Files
What you'll learn
- Describe what a Passport strategy is (a way of finding credentials in a request plus a verify step) and what @nestjs/passport turns it into (a guard)
- Write a local strategy whose validate() checks a username and password, and a JWT strategy configured to read a bearer token with a secret and an expiry
- Override handleRequest() in a guard that extends AuthGuard(), and explain why the default answers every strategy failure with a 401
- Wire strategies as providers, PassportModule as an import, and a global JWT guard that honours @Public()
Press Run tests to start the app. Its log appears here.Graded endpoints
Registration is unchanged; only the sign-in machinery moves to Passport
LocalAuthGuard ran the local strategy on the body's username and password; validate() returned the user, and the handler signed a token for it
A second token, with the user role
validate() found no user and threw; handleRequest() passed that 401 on
passport-local never calls validate() without both fields: it refuses with status 400 and Missing credentials, and handleRequest() answers with both instead of the default 401
JwtAuthGuard ran the JWT strategy: passport-jwt read the bearer token, verified it, and validate() shaped request.user
The global guard, and no @Public() here
passport-jwt verifies with the same secret and refuses
RolesGuard still reads request.user, now shaped by JwtStrategy.validate(), and finds no admin role
The admin role came through the token as before
@Public() still opens a route: the global guard checks it before calling into Passport
Any signed-in member of staff
Decrypted for staff, as in lesson 2
Admin only
The admin may
Public, and empty again