Nestjs自定义注解实现接口权限控制详解

export enum Role {
  SuperAdmin = 'SuperAdmin',
  Admin = 'Admin',
  Normal = 'Normal',
  Guest = 'Guest',
}

import { SetMetadata } from '@nestjs/common';
import { Role } from '@constants';
export const ROLES_KEY = 'roles';
export const Roles = (...roles: Role[]) => SetMetadata(ROLES_KEY, roles);

{
  "statusCode": 403,
  "message": "Forbidden resource",
  "error": "Forbidden"
}

import { Injectable, CanActivate, ExecutionContext } from '@nestjs/common';
import { Reflector } from '@nestjs/core';
import { ROLES_KEY } from '../decorators/roles.decorator';
import { Role } from '@constants';
import { InternalErrorException } from '../../exception/InternalErrorException';
import { errorResult } from '@utils';
import { ErrorCodes } from '@constants/errorCode';
@Injectable()
export class RolesGuard implements CanActivate {
  constructor(private reflector: Reflector) {}
  canActivate(context: ExecutionContext): boolean {
    const requiredRoles = this.reflector.getAllAndOverride<Role[]>(ROLES_KEY, [
      context.getHandler(),
      context.getClass(),
    ]);
    if (!requiredRoles) {
      return true;
    }
    const { user } = context.switchToHttp().getRequest();
    const roleCodes = user.roles?.map((item) => item.code);
    const flag = requiredRoles.some((role) => roleCodes?.includes(role));
    if (!flag) {
      throw new InternalErrorException(errorResult(ErrorCodes.NoAuth));
    }
    return flag;
  }
}

providers: [
  {
    provide: APP_GUARD,
    useClass: RolesGuard,
  },
],

  @Get()
  @Roles(Role.Admin, Role.SuperAdmin)
  async findAll() {
    const users = await this.userService.findAll();
    return successResult(users);
  }