api/src/unraid-api/auth/auth.module.ts (1)

40-40: Hoist Logger and log stack traces properly.

Avoid per-call Logger creation and pass stack/trace to Logger.error for clarity.

Apply this diff to reuse a shared logger and improve error logging:

-                const logger = new Logger('AuthZModule');
+                const logger = AUTHZ_LOGGER;
@@
-                } catch (error) {
-                    logger.error('Failed to extract user context', error);
+                } catch (error) {
+                    logger.error(
+                        'Failed to extract user context',
+                        error instanceof Error ? error.stack : String(error)
+                    );
                     throw new UnauthorizedException('Failed to authenticate user');
                 }

Add this at module scope (top of file) to define the shared logger:

const AUTHZ_LOGGER = new Logger('AuthModule');

Also applies to: 66-69

api/src/unraid-api/auth/casbin/authz.guard.integration.spec.ts (3)

19-20: Use unknown[] instead of any[].

Tighten the handler signature to avoid any.

As per coding guidelines

-type Handler = (...args: any[]) => unknown;
+type Handler = (...args: unknown[]) => unknown;

---

69-79: Mirror module’s user presence check and safer subject fallback in tests.

Keep test mapper aligned with production to catch mismatches early.

Apply this diff:

-            userFromContext: (ctx: ExecutionContext) => {
-                const request = getRequest(ctx) as TestRequest | undefined;
-                const user: TestUser = request?.user ?? {};
-                const roles = user.roles ?? [];
-
-                if (!Array.isArray(roles)) {
-                    throw new UnauthorizedException('User roles must be an array');
-                }
-
-                return typeof user.id === 'string' && user.id.length > 0 ? user.id : roles.join(',');
-            },
+            userFromContext: (ctx: ExecutionContext) => {
+                const request = getRequest(ctx) as TestRequest | undefined;
+                const user = request?.user;
+                if (!user) {
+                    throw new UnauthorizedException('Request user context missing');
+                }
+                const roles = user.roles ?? [];
+                if (!Array.isArray(roles)) {
+                    throw new UnauthorizedException('User roles must be an array');
+                }
+                const userId = typeof user.id === 'string' ? user.id.trim() : '';
+                const subject = userId || (roles.length === 1 ? String(roles[0]) : '');
+                if (!subject) {
+                    throw new UnauthorizedException('User identifier (id) or single role is required');
+                }
+                return subject;
+            },

---

54-81: Add negative-path tests for missing user/invalid roles.

Strengthens guarantees around Unauthorized flows and aligns with test guidelines.

As per coding guidelines

it('rejects when user context is missing', async () => {
  // Create a context with no user
  const context = (() => {
    const graphqlContextHost = new ExecutionContextHost(
      [undefined, undefined, { req: {} as TestRequest }, undefined],
      DockerResolver,
      DockerResolver.prototype.containers
    );
    graphqlContextHost.setType('graphql');
    return graphqlContextHost as unknown as ExecutionContext;
  })();

  await expect(guard.canActivate(context)).rejects.toThrow();
});

it('rejects when roles is not an array', async () => {
  // roles: as any to simulate a malformed token/user object
  const badRoles = null as unknown as Role[];
  const context = createExecutionContext(
    DockerResolver.prototype.containers,
    DockerResolver,
    badRoles,
    'api-key-viewer'
  );
  await expect(guard.canActivate(context)).rejects.toThrow();
});

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro