Creating a CRM Super Admin

apps/api/src/platform/platform-jwt.strategy.ts

@@ -0,0 +1,56 @@
+import { Injectable, UnauthorizedException } from '@nestjs/common';
+import { ConfigService } from '@nestjs/config';
+import { PassportStrategy } from '@nestjs/passport';
+import { ExtractJwt, Strategy } from 'passport-jwt';
+import { PrismaService } from '../prisma/prisma.service';
+
+export type PlatformJwtPayload = {
+  sub: string;
+  typ?: string;
+};
+
+export type PlatformActor = {
+  platformAdminId: string;
+  email: string;
+  fullName: string;
+};
+
+@Injectable()
+export class PlatformJwtStrategy extends PassportStrategy(
+  Strategy,
+  'platform-jwt',
+) {
+  constructor(
+    config: ConfigService,
+    private readonly prisma: PrismaService,
+  ) {
+    super({
+      jwtFromRequest: ExtractJwt.fromAuthHeaderAsBearerToken(),
+      ignoreExpiration: false,
+      secretOrKey: config.get<string>('JWT_SECRET') ?? 'dev-secret',
+    });
+  }
+
+  async validate(payload: PlatformJwtPayload): Promise<PlatformActor> {
+    if (payload.typ !== 'platform-admin' || !payload.sub) {
+      throw new UnauthorizedException();
+    }
+    const admin = await this.prisma.platformAdmin.findUnique({
+      where: { id: payload.sub },
+      select: {
+        id: true,
+        email: true,
+        fullName: true,
+        isActive: true,
+      },
+    });
+    if (!admin || admin.isActive === false) {
+      throw new UnauthorizedException();
+    }
+    return {
+      platformAdminId: admin.id,
+      email: admin.email,
+      fullName: admin.fullName,
+    };
+  }
+}