From 10825e598856d0daf7ef2d847a4b2b53e62505dd Mon Sep 17 00:00:00 2001 From: mahyargdz Date: Wed, 19 Feb 2025 15:09:04 +0330 Subject: [PATCH] fix: prevent admin from login to console of user --- src/common/enums/message.enum.ts | 3 ++- src/modules/auth/providers/auth.service.ts | 5 +++++ 2 files changed, 7 insertions(+), 1 deletion(-) diff --git a/src/common/enums/message.enum.ts b/src/common/enums/message.enum.ts index 0fa28dc..3f54f21 100644 --- a/src/common/enums/message.enum.ts +++ b/src/common/enums/message.enum.ts @@ -53,7 +53,8 @@ export const enum AuthMessage { TOO_MANY_REQUESTS = "تعداد درخواست های شما بیش از حد مجاز است", NOT_ADMIN = "شما دسترسی به بخش ادمین ندارید", PHONE_SHOULD_BE_11_DIGIT = "شماره تلفن باید ۱۱ رقم باشد", - TIMESTAMP_NOT_EMPTY = "TIMESTAMP_NOT_EMPTY", + TIMESTAMP_NOT_EMPTY = "زمان نمی‌تواند خالی باشد", + ADMIN_CAN_NOT_LOGIN = "ادمین نمی‌تواند وارد شود", } export const enum UserMessage { diff --git a/src/modules/auth/providers/auth.service.ts b/src/modules/auth/providers/auth.service.ts index 6b30236..b9e9149 100644 --- a/src/modules/auth/providers/auth.service.ts +++ b/src/modules/auth/providers/auth.service.ts @@ -91,6 +91,8 @@ export class AuthService { const user = await this.checkUserLoginCredentialWithEmail(email, password); + if (!user.roles.some((role) => !role.isAdmin)) throw new BadRequestException(AuthMessage.ADMIN_CAN_NOT_LOGIN); + const tokens = this.generateAccessAndRefreshToken(user); await this.notificationService.createLoginNotification(user.id); @@ -169,6 +171,9 @@ export class AuthService { const user = await this.checkUserLoginCredentialWithPhone(phone, code); + if (!user.roles.some((role) => !role.isAdmin)) throw new BadRequestException(AuthMessage.ADMIN_CAN_NOT_LOGIN); + // if (user.roles.some((role) => role.isAdmin)) throw new BadRequestException(AuthMessage.ADMIN_CAN_NOT_LOGIN); + const tokens = this.generateAccessAndRefreshToken(user); await this.notificationService.createLoginNotification(user.id);