update pos consumer module

src/common/guards/context.guard.ts

@@ -1,57 +0,0 @@
-import {
-  CanActivate,
-  ExecutionContext,
-  Injectable,
-  UnauthorizedException,
-} from '@nestjs/common'
-import { Reflector } from '@nestjs/core'
-import { JwtService } from '@nestjs/jwt'
-import { IS_PUBLIC_KEY } from '../decorators/public.decorator'
-import { IWithJWTPayloadRequest } from '../models/token-model'
-
-@Injectable()
-export class JwtAuthGuard implements CanActivate {
-  constructor(
-    private jwt: JwtService,
-    private reflector: Reflector,
-  ) {}
-
-  async canActivate(context: ExecutionContext): Promise<boolean> {
-    const isPublic = this.reflector.getAllAndOverride<boolean>(IS_PUBLIC_KEY, [
-      context.getHandler(),
-      context.getClass(),
-    ])
-    if (isPublic) return true
-
-    const req = context.switchToHttp().getRequest<IWithJWTPayloadRequest>()
-
-    let token: string | undefined = req.cookies?.accessToken
-    if (!token) {
-      const authHeader = (req.headers.authorization || req.headers.Authorization) as
-        | string
-        | undefined
-      if (authHeader && authHeader.startsWith('Bearer ')) {
-        token = authHeader.slice(7)
-      }
-    }
-
-    if (!token) throw new UnauthorizedException('Missing access token')
-
-    try {
-      const payload = this.jwt.verify(token, {
-        secret: process.env.JWT_SECRET || 'secret',
-      })
-
-      if (payload.type !== 'POS')
-        throw new UnauthorizedException('Invalid or expired token')
-
-      // Set the typed dataPayload to the request
-      req.dataPayload = payload
-
-      return true
-    } catch (err) {
-      console.log(err)
-      throw new UnauthorizedException('Invalid or expired token')
-    }
-  }
-}

src/common/guards/jwt-auth.guard.ts

@@ -6,8 +6,8 @@ import {
 } from '@nestjs/common'
 import { Reflector } from '@nestjs/core'
 import { JwtService } from '@nestjs/jwt'
+import { Request as ExpressRequest } from 'express'
 import { IS_PUBLIC_KEY } from '../decorators/public.decorator'
-import { IWithJWTPayloadRequest } from '../models/token-model'
 
 @Injectable()
 export class JwtAuthGuard implements CanActivate {
@@ -23,7 +23,7 @@ export class JwtAuthGuard implements CanActivate {
     ])
     if (isPublic) return true
 
-    const req = context.switchToHttp().getRequest<IWithJWTPayloadRequest>()
+    const req = context.switchToHttp().getRequest<ExpressRequest>()
 
     let token: string | undefined = req.cookies?.accessToken
     if (!token) {
@@ -38,15 +38,15 @@ export class JwtAuthGuard implements CanActivate {
     if (!token) throw new UnauthorizedException('Missing access token')
 
     try {
-      const payload = this.jwt.verify(token, {
-        secret: process.env.JWT_SECRET || 'secret',
+      this.jwt.verify(token, {
+        secret: process.env.JWT_SECRET,
       })
 
       // if (payload.type !== 'POS')
       //   throw new UnauthorizedException('Invalid or expired token')
 
       // Set the typed dataPayload to the request
-      req.dataPayload = payload
+      // req.dataPayload = payload
 
       return true
     } catch (err) {

src/common/guards/pos.gaurd.ts

@@ -0,0 +1,130 @@
+// src/common/guards/permissions.guard.ts
+import { PrismaService } from '@/prisma/prisma.service'
+import {
+  CanActivate,
+  ExecutionContext,
+  ForbiddenException,
+  Injectable,
+} from '@nestjs/common'
+import { Reflector } from '@nestjs/core'
+import { JwtService } from '@nestjs/jwt'
+import { Request as ExpressRequest } from 'express'
+import { IS_PUBLIC_KEY } from '../decorators/public.decorator'
+import { checkAndDecodeJwtToken } from '../utils/jwt-user.util'
+
+@Injectable()
+export class PosGuard implements CanActivate {
+  constructor(
+    private jwt: JwtService,
+    private reflector: Reflector,
+    private prisma: PrismaService,
+  ) {}
+
+  async canActivate(context: ExecutionContext): Promise<boolean> {
+    const isPublic = this.reflector.getAllAndOverride<boolean>(IS_PUBLIC_KEY, [
+      context.getHandler(),
+      context.getClass(),
+    ])
+    if (isPublic) return true
+
+    // const requiredPermissions = this.reflector.get<string[]>(
+    //   'permissions',
+    //   context.getHandler(),
+    // )
+    // if (!requiredPermissions || requiredPermissions.length === 0) return true
+
+    const req = context.switchToHttp().getRequest<ExpressRequest>()
+
+    const account = checkAndDecodeJwtToken(req, this.jwt)
+    // const account = req.decodedToken
+
+    if (!req.url.startsWith('/api/v1/pos/')) {
+      return true
+    }
+
+    if (!account || account.type !== 'CONSUMER')
+      throw new ForbiddenException('شما دسترسی لازم را ندارید.')
+
+    const cookie = req.cookies
+    const { posId, accessToken } = cookie
+
+    if (!posId || !accessToken) {
+      return false
+    }
+
+    const pos = await this.prisma.pos.findUnique({
+      where: {
+        id: posId,
+        complex: {
+          business_activity: {
+            user: {
+              accounts: {
+                some: {
+                  account_id: account.account_id,
+                },
+              },
+            },
+          },
+        },
+      },
+      select: {
+        complex: {
+          select: {
+            id: true,
+            business_activity_id: true,
+          },
+        },
+      },
+    })
+
+    if (!pos) {
+      throw new ForbiddenException('شما دسترسی لازم را ندارید.')
+    }
+
+    const foundedAccount = await this.prisma.account.findUnique({
+      where: {
+        id: account.account_id,
+      },
+      select: {
+        consumer_account: {
+          select: {
+            role: true,
+          },
+        },
+      },
+    })
+
+    if (foundedAccount?.consumer_account?.role === 'OWNER') {
+      return true
+    }
+
+    const accountPermissions = await this.prisma.permissionConsumer.findUnique({
+      where: {
+        account_id: account.account_id,
+      },
+      select: {
+        posPermissions: true,
+        businessPermissions: true,
+        complexPermissions: true,
+      },
+    })
+
+    if (accountPermissions?.posPermissions.some(p => p.pos_id === posId)) {
+      return true
+    }
+    if (
+      accountPermissions?.complexPermissions.some(p => p.complex_id === pos.complex.id)
+    ) {
+      return true
+    }
+    if (
+      accountPermissions?.businessPermissions.some(
+        p => p.business_id === pos.complex.business_activity_id,
+      )
+    ) {
+      return true
+    }
+
+    throw new ForbiddenException('شما دسترسی لازم را ندارید.')
+  }
+}