Files
What you'll learn
- Store users with bcrypt hashes, at a cost read from configuration, and seed a staff account on the first start
- Sign users in with a JWT whose secret comes from configuration, and protect every route with a global guard that a @Public() decorator opens
- Restrict routes by role with a second global guard reading @Roles() metadata
- Take the acting user from the token rather than the request body, and map a database's unique-constraint error to a 409 with an exception filter
Press Run tests to start the app. Its log appears here.Graded endpoints
Public: the global guard lets it through
Reading is public
A new account is an adopter; the answer never carries the password or its hash
The unique column refuses it; the filter turns the database's error into a 409
Credentials are validated like any body
Created on the first start with the password from .env
200 with a token
401, without saying which half was wrong
The token's payload, read by the guard
Every route not marked public needs one
401 before any role is checked
Signed in, but not staff
Staff may
Updates are staff-only too
And removals
An adoption needs someone to adopt
The adopter is the token's user
The transaction's 409 is unchanged
Her second
The limit, and its rollback
Rolled back
Only hers
Sam has adopted nothing
The full list is for staff
Staff see them all
Staff may change a cat: the one in the path, with the fields in the body
The public list still filters by breed
A staff removal
From the public list too