RBAC (Role Based Access Control)

- 예시

export enum Role {
  Admin = 'admin',
  User = 'user',
  Guest = 'guest',
}

@Injectable()
export class RolesGuard implements CanActivate {
  constructor(private reflector: Reflector) {}
  canActivate(context: ExecutionContext): boolean {
    const roles = this.reflector.get<Role[]>(Role, context.getHandler());
    if (!roles) return true;
    const request = context.switchToHttp().getRequest();
    const user = request.user;
    return roles.some((role) => user.roles?.include(role));
  }
}

---

- 강의 예시

// user.entity.ts

export enum Role {
  admin,
  paidUser,
  user,
}

// rbac.decorator.ts

export const RBAC = Reflector.createDecorator<Role>();

// rbac.guard.ts

@Injectable()
export class RBACGuard implements CanActivate {
  constructor(private readonly reflector: Reflector) {}
  canActivate(context: ExecutionContext): boolean {
    const role = this.reflector.get<Role>(RBAC, context.getHandler());

    if (!Object.values(Role).includes(role)) return true; // 이거 수정 필요

    const request = context.switchToHttp().getRequest();
    const user = request.user;

    if (!user) return false;

    return user.role <= role; // 권한 레벨 true/false. role index 순서대로 높은 권한 설정해놓았음
  }
}

// app.module.ts

providers: [
    {
      provide: APP_GUARD,
      useClass: AuthGuard,
    },
    {
      provide: APP_GUARD,
      useClass: RBACGuard,
    },
  ],

// movie.controller.ts

@Delete(':id')
@RBAC(Role.admin)
deleteMovie(
    @Param('id', ParseIntPipe) id: number, //
  ) {
    return this.movieService.remove(id);
  }

---

https://fastcampus.co.kr/classroom/239666

커리어 성장을 위한 최고의 실무교육 아카데미 | 패스트캠퍼스