Claude Fable 5
1314096c94
Server halves of #17/#18/#19: PATCH /users/me and change-password (verifies the current password, logs out every other session), GET/DELETE /users/me/sessions with current-session flag and protection against revoking oneself; InstanceSettingsService as a typed, cached, Zod-validated registry over instance_settings (schema-default fallback for invalid stored values, audit-logged writes) consumed by the signup flow; /admin/settings behind the new SiteAdminGuard with strict unknown-key rejection. SessionsService moves to its own module to keep Auth/Users acyclic. Three new e2e suites bring the api to 42 tests. Part of #17, #18, #19 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
17 lines
586 B
TypeScript
17 lines
586 B
TypeScript
import { CanActivate, ExecutionContext, ForbiddenException, Injectable } from '@nestjs/common';
|
|
|
|
import type { AuthedRequest } from '../auth/auth.guard';
|
|
|
|
/**
|
|
* Second-stage guard for /admin routes: AuthGuard has already attached
|
|
* the user; this one requires the Site Admin flag (permissions.md).
|
|
*/
|
|
@Injectable()
|
|
export class SiteAdminGuard implements CanActivate {
|
|
canActivate(context: ExecutionContext): boolean {
|
|
const request = context.switchToHttp().getRequest<AuthedRequest>();
|
|
if (!request.user?.isSiteAdmin) throw new ForbiddenException();
|
|
return true;
|
|
}
|
|
}
|