NestJS Guards & Authorization

npm i @nestjs/jwt

import {
  Injectable,
  CanActivate,
  ExecutionContext,
  UnauthorizedException,
} from "@nestjs/common";
import { JwtService } from "@nestjs/jwt";
import { Request } from "express";

@Injectable()
export class AuthGuard implements CanActivate {
  constructor(private jwtService: JwtService) {}

  async canActivate(context: ExecutionContext): Promise<boolean> {
    const request = context.switchToHttp().getRequest<Request>();
    const token = this.extractToken(request);

    if (!token) {
      throw new UnauthorizedException("Login প্রয়োজন");
    }

    try {
      const payload = await this.jwtService.verifyAsync(token);
      request["user"] = payload; // controller-এ access
    } catch {
      throw new UnauthorizedException("Invalid token");
    }

    return true;
  }

  private extractToken(request: Request): string | undefined {
    const [type, token] = request.headers.authorization?.split(" ") ?? [];
    return type === "Bearer" ? token : undefined;
  }
}

import { Controller, Get, UseGuards } from "@nestjs/common";
import { AuthGuard } from "../auth/auth.guard";

@Controller("profile")
@UseGuards(AuthGuard) // পুরো controller protected
export class ProfileController {
  @Get()
  getProfile(@Req() req: Request) {
    return { user: req["user"] };
  }

  @Get("public")
  // এটা কোনো guard ছাড়া ধরে দরকার হলে override
  publicEndpoint() {
    return { message: "public" };
  }
}

import { SetMetadata } from "@nestjs/common";

export const ROLES_KEY = "roles";
export const Roles = (...roles: string[]) =>
  SetMetadata(ROLES_KEY, roles);

import { Injectable, CanActivate, ExecutionContext, ForbiddenException } from "@nestjs/common";
import { Reflector } from "@nestjs/core";
import { ROLES_KEY } from "./roles.decorator";

@Injectable()
export class RolesGuard implements CanActivate {
  constructor(private reflector: Reflector) {}

  canActivate(context: ExecutionContext): boolean {
    const requiredRoles = this.reflector.getAllAndOverride<string[]>(
      ROLES_KEY,
      [context.getHandler(), context.getClass()],
    );

    if (!requiredRoles) return true;

    const { user } = context.switchToHttp().getRequest();
    if (!user?.role || !requiredRoles.includes(user.role)) {
      throw new ForbiddenException("অনুমতি নেই");
    }
    return true;
  }
}

@Controller("admin")
@UseGuards(AuthGuard, RolesGuard)
export class AdminController {
  @Get()
  @Roles("admin") // শুধু admin
  dashboard() {
    return { message: "Admin panel" };
  }
}

// main.ts
const app = await NestFactory.create(AppModule);
app.useGlobalGuards(new RolesGuard());
// app.module-এ providers সেকশনে ensure করুন