Initial commit: Meshkee CMS API

NestJS backend with Prisma, Docker Compose for Postgres/Redis, and deploy docs for the production VM.

src/auth/guards/business-permission.guard.ts

@@ -0,0 +1,53 @@
+import {
+  CanActivate,
+  ExecutionContext,
+  ForbiddenException,
+  Injectable,
+} from '@nestjs/common';
+import { Reflector } from '@nestjs/core';
+import { AuthUser } from '../auth.types';
+import { BUSINESS_PERMISSION_KEY } from '../decorators/require-business-permission.decorator';
+import { PermissionsService } from '../permissions.service';
+
+@Injectable()
+export class BusinessPermissionGuard implements CanActivate {
+  constructor(
+    private readonly reflector: Reflector,
+    private readonly permissions: PermissionsService,
+  ) {}
+
+  async canActivate(context: ExecutionContext): Promise<boolean> {
+    const permission = this.reflector.get<string>(
+      BUSINESS_PERMISSION_KEY,
+      context.getHandler(),
+    );
+
+    if (!permission) {
+      return true;
+    }
+
+    const request = context.switchToHttp().getRequest<{
+      user: AuthUser;
+      params: { businessId?: string };
+    }>();
+
+    const businessIdRaw = request.params.businessId;
+    if (!businessIdRaw) {
+      throw new ForbiddenException('Business context is required');
+    }
+
+    const allowed = await this.permissions.hasBusinessPermission(
+      request.user.id,
+      BigInt(businessIdRaw),
+      permission,
+    );
+
+    if (!allowed) {
+      throw new ForbiddenException(
+        `Missing permission: ${permission} for this business`,
+      );
+    }
+
+    return true;
+  }
+}

src/auth/guards/jwt-auth.guard.ts

@@ -0,0 +1,5 @@
+import { Injectable } from '@nestjs/common';
+import { AuthGuard } from '@nestjs/passport';
+
+@Injectable()
+export class JwtAuthGuard extends AuthGuard('jwt') {}