[WIP] login したユーザーは自分の情報にのみアクセスできる (#32)

* yarn nest generate guard (user)

* [backend] Implement UserGuard and add it to UserController

* user guard don't user UserService class

backend/src/user/user.controller.ts

@@ -23,6 +23,7 @@ import {
 } from '@nestjs/swagger';
 import { UserEntity } from './entities/user.entity';
 import { JwtAuthGuard } from 'src/auth/jwt-auth.guard';
+import { UserGuard } from './user.guard';
 
 @Controller('user')
 @ApiTags('user')
@@ -44,6 +45,7 @@ export class UserController {
   }
 
   @Get(':id')
+  @UseGuards(UserGuard)
   @UseGuards(JwtAuthGuard)
   @ApiBearerAuth()
   @ApiOkResponse({ type: UserEntity })
@@ -52,6 +54,7 @@ export class UserController {
   }
 
   @Patch(':id')
+  @UseGuards(UserGuard)
   @UseGuards(JwtAuthGuard)
   @ApiBearerAuth()
   @ApiOkResponse({ type: UserEntity })
@@ -64,6 +67,7 @@ export class UserController {
 
   @Delete(':id')
   @HttpCode(204)
+  @UseGuards(UserGuard)
   @UseGuards(JwtAuthGuard)
   @ApiBearerAuth()
   @ApiNoContentResponse()

backend/src/user/user.guard.spec.ts

@@ -0,0 +1,7 @@
+import { UserGuard } from './user.guard';
+
+describe('UserGuard', () => {
+  it('should be defined', () => {
+    expect(new UserGuard()).toBeDefined();
+  });
+});

backend/src/user/user.guard.ts

@@ -0,0 +1,16 @@
+import { CanActivate, ExecutionContext } from '@nestjs/common';
+import { Observable } from 'rxjs';
+
+export class UserGuard implements CanActivate {
+
+  canActivate(
+    context: ExecutionContext,
+  ): boolean | Promise<boolean> | Observable<boolean> {
+	const req = context.switchToHttp().getRequest();
+	const { params, user } = req;
+	if (params?.id == null) {
+		return true;
+	}
+	return user.id === Number(params.id);
+  }
+}