Metadata та Reflector

@Controller('reports')
export class ReportsController {
  @Get()
  @Roles('admin', 'manager')
  getReports() {
    return [];
  }
}

ключ: roles
значення: ['admin', 'manager']

import { Injectable } from '@nestjs/common';
import { Reflector } from '@nestjs/core';

@Injectable()
export class ExampleGuard {
  constructor(private readonly reflector: Reflector) {}
}

const roles = this.reflector.get<string[]>(
  ROLES_KEY,
  context.getHandler(),
);

const handler = context.getHandler();
const controller = context.getClass();

const roles = this.reflector.get<string[]>(
  ROLES_KEY,
  context.getHandler(),
);

const isPublic = this.reflector.getAllAndOverride<boolean>(
  IS_PUBLIC_KEY,
  [
    context.getHandler(),
    context.getClass(),
  ],
);

const roles = this.reflector.getAllAndMerge<string[]>(
  ROLES_KEY,
  [
    context.getHandler(),
    context.getClass(),
  ],
);

@Roles('employee')
@Controller('reports')
export class ReportsController {
  @Get('financial')
  @Roles('accountant')
  getFinancialReports() {
    return [];
  }
}

import {
  CallHandler,
  Controller,
  ExecutionContext,
  Get,
  Injectable,
  Module,
  NestInterceptor,
  SetMetadata,
  UseGuards,
  UseInterceptors,
  CanActivate,
} from '@nestjs/common';
import { NestFactory, Reflector } from '@nestjs/core';
import { Observable, tap } from 'rxjs';

const IS_PUBLIC_KEY = 'isPublic';
const ROLES_KEY = 'roles';
const AUDIT_KEY = 'audit';

export const Public = () => SetMetadata(IS_PUBLIC_KEY, true);

export const Roles = (...roles: string[]) =>
  SetMetadata(ROLES_KEY, roles);

export const Audit = (eventName: string) =>
  SetMetadata(AUDIT_KEY, eventName);

@Injectable()
class RolesGuard implements CanActivate {
  constructor(private readonly reflector: Reflector) {}

  canActivate(context: ExecutionContext): boolean {
    const isPublic = this.reflector.getAllAndOverride<boolean>(
      IS_PUBLIC_KEY,
      [
        context.getHandler(),
        context.getClass(),
      ],
    );

    if (isPublic) {
      return true;
    }

    const requiredRoles = this.reflector.getAllAndMerge<string[]>(
      ROLES_KEY,
      [
        context.getHandler(),
        context.getClass(),
      ],
    );

    // Якщо ролі не вказані, маршрут доступний для цього прикладу.
    if (requiredRoles.length === 0) {
      return true;
    }

    const request = context
      .switchToHttp()
      .getRequest<{ headers: Record<string, string | string[] | undefined> }>();

    const roleHeader = request.headers['x-role'];
    const userRole = Array.isArray(roleHeader)
      ? roleHeader[0]
      : roleHeader;

    return typeof userRole === 'string'
      && requiredRoles.includes(userRole);
  }
}

@Injectable()
class AuditInterceptor implements NestInterceptor {
  constructor(private readonly reflector: Reflector) {}

  intercept(
    context: ExecutionContext,
    next: CallHandler,
  ): Observable<unknown> {
    const eventName = this.reflector.getAllAndOverride<string>(
      AUDIT_KEY,
      [
        context.getHandler(),
        context.getClass(),
      ],
    );

    return next.handle().pipe(
      tap(() => {
        if (eventName) {
          console.log(`Аудит-подія: ${eventName}`);
        }
      }),
    );
  }
}

@Controller('reports')
@UseGuards(RolesGuard)
@UseInterceptors(AuditInterceptor)
export class ReportsController {
  @Get('public')
  @Public()
  getPublicReport() {
    return {
      message: 'Цей звіт доступний усім',
    };
  }

  @Get('internal')
  @Roles('employee', 'admin')
  @Audit('view_internal_report')
  getInternalReport() {
    return {
      message: 'Цей звіт доступний працівникам та адміністраторам',
    };
  }

  @Get('financial')
  @Roles('admin')
  @Audit('view_financial_report')
  getFinancialReport() {
    return {
      message: 'Цей звіт доступний лише адміністраторам',
    };
  }
}

@Module({
  controllers: [ReportsController],
  providers: [
    Reflector,
    RolesGuard,
    AuditInterceptor,
  ],
})
export class AppModule {}

async function bootstrap() {
  const app = await NestFactory.create(AppModule);
  await app.listen(3000);
}

bootstrap();

curl http://localhost:3000/reports/public

curl http://localhost:3000/reports/internal \
  -H "x-role: employee"

curl http://localhost:3000/reports/financial \
  -H "x-role: employee"

curl http://localhost:3000/reports/financial \
  -H "x-role: admin"

@Roles('employee')
@Controller('reports')
export class ReportsController {
  @Get()
  getReports() {
    return [];
  }
}

@Roles('employee')
@Controller('reports')
export class ReportsController {
  @Get()
  getReports() {
    return [];
  }

  @Get('financial')
  @Roles('admin')
  getFinancialReports() {
    return [];
  }
}

const eventName = this.reflector.getAllAndOverride<string>(
  AUDIT_KEY,
  [
    context.getHandler(),
    context.getClass(),
  ],
);

const roles = this.reflector.get<string[]>(
  ROLES_KEY,
  context.getHandler(),
);

const isPublic = this.reflector.get<boolean>(
  IS_PUBLIC_KEY,
  context.getHandler(),
);

type RateLimitOptions = {
  limit: number;
  windowSeconds: number;
};

const RATE_LIMIT_KEY = 'rateLimit';

export const RateLimit = (options: RateLimitOptions) =>
  SetMetadata(RATE_LIMIT_KEY, options);

const options = this.reflector.get<RateLimitOptions>(
  RATE_LIMIT_KEY,
  context.getHandler(),
);

import { Reflector } from '@nestjs/core';

export const Roles = Reflector.createDecorator<string[]>();

@Roles(['admin', 'manager'])
getReports() {
  return [];
}

const roles = this.reflector.get(
  Roles,
  context.getHandler(),
);

export const Roles = (...roles: string[]) =>
  SetMetadata(ROLES_KEY, roles);

const methodMetadata = this.reflector.get(
  KEY,
  context.getHandler(),
);

const classMetadata = this.reflector.get(
  KEY,
  context.getClass(),
);

this.reflector.getAllAndOverride(KEY, [
  context.getHandler(),
  context.getClass(),
]);

[
  context.getHandler(),
  context.getClass(),
]

const value = this.reflector.get<boolean>(
  KEY,
  context.getHandler(),
);

const enabled =
  this.reflector.get<boolean>(KEY, context.getHandler()) ?? false;

SetMetadata('config', ['admin']);
SetMetadata('config', true);

const ROLES_KEY = 'roles';
const IS_PUBLIC_KEY = 'isPublic';