mirror of
https://github.com/mauriceboe/TREK.git
synced 2026-06-22 23:01:48 +00:00
Maurice
0b218d53b2
Co-hosted NestJS app behind the existing Express server via a strangler-fig dispatcher, sharing the same better-sqlite3 connection and JWT httpOnly cookie. Additive and dormant: default routing stays on Express, Nest only serves its own /api/_nest diagnostics until a module opts in. F1 @trek/shared Zod contract package; F2 Nest bootstrap co-hosted (fall-through, single Dockerfile/port); F3 shared better-sqlite3 provider; F4 JWT cookie auth guard (+ @CurrentUser, admin guard); F5 Zod validation pipe + error-envelope parity; F6 Nest test + coverage gates; F7 per-prefix strangler toggle (env, default Express); F8 CI build/typecheck/test/coverage. Remaining F4/F6/F8 checklist items (trip-access + permission levels + MFA policy, e2e harness/seed + 80% gate, Nest↔Express parity test, Playwright PR-comment workflow) are tracked on the first consuming module cards (L1/A1/C1).
29 lines
1.2 KiB
TypeScript
29 lines
1.2 KiB
TypeScript
import { CanActivate, ExecutionContext, HttpException, Injectable } from '@nestjs/common';
|
|
import type { Request } from 'express';
|
|
import { extractToken, verifyJwtAndLoadUser } from '../../middleware/auth';
|
|
|
|
/**
|
|
* Validates TREK's existing JWT session — the same httpOnly `trek_session`
|
|
* cookie (or `Authorization: Bearer`) the legacy app uses. Reuses the canonical
|
|
* `verifyJwtAndLoadUser` so the secret, the password_version invalidation gate
|
|
* and the loaded user are IDENTICAL to the Express middleware. No new tokens.
|
|
*
|
|
* Error bodies match the legacy 401 shape exactly so the client is unaffected.
|
|
*/
|
|
@Injectable()
|
|
export class JwtAuthGuard implements CanActivate {
|
|
canActivate(context: ExecutionContext): boolean {
|
|
const req = context.switchToHttp().getRequest<Request>();
|
|
const token = extractToken(req);
|
|
if (!token) {
|
|
throw new HttpException({ error: 'Access token required', code: 'AUTH_REQUIRED' }, 401);
|
|
}
|
|
const user = verifyJwtAndLoadUser(token);
|
|
if (!user) {
|
|
throw new HttpException({ error: 'Invalid or expired token', code: 'AUTH_REQUIRED' }, 401);
|
|
}
|
|
(req as Request & { user?: unknown }).user = user;
|
|
return true;
|
|
}
|
|
}
|