Role-based authorization in NestJS - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ component_behavior

intermediate

What is the output of this NestJS guard when a user with role 'user' accesses an admin route?

Consider this NestJS guard that checks if the user has the 'admin' role:

import { CanActivate, ExecutionContext, Injectable } from '@nestjs/common';

@Injectable()
export class RolesGuard implements CanActivate {
  canActivate(context: ExecutionContext): boolean {
    const request = context.switchToHttp().getRequest();
    const user = request.user;
    return user?.roles?.includes('admin');
  }
}

If a request has user.roles = ['user'], what will the guard return?

A false

B true

C throws an error

D undefined

💡 Hint

Check if the roles array includes 'admin'.

The guard returns true only if the user's roles include 'admin'. Since the user has only 'user' role, it returns false.

📝 Syntax

intermediate

Which option correctly applies a RolesGuard to a NestJS controller route?

Given a RolesGuard and a Roles decorator, which code snippet correctly protects the getAdminData route to only allow 'admin' role users?

A

@Get('admin')
@UseGuards(RolesGuard)
@Roles('admin')
getAdminData() { return 'secret'; }

B

@Roles('admin')
@UseGuards(RolesGuard)
@Get('admin')
getAdminData() { return 'secret'; }

C

@UseGuards(RolesGuard)
@Roles('admin')
@Get('admin')
getAdminData() { return 'secret'; }

D

@Get('admin')
@Roles('admin')
@UseGuards(RolesGuard)
getAdminData() { return 'secret'; }

💡 Hint

Order of decorators matters: guards should be applied before roles.

In NestJS, @UseGuards should be placed before @Roles to ensure the guard runs with the roles metadata available.

🔧 Debug

advanced

Why does this RolesGuard always deny access even for 'admin' users?

Look at this RolesGuard code:

canActivate(context: ExecutionContext): boolean {
  const request = context.switchToHttp().getRequest();
  const user = request.user;
  const requiredRoles = this.reflector.get('roles', context.getHandler());
  return requiredRoles.some(role => user.roles.includes(role));
}

Even when the user has the 'admin' role and the route requires 'admin', access is denied. Why?

A requiredRoles is undefined

B this.reflector is undefined or not injected

C user.roles is undefined

D some() returns false if user.roles is empty

💡 Hint

Check if this.reflector is properly set up.

If this.reflector is not injected via constructor, it will be undefined, causing requiredRoles to be undefined and the guard to fail.

❓ state_output

advanced

What is the value of 'isAuthorized' after this NestJS guard runs?

Given this guard snippet:

canActivate(context: ExecutionContext): boolean {
  const request = context.switchToHttp().getRequest();
  const user = request.user;
  const roles = ['admin', 'editor'];
  const isAuthorized = roles.some(role => user.roles?.includes(role));
  return isAuthorized;
}

If user.roles = ['viewer', 'editor'], what is the value of isAuthorized?

A false

B throws an error

C undefined

D true

💡 Hint

Check if any role in ['admin', 'editor'] is in user.roles.

The user has 'editor' role which matches one in the roles array, so isAuthorized is true.

🧠 Conceptual

expert

Which statement best describes the role of the Reflector in NestJS role-based authorization?

In NestJS, the Reflector class is often used in guards for role-based authorization. What is its main purpose?

A It retrieves metadata set by decorators on route handlers or controllers.

B It manages user session data during authorization.

C It encrypts role information before checking access.

D It automatically injects user roles into the request object.

💡 Hint

Think about how decorators store information in NestJS.

The Reflector reads metadata added by decorators like @Roles() to determine which roles are required for a route.