rmancinasandClaude Opus 4.8
74e2ad8bcd
Adds the RBAC foundation the CRUD phases build on, and the first write module (users). The platform was read-only: every controller was guarded only by AuthenticatedGuard and UserRole was ADMIN|STAFF. The old PHP app stored level+role but enforced neither, so this is a fresh design. Permission model (server-authoritative): - UserRole expanded to an ordered rank ADMIN > MANAGER > STAFF > VIEWER. VIEWER is the read-only role; STAFF+ can write. - auth/abilities.ts: ROLE_RANK + ABILITY_MIN matrix + can()/abilitiesFor(). - @RequireAbility decorator + AbilityGuard enforce it on write routes; reads stay on AuthenticatedGuard so any logged-in user can read. - /auth/login and /auth/me now return the resolved abilities map, so the web gates its UI off one payload instead of duplicating the rules. User management (ADMIN-only, ability "user:manage"): - UsersService gains list/create/update/resetPassword (argon2), never returns passwordHash; blocks self-deactivation and self-demotion; maps duplicate email to 409. - UsersController: GET/POST /users, PATCH /users/:id, POST /users/:id/reset-password. - Every mutation logged via new AuditService over the existing ActivityLog model (global CommonModule). Web: - AuthContext + useAuth/useCan; AppShell provides the user and gates the new "Usuarios" nav entry on user:manage; shows the user's role. - /usuarios admin page: list + create/edit form + password reset + active toggle, Spanish-first, reusing existing card/table/field styles. Schema pushed to dev (enum only, non-destructive). Verified end-to-end against dev: admin CRUD works, VIEWER writes 403 while reads 200, self-lockout guards and duplicate-email 409 all hold. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
37 lines
1.2 KiB
TypeScript
37 lines
1.2 KiB
TypeScript
import {
|
|
CanActivate,
|
|
ExecutionContext,
|
|
ForbiddenException,
|
|
Injectable,
|
|
} from "@nestjs/common";
|
|
import { Reflector } from "@nestjs/core";
|
|
import { Request } from "express";
|
|
import { ABILITY_KEY } from "./require-ability.decorator";
|
|
import { Ability, Role, can } from "./abilities";
|
|
|
|
/**
|
|
* Enforces the ability matrix (abilities.ts) against req.user.role. A route
|
|
* with no @RequireAbility passes through untouched — this guard only gates the
|
|
* routes that declare one. It does NOT check authentication; always list it
|
|
* after AuthenticatedGuard so an unauthenticated request is rejected first.
|
|
*/
|
|
@Injectable()
|
|
export class AbilityGuard implements CanActivate {
|
|
constructor(private readonly reflector: Reflector) {}
|
|
|
|
canActivate(context: ExecutionContext): boolean {
|
|
const ability = this.reflector.getAllAndOverride<Ability | undefined>(
|
|
ABILITY_KEY,
|
|
[context.getHandler(), context.getClass()],
|
|
);
|
|
if (!ability) return true;
|
|
|
|
const req = context.switchToHttp().getRequest<Request>();
|
|
const user = req.user as { role?: Role } | undefined;
|
|
if (!user?.role || !can(user.role, ability)) {
|
|
throw new ForbiddenException("No tiene permisos para esta acción");
|
|
}
|
|
return true;
|
|
}
|
|
}
|