کنترل دسترسی مبتنی بر نقش پیشرفته (RBAC) در Nestjs با یک نگهبان مجوز سفارشی

@Permission('user:create')
@Post('create')
createUser() { ... }

import { Injectable, CanActivate, ExecutionContext } from '@nestjs/common';
import { Reflector } from '@nestjs/core';
import { IS_PUBLIC_KEY } from 'src/decorators/public.decorator';
import { PERMISSION_KEY } from 'src/decorators/Permission.decorator';
import { JwtPayload } from 'jsonwebtoken';
import { AdministratorRoleEnum } from '@prisma/client';

@Injectable()
export class PermissionGuard implements CanActivate {
  constructor(private reflector: Reflector) {}

  canActivate(context: ExecutionContext): boolean {
    const isPublic = this.reflector.get(
      IS_PUBLIC_KEY,
      context.getHandler(),
    );
    if (isPublic) return true;

    const requiredRules = this.reflector.get(
      PERMISSION_KEY,
      context.getHandler(),
    );
    if (!requiredRules || requiredRules.length === 0) return true;

    const request = context.switchToHttp().getRequest();
    const user = request.user as JwtPayload;

    if (!user) return false;

    if (user.role === AdministratorRoleEnum.super_admin) return true;

    if (!Array.isArray(user.rules)) return false;

    return requiredRules.every((requiredRule) => {
      if (user.rules.includes(requiredRule)) return true;
      const resource = requiredRule.split(':')?.[0];
      return user.rules.includes(`${resource}:*`);
    });
  }
}