mirror of
https://github.com/mauriceboe/TREK.git
synced 2026-06-19 13:21:46 +00:00
Maurice
0b218d53b2
Co-hosted NestJS app behind the existing Express server via a strangler-fig dispatcher, sharing the same better-sqlite3 connection and JWT httpOnly cookie. Additive and dormant: default routing stays on Express, Nest only serves its own /api/_nest diagnostics until a module opts in. F1 @trek/shared Zod contract package; F2 Nest bootstrap co-hosted (fall-through, single Dockerfile/port); F3 shared better-sqlite3 provider; F4 JWT cookie auth guard (+ @CurrentUser, admin guard); F5 Zod validation pipe + error-envelope parity; F6 Nest test + coverage gates; F7 per-prefix strangler toggle (env, default Express); F8 CI build/typecheck/test/coverage. Remaining F4/F6/F8 checklist items (trip-access + permission levels + MFA policy, e2e harness/seed + 80% gate, Nest↔Express parity test, Playwright PR-comment workflow) are tracked on the first consuming module cards (L1/A1/C1).
20 lines
711 B
TypeScript
20 lines
711 B
TypeScript
import { CanActivate, ExecutionContext, HttpException, Injectable } from '@nestjs/common';
|
|
import type { Request } from 'express';
|
|
import type { User } from '../../types';
|
|
|
|
/**
|
|
* Mirrors the legacy `adminOnly` middleware: requires an authenticated admin.
|
|
* Use together with JwtAuthGuard (which populates req.user):
|
|
* `@UseGuards(JwtAuthGuard, AdminGuard)`.
|
|
*/
|
|
@Injectable()
|
|
export class AdminGuard implements CanActivate {
|
|
canActivate(context: ExecutionContext): boolean {
|
|
const req = context.switchToHttp().getRequest<Request & { user?: User }>();
|
|
if (!req.user || req.user.role !== 'admin') {
|
|
throw new HttpException({ error: 'Admin access required' }, 403);
|
|
}
|
|
return true;
|
|
}
|
|
}
|