Configuring access rights in the CRM Super Admin

apps/api/src/billing/org-module.guard.ts

@@ -0,0 +1,32 @@
+import {
+  CanActivate,
+  ExecutionContext,
+  Injectable,
+} from '@nestjs/common';
+import { Reflector } from '@nestjs/core';
+import type { OrgModuleKey } from '@mento/shared';
+import { BillingService } from './billing.service';
+import { ORG_MODULE_KEY } from './org-module.decorator';
+
+@Injectable()
+export class OrgModuleGuard implements CanActivate {
+  constructor(
+    private readonly reflector: Reflector,
+    private readonly billing: BillingService,
+  ) {}
+
+  async canActivate(context: ExecutionContext): Promise<boolean> {
+    const module = this.reflector.getAllAndOverride<OrgModuleKey | undefined>(
+      ORG_MODULE_KEY,
+      [context.getHandler(), context.getClass()],
+    );
+    if (!module) return true;
+    const req = context.switchToHttp().getRequest<{
+      user?: { organizationId?: string };
+    }>();
+    const organizationId = req.user?.organizationId;
+    if (!organizationId) return false;
+    await this.billing.requireModule(organizationId, module);
+    return true;
+  }
+}