Spaces:
Running
Running
| ; | |
| var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) { | |
| var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d; | |
| if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc); | |
| else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r; | |
| return c > 3 && r && Object.defineProperty(target, key, r), r; | |
| }; | |
| var __metadata = (this && this.__metadata) || function (k, v) { | |
| if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v); | |
| }; | |
| var AdminAuthService_1; | |
| Object.defineProperty(exports, "__esModule", { value: true }); | |
| exports.AdminAuthService = void 0; | |
| const common_1 = require("@nestjs/common"); | |
| const server_1 = require("@trpc/server"); | |
| const prisma_service_1 = require("../prisma/prisma.service"); | |
| const shared_types_1 = require("@micprotocol/shared-types"); | |
| const platform_admin_1 = require("../common/platform-admin"); | |
| let AdminAuthService = AdminAuthService_1 = class AdminAuthService { | |
| prisma; | |
| logger = new common_1.Logger(AdminAuthService_1.name); | |
| constructor(prisma) { | |
| this.prisma = prisma; | |
| } | |
| async getAdminContext(userId) { | |
| const user = await this.prisma.user.findUnique({ | |
| where: { id: userId }, | |
| select: { | |
| id: true, | |
| isAdmin: true, | |
| adminRole: true, | |
| adminPermissions: true, | |
| suspendedAt: true, | |
| }, | |
| }); | |
| if (!user) | |
| return null; | |
| const role = (0, platform_admin_1.deriveAdminRole)(user); | |
| if (!role) | |
| return null; | |
| const permissions = (0, shared_types_1.resolveAdminPermissions)(role, user.adminPermissions); | |
| const suspended = !!user.suspendedAt; | |
| return { | |
| userId: user.id, | |
| isAdmin: !!user.isAdmin, | |
| role, | |
| permissions, | |
| suspended, | |
| }; | |
| } | |
| async requirePermission(userId, permission) { | |
| const ctx = await this.getAdminContext(userId); | |
| if (!ctx) { | |
| throw new server_1.TRPCError({ code: "FORBIDDEN", message: "Admin privileges required" }); | |
| } | |
| if (ctx.suspended) { | |
| throw new server_1.TRPCError({ code: "FORBIDDEN", message: "Account is suspended" }); | |
| } | |
| if (!ctx.permissions.has(permission)) { | |
| throw new server_1.TRPCError({ | |
| code: "FORBIDDEN", | |
| message: `Insufficient permissions: ${permission} required`, | |
| }); | |
| } | |
| return ctx; | |
| } | |
| async requireAnyPermission(userId, ...permissions) { | |
| const ctx = await this.getAdminContext(userId); | |
| if (!ctx || ctx.suspended) { | |
| throw new server_1.TRPCError({ code: "FORBIDDEN", message: "Admin privileges required" }); | |
| } | |
| const hasAny = permissions.some((p) => ctx.permissions.has(p)); | |
| if (!hasAny) { | |
| throw new server_1.TRPCError({ | |
| code: "FORBIDDEN", | |
| message: `Insufficient permissions: one of ${permissions.join(", ")} required`, | |
| }); | |
| } | |
| return ctx; | |
| } | |
| }; | |
| exports.AdminAuthService = AdminAuthService; | |
| exports.AdminAuthService = AdminAuthService = AdminAuthService_1 = __decorate([ | |
| (0, common_1.Injectable)(), | |
| __metadata("design:paramtypes", [prisma_service_1.PrismaService]) | |
| ], AdminAuthService); | |
| //# sourceMappingURL=admin-auth.service.js.map |