Initial commit of Balout Pastry NestJS API.

Co-authored-by: Cursor <cursoragent@cursor.com>

src/auth/strategies/jwt.strategy.ts

@@ -0,0 +1,45 @@
+import { Injectable, UnauthorizedException } from '@nestjs/common';
+import { ConfigService } from '@nestjs/config';
+import { PassportStrategy } from '@nestjs/passport';
+import { UserRole } from '@prisma/client';
+import { ExtractJwt, Strategy } from 'passport-jwt';
+import { PrismaService } from '../../prisma/prisma.service';
+import { AuthUser, isElevatedRole } from '../auth.types';
+
+type JwtPayload = {
+  sub: string;
+  role: UserRole;
+};
+
+@Injectable()
+export class JwtStrategy extends PassportStrategy(Strategy, 'jwt') {
+  constructor(
+    config: ConfigService,
+    private readonly prisma: PrismaService,
+  ) {
+    super({
+      jwtFromRequest: ExtractJwt.fromAuthHeaderAsBearerToken(),
+      ignoreExpiration: false,
+      secretOrKey: config.getOrThrow<string>('JWT_ACCESS_SECRET'),
+    });
+  }
+
+  async validate(payload: JwtPayload): Promise<AuthUser> {
+    const user = await this.prisma.user.findUnique({
+      where: { id: payload.sub },
+    });
+
+    if (!user || user.disabled || !isElevatedRole(user.role)) {
+      throw new UnauthorizedException('نشست نامعتبر است');
+    }
+
+    return {
+      id: user.id,
+      cellNumber: user.cellNumber,
+      role: user.role,
+      firstName: user.firstName,
+      lastName: user.lastName,
+      title: user.title,
+    };
+  }
+}