Permissions

<ресурс>:<операція>

users:read
users:update
posts:delete
comments:moderate

posts:update:own
posts:update:any

interface AuthenticatedUser {
  id: string;
  email: string;
  permissions: string[];
}

request.user = {
  id: 'user-42',
  email: 'anna@example.com',
  permissions: ['posts:read', 'posts:update'],
};

// permissions.decorator.ts
import { SetMetadata } from '@nestjs/common';

export const PERMISSIONS_KEY = 'permissions';

export const RequirePermissions = (...permissions: string[]) =>
  SetMetadata(PERMISSIONS_KEY, permissions);

@RequirePermissions('posts:read')

// permissions.guard.ts
import {
  CanActivate,
  ExecutionContext,
  ForbiddenException,
  Injectable,
  UnauthorizedException,
} from '@nestjs/common';
import { Reflector } from '@nestjs/core';
import { PERMISSIONS_KEY } from './permissions.decorator';

interface AuthenticatedUser {
  id: string;
  email: string;
  permissions: string[];
}

interface AuthenticatedRequest {
  user?: AuthenticatedUser;
}

@Injectable()
export class PermissionsGuard implements CanActivate {
  constructor(private readonly reflector: Reflector) {}

  canActivate(context: ExecutionContext): boolean {
    const requiredPermissions =
      this.reflector.getAllAndOverride<string[]>(
        PERMISSIONS_KEY,
        [context.getHandler(), context.getClass()],
      );

    // Якщо дозвіл не вказано, цей guard не обмежує маршрут.
    if (!requiredPermissions?.length) {
      return true;
    }

    const request =
      context.switchToHttp().getRequest<AuthenticatedRequest>();

    if (!request.user) {
      throw new UnauthorizedException();
    }

    const grantedPermissions = new Set(request.user.permissions);

    const hasAllPermissions = requiredPermissions.every((permission) =>
      grantedPermissions.has(permission),
    );

    if (!hasAllPermissions) {
      throw new ForbiddenException(
        'Недостатньо дозволів для виконання операції',
      );
    }

    return true;
  }
}

@RequirePermissions('posts:read', 'posts:export')

// posts.controller.ts
import {
  Controller,
  Delete,
  Get,
  Param,
  Patch,
  Post,
  UseGuards,
} from '@nestjs/common';
import { PermissionsGuard } from './permissions.guard';
import { RequirePermissions } from './permissions.decorator';

@Controller('posts')
@UseGuards(PermissionsGuard)
export class PostsController {
  @Get()
  @RequirePermissions('posts:read')
  findAll() {
    return {
      message: 'Список публікацій',
    };
  }

  @Post()
  @RequirePermissions('posts:create')
  create() {
    return {
      message: 'Публікацію створено',
    };
  }

  @Patch(':id')
  @RequirePermissions('posts:update')
  update(@Param('id') id: string) {
    return {
      message: `Публікацію ${id} оновлено`,
    };
  }

  @Delete(':id')
  @RequirePermissions('posts:delete')
  remove(@Param('id') id: string) {
    return {
      message: `Публікацію ${id} видалено`,
    };
  }
}

@UseGuards(AuthenticationGuard, PermissionsGuard)

import { Module } from '@nestjs/common';
import { PermissionsGuard } from './permissions.guard';
import { PostsController } from './posts.controller';

@Module({
  controllers: [PostsController],
  providers: [PermissionsGuard],
})
export class PostsModule {}

@Controller('posts')
@UseGuards(PermissionsGuard)
@RequirePermissions('posts:read')
export class PostsController {
  @Get()
  findAll() {
    return [];
  }

  @Get(':id')
  findOne() {
    return {};
  }
}

@Controller('posts')
@UseGuards(PermissionsGuard)
@RequirePermissions('posts:read')
export class PostsController {
  @Get()
  findAll() {
    return [];
  }

  @Delete(':id')
  @RequirePermissions('posts:delete')
  remove(@Param('id') id: string) {
    return {
      message: `Публікацію ${id} видалено`,
    };
  }
}

import {
  ForbiddenException,
  Injectable,
  NotFoundException,
} from '@nestjs/common';

interface Post {
  id: string;
  authorId: string;
  title: string;
}

interface User {
  id: string;
  permissions: string[];
}

@Injectable()
export class PostsService {
  async updatePost(
    postId: string,
    user: User,
    title: string,
  ): Promise<Post> {
    const post = await this.findPost(postId);

    const canUpdateAnyPost = user.permissions.includes('posts:update:any');
    const canUpdateOwnPost = user.permissions.includes('posts:update:own');

    const isOwner = post.authorId === user.id;

    if (!canUpdateAnyPost && !(canUpdateOwnPost && isOwner)) {
      throw new ForbiddenException(
        'Ви не можете змінити цю публікацію',
      );
    }

    post.title = title;

    return post;
  }

  private async findPost(postId: string): Promise<Post> {
    const post: Post | undefined = await Promise.resolve({
      id: postId,
      authorId: 'user-42',
      title: 'Початковий заголовок',
    });

    if (!post) {
      throw new NotFoundException('Публікацію не знайдено');
    }

    return post;
  }
}

import {
  Body,
  Controller,
  Param,
  Patch,
  Req,
  UseGuards,
} from '@nestjs/common';
import { PermissionsGuard } from './permissions.guard';
import { RequirePermissions } from './permissions.decorator';
import { PostsService } from './posts.service';

@Controller('posts')
@UseGuards(PermissionsGuard)
export class PostsController {
  constructor(private readonly postsService: PostsService) {}

  @Patch(':id')
  @RequirePermissions('posts:update:own')
  update(
    @Param('id') id: string,
    @Body('title') title: string,
    @Req() request: { user: { id: string; permissions: string[] } },
  ) {
    return this.postsService.updatePost(id, request.user, title);
  }
}

import { SetMetadata } from '@nestjs/common';

export const PERMISSIONS_KEY = 'permissions';
export const PERMISSIONS_MODE_KEY = 'permissions_mode';

export const RequireAnyPermission = (...permissions: string[]) => {
  return (target: object, propertyKey?: string, descriptor?: PropertyDescriptor) => {
    SetMetadata(PERMISSIONS_KEY, permissions)(
      target,
      propertyKey,
      descriptor,
    );

    SetMetadata(PERMISSIONS_MODE_KEY, 'any')(
      target,
      propertyKey,
      descriptor,
    );
  };
};

import { applyDecorators, SetMetadata } from '@nestjs/common';

export const PERMISSIONS_KEY = 'permissions';
export const PERMISSIONS_MODE_KEY = 'permissions_mode';

export const RequirePermissions = (...permissions: string[]) =>
  applyDecorators(
    SetMetadata(PERMISSIONS_KEY, permissions),
    SetMetadata(PERMISSIONS_MODE_KEY, 'all'),
  );

export const RequireAnyPermission = (...permissions: string[]) =>
  applyDecorators(
    SetMetadata(PERMISSIONS_KEY, permissions),
    SetMetadata(PERMISSIONS_MODE_KEY, 'any'),
  );

import {
  CanActivate,
  ExecutionContext,
  ForbiddenException,
  Injectable,
  UnauthorizedException,
} from '@nestjs/common';
import { Reflector } from '@nestjs/core';
import {
  PERMISSIONS_KEY,
  PERMISSIONS_MODE_KEY,
} from './permissions.decorator';

@Injectable()
export class PermissionsGuard implements CanActivate {
  constructor(private readonly reflector: Reflector) {}

  canActivate(context: ExecutionContext): boolean {
    const requiredPermissions =
      this.reflector.getAllAndOverride<string[]>(
        PERMISSIONS_KEY,
        [context.getHandler(), context.getClass()],
      );

    if (!requiredPermissions?.length) {
      return true;
    }

    const mode =
      this.reflector.getAllAndOverride<'all' | 'any'>(
        PERMISSIONS_MODE_KEY,
        [context.getHandler(), context.getClass()],
      ) ?? 'all';

    const request = context
      .switchToHttp()
      .getRequest<{ user?: { permissions: string[] } }>();

    if (!request.user) {
      throw new UnauthorizedException();
    }

    const grantedPermissions = new Set(request.user.permissions);

    const hasPermission =
      mode === 'any'
        ? requiredPermissions.some((permission) =>
            grantedPermissions.has(permission),
          )
        : requiredPermissions.every((permission) =>
            grantedPermissions.has(permission),
          );

    if (!hasPermission) {
      throw new ForbiddenException(
        'Недостатньо дозволів для виконання операції',
      );
    }

    return true;
  }
}

@Patch(':id')
@RequireAnyPermission('posts:update:own', 'posts:update:any')
update() {
  return {
    message: 'Публікацію оновлено',
  };
}

posts:read
posts:create
posts:update
posts:delete
posts:publish
posts:moderate

posts:update:own
posts:update:any

posts:read-and-update

posts:read
posts:update

if (user.role === 'admin') {
  // доступ
}

if (user.permissions.includes('posts:delete')) {
  // доступ
}