Enable auth-service/api-gateway on production, build their images in CI

apps/auth-service/src/auth/jwt.guard.ts

@@ -0,0 +1,38 @@
+import {
+  CanActivate,
+  ExecutionContext,
+  Injectable,
+  UnauthorizedException,
+} from "@nestjs/common";
+import { JwtService } from "@nestjs/jwt";
+import type { Request } from "express";
+
+export interface JwtPayload {
+  sub: string;
+  username: string;
+  role: "user" | "admin";
+}
+
+function bearerToken(request: Request): string | null {
+  const header = request.headers.authorization;
+  if (!header?.startsWith("Bearer ")) return null;
+  return header.slice("Bearer ".length);
+}
+
+@Injectable()
+export class JwtAuthGuard implements CanActivate {
+  constructor(private readonly jwt: JwtService) {}
+
+  async canActivate(context: ExecutionContext): Promise<boolean> {
+    const request = context.switchToHttp().getRequest<Request>();
+    const token = bearerToken(request);
+    if (!token) throw new UnauthorizedException("missing bearer token");
+    try {
+      const payload = await this.jwt.verifyAsync<JwtPayload>(token);
+      (request as Request & { user: JwtPayload }).user = payload;
+      return true;
+    } catch {
+      throw new UnauthorizedException("invalid or expired token");
+    }
+  }
+}