[Solved] Why does this role-based guard fail to restrict access?canActivate(context: ExecutionContext) { const roles = this.reflector.get('roles', context.getHandler()); const user = context.switchToHttp().... | NestJS

NestJS - Guards

Why does this role-based guard fail to restrict access?

canActivate(context: ExecutionContext) { const roles = this.reflector.get('roles', context.getHandler()); const user = context.switchToHttp().getRequest().user; return roles.includes(user.roles); }

Auser.roles is an array but includes expects a string

Broles is undefined due to missing metadata

CUsing includes on roles array is incorrect

DNo error, guard works correctly

Step-by-Step Solution

Solution:

Step 1: Analyze user.roles type
user.roles is likely an array of roles, but includes expects a single string.
Step 2: Understand includes method
includes checks if a single element exists, not an array inside an array.
Final Answer:
user.roles is an array but includes expects a string -> Option A
Quick Check:
includes expects single value, not array [OK]

Quick Trick: Check types: includes needs single value, not array [OK]

Common Mistakes:

Passing array to includes instead of single role
Assuming roles metadata is always present
Confusing includes with some

Master "Guards" in NestJS

9 interactive learning modes - each teaches the same concept differently

Learn Why Deep Visual Try Challenge Project Recall Perf

More NestJS Quizzes

Why does this role-based guard fail to restrict access?

Step 1: Analyze user.roles type

Step 2: Understand includes method

Final Answer:

Quick Check:

Want More Practice?