Initial commit: digital reception monorepo (M1-M11 + demo extensions)

apps/api/src/auth/guards/roles.guard.ts

@@ -0,0 +1,26 @@
+import { CanActivate, ExecutionContext, ForbiddenException, Injectable } from '@nestjs/common';
+import { Reflector } from '@nestjs/core';
+import { Role } from '@reception/db';
+import { ROLES_KEY } from '../decorators/roles.decorator';
+import type { AuthUser } from '../decorators/current-user.decorator';
+
+@Injectable()
+export class RolesGuard implements CanActivate {
+  constructor(private readonly reflector: Reflector) {}
+
+  canActivate(context: ExecutionContext): boolean {
+    const required = this.reflector.getAllAndOverride<Role[] | undefined>(ROLES_KEY, [
+      context.getHandler(),
+      context.getClass(),
+    ]);
+    if (!required || required.length === 0) return true;
+
+    const req = context.switchToHttp().getRequest();
+    const user: AuthUser | undefined = req.user;
+    if (!user) throw new ForbiddenException('No user context');
+    if (!required.includes(user.role)) {
+      throw new ForbiddenException(`Required role: ${required.join(' or ')}`);
+    }
+    return true;
+  }
+}