What is Reflector and how does it work with SetMetadata in NestJS?

Q: What is Reflector and how does it work with SetMetadata in NestJS?

// roles.decorator.ts export const Roles = (...roles: string[]) => SetMetadata('roles', roles); // roles.guard.ts @Injectable() export class RolesGuard implements CanActivate { constructor(private reflector: Reflector) {} canActivate(context: ExecutionContext): boolean { const roles = this.reflector.getAllAndOverride ('roles', [ context.getHandler(), // method-level metadata first context.getClass(), // class-level metadata as fallback ]); if (!roles) return true; // no roles required const { user } = context.switchToHttp().getRequest(); return roles.some(role => user.roles.includes(role)); } } // Usage @Roles('admin') @Get('secret') adminRoute() {} get(key, target) — reads metadata from a single target. getAllAndOverride(key, targets) — returns first defined value across targets; method overrides class. getAllAndMerge(key, targets) — merges arrays/objects from all targets.

Difficulty: 5/10

custom decorators, metadata reflection, authorization guards

SetMetadata(key, value) attaches metadata to a class or method using Reflect.defineMetadata. Reflector is a helper injected into guards and interceptors to read that metadata using getAllAndOverride or getAllAndMerge. This is the standard pattern for RBAC guards and feature flags.

SetMetadata + Reflector pattern for RBAC

Reflector methods:

1
get(key, target) — reads metadata from a single target.
2
getAllAndOverride(key, targets) — returns first defined value across targets; method overrides class.
3
getAllAndMerge(key, targets) — merges arrays/objects from all targets.

Scenario Questions

0-2 years experience

1How would you create a custom @Public() decorator with SetMetadata and use Reflector in a guard to allow unauthenticated access?
2If you forget to inject Reflector into a guard that reads SetMetadata, what error or behavior would you observe when a request hits the endpoint?
3After applying @SetMetadata('isPublic', true) to a controller method, what value does reflector.get('isPublic', context.getHandler()) return?

Follow-up Questions

Can you sketch the code for a @Public() decorator using SetMetadata?
What happens if two decorators write different values to the same metadata key on a method?
How does NestJS handle metadata inheritance from a controller class to its methods?