將服務注入Guard-Nestjs

我有以下全球守衛：

授權.guard.ts

import { ExecutionContext, Injectable } from "@nestjs/common"
import { Reflector } from "@nestjs/core"
import { AuthGuard } from "@nestjs/passport"

@Injectable()
export class AuthorizationGuard extends AuthGuard(["azure-ad"]) {
  public constructor(private readonly reflector: Reflector) {
    super()
  }

  async canActivate(context: ExecutionContext) {
    const isPublic = this.reflector.get<boolean>(
      "isPublic",
      context.getHandler(),
    )

    if (isPublic) {
      return true
    }

    const req = context.switchToHttp().getRequest()
    if(req.headers.isbypass){
      //help needed
    }


    const result = (await super.canActivate(context)) as boolean
    await super.logIn(req)
    return result
  }
}

以及以下身份驗證模塊和策略：

import { Module } from "@nestjs/common";
import { PassportModule } from "@nestjs/passport";
import { UsersModule } from "modules/users/users.module";
import { AzureADStrategy } from "./azureAD.strategy";
import { SessionSerializer } from "./session.serializer";

@Module({
    imports: [PassportModule, UsersModule],
    providers: [AzureADStrategy, SessionSerializer],
})
export class AuthModule {}

import {
    BearerStrategy,
    IBearerStrategyOption,
    ITokenPayload,
    VerifyCallback,
} from "passport-azure-ad";
import {
    Inject,
    Injectable,
    OnModuleInit,
    UnauthorizedException,
} from "@nestjs/common";
import passport = require("passport");
import { UsersService } from "modules/users/users.service";
import env from "../../config";

const tenantId = env.TENANT_ID;
const clientID = env.CLIENT_ID || "";

const azureCredentials: IBearerStrategyOption = {
//
};

@Injectable()
export class AzureADStrategy extends BearerStrategy implements OnModuleInit {
    onModuleInit() {
        passport.use("azure-ad", this);
    }

    constructor(
        @Inject(UsersService) private usersService: UsersService
    ) {
        super(
            azureCredentials,
            async (token: ITokenPayload, done: VerifyCallback) => {
                if (Date.now() / 1000 > token.exp) {
                    return done(new UnauthorizedException("access token is expired"));
                }

                const tokenUsername = token?.preferred_username?.slice(0, 9);
                const tokenAppId = !tokenUsername && token?.azp;

                if (!tokenUsername && !tokenAppId) {
                    return done(new UnauthorizedException("Missing User"));
                }

                let user;

                if (tokenUsername) {
                        try {
                            user = await this.usersService.getUser(
                                tokenUsername
                            );

                            if (!user) {
                                return done(
                                    new UnauthorizedException("User is not a test user")
                                );
                            }
                        } catch (err) {
                            return done(err);
                        }

                    user.tz = tokenUsername;
                } else {
                    user.appId = tokenAppId;
                }

                return done(null, user, token);
            }
        );
    }
}

守衛是全域定義的，使用：

  const reflector = app.get(Reflector);
  app.useGlobalGuards(
        new AuthorizationGuard(reflector),
    );

并且在 app.module.ts 中匯入了 auth 模塊：

@Module({
  imports: [
    AuthModule,
    ...
]

現在，對于這個問題。

我想通過檢查請求標頭中是否存在 req.headers.isbypass 以及是否在 authorizationGuard 中使用 userService 來“后門”全域授權，這樣我就可以將用戶從資料庫注入到 req.user我自己并繼續請求。我該如何實作？

uj5u.com熱心網友回復：

我會將其更改app.useGlobalGuards()為全球警衛提供者，并添加

{
  provider: APP_GUARD,
  useClass: AuthorizationGuard,
}

進入providers你的AppModule，以便 Nest 為你處理所有的 DI。從那里開始，它只是UsersService將constructorReflector

@Injectable()
export class AuthorizationGuard extends AuthGuard(["azure-ad"]) {
  public constructor(
    private readonly reflector: Reflector,
    private readonly usersService: UsersServce
  ) {
    super()
  }

  async canActivate(context: ExecutionContext) {
    const isPublic = this.reflector.get<boolean>(
      "isPublic",
      context.getHandler(),
    )

    if (isPublic) {
      return true
    }

    const req = context.switchToHttp().getRequest()
    if(req.headers.isbypass){
      //help needed
    }


    const result = (await super.canActivate(context)) as boolean
    await super.logIn(req)
    return result
  }
}

標籤：节点.js验证嵌套护照.js

上一篇：從SSO遠程主機驗證本地客戶端

下一篇：就安全性而言，使用PEM檔案的ssh與公鑰身份驗證有什么不同嗎？