Replace JwtAuthGuard with PermissionsGuard and add specific permissions

2025-07-16 18:56:22 +00:00 · 2024-12-16 00:19:34 -06:00
parent 64027d3a16
commit d169999675
13 changed files with 158 additions and 80 deletions
--- a/src/automation/controllers/automation.controller.ts
+++ b/src/automation/controllers/automation.controller.ts
@ -16,10 +16,11 @@ import {
  UpdateAutomationDto,
  UpdateAutomationStatusDto,
 } from '../dtos/automation.dto';
-import { JwtAuthGuard } from '@app/common/guards/jwt.auth.guard';
 import { EnableDisableStatusEnum } from '@app/common/constants/days.enum';
 import { AutomationParamDto, SpaceParamDto } from '../dtos';
 import { ControllerRoute } from '@app/common/constants/controller-route';
+import { PermissionsGuard } from 'src/guards/permissions.guard';
+import { Permissions } from 'src/decorators/permissions.decorator';

@ApiTags('Automation Module')
@Controller({
@ -30,7 +31,8 @@ export class AutomationController {
  constructor(private readonly automationService: AutomationService) {}

  @ApiBearerAuth()
-  @UseGuards(JwtAuthGuard)
+  @UseGuards(PermissionsGuard)
+  @Permissions('AUTOMATION_ADD')
  @Post()
  @ApiOperation({
    summary: ControllerRoute.AUTOMATION.ACTIONS.ADD_AUTOMATION_SUMMARY,
@ -48,7 +50,8 @@ export class AutomationController {
  }

  @ApiBearerAuth()
-  @UseGuards(JwtAuthGuard)
+  @UseGuards(PermissionsGuard)
+  @Permissions('AUTOMATION_VIEW')
  @Get(':spaceUuid')
  @ApiOperation({
    summary: ControllerRoute.AUTOMATION.ACTIONS.GET_AUTOMATION_BY_SPACE_SUMMARY,
@ -63,7 +66,8 @@ export class AutomationController {
  }

  @ApiBearerAuth()
-  @UseGuards(JwtAuthGuard)
+  @UseGuards(PermissionsGuard)
+  @Permissions('AUTOMATION_VIEW')
  @Get('details/:automationUuid')
  @ApiOperation({
    summary: ControllerRoute.AUTOMATION.ACTIONS.GET_AUTOMATION_DETAILS_SUMMARY,
@ -78,7 +82,8 @@ export class AutomationController {
  }

  @ApiBearerAuth()
-  @UseGuards(JwtAuthGuard)
+  @UseGuards(PermissionsGuard)
+  @Permissions('AUTOMATION_DELETE')
  @Delete(':automationUuid')
  @ApiOperation({
    summary: ControllerRoute.AUTOMATION.ACTIONS.DELETE_AUTOMATION_SUMMARY,
@ -94,7 +99,8 @@ export class AutomationController {
  }

  @ApiBearerAuth()
-  @UseGuards(JwtAuthGuard)
+  @UseGuards(PermissionsGuard)
+  @Permissions('AUTOMATION_UPDATE')
  @Put(':automationUuid')
  @ApiOperation({
    summary: ControllerRoute.AUTOMATION.ACTIONS.UPDATE_AUTOMATION_SUMMARY,
@ -118,7 +124,8 @@ export class AutomationController {
  }

  @ApiBearerAuth()
-  @UseGuards(JwtAuthGuard)
+  @UseGuards(PermissionsGuard)
+  @Permissions('AUTOMATION_UPDATE')
  @Put('status/:automationUuid')
  @ApiOperation({
    summary:
--- a/src/community/controllers/community.controller.ts
+++ b/src/community/controllers/community.controller.ts
@ -15,11 +15,12 @@ import { AddCommunityDto } from '../dtos/add.community.dto';
 import { GetCommunityParams } from '../dtos/get.community.dto';
 import { UpdateCommunityNameDto } from '../dtos/update.community.dto';
 // import { CheckUserCommunityGuard } from 'src/guards/user.community.guard';
-import { JwtAuthGuard } from '@app/common/guards/jwt.auth.guard';
 import { ControllerRoute } from '@app/common/constants/controller-route';
 import { BaseResponseDto } from '@app/common/dto/base.response.dto';
 import { PaginationRequestGetListDto } from '@app/common/dto/pagination.request.dto';
 import { ProjectParam } from '../dtos';
+import { PermissionsGuard } from 'src/guards/permissions.guard';
+import { Permissions } from 'src/decorators/permissions.decorator';

@ApiTags('Community Module')
@Controller({
@ -30,7 +31,8 @@ export class CommunityController {
  constructor(private readonly communityService: CommunityService) {}

  @ApiBearerAuth()
-  @UseGuards(JwtAuthGuard)
+  @UseGuards(PermissionsGuard)
+  @Permissions('COMMUNITY_ADD')
  @Post()
  @ApiOperation({
    summary: ControllerRoute.COMMUNITY.ACTIONS.CREATE_COMMUNITY_SUMMARY,
@ -44,7 +46,8 @@ export class CommunityController {
  }

  @ApiBearerAuth()
-  @UseGuards(JwtAuthGuard)
+  @UseGuards(PermissionsGuard)
+  @Permissions('COMMUNITY_VIEW')
  @ApiOperation({
    summary: ControllerRoute.COMMUNITY.ACTIONS.GET_COMMUNITY_BY_ID_SUMMARY,
    description:
@ -58,7 +61,8 @@ export class CommunityController {
  }

  @ApiBearerAuth()
-  @UseGuards(JwtAuthGuard)
+  @UseGuards(PermissionsGuard)
+  @Permissions('COMMUNITY_VIEW')
  @ApiOperation({
    summary: ControllerRoute.COMMUNITY.ACTIONS.LIST_COMMUNITY_SUMMARY,
    description: ControllerRoute.COMMUNITY.ACTIONS.LIST_COMMUNITY_DESCRIPTION,
@ -72,7 +76,8 @@ export class CommunityController {
  }

  @ApiBearerAuth()
-  @UseGuards(JwtAuthGuard)
+  @UseGuards(PermissionsGuard)
+  @Permissions('COMMUNITY_UPDATE')
  @ApiOperation({
    summary: ControllerRoute.COMMUNITY.ACTIONS.UPDATE_COMMUNITY_SUMMARY,
    description: ControllerRoute.COMMUNITY.ACTIONS.UPDATE_COMMUNITY_DESCRIPTION,
@ -86,7 +91,8 @@ export class CommunityController {
  }

  @ApiBearerAuth()
-  @UseGuards(JwtAuthGuard)
+  @UseGuards(PermissionsGuard)
+  @Permissions('COMMUNITY_DELETE')
  @Delete('/:communityUuid')
  @ApiOperation({
    summary: ControllerRoute.COMMUNITY.ACTIONS.DELETE_COMMUNITY_SUMMARY,
--- a/src/device/controllers/device.controller.ts
+++ b/src/device/controllers/device.controller.ts
@ -28,15 +28,15 @@ import {
  GetSceneFourSceneDeviceDto,
 } from '../dtos/control.device.dto';
 import { CheckRoomGuard } from 'src/guards/room.guard';
-import { JwtAuthGuard } from '@app/common/guards/jwt.auth.guard';
 import { CheckDeviceGuard } from 'src/guards/device.guard';
-import { SuperAdminRoleGuard } from 'src/guards/super.admin.role.guard';
 import { EnableDisableStatusEnum } from '@app/common/constants/days.enum';
 import { CheckFourAndSixSceneDeviceTypeGuard } from 'src/guards/scene.device.type.guard';
 import { ControllerRoute } from '@app/common/constants/controller-route';
 import { BaseResponseDto } from '@app/common/dto/base.response.dto';
 import { DeviceSceneParamDto } from '../dtos/device.param.dto';
 import { DeleteSceneFromSceneDeviceDto } from '../dtos/delete.device.dto';
+import { PermissionsGuard } from 'src/guards/permissions.guard';
+import { Permissions } from 'src/decorators/permissions.decorator';

@ApiTags('Device Module')
@Controller({
@ -46,7 +46,8 @@ import { DeleteSceneFromSceneDeviceDto } from '../dtos/delete.device.dto';
 export class DeviceController {
  constructor(private readonly deviceService: DeviceService) {}
  @ApiBearerAuth()
-  @UseGuards(SuperAdminRoleGuard, CheckDeviceGuard)
+  @UseGuards(PermissionsGuard, CheckDeviceGuard)
+  @Permissions('ASSIGN_DEVICE_TO_SPACE')
  @Post()
  @ApiOperation({
    summary: ControllerRoute.DEVICE.ACTIONS.ADD_DEVICE_TO_USER_SUMMARY,
@ -63,7 +64,8 @@ export class DeviceController {
    };
  }
  @ApiBearerAuth()
-  @UseGuards(JwtAuthGuard)
+  @UseGuards(PermissionsGuard)
+  @Permissions('DEVICE_VIEW')
  @Get('user/:userUuid')
  @ApiOperation({
    summary: ControllerRoute.DEVICE.ACTIONS.GET_DEVICES_BY_USER_SUMMARY,
@ -74,7 +76,8 @@ export class DeviceController {
  }

  @ApiBearerAuth()
-  @UseGuards(JwtAuthGuard)
+  @UseGuards(PermissionsGuard)
+  @Permissions('VIEW_DEVICE_IN_SPACE')
  @Get('space/:spaceUuid')
  @ApiOperation({
    summary: ControllerRoute.DEVICE.ACTIONS.GET_DEVICES_BY_SPACE_UUID_SUMMARY,
@ -85,7 +88,8 @@ export class DeviceController {
    return await this.deviceService.getDevicesBySpaceUuid(spaceUuid);
  }
  @ApiBearerAuth()
-  @UseGuards(JwtAuthGuard, CheckRoomGuard)
+  @UseGuards(PermissionsGuard, CheckRoomGuard)
+  @Permissions('UPDATE_DEVICE_IN_SUBSPACE')
  @Put('space')
  @ApiOperation({
    summary: ControllerRoute.DEVICE.ACTIONS.UPDATE_DEVICE_IN_ROOM_SUMMARY,
@ -108,7 +112,8 @@ export class DeviceController {
  }

  @ApiBearerAuth()
-  @UseGuards(JwtAuthGuard)
+  @UseGuards(PermissionsGuard)
+  @Permissions('DEVICE_VIEW')
  @Get(':deviceUuid')
  @ApiOperation({
    summary: ControllerRoute.DEVICE.ACTIONS.GET_DEVICE_DETAILS_SUMMARY,
@ -125,7 +130,8 @@ export class DeviceController {
    );
  }
  @ApiBearerAuth()
-  @UseGuards(JwtAuthGuard)
+  @UseGuards(PermissionsGuard)
+  @Permissions('DEVICE_UPDATE')
  @Put(':deviceUuid')
  @ApiOperation({
    summary: ControllerRoute.DEVICE.ACTIONS.UPDATE_DEVICE_SUMMARY,
@ -149,7 +155,8 @@ export class DeviceController {
  }

  @ApiBearerAuth()
-  @UseGuards(JwtAuthGuard)
+  @UseGuards(PermissionsGuard)
+  @Permissions('DEVICE_VIEW')
  @Get(':deviceUuid/functions')
  @ApiOperation({
    summary: ControllerRoute.DEVICE.ACTIONS.GET_DEVICE_INSTRUCTION_SUMMARY,
@ -162,7 +169,8 @@ export class DeviceController {
    return await this.deviceService.getDeviceInstructionByDeviceId(deviceUuid);
  }
  @ApiBearerAuth()
-  @UseGuards(JwtAuthGuard)
+  @UseGuards(PermissionsGuard)
+  @Permissions('DEVICE_VIEW')
  @Get(':deviceUuid/functions/status')
  @ApiOperation({
    summary: ControllerRoute.DEVICE.ACTIONS.GET_DEVICE_STATUS_SUMMARY,
@ -173,7 +181,8 @@ export class DeviceController {
  }

  @ApiBearerAuth()
-  @UseGuards(JwtAuthGuard)
+  @UseGuards(PermissionsGuard)
+  @Permissions('DEVICE_SINGLE_CONTROL')
  @Post(':deviceUuid/control')
  @ApiOperation({
    summary: ControllerRoute.DEVICE.ACTIONS.CONTROL_DEVICE_SUMMARY,
@ -186,7 +195,8 @@ export class DeviceController {
    return await this.deviceService.controlDevice(controlDeviceDto, deviceUuid);
  }
  @ApiBearerAuth()
-  @UseGuards(JwtAuthGuard)
+  @UseGuards(PermissionsGuard)
+  @Permissions('FIRMWARE_CONTROL')
  @Post(':deviceUuid/firmware/:firmwareVersion')
  @ApiOperation({
    summary: ControllerRoute.DEVICE.ACTIONS.UPDATE_DEVICE_FIRMWARE_SUMMARY,
@ -203,7 +213,8 @@ export class DeviceController {
    );
  }
  @ApiBearerAuth()
-  @UseGuards(JwtAuthGuard)
+  @UseGuards(PermissionsGuard)
+  @Permissions('DEVICE_VIEW')
  @Get('gateway/:gatewayUuid/devices')
  @ApiOperation({
    summary: ControllerRoute.DEVICE.ACTIONS.GET_DEVICES_IN_GATEWAY_SUMMARY,
@ -214,7 +225,8 @@ export class DeviceController {
    return await this.deviceService.getDevicesInGateway(gatewayUuid);
  }
  @ApiBearerAuth()
-  @UseGuards(JwtAuthGuard)
+  @UseGuards(PermissionsGuard)
+  @Permissions('DEVICE_VIEW')
  @Get()
  @ApiOperation({
    summary: ControllerRoute.DEVICE.ACTIONS.GET_ALL_DEVICES_SUMMARY,
@ -225,7 +237,8 @@ export class DeviceController {
  }

  @ApiBearerAuth()
-  @UseGuards(JwtAuthGuard)
+  @UseGuards(PermissionsGuard)
+  @Permissions('DEVICE_VIEW')
  @Get('report-logs/:deviceUuid')
  @ApiOperation({
    summary: ControllerRoute.DEVICE.ACTIONS.GET_DEVICE_LOGS_SUMMARY,
@ -238,7 +251,8 @@ export class DeviceController {
    return await this.deviceService.getDeviceLogs(deviceUuid, query);
  }
  @ApiBearerAuth()
-  @UseGuards(JwtAuthGuard)
+  @UseGuards(PermissionsGuard)
+  @Permissions('DEVICE_BATCH_CONTROL')
  @Post('control/batch')
  @ApiOperation({
    summary: ControllerRoute.DEVICE.ACTIONS.BATCH_CONTROL_DEVICES_SUMMARY,
@ -251,7 +265,8 @@ export class DeviceController {
    return await this.deviceService.batchControlDevices(batchControlDevicesDto);
  }
  @ApiBearerAuth()
-  @UseGuards(JwtAuthGuard)
+  @UseGuards(PermissionsGuard)
+  @Permissions('DEVICE_BATCH_CONTROL')
  @Get('status/batch')
  @ApiOperation({
    summary: ControllerRoute.DEVICE.ACTIONS.BATCH_STATUS_DEVICES_SUMMARY,
@ -264,7 +279,8 @@ export class DeviceController {
    return await this.deviceService.batchStatusDevices(batchStatusDevicesDto);
  }
  @ApiBearerAuth()
-  @UseGuards(JwtAuthGuard)
+  @UseGuards(PermissionsGuard)
+  @Permissions('DEVICE_DELETE')
  @Post('factory/reset/:deviceUuid')
  @ApiOperation({
    summary: ControllerRoute.DEVICE.ACTIONS.BATCH_FACTORY_RESET_DEVICES_SUMMARY,
@ -279,7 +295,8 @@ export class DeviceController {
    );
  }
  @ApiBearerAuth()
-  @UseGuards(JwtAuthGuard)
+  @UseGuards(PermissionsGuard)
+  @Permissions('DEVICE_VIEW')
  @Get(':powerClampUuid/power-clamp/status')
  @ApiOperation({
    summary: ControllerRoute.DEVICE.ACTIONS.GET_POWER_CLAMP_STATUS_SUMMARY,
@ -294,7 +311,8 @@ export class DeviceController {
    );
  }
  @ApiBearerAuth()
-  @UseGuards(JwtAuthGuard, CheckFourAndSixSceneDeviceTypeGuard)
+  @UseGuards(PermissionsGuard, CheckFourAndSixSceneDeviceTypeGuard)
+  @Permissions('DEVICE_SINGLE_CONTROL')
  @ApiOperation({
    summary: ControllerRoute.DEVICE.ACTIONS.ADD_SCENE_TO_DEVICE_SUMMARY,
    description: ControllerRoute.DEVICE.ACTIONS.ADD_SCENE_TO_DEVICE_DESCRIPTION,
@ -317,7 +335,8 @@ export class DeviceController {
    };
  }
  @ApiBearerAuth()
-  @UseGuards(JwtAuthGuard, CheckFourAndSixSceneDeviceTypeGuard)
+  @UseGuards(PermissionsGuard, CheckFourAndSixSceneDeviceTypeGuard)
+  @Permissions('DEVICE_VIEW')
  @Get(':deviceUuid/scenes')
  @ApiOperation({
    summary: ControllerRoute.DEVICE.ACTIONS.GET_SCENES_BY_DEVICE_SUMMARY,
@ -334,7 +353,8 @@ export class DeviceController {
    );
  }
  @ApiBearerAuth()
-  @UseGuards(JwtAuthGuard)
+  @UseGuards(PermissionsGuard)
+  @Permissions('DEVICE_DELETE')
  @Delete(':deviceUuid/scenes')
  @ApiOperation({
    summary:
--- a/src/group/controllers/group.controller.ts
+++ b/src/group/controllers/group.controller.ts
@ -1,9 +1,10 @@
 import { GroupService } from '../services/group.service';
 import { Controller, Get, UseGuards, Param, Req } from '@nestjs/common';
 import { ApiTags, ApiBearerAuth, ApiOperation } from '@nestjs/swagger';
-import { JwtAuthGuard } from '@app/common/guards/jwt.auth.guard';
 import { EnableDisableStatusEnum } from '@app/common/constants/days.enum';
 import { ControllerRoute } from '@app/common/constants/controller-route'; // Assuming this is where the routes are defined
+import { PermissionsGuard } from 'src/guards/permissions.guard';
+import { Permissions } from 'src/decorators/permissions.decorator';

@ApiTags('Group Module')
@Controller({
@ -14,7 +15,8 @@ export class GroupController {
  constructor(private readonly groupService: GroupService) {}

  @ApiBearerAuth()
-  @UseGuards(JwtAuthGuard)
+  @UseGuards(PermissionsGuard)
+  @Permissions('VIEW_DEVICE_WIZARD')
  @Get(':spaceUuid')
  @ApiOperation({
    summary: ControllerRoute.GROUP.ACTIONS.GET_GROUPS_BY_SPACE_UUID_SUMMARY,
@ -26,7 +28,8 @@ export class GroupController {
  }

  @ApiBearerAuth()
-  @UseGuards(JwtAuthGuard)
+  @UseGuards(PermissionsGuard)
+  @Permissions('VIEW_DEVICE_WIZARD')
  @Get(':spaceUuid/devices/:groupName')
  @ApiOperation({
    summary:
--- a/src/scene/controllers/scene.controller.ts
+++ b/src/scene/controllers/scene.controller.ts
@ -16,11 +16,12 @@ import {
  AddSceneTapToRunDto,
  UpdateSceneTapToRunDto,
 } from '../dtos/scene.dto';
-import { JwtAuthGuard } from '@app/common/guards/jwt.auth.guard';
 import { EnableDisableStatusEnum } from '@app/common/constants/days.enum';
 import { SceneParamDto } from '../dtos';
 import { BaseResponseDto } from '@app/common/dto/base.response.dto';
 import { ControllerRoute } from '@app/common/constants/controller-route';
+import { PermissionsGuard } from 'src/guards/permissions.guard';
+import { Permissions } from 'src/decorators/permissions.decorator';

@ApiTags('Scene Module')
@Controller({
@ -31,7 +32,8 @@ export class SceneController {
  constructor(private readonly sceneService: SceneService) {}

  @ApiBearerAuth()
-  @UseGuards(JwtAuthGuard)
+  @UseGuards(PermissionsGuard)
+  @Permissions('SCENES_ADD')
  @Post('tap-to-run')
  @ApiOperation({
    summary: ControllerRoute.SCENE.ACTIONS.CREATE_TAP_TO_RUN_SCENE_SUMMARY,
@ -45,7 +47,8 @@ export class SceneController {
  }

  @ApiBearerAuth()
-  @UseGuards(JwtAuthGuard)
+  @UseGuards(PermissionsGuard)
+  @Permissions('SCENES_DELETE')
  @Delete('tap-to-run/:sceneUuid')
  @ApiOperation({
    summary: ControllerRoute.SCENE.ACTIONS.DELETE_TAP_TO_RUN_SCENE_SUMMARY,
@ -59,7 +62,8 @@ export class SceneController {
  }

  @ApiBearerAuth()
-  @UseGuards(JwtAuthGuard)
+  @UseGuards(PermissionsGuard)
+  @Permissions('SCENES_CONTROL')
  @Post('tap-to-run/:sceneUuid/trigger')
  @ApiOperation({
    summary: ControllerRoute.SCENE.ACTIONS.TRIGGER_TAP_TO_RUN_SCENE_SUMMARY,
@ -71,7 +75,8 @@ export class SceneController {
  }

  @ApiBearerAuth()
-  @UseGuards(JwtAuthGuard)
+  @UseGuards(PermissionsGuard)
+  @Permissions('SCENES_VIEW')
  @Get('tap-to-run/:sceneUuid')
  @ApiOperation({
    summary: ControllerRoute.SCENE.ACTIONS.GET_TAP_TO_RUN_SCENE_SUMMARY,
@ -84,7 +89,8 @@ export class SceneController {
  }

  @ApiBearerAuth()
-  @UseGuards(JwtAuthGuard)
+  @UseGuards(PermissionsGuard)
+  @Permissions('SCENES_UPDATE')
  @Put('tap-to-run/:sceneUuid')
  @ApiOperation({
    summary: ControllerRoute.SCENE.ACTIONS.UPDATE_TAP_TO_RUN_SCENE_SUMMARY,
@ -102,7 +108,8 @@ export class SceneController {
  }

  @ApiBearerAuth()
-  @UseGuards(JwtAuthGuard)
+  @UseGuards(PermissionsGuard)
+  @Permissions('SCENES_ADD')
  @Post('icon')
  async addSceneIcon(@Body() addSceneIconDto: AddSceneIconDto) {
    const tapToRunScene = await this.sceneService.addSceneIcon(addSceneIconDto);
@ -114,7 +121,8 @@ export class SceneController {
    };
  }
  @ApiBearerAuth()
-  @UseGuards(JwtAuthGuard)
+  @UseGuards(PermissionsGuard)
+  @Permissions('SCENES_VIEW')
  @Get('icon')
  async getAllIcons() {
    const icons = await this.sceneService.getAllIcons();
--- a/src/space-model/controllers/space-model.controller.ts
+++ b/src/space-model/controllers/space-model.controller.ts
@ -4,8 +4,9 @@ import { ApiBearerAuth, ApiOperation, ApiTags } from '@nestjs/swagger';
 import { SpaceModelService } from '../services';
 import { CreateSpaceModelDto } from '../dtos';
 import { ProjectParam } from 'src/community/dtos';
-import { JwtAuthGuard } from '@app/common/guards/jwt.auth.guard';
 import { BaseResponseDto } from '@app/common/dto/base.response.dto';
+import { PermissionsGuard } from 'src/guards/permissions.guard';
+import { Permissions } from 'src/decorators/permissions.decorator';

@ApiTags('Space Model Module')
@Controller({
@ -16,7 +17,8 @@ export class SpaceModelController {
  constructor(private readonly spaceModelService: SpaceModelService) {}

  @ApiBearerAuth()
-  @UseGuards(JwtAuthGuard)
+  @UseGuards(PermissionsGuard)
+  @Permissions('SPACE_MODULE_ADD')
  @ApiOperation({
    summary: ControllerRoute.SPACE_MODEL.ACTIONS.CREATE_SPACE_MODEL_SUMMARY,
    description:
--- a/src/space/controllers/space-device.controller.ts
+++ b/src/space/controllers/space-device.controller.ts
@ -1,10 +1,11 @@
 import { ControllerRoute } from '@app/common/constants/controller-route';
 import { Controller, Get, Param, UseGuards } from '@nestjs/common';
 import { ApiBearerAuth, ApiOperation, ApiTags } from '@nestjs/swagger';
-import { JwtAuthGuard } from '@app/common/guards/jwt.auth.guard';
 import { GetSpaceParam } from '../dtos';
 import { BaseResponseDto } from '@app/common/dto/base.response.dto';
 import { SpaceDeviceService } from '../services';
+import { PermissionsGuard } from 'src/guards/permissions.guard';
+import { Permissions } from 'src/decorators/permissions.decorator';

@ApiTags('Space Module')
@Controller({
@ -15,7 +16,8 @@ export class SpaceDeviceController {
  constructor(private readonly spaceDeviceService: SpaceDeviceService) {}

  @ApiBearerAuth()
-  @UseGuards(JwtAuthGuard)
+  @UseGuards(PermissionsGuard)
+  @Permissions('VIEW_DEVICE_IN_SPACE')
  @ApiOperation({
    summary: ControllerRoute.SPACE_DEVICES.ACTIONS.LIST_SPACE_DEVICE_SUMMARY,
    description:
--- a/src/space/controllers/space-scene.controller.ts
+++ b/src/space/controllers/space-scene.controller.ts
@ -1,11 +1,12 @@
 import { ControllerRoute } from '@app/common/constants/controller-route';
 import { BaseResponseDto } from '@app/common/dto/base.response.dto';
-import { JwtAuthGuard } from '@app/common/guards/jwt.auth.guard';
 import { Controller, Get, Param, Query, UseGuards } from '@nestjs/common';
 import { ApiBearerAuth, ApiOperation, ApiTags } from '@nestjs/swagger';
 import { SpaceSceneService } from '../services';
 import { GetSceneDto } from '../../scene/dtos';
 import { GetSpaceParam } from '../dtos';
+import { PermissionsGuard } from 'src/guards/permissions.guard';
+import { Permissions } from 'src/decorators/permissions.decorator';

@ApiTags('Space Module')
@Controller({
@ -16,7 +17,8 @@ export class SpaceSceneController {
  constructor(private readonly sceneService: SpaceSceneService) {}

  @ApiBearerAuth()
-  @UseGuards(JwtAuthGuard)
+  @UseGuards(PermissionsGuard)
+  @Permissions('SCENES_VIEW')
  @ApiOperation({
    summary:
      ControllerRoute.SPACE_SCENE.ACTIONS.GET_TAP_TO_RUN_SCENE_BY_SPACE_SUMMARY,
--- a/src/space/controllers/space-user.controller.ts
+++ b/src/space/controllers/space-user.controller.ts
@ -3,8 +3,9 @@ import { Controller, Delete, Param, Post, UseGuards } from '@nestjs/common';
 import { ApiBearerAuth, ApiOperation, ApiTags } from '@nestjs/swagger';
 import { SpaceUserService } from '../services';
 import { BaseResponseDto } from '@app/common/dto/base.response.dto';
-import { JwtAuthGuard } from '@app/common/guards/jwt.auth.guard';
 import { UserSpaceParam } from '../dtos';
+import { PermissionsGuard } from 'src/guards/permissions.guard';
+import { Permissions } from 'src/decorators/permissions.decorator';

@ApiTags('Space Module')
@Controller({
@ -16,7 +17,8 @@ export class SpaceUserController {

  @ApiBearerAuth()
  @Post('/:userUuid')
-  @UseGuards(JwtAuthGuard)
+  @UseGuards(PermissionsGuard)
+  @Permissions('ASSIGN_USER_TO_SPACE')
  @ApiOperation({
    summary:
      ControllerRoute.SPACE_USER.ACTIONS.ASSOCIATE_SPACE_USER_DESCRIPTION,
@ -31,7 +33,8 @@ export class SpaceUserController {

  @ApiBearerAuth()
  @Delete('/:userUuid')
-  @UseGuards(JwtAuthGuard)
+  @UseGuards(PermissionsGuard)
+  @Permissions('DELETE_USER_FROM_SPACE')
  @ApiOperation({
    summary: ControllerRoute.SPACE_USER.ACTIONS.DISSOCIATE_SPACE_USER_SUMMARY,
    description:
--- a/src/space/controllers/space.controller.ts
+++ b/src/space/controllers/space.controller.ts
@ -11,10 +11,11 @@ import {
  Put,
  UseGuards,
 } from '@nestjs/common';
-import { JwtAuthGuard } from '@app/common/guards/jwt.auth.guard';
 import { AddSpaceDto, CommunitySpaceParam, UpdateSpaceDto } from '../dtos';
 import { BaseResponseDto } from '@app/common/dto/base.response.dto';
 import { GetSpaceParam } from '../dtos/get.space.param';
+import { PermissionsGuard } from 'src/guards/permissions.guard';
+import { Permissions } from 'src/decorators/permissions.decorator';

@ApiTags('Space Module')
@Controller({
@ -25,7 +26,8 @@ export class SpaceController {
  constructor(private readonly spaceService: SpaceService) {}

  @ApiBearerAuth()
-  @UseGuards(JwtAuthGuard)
+  @UseGuards(PermissionsGuard)
+  @Permissions('SPACE_ADD')
  @ApiOperation({
    summary: ControllerRoute.SPACE.ACTIONS.CREATE_SPACE_SUMMARY,
    description: ControllerRoute.SPACE.ACTIONS.CREATE_SPACE_DESCRIPTION,
@ -42,7 +44,8 @@ export class SpaceController {
  }

  @ApiBearerAuth()
-  @UseGuards(JwtAuthGuard)
+  @UseGuards(PermissionsGuard)
+  @Permissions('SPACE_VIEW')
  @ApiOperation({
    summary:
      ControllerRoute.SPACE.ACTIONS.GET_COMMUNITY_SPACES_HIERARCHY_SUMMARY,
@ -57,7 +60,8 @@ export class SpaceController {
  }

  @ApiBearerAuth()
-  @UseGuards(JwtAuthGuard)
+  @UseGuards(PermissionsGuard)
+  @Permissions('SPACE_DELETE')
  @ApiOperation({
    summary: ControllerRoute.SPACE.ACTIONS.DELETE_SPACE_SUMMARY,
    description: ControllerRoute.SPACE.ACTIONS.DELETE_SPACE_DESCRIPTION,
@ -68,7 +72,8 @@ export class SpaceController {
  }

  @ApiBearerAuth()
-  @UseGuards(JwtAuthGuard)
+  @UseGuards(PermissionsGuard)
+  @Permissions('SPACE_UPDATE')
  @Put('/:spaceUuid')
  @ApiOperation({
    summary: ControllerRoute.SPACE.ACTIONS.UPDATE_SPACE_SUMMARY,
@ -82,7 +87,8 @@ export class SpaceController {
  }

  @ApiBearerAuth()
-  @UseGuards(JwtAuthGuard)
+  @UseGuards(PermissionsGuard)
+  @Permissions('SPACE_VIEW')
  @ApiOperation({
    summary: ControllerRoute.SPACE.ACTIONS.GET_SPACE_SUMMARY,
    description: ControllerRoute.SPACE.ACTIONS.GET_SPACE_DESCRIPTION,
@ -93,7 +99,8 @@ export class SpaceController {
  }

  @ApiBearerAuth()
-  @UseGuards(JwtAuthGuard)
+  @UseGuards(PermissionsGuard)
+  @Permissions('SPACE_VIEW')
  @ApiOperation({
    summary: ControllerRoute.SPACE.ACTIONS.GET_HEIRARCHY_SUMMARY,
    description: ControllerRoute.SPACE.ACTIONS.GET_HEIRARCHY_DESCRIPTION,
@ -107,7 +114,8 @@ export class SpaceController {

  //should it be post?
  @ApiBearerAuth()
-  @UseGuards(JwtAuthGuard)
+  @UseGuards(PermissionsGuard)
+  @Permissions('SPACE_MEMBER_ADD')
  @ApiOperation({
    summary: ControllerRoute.SPACE.ACTIONS.CREATE_INVITATION_CODE_SPACE_SUMMARY,
    description:
--- a/src/space/controllers/subspace/subspace-device.controller.ts
+++ b/src/space/controllers/subspace/subspace-device.controller.ts
@ -1,5 +1,4 @@
 import { ControllerRoute } from '@app/common/constants/controller-route';
-import { JwtAuthGuard } from '@app/common/guards/jwt.auth.guard';
 import {
  Controller,
  Delete,
@ -12,6 +11,8 @@ import { ApiBearerAuth, ApiOperation, ApiTags } from '@nestjs/swagger';
 import { DeviceSubSpaceParam, GetSubSpaceParam } from '../../dtos';
 import { SubspaceDeviceService } from 'src/space/services';
 import { BaseResponseDto } from '@app/common/dto/base.response.dto';
+import { PermissionsGuard } from 'src/guards/permissions.guard';
+import { Permissions } from 'src/decorators/permissions.decorator';

@ApiTags('Space Module')
@Controller({
@ -22,7 +23,8 @@ export class SubSpaceDeviceController {
  constructor(private readonly subspaceDeviceService: SubspaceDeviceService) {}

  @ApiBearerAuth()
-  @UseGuards(JwtAuthGuard)
+  @UseGuards(PermissionsGuard)
+  @Permissions('VIEW_DEVICE_IN_SUBSPACE')
  @ApiOperation({
    summary:
      ControllerRoute.SUBSPACE_DEVICE.ACTIONS.LIST_SUBSPACE_DEVICE_SUMMARY,
@ -37,7 +39,8 @@ export class SubSpaceDeviceController {
  }

  @ApiBearerAuth()
-  @UseGuards(JwtAuthGuard)
+  @UseGuards(PermissionsGuard)
+  @Permissions('ASSIGN_DEVICE_TO_SUBSPACE')
  @ApiOperation({
    summary:
      ControllerRoute.SUBSPACE_DEVICE.ACTIONS.ASSOCIATE_SUBSPACE_DEVICE_SUMMARY,
@ -53,7 +56,8 @@ export class SubSpaceDeviceController {
  }

  @ApiBearerAuth()
-  @UseGuards(JwtAuthGuard)
+  @UseGuards(PermissionsGuard)
+  @Permissions('DELETE_DEVICE_FROM_SUBSPACE')
  @ApiOperation({
    summary:
      ControllerRoute.SUBSPACE_DEVICE.ACTIONS
--- a/src/space/controllers/subspace/subspace.controller.ts
+++ b/src/space/controllers/subspace/subspace.controller.ts
@ -14,8 +14,9 @@ import { SubSpaceService } from '../../services';
 import { ApiBearerAuth, ApiOperation, ApiTags } from '@nestjs/swagger';
 import { AddSubspaceDto, GetSpaceParam, GetSubSpaceParam } from '../../dtos';
 import { BaseResponseDto } from '@app/common/dto/base.response.dto';
-import { JwtAuthGuard } from '@app/common/guards/jwt.auth.guard';
 import { PaginationRequestGetListDto } from '@app/common/dto/pagination.request.dto';
+import { PermissionsGuard } from 'src/guards/permissions.guard';
+import { Permissions } from 'src/decorators/permissions.decorator';

@ApiTags('Space Module')
@Controller({
@ -26,7 +27,8 @@ export class SubSpaceController {
  constructor(private readonly subSpaceService: SubSpaceService) {}

  @ApiBearerAuth()
-  @UseGuards(JwtAuthGuard)
+  @UseGuards(PermissionsGuard)
+  @Permissions('SUBSPACE_ADD')
  @Post()
  @ApiOperation({
    summary: ControllerRoute.SUBSPACE.ACTIONS.CREATE_SUBSPACE_SUMMARY,
@ -40,7 +42,8 @@ export class SubSpaceController {
  }

  @ApiBearerAuth()
-  @UseGuards(JwtAuthGuard)
+  @UseGuards(PermissionsGuard)
+  @Permissions('SUBSPACE_VIEW')
  @ApiOperation({
    summary: ControllerRoute.SUBSPACE.ACTIONS.LIST_SUBSPACES_SUMMARY,
    description: ControllerRoute.SUBSPACE.ACTIONS.LIST_SUBSPACES_DESCRIPTION,
@ -54,7 +57,8 @@ export class SubSpaceController {
  }

  @ApiBearerAuth()
-  @UseGuards(JwtAuthGuard)
+  @UseGuards(PermissionsGuard)
+  @Permissions('SUBSPACE_VIEW')
  @ApiOperation({
    summary: ControllerRoute.SUBSPACE.ACTIONS.GET_SUBSPACE_SUMMARY,
    description: ControllerRoute.SUBSPACE.ACTIONS.GET_SUBSPACE_DESCRIPTION,
@ -65,7 +69,8 @@ export class SubSpaceController {
  }

  @ApiBearerAuth()
-  @UseGuards(JwtAuthGuard)
+  @UseGuards(PermissionsGuard)
+  @Permissions('SUBSPACE_UPDATE')
  @ApiOperation({
    summary: ControllerRoute.SUBSPACE.ACTIONS.UPDATE_SUBSPACE_SUMMARY,
    description: ControllerRoute.SUBSPACE.ACTIONS.UPDATE_SUBSPACE_DESCRIPTION,
@ -79,7 +84,8 @@ export class SubSpaceController {
  }

  @ApiBearerAuth()
-  @UseGuards(JwtAuthGuard)
+  @UseGuards(PermissionsGuard)
+  @Permissions('SUBSPACE_DELETE')
  @ApiOperation({
    summary: ControllerRoute.SUBSPACE.ACTIONS.DELETE_SUBSPACE_SUMMARY,
    description: ControllerRoute.SUBSPACE.ACTIONS.DELETE_SUBSPACE_DESCRIPTION,
--- a/src/vistor-password/controllers/visitor-password.controller.ts
+++ b/src/vistor-password/controllers/visitor-password.controller.ts
@ -15,9 +15,10 @@ import {
  AddDoorLockOnlineMultipleDto,
  AddDoorLockOnlineOneTimeDto,
 } from '../dtos/temp-pass.dto';
-import { JwtAuthGuard } from '@app/common/guards/jwt.auth.guard';
 import { EnableDisableStatusEnum } from '@app/common/constants/days.enum';
 import { ControllerRoute } from '@app/common/constants/controller-route';
+import { PermissionsGuard } from 'src/guards/permissions.guard';
+import { Permissions } from 'src/decorators/permissions.decorator';

@ApiTags('Visitor Password Module')
@Controller({
@ -30,7 +31,8 @@ export class VisitorPasswordController {
  ) {}

  @ApiBearerAuth()
-  @UseGuards(JwtAuthGuard)
+  @UseGuards(PermissionsGuard)
+  @Permissions('VISITOR_PASSWORD_ADD')
  @Post('temporary-password/online/multiple-time')
  @ApiOperation({
    summary:
@ -58,7 +60,8 @@ export class VisitorPasswordController {
  }

  @ApiBearerAuth()
-  @UseGuards(JwtAuthGuard)
+  @UseGuards(PermissionsGuard)
+  @Permissions('VISITOR_PASSWORD_ADD')
  @Post('temporary-password/online/one-time')
  @ApiOperation({
    summary:
@ -86,7 +89,8 @@ export class VisitorPasswordController {
  }

  @ApiBearerAuth()
-  @UseGuards(JwtAuthGuard)
+  @UseGuards(PermissionsGuard)
+  @Permissions('VISITOR_PASSWORD_ADD')
  @Post('temporary-password/offline/one-time')
  @ApiOperation({
    summary:
@ -114,7 +118,8 @@ export class VisitorPasswordController {
  }

  @ApiBearerAuth()
-  @UseGuards(JwtAuthGuard)
+  @UseGuards(PermissionsGuard)
+  @Permissions('VISITOR_PASSWORD_ADD')
  @Post('temporary-password/offline/multiple-time')
  @ApiOperation({
    summary:
@ -143,7 +148,8 @@ export class VisitorPasswordController {
  }

  @ApiBearerAuth()
-  @UseGuards(JwtAuthGuard)
+  @UseGuards(PermissionsGuard)
+  @Permissions('VISITOR_PASSWORD_VIEW')
  @Get()
  @ApiOperation({
    summary:
@ -156,7 +162,8 @@ export class VisitorPasswordController {
  }

  @ApiBearerAuth()
-  @UseGuards(JwtAuthGuard)
+  @UseGuards(PermissionsGuard)
+  @Permissions('VISITOR_PASSWORD_VIEW')
  @Get('/devices')
  @ApiOperation({
    summary: