exguard-backend 1.0.13 → 1.0.15

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "exguard-backend",
-  "version": "1.0.13",
+  "version": "1.0.15",
   "private": false,
   "publishConfig": {
     "access": "public"

package/scripts/setup-nestjs.cjs

@@ -227,7 +227,37 @@ export class ExGuardRoleGuard extends ExGuardNestGuard {
 export function createPermissionGuard(permissions: string[], requireAll = false) {
   return class extends ExGuardNestGuard {
     public async checkPermissions(context: GuardContext) {
-      return this.exGuard.requirePermissions(context, permissions, { requireAll });
+      // First authenticate the user
+      const authResult = await this.exGuard.authenticate(context);
+      
+      if (!authResult.allowed) {
+        return authResult;
+      }
+      
+      // Then check specific permissions
+      const userPermissions = authResult.user?.permissions || [];
+      
+      if (requireAll) {
+        // User must have ALL permissions
+        const hasAllPermissions = permissions.every(perm => userPermissions.includes(perm));
+        if (!hasAllPermissions) {
+          return {
+            allowed: false,
+            error: 'Insufficient permissions. Required all of: ' + permissions.join(', ')
+          };
+        }
+      } else {
+        // User must have ANY permission
+        const hasAnyPermission = permissions.some(perm => userPermissions.includes(perm));
+        if (!hasAnyPermission) {
+          return {
+            allowed: false,
+            error: 'Insufficient permissions. Required any of: ' + permissions.join(', ')
+          };
+        }
+      }
+      
+      return { allowed: true, user: authResult.user };
     }
   };
 }
@@ -370,9 +400,9 @@ import {
 } from '../exguard/exguard.guard';
 
 @Controller('events')
-@UseGuards(ExGuardPermissionGuard) // Requires 'read' permission
 export class EventsController {
   @Get()
+  @UseGuards(createPermissionGuard(['events:read']))
   async getEvents(@Request() req) {
     console.log('User accessing events:', req.user);
     console.log('User permissions:', req.user?.permissions);