I have implemented RoleGuard as follows with the help of official nestJS documentation:
@Injectable()
export class RolesGuard implements CanActivate {
constructor(private readonly reflector: Reflector) {}
canActivate(context: ExecutionContext): boolean {
const roles = this.reflector.get<string[]>('roles', context.getHandler());
if (!roles) {
return true;
}
const request = context.switchToHttp().getRequest();
const user = request.user;
//console.log(request)
const hasRole = () => user.role.some((role) => roles.includes(role));
return user && user.roles && hasRole();
}
}
and applied as follows:
@Get('get/all')
@UseGuards(AuthGuard('jwt'), RolesGuard)
@Roles('user')
async findAll(): Promise<Service[]> {
return this.serviceServce.findAll()
}
This is my auth strategy:
@Injectable()
export class JwtStrategy extends PassportStrategy(Strategy) {
constructor() {
super({
jwtFromRequest: ExtractJwt.fromAuthHeaderAsBearerToken(),
ignoreExpiration: false,
secretOrKey: jwtConstants.secret,
});
}
async validate(payload: any) {
console.log(JSON.stringify(payload));
return { userId: payload.sub, username: payload.username };
}
}
And this is my auth service:
async login(user: any) {
const payload = { email: user.email, sub: user.Id };
return {
access_token: this.jwtService.sign(payload),
};
}
but it always returns:
{
"statusCode": 403,
"error": "Forbidden",
"message": "Forbidden resource"
}
I debug for the request and the user is empty (request.user) in the documentation it says:
In the node.js world, it's common practice to attach the authorized user to the request object. Thus, in our sample code above, we are assuming that request.user contains the user instance and allowed roles.
I don't understand this part. How do I do that?
