Nick SzaunigandClaude Sonnet 5
cd24523ea5
Beim Umstellen von PermissionsGuard auf Fail-Closed wurde der @Public()-Check vergessen. JwtAuthGuard ueberspringt bei @Public() zwar die Authentifizierung, aber PermissionsGuard laeuft als eigenstaendiger, separat registrierter APP_GUARD trotzdem mit - und verweigerte seitdem jede Route ohne @RequirePermission/ @AnyAuthenticatedUser, selbst wenn sie @Public() war. Betroffen: health und health/ready (die gemeldeten 403), aber ebenso Login, SSO-Flow und die oeffentliche Herkunftsseite. PermissionsGuard prueft jetzt @Public() als erstes und laesst diese Routen durch, genau wie JwtAuthGuard es bereits tut. Regressionstest ergaenzt. Co-Authored-By: Claude Sonnet 5 <[email protected]>
64 lines
2.6 KiB
TypeScript
64 lines
2.6 KiB
TypeScript
import { CanActivate, ExecutionContext, Injectable } from '@nestjs/common';
|
|
import { Reflector } from '@nestjs/core';
|
|
import { ANY_AUTHENTICATED_USER_KEY } from '../decorators/any-authenticated-user.decorator';
|
|
import { IS_PUBLIC_KEY } from '../decorators/public.decorator';
|
|
import { REQUIRE_PERMISSION_KEY } from '../decorators/require-permission.decorator';
|
|
import { PermissionKey } from '../permissions/permission-catalog';
|
|
import { PermissionResolverService } from '../permissions/permission-resolver.service';
|
|
import { AuthenticatedUser } from '../types/authenticated-user';
|
|
|
|
interface RequestWithUser {
|
|
user?: AuthenticatedUser;
|
|
}
|
|
|
|
/**
|
|
* Fails closed by decorator absence: a route reaches this guard whether or
|
|
* not it's @Public (JwtAuthGuard only skips authentication for those, it
|
|
* doesn't remove this guard from the chain - NestJS APP_GUARD entries all
|
|
* run, there's no early-exit between them), so @Public is checked here too,
|
|
* the same way JwtAuthGuard checks it. A non-public route is denied unless
|
|
* it carries either @RequirePermission (checked against the caller's live
|
|
* permission set) or the explicit @AnyAuthenticatedUser opt-out for routes
|
|
* meant to be reachable by any logged-in user regardless of role. A route
|
|
* with none of the three is a bug - forgetting to decorate a new route now
|
|
* fails shut at runtime instead of silently granting access to every
|
|
* authenticated user and relying solely on
|
|
* test/authorization-coverage.e2e-spec.ts to catch it before deploy.
|
|
*/
|
|
@Injectable()
|
|
export class PermissionsGuard implements CanActivate {
|
|
constructor(
|
|
private readonly reflector: Reflector,
|
|
private readonly permissionResolver: PermissionResolverService,
|
|
) {}
|
|
|
|
async canActivate(context: ExecutionContext): Promise<boolean> {
|
|
const isPublic = this.reflector.getAllAndOverride<boolean>(IS_PUBLIC_KEY, [
|
|
context.getHandler(),
|
|
context.getClass(),
|
|
]);
|
|
if (isPublic) {
|
|
return true;
|
|
}
|
|
|
|
const requiredPermissions = this.reflector.getAllAndOverride<
|
|
PermissionKey[]
|
|
>(REQUIRE_PERMISSION_KEY, [context.getHandler(), context.getClass()]);
|
|
const request = context.switchToHttp().getRequest<RequestWithUser>();
|
|
const user = request.user;
|
|
|
|
if (requiredPermissions && requiredPermissions.length > 0) {
|
|
if (!user) {
|
|
return false;
|
|
}
|
|
return this.permissionResolver.hasAny(user.id, requiredPermissions);
|
|
}
|
|
|
|
const isAnyAuthenticatedUser = this.reflector.getAllAndOverride<boolean>(
|
|
ANY_AUTHENTICATED_USER_KEY,
|
|
[context.getHandler(), context.getClass()],
|
|
);
|
|
return Boolean(isAnyAuthenticatedUser && user);
|
|
}
|
|
}
|