fix: make JwtAuthGuard global to run before PermissionGuard, skip @Public routes

apps/server/src/app.module.ts

@@ -33,6 +33,7 @@ import { AuthModule } from './auth/auth.module';
 import { RbacModule } from './rbac/rbac.module';
 import { StudentsModule } from './students/students.module';
 import { PermissionGuard } from './auth/guards/permission.guard';
+import { JwtAuthGuard } from './auth/guards/jwt-auth.guard';
 import { RoomsModule } from './rooms/rooms.module';
 import { OccupanciesModule } from './occupancies/occupancies.module';
 import { ExpensesModule } from './expenses/expenses.module';
@@ -129,6 +130,7 @@ import { SyncModule } from './sync/sync.module';
   ],
   providers: [
     { provide: APP_GUARD, useClass: ThrottlerGuard },
+    { provide: APP_GUARD, useClass: JwtAuthGuard },
     { provide: APP_GUARD, useClass: PermissionGuard },
   ],
 })

apps/server/src/auth/guards/jwt-auth.guard.ts

@@ -1,5 +1,20 @@
 import { Injectable, ExecutionContext } from '@nestjs/common';
+import { Reflector } from '@nestjs/core';
 import { AuthGuard } from '@nestjs/passport';
+import { IS_PUBLIC_KEY } from '../decorators/public.decorator';
 
 @Injectable()
-export class JwtAuthGuard extends AuthGuard('jwt') {}
+export class JwtAuthGuard extends AuthGuard('jwt') {
+  constructor(private reflector: Reflector) {
+    super();
+  }
+
+  canActivate(context: ExecutionContext) {
+    const isPublic = this.reflector.getAllAndOverride<boolean>(IS_PUBLIC_KEY, [
+      context.getHandler(),
+      context.getClass(),
+    ]);
+    if (isPublic) return true;
+    return super.canActivate(context);
+  }
+}