From ef87a1ae6d8a0e614e907cce638be1525e86b100 Mon Sep 17 00:00:00 2001
From: morteza-mortezai <mrtz.mrtzi.1989@gmail.com>
Date: Wed, 19 Nov 2025 00:27:20 +0330
Subject: [PATCH] up

---
 src/modules/auth/guards/adminAuth.guard.ts | 49 +++++++++++++++-------
 1 file changed, 33 insertions(+), 16 deletions(-)

diff --git a/src/modules/auth/guards/adminAuth.guard.ts b/src/modules/auth/guards/adminAuth.guard.ts
index 63046b3..c767aba 100644
--- a/src/modules/auth/guards/adminAuth.guard.ts
+++ b/src/modules/auth/guards/adminAuth.guard.ts
@@ -36,21 +36,21 @@ export class AdminAuthGuard implements CanActivate {
   async canActivate(context: ExecutionContext) {
     const request = context.switchToHttp().getRequest<AdminAuthRequest>();
 
+    const token = this.extractTokenFromHeader(request);
+    if (!token) {
+      this.logger.warn('No token provided');
+      throw new UnauthorizedException('No token provided');
+    }
+
     try {
-      const secret = this.configService.get<string>('JWT_SECRET');
-      const token = this.extractTokenFromHeader(request);
-      if (!token) {
-        throw new UnauthorizedException();
+      // Verify token - JWT module is global, so it uses the configured secret automatically
+      const payload = await this.jwtService.verifyAsync<IAdminTokenPayload>(token);
+
+      if (!payload.adminId || !payload.restId) {
+        this.logger.error('Invalid token payload structure', payload);
+        throw new UnauthorizedException('Invalid token payload');
       }
 
-      const payload = await this.jwtService
-        .verifyAsync<IAdminTokenPayload>(token, {
-          secret,
-        })
-        .catch(err => {
-          this.logger.error('error in AdminAuthGuard', err);
-          throw new UnauthorizedException('Invalid or expired token');
-        });
       request['adminId'] = payload.adminId;
       request['restId'] = payload.restId;
 
@@ -58,20 +58,37 @@ export class AdminAuthGuard implements CanActivate {
       const requiredPermissions =
         this.reflector.getAllAndOverride<string[]>(PERMISSIONS_KEY, [context.getHandler(), context.getClass()]) ?? [];
 
-      if (!requiredPermissions || requiredPermissions.length === 0) return true;
+      if (!requiredPermissions || requiredPermissions.length === 0) {
+        return true;
+      }
 
       const adminPermission = await this.permissionsService.getAdminPermissions(payload.adminId, payload.restId);
       if (!adminPermission || !Array.isArray(adminPermission)) {
-        this.logger.error('No permissions found');
+        this.logger.error('No permissions found', { adminId: payload.adminId, restId: payload.restId });
         throw new ForbiddenException('No permissions found');
       }
 
       const hasPermission = requiredPermissions.every(p => adminPermission.includes(p));
 
-      if (!hasPermission) throw new ForbiddenException('You are not authorized to access this resource');
+      if (!hasPermission) {
+        this.logger.warn('Insufficient permissions', {
+          adminId: payload.adminId,
+          restId: payload.restId,
+          required: requiredPermissions,
+          has: adminPermission,
+        });
+        throw new ForbiddenException('You are not authorized to access this resource');
+      }
+
       return true;
     } catch (err) {
-      this.logger.error('error in AdminAuthGuard', err);
+      if (err instanceof ForbiddenException || err instanceof UnauthorizedException) {
+        throw err;
+      }
+      this.logger.error('Token verification error in AdminAuthGuard', {
+        error: err.message,
+        stack: err.stack,
+      });
       throw new UnauthorizedException('Invalid or expired token');
     }
   }