**Course Title:** Mastering NestJS: Building Scalable Server-Side Applications **Section Title:** Security Best Practices in NestJS **Topic:** Securing routes and handling user roles As we continue to build robust and scalable server-side applications with NestJS, it's essential to focus on security best practices. In this topic, we'll explore how to secure routes and handle user roles effectively. ### Securing Routes with Guards In NestJS, we can use guards to secure routes based on various conditions, such as authentication, authorization, or role-based access control. Let's create a simple example of a guard that checks if a user is authenticated before allowing access to a protected route. **auth.guard.ts** ```typescript import { CanActivate, ExecutionContext, Injectable } from '@nestjs/common'; import { Reflector } from '@nestjs/core'; import { Observable } from 'rxjs'; @Injectable() export class AuthGuard implements CanActivate { constructor(private reflector: Reflector) {} canActivate(context: ExecutionContext): boolean { const requiredRoles = this.reflector.getAllAndMerge('roles') as string[]; if (requiredRoles.length === 0) { return true; } const request = context.switchToHttp().getRequest(); const user = request.user; const hasRole = requiredRoles.some((role) => user.roles.includes(role)); return hasRole; } } ``` In this example, we're using the `@nestjs/common` and `@nestjs/core` packages to create a guard that checks if the user has the required roles. We're also using the `Reflector` to get the required roles from the route metadata. **app.module.ts** ```typescript import { Module } from '@nestjs/common'; import { AppController } from './app.controller'; import { AppService } from './app.service'; import { AuthGuard } from './auth.guard'; @Module({ controllers: [AppController], providers: [AppService, AuthGuard], }) export class AppModule {} ``` In this example, we're adding the `AuthGuard` to the `AppModule` providers. **app.controller.ts** ```typescript import { Controller, Get, UseGuards } from '@nestjs/common'; import { AuthGuard } from './auth.guard'; @Controller() export class AppController { @Get('protected') @UseGuards(AuthGuard) protectedRoute() { return 'Hello World!'; } } ``` In this example, we're using the `@UseGuards` decorator to apply the `AuthGuard` to the `protectedRoute` method. ### Handling User Roles In NestJS, we can use the `@Roles` decorator to specify the required roles for a route. Let's create a simple example of a route that requires a specific role. **roles.decorator.ts** ```typescript import { SetMetadata } from '@nestjs/common'; export const Roles = (...roles: string[]) => SetMetadata('roles', roles); ``` In this example, we're creating a decorator that sets the `roles` metadata on the route. **app.controller.ts** ```typescript import { Controller, Get, UseGuards } from '@nestjs/common'; import { Roles } from './roles.decorator'; import { AuthGuard } from './auth.guard'; @Controller() export class AppController { @Get('protected') @Roles('admin') @UseGuards(AuthGuard) protectedRoute() { return 'Hello World!'; } } ``` In this example, we're using the `@Roles` decorator to specify the required role for the `protectedRoute` method. ### Conclusion In this topic, we've explored how to secure routes and handle user roles in NestJS. We've created a simple example of a guard that checks if a user is authenticated before allowing access to a protected route. We've also created a decorator that specifies the required roles for a route. By using these techniques, you can create robust and scalable server-side applications with NestJS. ### Exercise Create a new route that requires a specific role. Use the `@Roles` decorator to specify the required role and the `AuthGuard` to check if the user has the required role. ### Resources * [NestJS Documentation: Guards](https://docs.nestjs.com/guards) * [NestJS Documentation: Decorators](https://docs.nestjs.com/decorators) ### Leave a comment or ask for help If you have any questions or need help with this topic, please leave a comment below.