NestJS：基于实例属性最佳实践的授权

Question

I need authorization in NestJS based on instances property. Ex. user can update only his own articles.

Is there another way despite defining the logic in each services? ( I know it is possible using CASL )

Not having a global guard will facility errors, and everything is authorized by default unless add logic on the service.

Answer 1

what about creating a function that takes the request, the model and the name of the proprety and use it wherever you want?

const verifAuthorization = (req: Request, propName: string, model:any): void=> {
const sender: User = req.user;
if (!sender) {
throw new BadRequestException('there is no user in the token');
}
if(!sender._id.equals(model[propName])) {
throw new UnauthorizedException();
}
}

yes, you will call it in every service you want to check the authorization in, but it will save you a lot of time and code