Role-based guards in NestJS - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ component_behavior

intermediate

What is the output of this NestJS guard when a user with role 'user' tries to access?

Consider this role-based guard in NestJS that allows access only to users with the 'admin' role.

import { CanActivate, ExecutionContext, Injectable } from '@nestjs/common';

@Injectable()
export class RolesGuard implements CanActivate {
  canActivate(context: ExecutionContext): boolean {
    const request = context.switchToHttp().getRequest();
    const user = request.user;
    return user?.roles?.includes('admin');
  }
}

If a request has user.roles = ['user'], what will the guard return?

A true

B false

C undefined

D throws a runtime error

💡 Hint

Check if the roles array includes 'admin'.

The guard checks if the user's roles array includes 'admin'. Since the user has only 'user' role, it returns false, denying access.

📝 Syntax

intermediate

Which option correctly applies a RolesGuard to a controller method in NestJS?

Given a RolesGuard class, which of the following code snippets correctly applies it to a controller method?

A

@UseGuards(RolesGuard)
@Get('admin')
getAdminData() { return 'data'; }

B

@UseGuard(RolesGuard)
@Get('admin')
getAdminData() { return 'data'; }

C

@UseGuards(RolesGuard())
@Get('admin')
getAdminData() { return 'data'; }

D

@UseGuards('RolesGuard')
@Get('admin')
getAdminData() { return 'data'; }

💡 Hint

Check the correct decorator name and usage syntax.

The correct decorator is @UseGuards with the guard class passed without parentheses. Option A is correct.

🔧 Debug

advanced

Why does this RolesGuard always deny access even for 'admin' users?

Examine this RolesGuard code:

import { CanActivate, ExecutionContext, Injectable } from '@nestjs/common';

@Injectable()
export class RolesGuard implements CanActivate {
  canActivate(context: ExecutionContext): boolean {
    const request = context.switchToHttp().getRequest();
    const user = request.user;
    if (!user) return false;
    if (user.roles === 'admin') {
      return true;
    }
    return false;
  }
}

Users have roles as an array of strings, e.g., ['admin']. Why does this guard deny access to admins?

A Because the guard never returns true

B Because request.user is undefined

C Because it compares an array to a string with ===, which is always false

D Because the guard is missing @Injectable decorator

💡 Hint

Check how roles are compared.

The guard compares user.roles (an array) to the string 'admin' using ===, which is always false. It should check if the array includes 'admin'.

❓ state_output

advanced

What is the value of 'hasAccess' after running this guard with user roles ['editor', 'admin']?

Given this guard snippet:

canActivate(context: ExecutionContext): boolean {
  const request = context.switchToHttp().getRequest();
  const user = request.user;
  const allowedRoles = ['admin', 'superuser'];
  const hasAccess = user.roles.some(role => allowedRoles.includes(role));
  return hasAccess;
}

If user.roles = ['editor', 'admin'], what is the value of hasAccess?

A true

B undefined

C throws a TypeError

D false

💡 Hint

Check if any user role matches allowedRoles.

The user has 'admin' role which is in allowedRoles, so some returns true.

🧠 Conceptual

expert

Which statement best describes the purpose of role-based guards in NestJS?

Choose the most accurate description of role-based guards in NestJS.

A They replace the need for authentication by verifying user identity

B They automatically assign roles to users when they log in

C They encrypt user roles to secure them in the database

D They restrict access to routes based on user roles by checking roles during request handling

💡 Hint

Think about what guards do in NestJS.

Role-based guards check user roles to allow or deny access to routes. They do not assign roles, encrypt data, or replace authentication.