feat(rbac): add PermissionGuard, @Public and @RequirePermission decorators

backend/src/auth/decorators/permission.decorator.ts

@@ -0,0 +1,11 @@
+import { SetMetadata } from '@nestjs/common';
+
+export const PERMISSION_KEY = 'permissions';
+
+/**
+ * 声明接口所需权限。
+ * 多次调用 = AND 逻辑（需要同时满足所有组）；
+ * 单次调用多个参数 = OR 逻辑（满足其中一个即可）。
+ */
+export const RequirePermission = (...permissions: string[]) =>
+  SetMetadata(PERMISSION_KEY, permissions);

backend/src/auth/decorators/public.decorator.ts

@@ -0,0 +1,4 @@
+import { SetMetadata } from '@nestjs/common';
+
+export const IS_PUBLIC_KEY = 'isPublic';
+export const Public = () => SetMetadata(IS_PUBLIC_KEY, true);

backend/src/auth/guards/permission.guard.ts

@@ -0,0 +1,34 @@
+import { Injectable, CanActivate, ExecutionContext } from '@nestjs/common';
+import { Reflector } from '@nestjs/core';
+import { IS_PUBLIC_KEY } from '../decorators/public.decorator';
+import { PERMISSION_KEY } from '../decorators/permission.decorator';
+
+@Injectable()
+export class PermissionGuard implements CanActivate {
+  constructor(private reflector: Reflector) {}
+
+  canActivate(context: ExecutionContext): boolean {
+    // 1. @Public() 豁免
+    const isPublic = this.reflector.getAllAndOverride<boolean>(IS_PUBLIC_KEY, [
+      context.getHandler(),
+      context.getClass(),
+    ]);
+    if (isPublic) return true;
+
+    // 2. 获取所需权限（getAllAndMerge 合并 handler+class 层的所有 metadata）
+    const requiredPermissions = this.reflector.getAllAndMerge<string[]>(
+      PERMISSION_KEY,
+      [context.getHandler(), context.getClass()],
+    );
+    // 无装饰器 = 默认拒绝
+    if (!requiredPermissions || requiredPermissions.length === 0) return false;
+
+    // 3. 从 JWT payload 获取用户权限
+    const request = context.switchToHttp().getRequest();
+    const user = request.user;
+    if (!user || !user.permissions || !Array.isArray(user.permissions)) return false;
+
+    // 4. OR 匹配：用户拥有 requiredPermissions 中任一权限即可通过
+    return requiredPermissions.some(p => user.permissions.includes(p));
+  }
+}