psp_api/src/common/guards/auth-partner.guard.ts

// src/common/guards/permissions.guard.ts
import { ITokenPayload } from '@/modules/auth/auth.utils'
import { PrismaService } from '@/prisma/prisma.service'
import {
  ExecutionContext,
  ForbiddenException,
  Injectable,
  UnauthorizedException,
} from '@nestjs/common'
import { Request as ExpressRequest } from 'express'

@Injectable()
export class PartnerGuard {
  constructor(private prisma: PrismaService) {}

  async canActivate(
    tokenPayload: ITokenPayload,
    context: ExecutionContext,
  ): Promise<boolean> {
    if (!tokenPayload || tokenPayload.type !== 'PARTNER') {
      throw new UnauthorizedException()
    }

    const partner = await this.prisma.partner.findFirst({
      where: {
        accounts: {
          some: {
            id: tokenPayload.account_id,
          },
        },
      },
      select: {
        accounts: {
          select: {
            role: true,
          },
        },
      },
    })

    if (!partner) {
      throw new ForbiddenException('شما دسترسی لازم را ندارید.')
    }

    const req = context.switchToHttp().getRequest<ExpressRequest>()

    return true
  }
}