58 lines
2.1 KiB
TypeScript
58 lines
2.1 KiB
TypeScript
import { ForbiddenException } from '@nestjs/common';
|
|
import { JwtService } from '@nestjs/jwt';
|
|
import { firstValueFrom } from 'rxjs';
|
|
import { CoreGrpcService } from './core-grpc.service';
|
|
import { assertSessionUnlocked, verifyAccessToken } from './session-auth';
|
|
|
|
interface RequesterProfile {
|
|
id: string;
|
|
isSuperAdmin: boolean;
|
|
canViewUserDocuments?: boolean;
|
|
}
|
|
|
|
async function getRequesterProfile(jwt: JwtService, core: CoreGrpcService, authorization?: string): Promise<RequesterProfile> {
|
|
const payload = await verifyAccessToken(jwt, authorization);
|
|
await assertSessionUnlocked(core, payload);
|
|
|
|
if (payload.isSuperAdmin) {
|
|
return { id: payload.sub, isSuperAdmin: true, canViewUserDocuments: true };
|
|
}
|
|
|
|
const profile = (await firstValueFrom(core.auth.GetMe({ userId: payload.sub }))) as RequesterProfile & { id: string };
|
|
return { id: profile.id, isSuperAdmin: profile.isSuperAdmin, canViewUserDocuments: profile.canViewUserDocuments };
|
|
}
|
|
|
|
export async function assertDocumentsReadAccess(
|
|
jwt: JwtService,
|
|
core: CoreGrpcService,
|
|
authorization: string | undefined,
|
|
targetUserId: string
|
|
) {
|
|
const requester = await getRequesterProfile(jwt, core, authorization);
|
|
if (requester.id === targetUserId) {
|
|
return requester.id;
|
|
}
|
|
if (!requester.canViewUserDocuments && !requester.isSuperAdmin) {
|
|
throw new ForbiddenException('Нет доступа к документам пользователя');
|
|
}
|
|
return requester.id;
|
|
}
|
|
|
|
export async function assertDocumentsWriteAccess(
|
|
jwt: JwtService,
|
|
core: CoreGrpcService,
|
|
authorization: string | undefined,
|
|
targetUserId: string
|
|
) {
|
|
const requester = await getRequesterProfile(jwt, core, authorization);
|
|
if (requester.id !== targetUserId) {
|
|
throw new ForbiddenException('Нельзя изменять документы другого пользователя');
|
|
}
|
|
return requester.id;
|
|
}
|
|
|
|
export async function getAuthorizedUserId(jwt: JwtService, core: CoreGrpcService, authorization?: string) {
|
|
const requester = await getRequesterProfile(jwt, core, authorization);
|
|
return requester.id;
|
|
}
|