39 lines
1.1 KiB
TypeScript
39 lines
1.1 KiB
TypeScript
import {
|
|
CanActivate,
|
|
ExecutionContext,
|
|
Injectable,
|
|
UnauthorizedException,
|
|
} from "@nestjs/common";
|
|
import { JwtService } from "@nestjs/jwt";
|
|
import type { Request } from "express";
|
|
|
|
export interface JwtPayload {
|
|
sub: string;
|
|
username: string;
|
|
role: "user" | "admin";
|
|
}
|
|
|
|
function bearerToken(request: Request): string | null {
|
|
const header = request.headers.authorization;
|
|
if (!header?.startsWith("Bearer ")) return null;
|
|
return header.slice("Bearer ".length);
|
|
}
|
|
|
|
@Injectable()
|
|
export class JwtAuthGuard implements CanActivate {
|
|
constructor(private readonly jwt: JwtService) {}
|
|
|
|
async canActivate(context: ExecutionContext): Promise<boolean> {
|
|
const request = context.switchToHttp().getRequest<Request>();
|
|
const token = bearerToken(request);
|
|
if (!token) throw new UnauthorizedException("missing bearer token");
|
|
try {
|
|
const payload = await this.jwt.verifyAsync<JwtPayload>(token);
|
|
(request as Request & { user: JwtPayload }).user = payload;
|
|
return true;
|
|
} catch {
|
|
throw new UnauthorizedException("invalid or expired token");
|
|
}
|
|
}
|
|
}
|