feat: complete admin panel and backend admin api migration

apps/api/src/modules/auth/jwt.strategy.ts

@@ -0,0 +1,63 @@
+import { Injectable, UnauthorizedException } from '@nestjs/common';
+import { PassportStrategy } from '@nestjs/passport';
+import { ExtractJwt, Strategy } from 'passport-jwt';
+import { PrismaService } from '../../prisma/prisma.service';
+import { expandWithParents } from './acl.constants';
+
+export interface JwtPayload {
+  sub: string;
+  mobile: string;
+}
+
+/**
+ * The authenticated principal attached to `req.user`.
+ *
+ * `permissions` is already expanded with ancestors, so guards can test a rid with
+ * a plain `includes()` — the same shape the legacy frontend held in its Vuex store
+ * after checkParent().
+ */
+export interface AuthenticatedAdmin {
+  id: string;
+  fullName: string;
+  mobile: string;
+  role: string;
+  userTypeId: number | null;
+  branchId: string | null;
+  permissions: string[];
+}
+
+@Injectable()
+export class JwtStrategy extends PassportStrategy(Strategy, 'jwt') {
+  constructor(private readonly prisma: PrismaService) {
+    super({
+      jwtFromRequest: ExtractJwt.fromAuthHeaderAsBearerToken(),
+      ignoreExpiration: false,
+      secretOrKey: process.env.JWT_SECRET ?? 'dev-only-insecure-secret',
+    });
+  }
+
+  async validate(payload: JwtPayload): Promise<AuthenticatedAdmin> {
+    const user = await this.prisma.adminUser.findUnique({
+      where: { id: payload.sub },
+      include: { userType: { include: { permissions: true } } },
+    });
+
+    if (!user || !user.isActive) {
+      throw new UnauthorizedException();
+    }
+
+    // Permissions are re-read on every request rather than baked into the token,
+    // so a permission change takes effect immediately instead of at next login.
+    const rids = user.userType?.permissions.map((p) => p.rid) ?? [];
+
+    return {
+      id: user.id,
+      fullName: user.fullName,
+      mobile: user.mobile,
+      role: user.role,
+      userTypeId: user.userTypeId,
+      branchId: user.branchId,
+      permissions: expandWithParents(rids),
+    };
+  }
+}