exguard-backend 1.0.39 → 1.1.0

package/scripts/setup-nestjs-simple.cjs

@@ -0,0 +1,199 @@
+/**
+ * ExGuard NestJS Guards - Simple Implementation
+ * Copy this file to your project's src/exguard/exguard.guard.ts
+ */
+
+import { Injectable, CanActivate, ExecutionContext, UnauthorizedException, ForbiddenException, Inject, Optional } from '@nestjs/common';
+import { Reflector } from '@nestjs/core';
+import { ExGuardBackend } from 'exguard-backend';
+
+export const EXGUARD_PERMISSIONS_KEY = 'exguard_permissions';
+export const EXGUARD_ROLES_KEY = 'exguard_roles';
+
+@Injectable()
+export class ExGuardAuthGuard implements CanActivate {
+  constructor(
+    @Optional() @Inject('EXGUARD_INSTANCE') private exGuard: ExGuardBackend,
+    private reflector: Reflector,
+  ) {}
+
+  async canActivate(context: ExecutionContext): Promise<boolean> {
+    const request = context.switchToHttp().getRequest();
+    const token = this.extractToken(request);
+
+    if (!token) {
+      throw new UnauthorizedException('No token provided');
+    }
+
+    if (!this.exGuard) {
+      return true;
+    }
+
+    const result = await this.exGuard.authenticate({ token, request });
+
+    if (!result.allowed) {
+      throw new ForbiddenException(result.error || 'Access denied');
+    }
+
+    request.user = result.user;
+    return true;
+  }
+
+  private extractToken(request: any): string | null {
+    const auth = request.headers?.authorization;
+    if (auth?.startsWith('Bearer ')) {
+      return auth.substring(7);
+    }
+    return request.headers?.['x-access-token'] || null;
+  }
+}
+
+@Injectable()
+export class ExGuardPermissionGuard implements CanActivate {
+  constructor(
+    @Optional() @Inject('EXGUARD_INSTANCE') private exGuard: ExGuardBackend,
+    private reflector: Reflector,
+  ) {}
+
+  async canActivate(context: ExecutionContext): Promise<boolean> {
+    const request = context.switchToHttp().getRequest();
+    const token = this.extractToken(request);
+
+    if (!token) {
+      throw new UnauthorizedException('No token provided');
+    }
+
+    if (!this.exGuard) {
+      return true;
+    }
+
+    const authResult = await this.exGuard.authenticate({ token, request });
+
+    if (!authResult.allowed) {
+      throw new ForbiddenException(authResult.error || 'Access denied');
+    }
+
+    if (!authResult.user) {
+      throw new ForbiddenException('User not found');
+    }
+
+    const handler = context.getHandler();
+
+    const permMeta = this.reflector.get<{ permissions: string[]; requireAll?: boolean }>(
+      EXGUARD_PERMISSIONS_KEY,
+      handler,
+    );
+
+    if (permMeta) {
+      const { permissions, requireAll } = permMeta;
+      const userPermissions = authResult.user.modules?.flatMap(m => m.permissions) || [];
+
+      if (requireAll) {
+        if (!permissions.every(p => userPermissions.includes(p))) {
+          throw new ForbiddenException('Insufficient permissions');
+        }
+      } else {
+        if (!permissions.some(p => userPermissions.includes(p))) {
+          throw new ForbiddenException('Insufficient permissions');
+        }
+      }
+    }
+
+    const roleMeta = this.reflector.get<{ roles: string[]; requireAll?: boolean }>(
+      EXGUARD_ROLES_KEY,
+      handler,
+    );
+
+    if (roleMeta) {
+      const { roles, requireAll } = roleMeta;
+      const userRoles = authResult.user.roles || [];
+
+      if (requireAll) {
+        if (!roles.every(r => userRoles.includes(r))) {
+          throw new ForbiddenException('Insufficient roles');
+        }
+      } else {
+        if (!roles.some(r => userRoles.includes(r))) {
+          throw new ForbiddenException('Insufficient roles');
+        }
+      }
+    }
+
+    request.user = authResult.user;
+    return true;
+  }
+
+  private extractToken(request: any): string | null {
+    const auth = request.headers?.authorization;
+    if (auth?.startsWith('Bearer ')) {
+      return auth.substring(7);
+    }
+    return request.headers?.['x-access-token'] || null;
+  }
+}
+
+export function RequirePermissions(permissions: string[], requireAll = false) {
+  return (target: any, propertyKey: string, descriptor: PropertyDescriptor) => {
+    Reflect.defineMetadata(EXGUARD_PERMISSIONS_KEY, { permissions, requireAll }, descriptor.value);
+  };
+}
+
+export function RequireRoles(roles: string[], requireAll = false) {
+  return (target: any, propertyKey: string, descriptor: PropertyDescriptor) => {
+    Reflect.defineMetadata(EXGUARD_ROLES_KEY, { roles, requireAll }, descriptor.value);
+  };
+}
+
+export function createPermissionGuard(permissions: string[], requireAll = false) {
+  return new (class PermissionGuard implements CanActivate {
+    private exGuard: ExGuardBackend;
+
+    async canActivate(context: ExecutionContext): Promise<boolean> {
+      const request = context.switchToHttp().getRequest();
+      const token = this.extractToken(request);
+
+      if (!token) {
+        throw new UnauthorizedException('No token provided');
+      }
+
+      // Get ExGuard instance from request
+      const exGuardInstance = request.exGuard || (this as any).exGuard;
+      if (!exGuardInstance) {
+        return true;
+      }
+
+      const authResult = await exGuardInstance.authenticate({ token, request });
+
+      if (!authResult.allowed) {
+        throw new ForbiddenException(authResult.error || 'Access denied');
+      }
+
+      if (!authResult.user) {
+        throw new ForbiddenException('User not found');
+      }
+
+      const userPermissions = authResult.user.modules?.flatMap(m => m.permissions) || [];
+
+      if (requireAll) {
+        if (!permissions.every(p => userPermissions.includes(p))) {
+          throw new ForbiddenException('Insufficient permissions');
+        }
+      } else {
+        if (!permissions.some(p => userPermissions.includes(p))) {
+          throw new ForbiddenException('Insufficient permissions');
+        }
+      }
+
+      request.user = authResult.user;
+      return true;
+    }
+
+    private extractToken(request: any): string | null {
+      const auth = request.headers?.authorization;
+      if (auth?.startsWith('Bearer ')) {
+        return auth.substring(7);
+      }
+      return request.headers?.['x-access-token'] || null;
+    }
+  })();
+}