Merge pull request iKa-h#54 from No-bodyq/feat/resource-owner-guard

Implement resource ownership checks for chat messages, escrows, orders, and payment methods; add app_role enum and role column to AppUser model

Author: Dario0731

prisma/migrations/20260719120000_add_app_role/migration.sql

@@ -0,0 +1,5 @@
+-- CreateEnum
+CREATE TYPE "app_role" AS ENUM ('user', 'admin', 'support');
+
+-- AlterTable
+ALTER TABLE "app_user" ADD COLUMN "role" "app_role" NOT NULL DEFAULT 'user';

prisma/migrations/20260719194500_add_escrow_evidence_url/migration.sql

@@ -0,0 +1,2 @@
+-- AlterTable
+ALTER TABLE "escrowonchain" ADD COLUMN "evidence_url" TEXT;

prisma/schema.prisma

@@ -13,6 +13,7 @@ model AppUser {
   publicKey            String           @unique @map("public_key")
   alias                String?          @unique @map("alias")
   username             String?          @map("username")
+  role                 app_role         @default(user) @map("role")
   kycStatus            kyc_status       @default(pending) @map("kyc_status")
   kycUpdatedAt         DateTime?        @map("kyc_updated_at") @db.Timestamptz(6)
   totalVolume          Decimal          @default(0) @map("total_volume") @db.Decimal(20, 7)
@@ -141,6 +142,12 @@ model payment_provider {
   @@index([type], map: "idx_payment_provider_type")
 }
 
+enum app_role {
+  user
+  admin
+  support
+}
+
 enum kyc_status {
   pending
   approved

src/common/decorators/resource-owner.decorator.spec.ts

@@ -0,0 +1,71 @@
+import { Reflector } from '@nestjs/core';
+import { ResourceOwner, RESOURCE_OWNER_KEY } from './resource-owner.decorator';
+import {
+  ResourceOwnerMetadata,
+  ResourceType,
+} from '../interfaces/resource-owner.interface';
+
+function getHandlerMetadata(target: object): ResourceOwnerMetadata | undefined {
+  return Reflect.getMetadata(RESOURCE_OWNER_KEY, target) as
+    | ResourceOwnerMetadata
+    | undefined;
+}
+
+describe('ResourceOwner decorator', () => {
+  it('sets RESOURCE_OWNER_KEY metadata with the given type and default paramKey', () => {
+    class TestController {
+      @ResourceOwner(ResourceType.ORDER)
+      handler() {}
+    }
+
+    // eslint-disable-next-line @typescript-eslint/unbound-method
+    const metadata = getHandlerMetadata(TestController.prototype.handler);
+
+    expect(metadata).toEqual({ type: ResourceType.ORDER, paramKey: 'id' });
+  });
+
+  it('sets a custom paramKey when provided', () => {
+    class TestController {
+      @ResourceOwner(ResourceType.PAYMENT_METHOD, 'paymentId')
+      handler() {}
+    }
+
+    // eslint-disable-next-line @typescript-eslint/unbound-method
+    const metadata = getHandlerMetadata(TestController.prototype.handler);
+
+    expect(metadata).toEqual({
+      type: ResourceType.PAYMENT_METHOD,
+      paramKey: 'paymentId',
+    });
+  });
+
+  it('is readable through Reflector.get, exactly as the guard reads it', () => {
+    class TestController {
+      @ResourceOwner(ResourceType.ESCROW, 'escrowId')
+      handler() {}
+    }
+
+    const reflector = new Reflector();
+    const metadata = reflector.get<ResourceOwnerMetadata | undefined>(
+      RESOURCE_OWNER_KEY,
+      // eslint-disable-next-line @typescript-eslint/unbound-method
+      TestController.prototype.handler,
+    );
+
+    expect(metadata).toEqual({
+      type: ResourceType.ESCROW,
+      paramKey: 'escrowId',
+    });
+  });
+
+  it('leaves undecorated handlers without metadata', () => {
+    class TestController {
+      handler() {}
+    }
+
+    // eslint-disable-next-line @typescript-eslint/unbound-method
+    const metadata = getHandlerMetadata(TestController.prototype.handler);
+
+    expect(metadata).toBeUndefined();
+  });
+});

src/common/decorators/resource-owner.decorator.ts

@@ -0,0 +1,13 @@
+import { SetMetadata } from '@nestjs/common';
+import {
+  ResourceOwnerMetadata,
+  ResourceType,
+} from '../interfaces/resource-owner.interface';
+
+export const RESOURCE_OWNER_KEY = 'resource_owner';
+
+export const ResourceOwner = (type: ResourceType, paramKey = 'id') =>
+  SetMetadata<string, ResourceOwnerMetadata>(RESOURCE_OWNER_KEY, {
+    type,
+    paramKey,
+  });