typescript 50 lines · 8 steps

Role-based route guards in NestJS

A custom decorator tags routes with required roles and a guard reads that metadata to allow or forbid each request.

Explained by highlit

NestJS Intermediate authorization decorators metadata-reflection guards rbac

1import {
2  CanActivate,
3  ExecutionContext,
4  Injectable,
5  SetMetadata,
6  ForbiddenException,
7} from '@nestjs/common';
8import { Reflector } from '@nestjs/core';
9 
10export enum Role {
11  User = 'user',
12  Editor = 'editor',
13  Admin = 'admin',
14}
15 
16export const ROLES_KEY = 'roles';
17export const Roles = (...roles: Role[]) => SetMetadata(ROLES_KEY, roles);
18 
19@Injectable()
20export class RolesGuard implements CanActivate {
21  constructor(private readonly reflector: Reflector) {}
22 
23  canActivate(context: ExecutionContext): boolean {
24    const requiredRoles = this.reflector.getAllAndOverride<Role[]>(ROLES_KEY, [
25      context.getHandler(),
26      context.getClass(),
27    ]);
28 
29    if (!requiredRoles || requiredRoles.length === 0) {
30      return true;
31    }
32 
33    const { user } = context.switchToHttp().getRequest();
34 
35    if (!user) {
36      throw new ForbiddenException('Authentication required');
37    }
38 
39    const userRoles: Role[] = user.roles ?? [];
40    const hasRole = requiredRoles.some((role) => userRoles.includes(role));
41 
42    if (!hasRole) {
43      throw new ForbiddenException(
44        `Requires one of: ${requiredRoles.join(', ')}`,
45      );
46    }
47 
48    return true;
49  }
50}

01 / 01

STEP 01

Walkthrough

Space play ←→ step click any line

Three takeaways

1Custom metadata plus a reflector lets you attach declarative rules to routes and read them back at request time.
2getAllAndOverride merges handler and class metadata so route-level roles override controller-level defaults.
3Returning true for unrestricted routes keeps the guard opt-in rather than locking everything down by default.

Related explainers

typescript

import { registerLocaleData } from '@angular/common';
import localeFr from '@angular/common/locales/fr';
import localeFrExtra from '@angular/common/locales/extra/fr';
import localeDe from '@angular/common/locales/de';

Locale-aware bootstrapping in Angular

i18n localization dependency-injection

Intermediate 8 steps

typescript

import { Module } from '@nestjs/common';
import { ConfigModule } from '@nestjs/config';
import * as Joi from 'joi';

Validating env config at boot in NestJS

configuration schema-validation environment-variables

Intermediate 8 steps

typescript

import { Inject, Injectable, Logger } from '@nestjs/common';
import { CACHE_MANAGER } from '@nestjs/cache-manager';
import { Cache } from 'cache-manager';
import { InjectRepository } from '@nestjs/typeorm';

A cache-aside country lookup in NestJS

cache-aside dependency-injection batch-lookup

Intermediate 8 steps

typescript

import { Injectable, effect, signal, computed } from '@angular/core';
 
interface Preferences {
  theme: 'light' | 'dark';

A signal-based preferences store in Angular

signals state-management persistence

Intermediate 7 steps

typescript

import { useEffect, useState } from "react";
 
interface Section {
  id: string;

Building a scroll-spy hook in React

custom-hooks intersectionobserver dom-observation

Intermediate 8 steps

typescript

import { Injectable, Scope, Inject, NotFoundException } from '@nestjs/common';
import { REQUEST } from '@nestjs/core';
import { Request } from 'express';
import { DataSource } from 'typeorm';