How do you test authentication guards and strategies in NestJS?

Question

Accepted Answer

// Unit test — JwtAuthGuard with mocked Reflector
describe('JwtAuthGuard', () => {
  let guard: JwtAuthGuard;
  const reflector = { getAllAndOverride: jest.fn() };

beforeEach(async () => {
    const module = await Test.createTestingModule({
      providers: [
        JwtAuthGuard,
        { provide: Reflector, useValue: reflector },
      ],
    }).compile();
    guard = module.get(JwtAuthGuard);
  });

it('allows public routes without a token', () => {
    reflector.getAllAndOverride.mockReturnValue(true); // isPublic = true
    const ctx = mockExecutionContext({});
    expect(guard.canActivate(ctx)).toBe(true);
  });
});

// E2E test — full auth flow with supertest
describe('Auth (e2e)', () => {
  let app: INestApplication;
  let jwtToken: string;

beforeAll(async () => {
    const module = await Test.createTestingModule({ imports: [AppModule] })
      .overrideProvider(UsersService)
      .useValue({ findByEmail: jest.fn().mockResolvedValue(testUser), findOne: jest.fn().mockResolvedValue(testUser) })
      .compile();
    app = module.createNestApplication();
    await app.init();

const res = await request(app.getHttpServer())
      .post('/auth/login')
      .send({ email: 'test@test.com', password: 'password' });
    jwtToken = res.body.accessToken;
  });

it('GET /profile returns 401 without token', () =>
    request(app.getHttpServer()).get('/profile').expect(401));

it('GET /profile returns 200 with valid token', () =>
    request(app.getHttpServer())
      .get('/profile')
      .set('Authorization', `Bearer ${jwtToken}`)
      .expect(200));
}); Unit test guards by calling canActivate() directly with a mock ExecutionContext — no HTTP needed. Mock Reflector with jest.fn() and control getAllAndOverride return values per test case. E2E tests should use .overrideProvider() to swap UsersService with a mock — no real database needed. Always test both the unauthenticated (401) and authenticated (200) paths for protected routes. Test role-based routes with tokens carrying different role claims — assert 403 for insufficient roles.

How do you test authentication guards and strategies in NestJS?

Unit test guards by creating a TestingModule with a mocked Reflector and calling canActivate() directly with a mock ExecutionContext. E2E test the full auth flow using supertest — log in to get a real JWT, then assert that protected routes return 401 without it and 200 with it.

How do you test authentication guards and strategies in NestJS?

Unit test guards by creating a TestingModule with a mocked Reflector and calling canActivate() directly with a mock ExecutionContext. E2E test the full auth flow using supertest — log in to get a real JWT, then assert that protected routes return 401 without it and 200 with it.

Scenario Questions

Follow-up Questions