bug

src/modules/auth/guards/adminAuth.guard.ts

@@ -38,13 +38,22 @@ export class AdminAuthGuard implements CanActivate {
 
     const token = this.extractTokenFromHeader(request);
     if (!token) {
-      this.logger.warn('No token provided');
+      this.logger.warn('No token provided', {
+        hasAuthHeader: !!request.headers.authorization,
+        authHeader: request.headers.authorization ? 'present' : 'missing',
+        headers: Object.keys(request.headers),
+      });
       throw new UnauthorizedException('No token provided');
     }
 
     try {
-      // Verify token - JWT module is global, so it uses the configured secret automatically
-      const payload = await this.jwtService.verifyAsync<IAdminTokenPayload>(token);
+      // Get the JWT secret from config
+      const secret = this.configService.getOrThrow<string>('JWT_SECRET');
+
+      // Verify token with the secret
+      const payload = await this.jwtService.verifyAsync<IAdminTokenPayload>(token, {
+        secret,
+      });
 
       if (!payload.adminId || !payload.restId) {
         this.logger.error('Invalid token payload structure', payload);
@@ -85,16 +94,27 @@ export class AdminAuthGuard implements CanActivate {
       if (err instanceof ForbiddenException || err instanceof UnauthorizedException) {
         throw err;
       }
+      const errorMessage = err instanceof Error ? err.message : 'Unknown error';
+      const errorStack = err instanceof Error ? err.stack : undefined;
       this.logger.error('Token verification error in AdminAuthGuard', {
-        error: err.message,
-        stack: err.stack,
+        error: errorMessage,
+        stack: errorStack,
       });
       throw new UnauthorizedException('Invalid or expired token');
     }
   }
 
   private extractTokenFromHeader(request: Request): string | undefined {
-    const [type, token] = request.headers.authorization?.split(' ') ?? [];
-    return type === 'Bearer' ? token : undefined;
+    const authHeader = request.headers.authorization || request.headers['authorization'];
+    if (!authHeader) {
+      return undefined;
+    }
+
+    const [type, token] = authHeader.split(' ');
+    if (type?.toLowerCase() !== 'bearer' || !token) {
+      return undefined;
+    }
+
+    return token;
   }
 }

src/modules/foods/controllers/category.controller.ts

@@ -19,35 +19,30 @@ import { RestId } from 'src/common/decorators';
 
 @UseGuards(AdminAuthGuard)
 @ApiBearerAuth()
-@ApiTags('categories')
-@Controller()
+@ApiTags('admin/categories')
+@Controller('admin/categories')
 export class CategoryController {
   constructor(private readonly categoryService: CategoryService) {}
 
-  @ApiBearerAuth('/admin/categories')
-  @Post()
   @ApiOperation({ summary: 'Create category' })
   @ApiCreatedResponse({ description: 'Category created', type: CreateCategoryDto })
   @ApiBody({ type: CreateCategoryDto })
+  @Post()
   create(@Body() dto: CreateCategoryDto) {
     return this.categoryService.create(dto);
   }
 
-  @UseGuards(AdminAuthGuard)
-  @ApiBearerAuth('/admin/categories')
-  @Get()
   @ApiOperation({ summary: 'my restaurant categories' })
   @ApiOkResponse({ description: 'List of categories' })
   @ApiQuery({ name: 'restId', required: false, type: String })
   @ApiQuery({ name: 'isActive', required: false, type: Boolean })
+  @Get()
   findAll(@RestId() restId: string, @Query('isActive') isActive?: string) {
     // convert isActive from query string to boolean when provided
     const isActiveBool: boolean | undefined = typeof isActive !== 'undefined' ? isActive === 'true' : undefined;
     return this.categoryService.findAll({ restId, isActive: isActiveBool });
   }
 
-  @UseGuards(AdminAuthGuard)
-  @ApiBearerAuth('/admin/categories')
   @Get(':id')
   @ApiOperation({ summary: 'Get category' })
   @ApiOkResponse({ description: 'Category detail', type: CreateCategoryDto })
@@ -56,8 +51,6 @@ export class CategoryController {
     return this.categoryService.findOne(restId, id);
   }
 
-  @UseGuards(AdminAuthGuard)
-  @ApiBearerAuth('/admin/categories')
   @Patch(':id')
   @ApiOperation({ summary: 'Update category' })
   @ApiParam({ name: 'id' })
@@ -67,8 +60,6 @@ export class CategoryController {
     return this.categoryService.update(restId, id, dto);
   }
 
-  @UseGuards(AdminAuthGuard)
-  @ApiBearerAuth('/admin/categories')
   @Delete(':id')
   @ApiOperation({ summary: 'Delete category' })
   @ApiParam({ name: 'id' })
@@ -77,11 +68,11 @@ export class CategoryController {
     return this.categoryService.remove(restId, id);
   }
 
-  @Get('restaurant/:restId')
-  @ApiOperation({ summary: 'Restaurant categories for user' })
-  @ApiOkResponse({ description: 'List of categories' })
-  @ApiParam({ name: 'restId', required: true, type: String })
-  findAllForRestaurant(@Param('restId') restId: string) {
-    return this.categoryService.findRestaurantCategories(restId);
-  }
+  // @Get('restaurant/:restId')
+  // @ApiOperation({ summary: 'Restaurant categories for user' })
+  // @ApiOkResponse({ description: 'List of categories' })
+  // @ApiParam({ name: 'restId', required: true, type: String })
+  // findAllForRestaurant(@Param('restId') restId: string) {
+  //   return this.categoryService.findRestaurantCategories(restId);
+  // }
 }