Add support for adding custom decorators to endpoints

[izundo-viennv]

@doug-martin
I found that the library has support for adding filters, pipes, guards, but I don't know if I want to add @Permissions(['READ', 'UPDATE']) to built-in endpoints. Like what I did for custom methods:

@Query(() => UserDTO)
@UseGuards(JwtAuthGuard, GqlAuthGuard)
@Permissions(['READ', 'UPDATE'])
async me(@CurrentUser() user: User): Promise<UserDTO> {
  return this.service.findById(user.id);
}

[doug-martin]

Where does permissions come from? Is it a guard?

[izundo-viennv]

@doug-martin Permissions will be read from GqlAuthGuard guard. How to address this issue?

[doug-martin]

I was wondering if @Permissions is from an opensource library or did is in internal?

The reason I ask is without more context it is hard to answer your question.

If it were my project I would try to make a new PermissionsGuard that accepts the roles and blocks requests accordingly.

[doug-martin]

Again, without more information this is hard to answer.

[izundo-viennv]

This is for GqlAuthGuard

@Injectable()
export class GqlAuthGuard implements CanActivate {
  constructor(
    private readonly reflector: Reflector,
    private readonly userService: UserService,
  ) {}

  async canActivate(context: ExecutionContext): Promise<boolean> {
    const ctx = GqlExecutionContext.create(context).getContext();
    const user = ctx.req.user as User;

    if (!this.userService.canAccess(user)) {
      return false;
    }

    const permissions = this.reflector.get<string[]>(
      PermissionsMetaKey,
      context.getHandler(),
    );

    const grantedPermissions = user.grantedPermissions;

    if (grantedPermissions.some(gp => permissions.some(p => p === gp.name))) {
      return true;
    }

    return false;
  }
}

And this is for Permissions (this is the custom decorator I wrote)

import { SetMetadata } from '@nestjs/common';

export const PermissionsMetaKey = 'permissions';

export const Permissions = (permissions: string[]) =>
  SetMetadata(PermissionsMetaKey, permissions);

[izundo-viennv]

@doug-martin In GqlAuthGuard it's just simple read metadata set to method handler to get permissions for checking

[doug-martin]

Published under v0.5.0

[izundo-viennv]

@doug-martin Thank you very much. You're awesome