Spaces:
Running
Running
File size: 3,681 Bytes
303c85f | 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 | "use strict";
var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
return c > 3 && r && Object.defineProperty(target, key, r), r;
};
var __metadata = (this && this.__metadata) || function (k, v) {
if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
};
var AdminAuthService_1;
Object.defineProperty(exports, "__esModule", { value: true });
exports.AdminAuthService = void 0;
const common_1 = require("@nestjs/common");
const server_1 = require("@trpc/server");
const prisma_service_1 = require("../prisma/prisma.service");
const shared_types_1 = require("@micprotocol/shared-types");
const platform_admin_1 = require("../common/platform-admin");
let AdminAuthService = AdminAuthService_1 = class AdminAuthService {
prisma;
logger = new common_1.Logger(AdminAuthService_1.name);
constructor(prisma) {
this.prisma = prisma;
}
async getAdminContext(userId) {
const user = await this.prisma.user.findUnique({
where: { id: userId },
select: {
id: true,
isAdmin: true,
adminRole: true,
adminPermissions: true,
suspendedAt: true,
},
});
if (!user)
return null;
const role = (0, platform_admin_1.deriveAdminRole)(user);
if (!role)
return null;
const permissions = (0, shared_types_1.resolveAdminPermissions)(role, user.adminPermissions);
const suspended = !!user.suspendedAt;
return {
userId: user.id,
isAdmin: !!user.isAdmin,
role,
permissions,
suspended,
};
}
async requirePermission(userId, permission) {
const ctx = await this.getAdminContext(userId);
if (!ctx) {
throw new server_1.TRPCError({ code: "FORBIDDEN", message: "Admin privileges required" });
}
if (ctx.suspended) {
throw new server_1.TRPCError({ code: "FORBIDDEN", message: "Account is suspended" });
}
if (!ctx.permissions.has(permission)) {
throw new server_1.TRPCError({
code: "FORBIDDEN",
message: `Insufficient permissions: ${permission} required`,
});
}
return ctx;
}
async requireAnyPermission(userId, ...permissions) {
const ctx = await this.getAdminContext(userId);
if (!ctx || ctx.suspended) {
throw new server_1.TRPCError({ code: "FORBIDDEN", message: "Admin privileges required" });
}
const hasAny = permissions.some((p) => ctx.permissions.has(p));
if (!hasAny) {
throw new server_1.TRPCError({
code: "FORBIDDEN",
message: `Insufficient permissions: one of ${permissions.join(", ")} required`,
});
}
return ctx;
}
};
exports.AdminAuthService = AdminAuthService;
exports.AdminAuthService = AdminAuthService = AdminAuthService_1 = __decorate([
(0, common_1.Injectable)(),
__metadata("design:paramtypes", [prisma_service_1.PrismaService])
], AdminAuthService);
//# sourceMappingURL=admin-auth.service.js.map |