lendry/IdP
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

update oauth

Browse Source
This commit is contained in:
lendry
2026-06-25 14:23:55 +03:00
parent c3e06e03cf
commit 1796008a28
21 changed files with 340 additions and 64 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
apps/api-gateway/src/controllers/rbac.controller.ts
View File

@@ -4,7 +4,7 @@ import { map } from 'rxjs';
import { CoreGrpcService } from '../core-grpc.service';
import { CurrentAdmin } from '../decorators/current-admin.decorator';
import { AssignUserRoleDto, CreateOAuthClientDto, CreateRoleDto, UpdateOAuthClientDto } from '../dto/rbac.dto';
import { AdminGuard, AdminRequestUser, assertAdminPermission, SuperAdminGuard } from '../guards/admin.guard';
import { AdminGuard, AdminRequestUser, assertAdminAnyPermission, assertAdminPermission, SuperAdminGuard } from '../guards/admin.guard';
@ApiTags('RBAC и OAuth')
@ApiBearerAuth()
@@ -39,15 +39,15 @@ export class RbacController {
@Get('oauth-scopes')
@ApiOperation({ summary: 'OAuth scopes', description: 'Возвращает доступные scopes для OAuth-приложений.' })
listOAuthScopes(@CurrentAdmin() admin: AdminRequestUser) {
assertAdminPermission(admin, 'canManageOAuth');
assertAdminAnyPermission(admin, 'canViewOAuth', 'canManageOAuth');
return this.core.rbac.ListOAuthScopes({});
}
@Get('oauth-clients')
@ApiOperation({ summary: 'OAuth приложения', description: 'Возвращает OAuth-клиенты и доступные scopes.' })
listOAuthClients(@CurrentAdmin() admin: AdminRequestUser) {
assertAdminPermission(admin, 'canManageOAuth');
return this.core.rbac.ListOAuthClients({});
assertAdminPermission(admin, 'canViewOAuth');
return this.core.rbac.ListOAuthClients({ actorUserId: admin.id });
}
@Post('roles')

19
apps/api-gateway/src/guards/admin.guard.ts
View File

@@ -9,8 +9,11 @@ export interface AdminRequestUser {
isSuperAdmin: boolean;
canAccessAdmin: boolean;
canManageRoles: boolean;
canViewOAuth: boolean;
canManageOAuth: boolean;
canManageAllOAuth: boolean;
canManageUsers: boolean;
canManageAllUsers: boolean;
canViewUsers: boolean;
canManageSettings: boolean;
roles: string[];
@@ -48,8 +51,11 @@ export class AdminGuard implements CanActivate {
isSuperAdmin: profile.isSuperAdmin,
canAccessAdmin: Boolean(profile.canAccessAdmin),
canManageRoles: Boolean(profile.canManageRoles),
canViewOAuth: Boolean(profile.canViewOAuth),
canManageOAuth: Boolean(profile.canManageOAuth),
canManageAllOAuth: Boolean(profile.canManageAllOAuth),
canManageUsers: Boolean(profile.canManageUsers),
canManageAllUsers: Boolean(profile.canManageAllUsers),
canManageSettings: Boolean(profile.canManageSettings),
canViewUsers: Boolean(profile.canViewUsers),
roles: profile.roles ?? [],
@@ -71,8 +77,19 @@ export class SuperAdminGuard implements CanActivate {
}
}
export function assertAdminPermission(user: AdminRequestUser | undefined, permission: keyof Pick<AdminRequestUser, 'canManageOAuth' | 'canManageUsers' | 'canManageSettings'>) {
type AdminPermissionKey = keyof Pick<
AdminRequestUser,
'canViewOAuth' | 'canManageOAuth' | 'canManageUsers' | 'canViewUsers' | 'canManageSettings'
>;
export function assertAdminPermission(user: AdminRequestUser | undefined, permission: AdminPermissionKey) {
if (!user?.[permission]) {
throw new ForbiddenException('Недостаточно прав для выполнения действия');
}
}
export function assertAdminAnyPermission(user: AdminRequestUser | undefined, ...permissions: AdminPermissionKey[]) {
if (!user || !permissions.some((permission) => user[permission])) {
throw new ForbiddenException('Недостаточно прав для выполнения действия');
}
}