We have a nest application that should implement rbac. I added a basic guard and decorator for it based on the guard docs: https://docs.nestjs.com/guards. The problem: This only allows static roles.
Our goal: In our case, we have a Contract entity. This contract should be loaded solely if the contract's contractor (<User>) or the contractor's supervisor (<User>) try to access it.
I don't want to implement something like if (contract.contractor.id === user.id) and so on because we have lots of different cases which would make it a mess over time.
It looks like the following:
@Get()
@Roles(ROLES.ADMIN, ROLES.CONTRACTOR, ROLES.SUPERVISOR)
getContractById(...): Contract {
return this.contractService.findById(...);
}
Of course, ROLES.SUPERVISOR is only a string which then gets matched with the user's static roles. So here's the question: How can I implement something like this with dynamic roles, like the supervisor role which is dynamic in context only for certain items.