init

src/modules/auth/jwt-auth.guard.ts

@@ -0,0 +1,35 @@
+import {
+  CanActivate,
+  ExecutionContext,
+  Injectable,
+  UnauthorizedException,
+} from '@nestjs/common'
+import { JwtService } from '@nestjs/jwt'
+import { Request } from 'express'
+
+@Injectable()
+export class JwtAuthGuard implements CanActivate {
+  constructor(private jwt: JwtService) {}
+
+  async canActivate(context: ExecutionContext): Promise<boolean> {
+    const req = context.switchToHttp().getRequest<Request>()
+    const auth = req.headers.authorization
+    if (!auth) throw new UnauthorizedException('Missing Authorization header')
+
+    const parts = auth.split(' ')
+    if (parts.length !== 2 || parts[0] !== 'Bearer') {
+      throw new UnauthorizedException('Invalid Authorization header format')
+    }
+
+    const token = parts[1]
+    try {
+      const payload = this.jwt.verify(token, {
+        secret: process.env.JWT_SECRET || 'secret',
+      })
+      ;(req as any).user = payload
+      return true
+    } catch (err) {
+      throw new UnauthorizedException('Invalid or expired token')
+    }
+  }
+}