7340658305
收口 Phase 0 三处「声明未生效」： - 三级鉴权落地：权限集存 Redis（key 前缀隔离多项目），@RequirePermissions 挂到全部受控接口，super_admin 角色绕过权限码与 data_scope - 审计/登录日志自动落库：@AuditLog 装饰器 + 拦截器异步写入（写操作+登录登出），登录成功/失败均记 login_log（脱敏） - seed 脚本：一键初始化租户 touyun/用户 touyun/超管 super_admin/全量资源树（48 资源全量授权） Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
30 lines
1.1 KiB
TypeScript
30 lines
1.1 KiB
TypeScript
import { CanActivate, ExecutionContext, ForbiddenException, Injectable } from '@nestjs/common';
|
|
import { Reflector } from '@nestjs/core';
|
|
import { AuthService } from './auth.service.js';
|
|
import { PERMISSIONS_KEY } from './decorators.js';
|
|
|
|
@Injectable()
|
|
export class PermissionsGuard implements CanActivate {
|
|
constructor(
|
|
private readonly auth: AuthService,
|
|
private readonly reflector: Reflector,
|
|
) {}
|
|
|
|
async canActivate(context: ExecutionContext): Promise<boolean> {
|
|
const required = this.reflector.getAllAndOverride<string[]>(PERMISSIONS_KEY, [
|
|
context.getHandler(),
|
|
context.getClass(),
|
|
]);
|
|
if (!required || required.length === 0) return true;
|
|
|
|
const request = context.switchToHttp().getRequest();
|
|
const user = request.user as { userId: string; tenantCode: string } | undefined;
|
|
if (!user) throw new ForbiddenException('无权限');
|
|
|
|
const { super: isSuper, permissions } = await this.auth.getPermissionSet(user.tenantCode, user.userId);
|
|
if (isSuper) return true;
|
|
if (required.every((code) => permissions.includes(code))) return true;
|
|
throw new ForbiddenException('无权限');
|
|
}
|
|
}
|