역할 기반 접근 제어 (RBAC) 구현

export enum Role {
  User = 'user',
  Editor = 'editor',
  Admin = 'admin',
}

import { Injectable, UnauthorizedException } from '@nestjs/common';
import { ConfigService } from '@nestjs/config';
import { PassportStrategy } from '@nestjs/passport';
import { ExtractJwt, Strategy } from 'passport-jwt';
import { Role } from '../role.enum';

type JwtPayload = {
  sub: number;
  username: string;
  roles: Role[];
};

const roleValues = new Set<string>(Object.values(Role));

function isJwtPayload(value: unknown): value is JwtPayload {
  if (typeof value !== 'object' || value === null) return false;

  const payload = value as Record<string, unknown>;
  return (
    typeof payload.sub === 'number' &&
    Number.isSafeInteger(payload.sub) &&
    typeof payload.username === 'string' &&
    Array.isArray(payload.roles) &&
    payload.roles.every(
      (role): role is Role =>
        typeof role === 'string' && roleValues.has(role),
    )
  );
}

@Injectable()
export class JwtStrategy extends PassportStrategy(Strategy) {
  constructor(configService: ConfigService) {
    super({
      jwtFromRequest: ExtractJwt.fromAuthHeaderAsBearerToken(),
      secretOrKey:
        configService.getOrThrow<string>('JWT_SECRET'),
      algorithms: ['HS256'],
      ignoreExpiration: false,
    });
  }

  validate(payload: unknown) {
    if (!isJwtPayload(payload)) {
      throw new UnauthorizedException('Invalid JWT claims');
    }

    return {
      userId: payload.sub,
      username: payload.username,
      roles: payload.roles,
    };
  }
}

import { SetMetadata } from '@nestjs/common';
import { Role } from '../../auth/role.enum';

export const ROLES_KEY = 'roles';
export const Roles = (...roles: Role[]) =>
  SetMetadata(ROLES_KEY, roles);

import { SetMetadata } from '@nestjs/common';

export const IS_PUBLIC_KEY = 'isPublic';
export const Public = () => SetMetadata(IS_PUBLIC_KEY, true);

import { ExecutionContext, Injectable } from '@nestjs/common';
import { Reflector } from '@nestjs/core';
import { AuthGuard } from '@nestjs/passport';
import {
  IS_PUBLIC_KEY,
} from '../../common/decorators/public.decorator';

@Injectable()
export class JwtAuthGuard extends AuthGuard('jwt') {
  constructor(private readonly reflector: Reflector) {
    super();
  }

  canActivate(context: ExecutionContext) {
    const isPublic = this.reflector.getAllAndOverride<boolean>(
      IS_PUBLIC_KEY,
      [context.getHandler(), context.getClass()],
    );

    if (isPublic) return true;
    return super.canActivate(context);
  }
}

import {
  CanActivate,
  ExecutionContext,
  Injectable,
} from '@nestjs/common';
import { Reflector } from '@nestjs/core';
import { Role } from '../role.enum';
import {
  IS_PUBLIC_KEY,
} from '../../common/decorators/public.decorator';
import {
  ROLES_KEY,
} from '../../common/decorators/roles.decorator';

type AuthenticatedRequest = {
  user?: {
    userId: number;
    username: string;
    roles: Role[];
  };
};

@Injectable()
export class RolesGuard implements CanActivate {
  constructor(private readonly reflector: Reflector) {}

  canActivate(context: ExecutionContext): boolean {
    const targets = [context.getHandler(), context.getClass()];
    const isPublic = this.reflector.getAllAndOverride<boolean>(
      IS_PUBLIC_KEY,
      targets,
    );

    if (isPublic) return true;

    const requiredRoles =
      this.reflector.getAllAndOverride<Role[]>(
        ROLES_KEY,
        targets,
      );

    if (requiredRoles === undefined) {
      return true;
    }

    const { user } =
      context.switchToHttp().getRequest<AuthenticatedRequest>();

    return (
      user !== undefined &&
      requiredRoles.some((role) => user.roles.includes(role))
    );
  }
}

import { Module } from '@nestjs/common';
import { APP_GUARD } from '@nestjs/core';
import { AuthService } from './auth.service';
import { JwtAuthGuard } from './guards/jwt-auth.guard';
import { RolesGuard } from './guards/roles.guard';
import { JwtStrategy } from './strategies/jwt.strategy';
import { LocalStrategy } from './strategies/local.strategy';

@Module({
  // imports, controllers 생략
  providers: [
    AuthService,
    LocalStrategy,
    JwtStrategy,
    {
      provide: APP_GUARD,
      useClass: JwtAuthGuard,
    },
    {
      provide: APP_GUARD,
      useClass: RolesGuard,
    },
  ],
})
export class AuthModule {}

import { Controller, Get, Request } from '@nestjs/common';
import { Role } from './auth/role.enum';
import { Public } from './common/decorators/public.decorator';
import { Roles } from './common/decorators/roles.decorator';

@Controller()
export class AppController {
  @Public()
  @Get()
  getHello() {
    return { message: 'public endpoint' };
  }

  @Get('profile')
  getProfile(@Request() req) {
    return req.user;
  }

  @Roles(Role.Admin)
  @Get('admin-dashboard')
  getAdminDashboard() {
    return { message: 'admin only' };
  }

  @Roles(Role.User, Role.Editor)
  @Get('user-content')
  getUserContent() {
    return { message: 'user or editor' };
  }
}