From 6737c00d96fea910a3e407632df4397805286c1f Mon Sep 17 00:00:00 2001
From: wangziqi <wangziqi@gongxue100.com>
Date: Sun, 5 Jul 2026 21:23:42 +0800
Subject: [PATCH] fix: make JwtAuthGuard global to run before PermissionGuard,
 skip @Public routes

---
 apps/server/src/app.module.ts                 |  2 ++
 apps/server/src/auth/guards/jwt-auth.guard.ts | 17 ++++++++++++++++-
 2 files changed, 18 insertions(+), 1 deletion(-)

diff --git a/apps/server/src/app.module.ts b/apps/server/src/app.module.ts
index dc27c5b..4ddefe4 100644
--- a/apps/server/src/app.module.ts
+++ b/apps/server/src/app.module.ts
@@ -33,6 +33,7 @@ import { AuthModule } from './auth/auth.module';
 import { RbacModule } from './rbac/rbac.module';
 import { StudentsModule } from './students/students.module';
 import { PermissionGuard } from './auth/guards/permission.guard';
+import { JwtAuthGuard } from './auth/guards/jwt-auth.guard';
 import { RoomsModule } from './rooms/rooms.module';
 import { OccupanciesModule } from './occupancies/occupancies.module';
 import { ExpensesModule } from './expenses/expenses.module';
@@ -129,6 +130,7 @@ import { SyncModule } from './sync/sync.module';
   ],
   providers: [
     { provide: APP_GUARD, useClass: ThrottlerGuard },
+    { provide: APP_GUARD, useClass: JwtAuthGuard },
     { provide: APP_GUARD, useClass: PermissionGuard },
   ],
 })
diff --git a/apps/server/src/auth/guards/jwt-auth.guard.ts b/apps/server/src/auth/guards/jwt-auth.guard.ts
index 00fd7de..d44759b 100644
--- a/apps/server/src/auth/guards/jwt-auth.guard.ts
+++ b/apps/server/src/auth/guards/jwt-auth.guard.ts
@@ -1,5 +1,20 @@
 import { Injectable, ExecutionContext } from '@nestjs/common';
+import { Reflector } from '@nestjs/core';
 import { AuthGuard } from '@nestjs/passport';
+import { IS_PUBLIC_KEY } from '../decorators/public.decorator';
 
 @Injectable()
-export class JwtAuthGuard extends AuthGuard('jwt') {}
+export class JwtAuthGuard extends AuthGuard('jwt') {
+  constructor(private reflector: Reflector) {
+    super();
+  }
+
+  canActivate(context: ExecutionContext) {
+    const isPublic = this.reflector.getAllAndOverride<boolean>(IS_PUBLIC_KEY, [
+      context.getHandler(),
+      context.getClass(),
+    ]);
+    if (isPublic) return true;
+    return super.canActivate(context);
+  }
+}