Gardes et rôles

What are NestJS Guards?

Building a Basic Guard

import { CanActivate, ExecutionContext, Injectable } from '@nestjs/common';
import { Observable } from 'rxjs';

@Injectable()
export class AuthGuard implements CanActivate {
  canActivate(
    context: ExecutionContext,
  ): boolean | Promise<boolean> | Observable<boolean> {
    // Logic to determine if user is authorized
    // For now, let's just allow it
    return true;
  }
}

A Simple Authentication Check

import { CanActivate, ExecutionContext, Injectable } from '@nestjs/common';
import { Observable } from 'rxjs';

@Injectable()
export class BasicAuthGuard implements CanActivate {
  canActivate(
    context: ExecutionContext,
  ): boolean | Promise<boolean> | Observable<boolean> {
    const request = context.switchToHttp().getRequest();
    // In a real app, you'd check JWT, session, etc.
    // For this example, we check a simple header.
    const hasAuthHeader = request.headers['authorization'] === 'Bearer secret-token';
    return hasAuthHeader; // Only allow if header is correct
  }
}

Protecting Your Endpoints

import { Controller, Get, UseGuards } from '@nestjs/common';
import { BasicAuthGuard } from './common/guards/auth.guard';

@Controller('protected')
@UseGuards(BasicAuthGuard) // Protects all routes in this controller
export class ProtectedController {
  @Get()
  getProtectedData(): string {
    return 'This data is protected!';
  }

  @Get('public')
  getAnotherProtectedData(): string {
    return 'More protected data.';
  }
}

// src/app.module.ts
import { Module } from '@nestjs/common';
import { ProtectedController } from './app.controller';

@Module({
  controllers: [ProtectedController],
  providers: [],
})
export class AppModule {}

// src/main.ts
import { NestFactory } from '@nestjs/core';
import { AppModule } from './app.module';

async function bootstrap() {
  const app = await NestFactory.create(AppModule);
  await app.listen(3000);
  console.log('App running on http://localhost:3000');
}
bootstrap();

Understanding RBAC

Marking Routes with Roles

import { SetMetadata } from '@nestjs/common';

export const ROLES_KEY = 'roles';
export const Roles = (...roles: string[]) => SetMetadata(ROLES_KEY, roles);

// Example usage in a controller:
// @Roles('admin', 'editor')
// @Get('admin-only')
// someAdminMethod() { ... }

The Roles Guard Logic

import { Injectable, CanActivate, ExecutionContext } from '@nestjs/common';
import { Reflector } from '@nestjs/core';
import { Observable } from 'rxjs';
import { ROLES_KEY } from '../decorators/roles.decorator';

@Injectable()
export class RolesGuard implements CanActivate {
  constructor(private reflector: Reflector) {}

  canActivate(
    context: ExecutionContext,
  ): boolean | Promise<boolean> | Observable<boolean> {
    const requiredRoles = this.reflector.getAllAndOverride<string[]>(ROLES_KEY, [
      context.getHandler(),
      context.getClass(),
    ]);

    if (!requiredRoles) {
      return true; // No roles defined, so access is allowed by default
    }

    const request = context.switchToHttp().getRequest();
    // In a real app, 'user' would come from an authentication guard
    // and contain actual user data including roles.
    const user = request.user || { roles: ['viewer'] }; // Dummy user for example

    const hasPermission = requiredRoles.some((role) => user.roles.includes(role));
    return hasPermission;
  }
}

Stacking Guards for Protection

Applying Guards and Roles

import { Controller, Get, UseGuards, Req } from '@nestjs/common';
import { BasicAuthGuard } from './common/guards/auth.guard';
import { RolesGuard } from './common/guards/roles.guard';
import { Roles } from './common/decorators/roles.decorator';

// Assume this comes from a real authentication process
interface User {
  username: string;
  roles: string[];
}

@Controller('admin')
@UseGuards(BasicAuthGuard, RolesGuard) // Guards applied in order
export class AdminController {
  @Get('dashboard')
  @Roles('admin') // Only users with 'admin' role can access
  getAdminDashboard(@Req() req): string {
    // For this runnable example's context, manually set user.
    // In a real app, BasicAuthGuard would populate req.user.
    req.user = { username: 'testuser', roles: ['admin'] };
    return `Welcome to the Admin Dashboard, ${req.user.username}!`;
  }

  @Get('reports')
  @Roles('admin', 'editor') // Admins or Editors can access
  getReports(@Req() req): string {
    req.user = { username: 'editoruser', roles: ['editor'] };
    return `Accessing reports as ${req.user.username}.`;
  }
}

// src/app.module.ts
import { Module } from '@nestjs/common';
import { AdminController } from './app.controller';

@Module({
  controllers: [AdminController],
  providers: [],
})
export class AppModule {}

// src/main.ts (unchanged from previous runnable example)
import { NestFactory } from '@nestjs/core';
import { AppModule } from './app.module';

async function bootstrap() {
  const app = await NestFactory.create(AppModule);
  await app.listen(3000);
  console.log('Admin app running on http://localhost:3000');
}
bootstrap();

Guard & Role Check

Guards & Roles Summary