Authorization refactor

package.json

@@ -35,6 +35,7 @@
   "dependencies": {
     "@aws-sdk/client-s3": "3.504.0",
     "@aws-sdk/s3-request-presigner": "^3.498.0",
+    "@casl/ability": "^6.7.1",
     "@nestjs/common": "10.3.2",
     "@nestjs/config": "3.2.0",
     "@nestjs/core": "10.3.2",

src/app.module.ts

@@ -37,6 +37,7 @@ import { ThreadsModule } from './threads/threads.module';
 import { EventsModule } from './events/events.module';
 import { InvitesModule } from './invites/invites.module';
 import { WorkspaceChannelModule } from './workspace-channel/workspace-channel.module';
+import { CaslModule } from './casl/casl.module';
 
 @Module({
   imports: [
@@ -106,6 +107,7 @@ import { WorkspaceChannelModule } from './workspace-channel/workspace-channel.mo
     EventsModule,
     InvitesModule,
     WorkspaceChannelModule,
+    CaslModule,
   ],
   providers: [],
 })

src/authz/check-policies/check-policies.decorator.ts

@@ -0,0 +1,6 @@
+import { SetMetadata } from '@nestjs/common';
+import { PolicyHandler } from './policy-handler.type';
+
+export const CHECK_POLICIES_KEY = 'check_policy';
+export const CheckPolicies = (...handlers: PolicyHandler[]) =>
+  SetMetadata(CHECK_POLICIES_KEY, handlers);

src/authz/check-policies/policy-handler.type.ts

@@ -0,0 +1,9 @@
+import { AppAbility } from 'src/casl/casl-ability.factory/casl-ability.factory';
+
+interface IPolicyHandler {
+  handle(ability: AppAbility): boolean;
+}
+
+type PolicyHandlerCallback = (ability: AppAbility) => boolean;
+
+export type PolicyHandler = IPolicyHandler | PolicyHandlerCallback;

src/authz/policies.guard/policies.guard.ts

@@ -0,0 +1,39 @@
+import { CanActivate, ExecutionContext, Injectable } from '@nestjs/common';
+import { Reflector } from '@nestjs/core';
+import {
+  AppAbility,
+  CaslAbilityFactory,
+} from 'src/casl/casl-ability.factory/casl-ability.factory';
+import { PolicyHandler } from '../check-policies/policy-handler.type';
+import { CHECK_POLICIES_KEY } from '../check-policies/check-policies.decorator';
+
+@Injectable()
+export class PoliciesGuard implements CanActivate {
+  constructor(
+    private reflector: Reflector,
+    private caslAbilityFactory: CaslAbilityFactory,
+  ) {}
+
+  // eslint-disable-next-line @typescript-eslint/require-await
+  async canActivate(context: ExecutionContext): Promise<boolean> {
+    const policyHandlers =
+      this.reflector.get<PolicyHandler[]>(
+        CHECK_POLICIES_KEY,
+        context.getHandler(),
+      ) || [];
+
+    const { user } = context.switchToHttp().getRequest();
+    const ability = this.caslAbilityFactory.createForUser(user);
+
+    return policyHandlers.every((handler) =>
+      this.execPolicyHandler(handler, ability),
+    );
+  }
+
+  private execPolicyHandler(handler: PolicyHandler, ability: AppAbility) {
+    if (typeof handler === 'function') {
+      return handler(ability);
+    }
+    return handler.handle(ability);
+  }
+}

src/casl/action.enum.ts

@@ -0,0 +1,7 @@
+export enum Action {
+  MANAGE = 'manage',
+  CREATE = 'create',
+  READ = 'read',
+  UPDATE = 'update',
+  DELETE = 'delete',
+}

src/casl/casl-ability.factory/casl-ability.factory.ts

@@ -0,0 +1,50 @@
+import {
+  AbilityBuilder,
+  ExtractSubjectType,
+  InferSubjects,
+  MongoAbility,
+  MongoQuery,
+  createMongoAbility,
+} from '@casl/ability';
+import { Channel } from 'src/channels/domain/channel';
+import { FlatChannel } from './typs';
+import { Message } from 'src/messages/domain/message';
+import { Workspace } from 'src/workspaces/domain/workspace';
+import { Action } from '../action.enum';
+import { Injectable } from '@nestjs/common';
+import { User } from 'src/users/domain/user';
+import { RoleEnum } from 'src/roles/roles.enum';
+
+type Subjects =
+  | InferSubjects<typeof Workspace | typeof Channel | typeof Message>
+  | 'all';
+
+type PossibleAbilities = [Action, Subjects];
+type Conditions = MongoQuery;
+export type AppAbility = MongoAbility<PossibleAbilities, Conditions>;
+
+@Injectable()
+export class CaslAbilityFactory {
+  createForUser(user: User) {
+    const { can, build } = new AbilityBuilder(
+      createMongoAbility<PossibleAbilities, Conditions>,
+    );
+
+    if (user.role?.id === RoleEnum.admin) {
+      can(Action.MANAGE, 'all');
+    } else {
+      console.log(user);
+      console.log(Channel);
+      can(Action.READ, Channel);
+      can(Action.CREATE, Channel);
+      can<FlatChannel>(Action.UPDATE, Channel, { 'owner.id': user.id });
+      can<FlatChannel>(Action.DELETE, Channel, { 'owner.id': user.id });
+    }
+
+    return build({
+      // Read https://casl.js.org/v5/en/guide/subject-type-detection#use-classes-as-subject-types for details
+      detectSubjectType: (item) =>
+        item.constructor as ExtractSubjectType<Subjects>,
+    });
+  }
+}

src/casl/casl-ability.factory/typs.ts

@@ -0,0 +1,5 @@
+import { Channel } from 'src/channels/domain/channel';
+
+export type FlatChannel = Channel & {
+  'owner.id': Channel['owner']['id'];
+};

src/casl/casl.module.ts

@@ -0,0 +1,8 @@
+import { Module } from '@nestjs/common';
+import { CaslAbilityFactory } from './casl-ability.factory/casl-ability.factory';
+
+@Module({
+  providers: [CaslAbilityFactory],
+  exports: [CaslAbilityFactory],
+})
+export class CaslModule {}

src/channels/channels.controller.ts

@@ -21,17 +21,22 @@ import { UpdateChannelDto } from './dto/update-channel.dto';
 import { QueryUserDto } from '../users/dto/query-user.dto';
 import { infinityPagination } from '../utils/infinity-pagination';
 import { QueryMessageDto } from 'src/messages/dto/query-message.dto';
+import { CheckPolicies } from 'src/authz/check-policies/check-policies.decorator';
+import { AppAbility } from 'src/casl/casl-ability.factory/casl-ability.factory';
+import { Action } from 'src/casl/action.enum';
+import { PoliciesGuard } from 'src/authz/policies.guard/policies.guard';
 
 @ApiTags('Channels')
 @Controller({
   path: 'channels',
   version: '1',
 })
+@UseGuards(AuthGuard('jwt'), PoliciesGuard)
 export class ChannelsController {
   constructor(private readonly channelsService: ChannelsService) {}
 
   @ApiBearerAuth()
-  @UseGuards(AuthGuard('jwt'))
+  @CheckPolicies((ability: AppAbility) => ability.can(Action.CREATE, Channel))
   @Post()
   @HttpCode(HttpStatus.CREATED)
   createChannel(
@@ -42,7 +47,6 @@ export class ChannelsController {
   }
 
   @ApiBearerAuth()
-  @UseGuards(AuthGuard('jwt'))
   @Get(':id')
   @ApiParam({
     name: 'id',
@@ -53,7 +57,7 @@ export class ChannelsController {
   }
 
   @ApiBearerAuth()
-  @UseGuards(AuthGuard('jwt'))
+  @CheckPolicies((ability: AppAbility) => ability.can(Action.UPDATE, Channel))
   @Patch(':id')
   @ApiParam({
     name: 'id',
@@ -68,7 +72,6 @@ export class ChannelsController {
   }
 
   @ApiBearerAuth()
-  @UseGuards(AuthGuard('jwt'))
   @Get(':id/messages')
   @ApiParam({
     name: 'id',
@@ -94,7 +97,6 @@ export class ChannelsController {
   }
 
   @ApiBearerAuth()
-  @UseGuards(AuthGuard('jwt'))
   @Get(':id/users')
   @ApiParam({
     name: 'id',
@@ -127,7 +129,7 @@ export class ChannelsController {
   }
 
   @ApiBearerAuth()
-  @UseGuards(AuthGuard('jwt'))
+  @CheckPolicies((ability: AppAbility) => ability.can(Action.DELETE, Channel))
   @Delete(':id')
   @ApiParam({
     name: 'id',

src/channels/channels.module.ts

@@ -4,11 +4,12 @@ import { ChannelsController } from './channels.controller';
 import { ChannelPersistenceModule } from './infrastructure/persistence/persistence.module';
 import { MessagesModule } from 'src/messages/messages.module';
 import { UsersModule } from '../users/users.module';
+import { CaslAbilityFactory } from 'src/casl/casl-ability.factory/casl-ability.factory';
 
 @Module({
   imports: [ChannelPersistenceModule, MessagesModule, UsersModule],
   controllers: [ChannelsController],
-  providers: [ChannelsService],
+  providers: [ChannelsService, CaslAbilityFactory],
   exports: [ChannelsService],
 })
 export class ChannelsModule {}

src/channels/channels.service.ts

@@ -140,10 +140,6 @@ export class ChannelsService {
       throw new NotFoundException();
     }
 
-    if (channel.owner.id !== user.id) {
-      throw new ForbiddenException();
-    }
-
     await this.channelRepostory.softDelete(id);
   }