| 1 | /* |
| 2 | * @Author: nevin |
| 3 | * @Date: 2025-02-06 12:10:04 |
| 4 | * @LastEditTime: 2025-02-06 14:10:51 |
| 5 | * @LastEditors: nevin |
| 6 | * @Description: |
| 7 | */ |
| 8 | import { |
| 9 | CanActivate, |
| 10 | ExecutionContext, |
| 11 | Injectable, |
| 12 | UnauthorizedException, |
| 13 | } from '@nestjs/common'; |
| 14 | import { Reflector } from '@nestjs/core'; |
| 15 | import { JwtService } from '@nestjs/jwt'; |
| 16 | import { Request } from 'express'; |
| 17 | import { SetMetadata } from '@nestjs/common'; |
| 18 | import { IS_PUBLIC_KEY } from './auth.guard'; |
| 19 | |
| 20 | export const IS_MANAGER_KEY = 'isManager'; |
| 21 | export const Manager = () => SetMetadata(IS_MANAGER_KEY, true); |
| 22 | |
| 23 | @Injectable() |
| 24 | export class ManagerGuard implements CanActivate { |
| 25 | constructor( |
| 26 | private jwtService: JwtService, |
| 27 | private reflector: Reflector, |
| 28 | ) {} |
| 29 | |
| 30 | async canActivate(context: ExecutionContext): Promise<boolean> { |
| 31 | const isManager = this.reflector.getAllAndOverride<boolean>( |
| 32 | IS_MANAGER_KEY, |
| 33 | [context.getHandler(), context.getClass()], |
| 34 | ); |
| 35 | |
| 36 | const isPublic = this.reflector.getAllAndOverride<boolean>(IS_PUBLIC_KEY, [ |
| 37 | context.getHandler(), |
| 38 | context.getClass(), |
| 39 | ]); |
| 40 | |
| 41 | if (!isManager || isPublic) { |
| 42 | return true; |
| 43 | } |
| 44 | |
| 45 | const request = context.switchToHttp().getRequest(); |
| 46 | const token = this.extractTokenFromHeader(request); |
| 47 | if (!token) { |
| 48 | throw new UnauthorizedException('token不存在,需要管理员权限'); |
| 49 | } |
| 50 | |
| 51 | try { |
| 52 | const payload = await this.jwtService.verifyAsync(token, { |
| 53 | secret: process.env.AUTH_SECRET, |
| 54 | }); |
| 55 | |
| 56 | if (!payload.isManager) { |
| 57 | throw new UnauthorizedException('需要管理员权限1'); |
| 58 | } |
| 59 | |
| 60 | request['user'] = payload; |
| 61 | } catch { |
| 62 | throw new UnauthorizedException('需要管理员权限2'); |
| 63 | } |
| 64 | return true; |
| 65 | } |
| 66 | |
| 67 | private extractTokenFromHeader(request: Request): string | undefined { |
| 68 | const [type, token] = request.headers.authorization?.split(' ') ?? []; |
| 69 | return type === 'Bearer' ? token : undefined; |
| 70 | } |
| 71 | } |
| 72 |