Questions
5 of 6
1How do you implement a @Public() decorator to skip a global auth guard for specific routes in NestJS?
2What is a guard in NestJS and when should you use one over middleware?
3How do you write a single guard that works across both HTTP and WebSocket transports in NestJS?
4How does the request lifecycle behave differently for WebSocket gateways vs HTTP controllers in NestJS?
5How do you implement role-based access control (RBAC) with a guard and Reflector in NestJS?
6What does a guard return when it needs to deny the request and how can it throw a custom exception in NestJS?
NestJSNestJS
Basics
Modules
Decorators
Controllers
Dependency Injection
Providers
Architecture
Request Lifecycle
Middleware
Guards
Interceptors
Pipes
Filters
Exception Handling
API Design
GraphQL
Database and ORM
Microservices
Authentication and Authorization
05 / 06

How do you implement role-based access control (RBAC) with a guard and Reflector in NestJS?

Define a @Roles() decorator using SetMetadata, build a RolesGuard that reads the metadata via Reflector.getAllAndOverride(), and apply both globally or per route. getAllAndOverride returns the first defined value — method-level metadata overrides class-level, which is the correct inheritance behavior for RBAC.

Full RBAC implementation
Reflector methods for metadata reading:
  1. 1

    getAllAndOverride(key, [handler, class]) — returns first defined value; method overrides class.

  2. 2

    get(key, target) — reads metadata from a single target only.

  3. 3

    getAllAndMerge(key, [handler, class]) — merges arrays from both targets into one.

  4. 4

    Use getAllAndOverride for RBAC so method-level roles can override class-level defaults.