
|
}
|