@rytass/member-base-nestjs-module/guards/casbin.guard.js

Rytass Member System NestJS Base Module

import { Injectable, Inject } from '@nestjs/common';
import { COOKIE_MODE, CASBIN_ENFORCER, ACCESS_TOKEN_SECRET, ENABLE_GLOBAL_GUARD, CASBIN_PERMISSION_DECORATOR, CASBIN_PERMISSION_CHECKER, ACCESS_TOKEN_COOKIE_NAME } from '../typings/member-base.tokens.js';
import { Reflector } from '@nestjs/core';
import { IS_ROUTE_PUBLIC } from '../decorators/is-public.decorator.js';
import { AllowActions } from '../decorators/action.decorator.js';
import { verify } from 'jsonwebtoken';
import { IS_ROUTE_ONLY_AUTHENTICATED } from '../decorators/authenticated.decorator.js';
import { getTokenFromContext } from '../utils/get-token-from-context.js';
import { getRequestFromContext } from '../utils/get-request-from-context.js';
import { normalizeCasbinDecision } from '../utils/normalize-casbin-decision.js';

function _ts_decorate(decorators, target, key, desc) {
    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
    else for(var i = decorators.length - 1; i >= 0; i--)if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
    return c > 3 && r && Object.defineProperty(target, key, r), r;
}
function _ts_metadata(k, v) {
    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
}
function _ts_param(paramIndex, decorator) {
    return function(target, key) {
        decorator(target, key, paramIndex);
    };
}
class CasbinGuard {
    cookieMode;
    enforcer;
    accessTokenSecret;
    enableGlobalGuard;
    permissionDecorator;
    permissionChecker;
    accessTokenCookieName;
    constructor(cookieMode, enforcer, accessTokenSecret, enableGlobalGuard, permissionDecorator, permissionChecker, accessTokenCookieName){
        this.cookieMode = cookieMode;
        this.enforcer = enforcer;
        this.accessTokenSecret = accessTokenSecret;
        this.enableGlobalGuard = enableGlobalGuard;
        this.permissionDecorator = permissionDecorator;
        this.permissionChecker = permissionChecker;
        this.accessTokenCookieName = accessTokenCookieName;
    }
    async canActivate(context) {
        const request = await getRequestFromContext(context);
        const token = await getTokenFromContext(context, this.cookieMode, this.accessTokenCookieName);
        if (token) {
            try {
                const payload = verify(token, this.accessTokenSecret);
                request.payload = payload;
            } catch (_ex) {
                request.payload = undefined;
            }
        } else {
            request.payload = undefined;
        }
        request.enforcer = this.enforcer ?? undefined;
        request.casbinPermissionChecker = this.permissionChecker;
        if (!this.enableGlobalGuard) return true;
        const reflector = new Reflector();
        const isPublic = reflector.get(IS_ROUTE_PUBLIC, context.getHandler());
        const onlyAuthenticated = reflector.get(IS_ROUTE_ONLY_AUTHENTICATED, context.getHandler());
        if (isPublic) return true;
        const allowActions = reflector.get(this.permissionDecorator ?? AllowActions, context.getHandler());
        if (!allowActions?.length && !onlyAuthenticated) return false;
        if (!token) return false;
        if (!request.payload) return false;
        if (onlyAuthenticated) return true;
        if (!this.enforcer) return false;
        const result = await this.permissionChecker({
            enforcer: this.enforcer,
            payload: request.payload,
            actions: allowActions,
            context,
            request
        });
        const decision = normalizeCasbinDecision(result);
        request.casbinDecision = decision;
        return decision.allowed;
    }
}
CasbinGuard = _ts_decorate([
    Injectable(),
    _ts_param(0, Inject(COOKIE_MODE)),
    _ts_param(1, Inject(CASBIN_ENFORCER)),
    _ts_param(2, Inject(ACCESS_TOKEN_SECRET)),
    _ts_param(3, Inject(ENABLE_GLOBAL_GUARD)),
    _ts_param(4, Inject(CASBIN_PERMISSION_DECORATOR)),
    _ts_param(5, Inject(CASBIN_PERMISSION_CHECKER)),
    _ts_param(6, Inject(ACCESS_TOKEN_COOKIE_NAME)),
    _ts_metadata("design:type", Function),
    _ts_metadata("design:paramtypes", [
        Boolean,
        Object,
        String,
        Boolean,
        typeof ReflectableDecorator === "undefined" ? Object : ReflectableDecorator,
        typeof CasbinPermissionChecker === "undefined" ? Object : CasbinPermissionChecker,
        String
    ])
], CasbinGuard);

export { CasbinGuard };