105 lines
3.6 KiB
TypeScript
105 lines
3.6 KiB
TypeScript
import { Injectable, UnauthorizedException } from '@nestjs/common';
|
|
import { PassportStrategy } from '@nestjs/passport';
|
|
import { ExtractJwt, Strategy } from 'passport-jwt';
|
|
import { PrismaService } from '../../prisma/prisma.service';
|
|
import { envOr } from '../../common/env';
|
|
import { AdminSessionService } from '../sessions/admin-session.service';
|
|
import { expandWithParents } from './acl.constants';
|
|
|
|
export interface JwtPayload {
|
|
sub: string;
|
|
mobile: string;
|
|
/**
|
|
* Present only on tokens issued while session tracking is on. It identifies the
|
|
* AdminSession row, which is what makes revoking a token before it expires
|
|
* possible. A token without it predates tracking and stays valid until it
|
|
* expires, so switching the feature on does not sign everyone out.
|
|
*/
|
|
jti?: string;
|
|
/**
|
|
* Set on APP tokens only ('customer' or 'sales-expert'). An admin-panel
|
|
* token has no `typ`. Checked in validate() below — see the note there.
|
|
*/
|
|
typ?: string;
|
|
}
|
|
|
|
/**
|
|
* App token types, which must NEVER authenticate an admin-panel route.
|
|
*
|
|
* This matters because a sales expert's app token carries their AdminUser id
|
|
* in `sub` (D21). The two token families are signed with different secrets, so
|
|
* normally the signature alone stops it — but `JWT_CUSTOMER_SECRET` falls back
|
|
* to `JWT_SECRET` when unset, and in that configuration an expert's app token
|
|
* WOULD verify here and be handed full admin-panel permissions. This check
|
|
* closes that regardless of how the secrets are configured.
|
|
*/
|
|
const APP_TOKEN_TYPES = new Set(['customer', 'sales-expert']);
|
|
|
|
/**
|
|
* The authenticated principal attached to `req.user`.
|
|
*
|
|
* `permissions` is already expanded with ancestors, so guards can test a rid with
|
|
* a plain `includes()` — the same shape the legacy frontend held in its Vuex store
|
|
* after checkParent().
|
|
*/
|
|
export interface AuthenticatedAdmin {
|
|
id: string;
|
|
fullName: string;
|
|
mobile: string;
|
|
role: string;
|
|
userTypeId: number | null;
|
|
branchId: string | null;
|
|
permissions: string[];
|
|
}
|
|
|
|
@Injectable()
|
|
export class JwtStrategy extends PassportStrategy(Strategy, 'jwt') {
|
|
constructor(
|
|
private readonly prisma: PrismaService,
|
|
private readonly sessions: AdminSessionService,
|
|
) {
|
|
super({
|
|
jwtFromRequest: ExtractJwt.fromAuthHeaderAsBearerToken(),
|
|
ignoreExpiration: false,
|
|
secretOrKey: envOr('JWT_SECRET', 'dev-only-insecure-secret'),
|
|
});
|
|
}
|
|
|
|
async validate(payload: JwtPayload): Promise<AuthenticatedAdmin> {
|
|
// An app token is never an admin-panel token, whatever it is signed with.
|
|
if (payload?.typ && APP_TOKEN_TYPES.has(payload.typ)) {
|
|
throw new UnauthorizedException();
|
|
}
|
|
|
|
// Revoked centrally (IAM back-channel logout) or locally? While tracking is
|
|
// off this returns true without touching the database, so the request costs
|
|
// exactly what it did before.
|
|
if (!(await this.sessions.isActive(payload.jti))) {
|
|
throw new UnauthorizedException();
|
|
}
|
|
|
|
const user = await this.prisma.adminUser.findUnique({
|
|
where: { id: payload.sub },
|
|
include: { userType: { include: { permissions: true } } },
|
|
});
|
|
|
|
if (!user || !user.isActive) {
|
|
throw new UnauthorizedException();
|
|
}
|
|
|
|
// Permissions are re-read on every request rather than baked into the token,
|
|
// so a permission change takes effect immediately instead of at next login.
|
|
const rids = user.userType?.permissions.map((p) => p.rid) ?? [];
|
|
|
|
return {
|
|
id: user.id,
|
|
fullName: user.fullName,
|
|
mobile: user.mobile,
|
|
role: user.role,
|
|
userTypeId: user.userTypeId,
|
|
branchId: user.branchId,
|
|
permissions: expandWithParents(rids),
|
|
};
|
|
}
|
|
}
|