feat: added role decorator and guard

src/common/decorators/role-decorator.ts

@@ -0,0 +1,5 @@
+import { SetMetadata } from "@nestjs/common";
+import { RoleType } from "src/modules/users/enums/user-role.enum";
+
+export const ROLE_KEY = 'roles';
+export const RoleDec = (...roles: RoleType[]) => SetMetadata(ROLE_KEY, roles);

src/common/enums/messages.enum.ts

@@ -18,6 +18,7 @@ export enum UserRoleMessages {
 
 export enum AuthMessages {
   TOKEN_EXPIRED_OR_INVALID = 'توکن منسوخ شده یا نامعتبر است!',
+  UNAUTHORIZED_ACCESS = 'شما مجاز به دسترسی به این بخش نیستید!'
 }
 
 export enum OrganMessages {

src/modules/auth/guards/role-guard.ts

@@ -0,0 +1,40 @@
+import {
+  CanActivate,
+  ExecutionContext,
+  ForbiddenException,
+  Injectable,
+} from '@nestjs/common';
+import { Reflector } from '@nestjs/core';
+import { Observable } from 'rxjs';
+import { ROLE_KEY } from 'src/common/decorators/role-decorator';
+import { RoleType } from 'src/modules/users/enums/user-role.enum';
+import { IRequest } from '../interfaces/IRequest';
+import { AuthMessages } from 'src/common/enums/messages.enum';
+
+@Injectable()
+export class RoleGuard implements CanActivate {
+  constructor(private reflector: Reflector) {}
+
+  canActivate(
+    context: ExecutionContext,
+  ): boolean | Promise<boolean> | Observable<boolean> {
+    const requiredRoles = this.reflector.getAllAndOverride<RoleType[]>(
+      ROLE_KEY,
+      [context.getHandler(), context.getClass()],
+    );
+
+    if (!requiredRoles) return true;
+
+    const req = context.switchToHttp().getRequest<IRequest>();
+    const user = req.user;
+
+    if (!user) throw new ForbiddenException(AuthMessages.UNAUTHORIZED_ACCESS);
+
+    const hasRole = requiredRoles.every((role) => user.roles.includes(role));
+
+    if (!hasRole)
+      throw new ForbiddenException(AuthMessages.UNAUTHORIZED_ACCESS);
+
+    return true;
+  }
+}