What is RBAC and how do you implement a basic roles guard in NestJS?

Question

Accepted Answer

// 1. Define the roles enum
export enum Role { USER = 'user', ADMIN = 'admin', MODERATOR = 'moderator' }

// 2. Create the @Roles() decorator
export const Roles = (...roles: Role[]) => SetMetadata('roles', roles);

// 3. Build the guard
@Injectable()
export class RolesGuard implements CanActivate {
  constructor(private reflector: Reflector) {}

canActivate(ctx: ExecutionContext): boolean {
    const required = this.reflector.getAllAndOverride<Role[]>('roles', [
      ctx.getHandler(),
      ctx.getClass(),
    ]);
    if (!required?.length) return true; // no roles required
    const { user } = ctx.switchToHttp().getRequest();
    return required.some(role => user?.roles?.includes(role));
  }
}

// 4. Apply — run after JwtAuthGuard so req.user is populated
@UseGuards(JwtAuthGuard, RolesGuard)
@Roles(Role.ADMIN)
@Delete(':id')
remove(@Param('id', ParseIntPipe) id: number) {}

@UseGuards(JwtAuthGuard, RolesGuard)
@Roles(Role.ADMIN, Role.MODERATOR) // either role is sufficient
@Patch(':id/status')
setStatus(@Param('id', ParseIntPipe) id: number) {} getAllAndOverride(key, [handler, class]) — method-level roles override class-level roles. Return true when no roles are required — routes without @Roles() are accessible to all authenticated users. Use some() not every() — the user needs at least one of the required roles, not all. Always run RolesGuard AFTER JwtAuthGuard — req.user must be populated before roles can be checked. Register RolesGuard via APP_GUARD alongside JwtAuthGuard for global application.

What is RBAC and how do you implement a basic roles guard in NestJS?

Scenario Questions

Follow-up Questions