I am writing a REST API service where I need to add a layer of authorization for the endpoints I provide. I implemented authorization by using discrete permission on every controller using a guard/middleware.
@Get('/clients')
@hasPermissions('read', 'all')
@UseGuards(PermissionsGuard)
async getClient(@Query() query, @Res() res) {
...
}
My question is I need to add a layer of access depending on the owner of the resource. For example, if the user has an admin previllages he/she can see clients created by everyone, however, if the user has a privilege that is lower than the admin he/she can only see a client which created by himself/herself.