xmuhameed Backend Auth & Authorization
Roles
CUSTOMER, ADMIN, EDITOR, ORDER_HANDLER, ORDER_DRIVER, ACCOUNTANT, MARKETER
Guards
| Guard | Use |
|---|---|
JwtGuard |
Required auth — 401 if missing |
OptionalJwtGuard |
Public endpoint, @GetUser() may be null |
AuthorizeCoreUsersGuard |
Role check — always after JwtGuard |
Protect Endpoint
@UseGuards(JwtGuard, AuthorizeCoreUsersGuard)
@ApiBearerAuth()
@CoreUserType([CoreUserEnum.ADMIN, CoreUserEnum.EDITOR])
@Post('create-category')
async create(@Body() dto: CreateDto, @GetUser() user: user) { ... }
Access Matrix (typical module)
| Endpoint | Guards |
|---|---|
get-all-* |
None (public) |
get-* |
OptionalJwtGuard (view tracking) |
create/update/delete-* |
Jwt + Authorize + @CoreUserType([ADMIN, EDITOR]) |
| Admin-only | @CoreUserType([ADMIN]) |
| Customer | @CoreUserType([CUSTOMER]) |
JWT Flow
- Login →
signJwtToken(userId, email, role)— 90-day HS256 - Request → Bearer header →
JwtStrategy.validate()→ DB user lookup by role @GetUser()→request.user
Auth Endpoints
| Route | Access |
|---|---|
POST /auth/login |
Public |
POST /auth/register |
Public |
POST /auth/oauth/google |
Public |
POST /auth/oauth/apple |
Public |
GET /auth/get-profile |
JwtGuard |
PATCH /auth/update-profile |
JwtGuard |
POST /auth/logout |
JwtGuard + token blacklist |
POST /auth/register-admin |
Admin only |
OptionalJwtGuard
@UseGuards(OptionalJwtGuard)
@Get('get-category')
async getOne(@GetUser() user: user) { ... } // user may be null
Token Invalidation
expired_tokens table — logout inserts token; optional guard rejects blacklisted tokens.
Imports
import { JwtGuard, AuthorizeCoreUsersGuard, OptionalJwtGuard } from '../auth/guard';
import { CoreUserEnum, CoreUserType, GetUser } from '../auth/decorator';
Password
bcrypt hash on register; comparePassword on login. Never return password in responses.
Common Mistakes
AuthorizeCoreUsersGuardwithoutJwtGuard— always stack Jwt first@CoreUserTypewithout guard — guard reads metadata, both required- Trusting JWT role without DB lookup — strategy must re-fetch user
More: reference.md