How do you implement role-based access control (RBAC) with a guard and Reflector in NestJS?

Q: How do you implement role-based access control (RBAC) with a guard and Reflector in NestJS?

// 1. Define the decorator export const Roles = (...roles: string[]) => SetMetadata('roles', roles); // 2. Build the guard @Injectable() export class RolesGuard implements CanActivate { constructor(private reflector: Reflector) {} canActivate(ctx: ExecutionContext): boolean { const required = this.reflector.getAllAndOverride ('roles', [ ctx.getHandler(), // method-level first ctx.getClass(), // class-level fallback ]); if (!required?.length) return true; // no roles = public const { user } = ctx.switchToHttp().getRequest(); return required.some(role => user?.roles?.includes(role)); } } // 3. Apply on a controller and override at method level @Roles('user') @UseGuards(JwtAuthGuard, RolesGuard) @Controller('content') export class ContentController { @Roles('admin') // overrides class-level 'user' @Delete(':id') remove() {} } getAllAndOverride(key, [handler, class]) — returns first defined value; method overrides class. get(key, target) — reads metadata from a single target only. getAllAndMerge(key, [handler, class]) — merges arrays from both targets into one. Use getAllAndOverride for RBAC so method-level roles can override class-level defaults.

Difficulty: 7/10

Guards, Reflector metadata, RBAC implementation

Define a @Roles() decorator using SetMetadata, build a RolesGuard that reads the metadata via Reflector.getAllAndOverride(), and apply both globally or per route. getAllAndOverride returns the first defined value — method-level metadata overrides class-level, which is the correct inheritance behavior for RBAC.

Full RBAC implementation

Reflector methods for metadata reading:

1
getAllAndOverride(key, [handler, class]) — returns first defined value; method overrides class.
2
get(key, target) — reads metadata from a single target only.

How do you implement role-based access control (RBAC) with a guard and Reflector in NestJS?

Difficulty: 7/10

Guards, Reflector metadata, RBAC implementation

Define a @Roles() decorator using SetMetadata, build a RolesGuard that reads the metadata via Reflector.getAllAndOverride(), and apply both globally or per route. getAllAndOverride returns the first defined value — method-level metadata overrides class-level, which is the correct inheritance behavior for RBAC.

Full RBAC implementation

Reflector methods for metadata reading:

1
getAllAndOverride(key, [handler, class]) — returns first defined value; method overrides class.
2
get(key, target) — reads metadata from a single target only.

How do you implement role-based access control (RBAC) with a guard and Reflector in NestJS?

How do you implement role-based access control (RBAC) with a guard and Reflector in NestJS?

Scenario Questions

Follow-up Questions