How do you implement row-level (resource-level) authorization to ensure users can only access their own records in NestJS?

Q: How do you implement row-level (resource-level) authorization to ensure users can only access their own records in NestJS?

@Injectable() export class OwnershipGuard implements CanActivate { constructor( private articlesService: ArticlesService, private reflector: Reflector, ) {} async canActivate(ctx: ExecutionContext): Promise { const req = ctx.switchToHttp().getRequest(); const user = req.user; const resourceId = +req.params.id; // Admins bypass ownership check if (user.roles.includes('admin')) return true; const article = await this.articlesService.findOne(resourceId); if (!article) throw new NotFoundException(); return article.authorId === user.id; } } // Apply to update and delete routes @UseGuards(JwtAuthGuard, OwnershipGuard) @Patch(':id') update(@Param('id', ParseIntPipe) id: number, @Body() dto: UpdateArticleDto) {} @UseGuards(JwtAuthGuard, OwnershipGuard) @Delete(':id') remove(@Param('id', ParseIntPipe) id: number) {} // Defense-in-depth — also scope DB queries to the user async findUserArticles(userId: number): Promise { return this.articleRepo.find({ where: { authorId: userId } }); // Never: return this.articleRepo.find() — returns ALL articles } Never rely solely on the guard — always scope database queries to the authenticated user as defense-in-depth. Load the resource inside the guard to check ownership — do not trust the client to send the owner ID. Throw NotFoundException (not ForbiddenException) when the resource does not exist — prevents resource enumeration. Admins typically bypass ownership checks — check role first to avoid an unnecessary database query. Consider caching the loaded resource in the request so the controller handler does not need to re-fetch it.

Difficulty: 6/10

Guards, Policies, Database Query Filtering

Build an OwnershipGuard that loads the resource and compares its owner ID against the authenticated user's ID. Admins bypass the check via a role shortcut. Pair the guard with service-level query scoping as defense-in-depth — never rely solely on the guard.

OwnershipGuard and service-level query scoping

Row-level authorization design principles:

1
Never rely solely on the guard — always scope database queries to the authenticated user as defense-in-depth.
2

How do you implement row-level (resource-level) authorization to ensure users can only access their own records in NestJS?

Difficulty: 6/10

Guards, Policies, Database Query Filtering

Build an OwnershipGuard that loads the resource and compares its owner ID against the authenticated user's ID. Admins bypass the check via a role shortcut. Pair the guard with service-level query scoping as defense-in-depth — never rely solely on the guard.

OwnershipGuard and service-level query scoping

Row-level authorization design principles:

1
Never rely solely on the guard — always scope database queries to the authenticated user as defense-in-depth.
2

How do you implement row-level (resource-level) authorization to ensure users can only access their own records in NestJS?

Build an OwnershipGuard that loads the resource and compares its owner ID against the authenticated user's ID. Admins bypass the check via a role shortcut. Pair the guard with service-level query scoping as defense-in-depth — never rely solely on the guard.

How do you implement row-level (resource-level) authorization to ensure users can only access their own records in NestJS?

Build an OwnershipGuard that loads the resource and compares its owner ID against the authenticated user's ID. Admins bypass the check via a role shortcut. Pair the guard with service-level query scoping as defense-in-depth — never rely solely on the guard.

Scenario Questions

Follow-up Questions