admin管理员组

文章数量:1310868

Although I can handle authorization at the controller level using @UseGuards(), for this specific use case I prefer to implement authorization checks at the service level. However, since NestJS's built-in @UseGuards() only works at the controller level but not for service methods, I'm implementing a custom decorator for role-based authorization. Here's a minimal example:

// Proposed decorator approach since @UseGuards doesn't work for service methods
@Injectable()
export class ProjectService {
  constructor(private readonly authService: ProjectAuthService) {}

  @ProjectRoleGuard('admin', 'owner')
  async addProject(data: { projectId: string }) {
    // ... method implementation
  }
}

// Decorator implementation
export function ProjectRoleGuard(...roles: string[]) {
  return function (target: any, propertyKey: string, descriptor: PropertyDescriptor) {
    const originalMethod = descriptor.value;
    
    descriptor.value = async function (...args: any[]) {
      const authService = Object.values(this).find(
        (value) => value instanceof ProjectAuthService
      );
      
      const { projectId } = args[0];
      
      if (!await authService.isCurrentUserInProjectRole({
        projectId,
        roles
      })) {
        throw new UnauthorizedException();
      }
      
      return originalMethod.apply(this, args);
    };
    return descriptor;
  };
}

The decorator approach looks cleaner and more reusable than inline checks, but I want to ensure it's as secure as the inline approach since we're working around NestJS's guard limitations. Are there any security concerns or best practices I should consider when using this pattern?

Would love to hear thoughts on:

  • Security implications
  • Potential edge cases
  • Better ways to handle dependency injection
  • Performance considerations
  • Alternative approaches for service-level authorization in NestJS

本文标签：

版权声明：本文标题：typescript - Alternative to NestJS @UseGuards for service methods - Is this decorator-based authorization approach secure? - Sta 内容由网友自发贡献，该文观点仅代表作者本人， 转载请联系作者并注明出处：http://www.betaflare.com/web/1741864746a2401833.html， 本站仅提供信息存储空间服务，不拥有所有权，不承担相关法律责任。如发现本站有涉嫌抄袭侵权/违法违规的内容，一经查实，本站将立刻删除。