diff --git a/src/guard/role.guard.ts b/src/guard/role.guard.ts new file mode 100644 index 0000000..29791af --- /dev/null +++ b/src/guard/role.guard.ts @@ -0,0 +1,25 @@ +import { CanActivate, ExecutionContext, Injectable, UnauthorizedException } from "@nestjs/common"; +import { JwtService } from "@nestjs/jwt"; + +@Injectable() +export class RoleGuard implements CanActivate { + constructor( + private jwtService: JwtService, + ) {} + async canActivate(context: ExecutionContext): Promise { + const request = context.switchToHttp().getRequest(); + const token = request.headers["authorization"]?.split(" ")[1]; + if (!token) throw new UnauthorizedException("Authorization token is missing"); + try { + const decoded = this.jwtService.verify(token, { secret: process.env.JWT_SECRET }); + const userRole = decoded.role; + if (userRole !== "admin") { + throw new UnauthorizedException("You do not have the required role"); + } + request.user = decoded; + return true; + } catch (error) { + throw new UnauthorizedException("Invalid or expired token"); + } + } +}