Guards suna ƙayyadewa ko aikace-aikace aika wajen dakin da ƙa'idodin — suke abin buƙacce na NestJS na ƙarewa don ikon (authorization) (kuma sau da yawa dukoki na tabbatar). Guard yana dawo true don ba da izini ga wajazo ko false/jajiya don katse shi.
@Injectable()
export class AuthGuard implements CanActivate {
canActivate(context: ExecutionContext): boolean {
const request = context.switchToHttp().getRequest();
return !!request.headers.authorization; // true = allow, false = block (403)
}
}
Guard yana aiwatar da canActivate(), wanda ke komawa boolean (ko Promise/Observable na wannan). Komawa false yana katse wajazo tare da 403; kuna iya jajiyar keɓantaccen karya (misali UnauthorizedException).
@UseGuards(AuthGuard) // on a single route
@Get("profile")
getProfile() {}
@UseGuards(AuthGuard) // on a whole controller (all routes)
@Controller("admin")
export class AdminController {}
app.useGlobalGuards(new AuthGuard()); // globally (all routes)
Ana iya aiwatar da guards a matakin aiki, jantacin ƙa'ida, ko jama'a.
@Injectable()
export class JwtAuthGuard implements CanActivate {
constructor(private jwtService: JwtService) {}
async canActivate(context: ExecutionContext): Promise<boolean> {
const request = context.switchToHttp().getRequest();
const token = request.headers.authorization?.split(" ")[1];
if (!token) throw new UnauthorizedException();
try {
request.user = await this.jwtService.verifyAsync(token); // attach the user
return true;
} catch {
throw new UnauthorizedException("Invalid token");
}
}
}
// a @Roles decorator stores required roles as metadata
@Roles("admin")
@Get("users")
listUsers() {}
// the RolesGuard reads the metadata and checks the user's roles
@Injectable()
export class RolesGuard implements CanActivate {
constructor(private reflector: Reflector) {}
canActivate(ctx: ExecutionContext): boolean {
const roles = this.reflector.get<string[]>("roles", ctx.getHandler());
const { user } = ctx.switchToHttp().getRequest();
return roles.some(role => user.roles?.includes(role)); // allow if the user has a required role
}
}
Hada ƙirja @Roles() (metadata) tare da guard da ke karantawa (ta hanyar Reflector) shine tsarin daidai ga ikon isa ga matsayi ƙa'ida.
The ExecutionContext gives guards rich info (the handler, class, request) — more
than plain middleware — which is why guards (not middleware) are the right place
for authorization decisions.
Guards sune abin buƙacce na NestJS da kuma dace don ikon (authorization) — ƙayyadewa wajen wajazo waɗanda aka ba izini karuwa zuwa handlers bisa ga tabbatar da ba'a.
Ganin su ya zama dole saboda kusan kowane aikace-aikace na ainihi yana bukatar karya hanyoyin gida (bukaci shiga, duba matsayi/ba'a), kuma guards ne babbar gida ga aiki wannan (fiye da marubace ilimin tabbatar a cikin middleware ko kowane handler).
Tsarin daidai — guard JWT/tabbatar wanda ke dukowa credantials kuma yana jajiyar ma'aikacin zuwa wajazo, da guards isa ga matsayi haɗu ƙirja @Roles() tare da guard karantawa ta Reflector ga RBAC — aka kira asali don kariyar NestJS APIs.
Goyon bayan guards ga rich ExecutionContext (sanin abin da ya buƙata, ajin da wajazo) shine ki'i daidai wanda ya buga su ma'aikacin wasan karya na izini waɗanda middleware ba ɗan shiga kyau ba.
Sanin yadda za a rubuta, aiwatar (aiki/jantacin ƙa'ida/jama'a), da haɗi da guards tare da alaƙa metadata shekaru ne muhimman ilimi don gina jiya NestJS kuma maɗaukaki, architektural-mahimmi ba'a a gida.