Improper Authorization

- import { Routes } from '@angular/router';
- import { AdminComponent } from './admin/admin.component';
- import { SettingsComponent } from './settings/settings.component';
- 
- const routes: Routes = [
-   { path: 'admin', component: AdminComponent },
-   { path: 'settings', component: SettingsComponent },
-   { path: 'profile/:id', component: ProfileComponent },
+ import { Injectable } from '@angular/core';
+ import { CanActivate, Router, Routes } from '@angular/router';
+ import { AuthService } from './auth.service';
+ 
+ @Injectable({ providedIn: 'root' })
+ export class AuthGuard implements CanActivate {
+   constructor(private auth: AuthService, private router: Router) {}
+   canActivate(): boolean {
+     if (this.auth.isAuthenticated()) return true;
+     this.router.navigate(['/login']);
+     return false;
+   }
+ }
+ 
+ const routes: Routes = [
+   { path: 'admin', component: AdminComponent, canActivate: [AuthGuard, AdminGuard] },
+   { path: 'settings', component: SettingsComponent, canActivate: [AuthGuard] },
+   { path: 'profile/:id', component: ProfileComponent, canActivate: [AuthGuard] },
  ];
  

- import { Controller, Delete, Post, Body, Param } from '@nestjs/common';
- 
- @Controller('admin')
+ import { Controller, Delete, Post, Body, Param, UseGuards } from '@nestjs/common';
+ import { AuthGuard } from '@nestjs/passport';
+ import { RolesGuard } from '../auth/roles.guard';
+ import { Roles } from '../auth/roles.decorator';
+ 
+ @Controller('admin')
+ @UseGuards(AuthGuard('jwt'), RolesGuard)
+ @Roles('admin')
  export class AdminController {
    @Delete('users/:id')
    deleteUser(@Param('id') id: string) {
      return this.adminService.deleteUser(id);
    }
  
    @Post('users')
    createUser(@Body() dto: CreateUserDto) {
      return this.adminService.createUser(dto);
    }
  }
  

- import { router, publicProcedure } from './trpc';
- import { z } from 'zod';
- 
- export const userRouter = router({
-   updateProfile: publicProcedure
-     .input(z.object({
-       userId: z.number(),
-       bio: z.string(),
-     }))
-     .mutation(async ({ input }) => {
-       return await db.user.update({
-         where: { id: input.userId },
-         data: { bio: input.bio },
-       });
-     }),
- 
-   deleteAccount: publicProcedure
-     .input(z.object({ userId: z.number() }))
-     .mutation(async ({ input }) => {
-       return await db.user.delete({ where: { id: input.userId } });
+ import { router, protectedProcedure } from './trpc';
+ import { z } from 'zod';
+ import { TRPCError } from '@trpc/server';
+ 
+ const isAuthed = t.middleware(async ({ ctx, next }) => {
+   if (!ctx.session?.user) {
+     throw new TRPCError({ code: 'UNAUTHORIZED' });
+   }
+   return next({ ctx: { user: ctx.session.user } });
+ });
+ 
+ const protectedProcedure = t.procedure.use(isAuthed);
+ 
+ export const userRouter = router({
+   updateProfile: protectedProcedure
+     .input(z.object({ bio: z.string() }))
+     .mutation(async ({ ctx, input }) => {
+       return await db.user.update({
+         where: { id: ctx.user.id },
+         data: { bio: input.bio },
+       });
+     }),
+ 
+   deleteAccount: protectedProcedure
+     .mutation(async ({ ctx }) => {
+       return await db.user.delete({ where: { id: ctx.user.id } });
      }),
  });