Refactor token group verification into separate method

Author: kiuma

.zed/debug.json

@@ -0,0 +1,5 @@
+// Project-local debug tasks
+//
+// For more documentation on how to configure debug tasks,
+// see: https://zed.dev/docs/debugger
+[]

src/auth.guard.ts

@@ -4,7 +4,6 @@ import {
   ExecutionContext,
   Injectable,
   Logger,
-  UnauthorizedException,
 } from '@nestjs/common';
 import { Reflector } from '@nestjs/core';
 import { Roles } from './auth.decorators';
@@ -27,16 +26,9 @@ export class AuthGuard implements CanActivate {
   canActivate(
     context: ExecutionContext,
   ): boolean | Promise<boolean> | Observable<boolean> {
-    const { pemCert, alg, rolesMapping } = this.options;
+    // const { pemCert, alg, rolesMapping } = this.options;
     const ctx = context.switchToHttp();
     const request = ctx.getRequest<Request>();
-    const accessToken = request
-      .header('authorization')
-      ?.replace(/^Bearer\s+/i, '');
-
-    if (!accessToken) {
-      throw new UnauthorizedException('Authorization header is missing');
-    }
 
     const roles: string[] | undefined = this.reflector.get(
       Roles,
@@ -48,12 +40,7 @@ export class AuthGuard implements CanActivate {
     }
 
     try {
-      const token = verify(accessToken, pemCert, {
-        algorithms: [alg],
-      });
-      const grp: string[] =
-        ((token as JwtPayload)?.[rolesMapping] as unknown as string[]) || [];
-
+      const grp = this.getUserGroups(request);
       const anyRoleMatch = grp.find((tokenRole) =>
         roles.find((allowedRole) => allowedRole === tokenRole),
       );
@@ -63,4 +50,21 @@ export class AuthGuard implements CanActivate {
       return false;
     }
   }
+  public getUserGroups(request: Request): string[] {
+    const { pemCert, alg, rolesMapping } = this.options;
+    const accessToken = request
+      .header('authorization')
+      ?.replace(/^Bearer\s+/i, '');
+
+    if (!accessToken) {
+      return [];
+    }
+
+    const token = verify(accessToken, pemCert, {
+      algorithms: [alg],
+    });
+    const grp: string[] =
+      ((token as JwtPayload)?.[rolesMapping] as unknown as string[]) || [];
+    return grp;
+  }
 }