session-manager.guard.ts

import {
  Injectable,
  CanActivate,
  ExecutionContext,
  UnauthorizedException,
  ForbiddenException,
} from '@nestjs/common';
import { SessionManagerService } from './session-manager.service';

/**
 * SessionManagerGuard - Protects routes that require authentication
 *
 * This guard validates session tokens from the Authorization header.
 * It uses the same JWT secret configured in the ApiModule.
 *
 * Usage:
 * ```typescript
 * @UseGuards(SessionManagerGuard)
 * @Post('protected-route')
 * async myRoute(@AuthenticatedUser() user: AuthenticatedUserData) {
 *   // user.identifier is available
 * }
 * ```
 *
 * The guard also validates that if a request body contains an `identifier`,
 * it matches the authenticated user's identifier (prevents impersonation).
 */
@Injectable()
export class SessionManagerGuard implements CanActivate {
  constructor(private readonly sessionManagerService: SessionManagerService) {}

  async canActivate(context: ExecutionContext): Promise<boolean> {
    const request = context.switchToHttp().getRequest();

    const authHeader = request.headers?.authorization;
    if (!authHeader || !authHeader.startsWith('Bearer ')) {
      throw new UnauthorizedException(
        'Missing or invalid Authorization header',
      );
    }

    const token = authHeader.replace('Bearer ', '');

    const result = this.sessionManagerService.verifySessionToken(token);
    if (!result.valid || !result.payload) {
      throw new UnauthorizedException(result.error || 'Invalid session token');
    }

    request.authenticatedUser = {
      identifier: result.payload.identifier,
    };

    // If the request body contains an identifier, verify it matches the token
    const bodyIdentifier = request.body?.identifier;
    if (bodyIdentifier && bodyIdentifier !== result.payload.identifier) {
      throw new ForbiddenException(
        'Request identifier does not match authenticated user',
      );
    }

    return true;
  }
}