So I am currently using NestJS extensively in my organization. And for authentication purposes we are using our own guards. So my question is that can anyone please guide me if there any way to pass data from guard to the controller, other than response.locals of expressjs? This is creating an hard dependency on the framework and I don't want that at this moment.
TIA.
The only ways possible to pass data from a Guard to a Controller is to either attach the data to a field on the request or to use some sort of metadata reflection, which may become more challenging than it is worth.
In your guard you could have a canActivate function like
canActivate(context: ExecutionContext): boolean | Promise<boolean> | Observable<boolean> {
const req = context.switchToHttp().getRequest();
if (/* some logic with req */) {
req.myData = 'some custom value';
}
return true;
}
And in your controller you could then pull req.myData and get the some custom value string back.
Instead of using the Guard, you can create your custom decorator to get the data:
export const Authorization = createParamDecorator((_, request: any) => {
const { authorization: accessToken } = request.headers;
try {
const decoded = jwt.verify(accessToken, process.env.JWT_HASH);
return pick(decoded, 'userId');
} catch (ex) {
throw new InvalidToken();
}
});
export interface AuthUser {
userId: string;
}
And pass to your controller like this:
@Post()
createFeedback(
@Body() body: FeedbackBody,
@Authorization() user: AuthUser,
): Promise<Feedback> {
body.userId = user.userId;
return this.feedbackService.feedback(body, user);
}
This can act as a guard because when your token is invalid, it will throw an exception
You can use a combination of Decorator and Pipe to safely retrieve and transform data to what you need, for instance getting the user authenticated using a JSON Web Token.
Here is what it looks like in use in a controller.
// profile.controller.ts
import { Controller, Get } from '@nestjs/common';
import { AuthenticationToken } from 'src/authentication/authentication.decorator';
import { UserEntity } from 'src/users/users.entity';
import { UserFromTokenPipe } from 'src/users/users.pipe';
@Controller('profile')
export class ProfileController {
@Get()
public getProfile(@AuthenticationToken(UserFromTokenPipe) user: UserEntity) {
const { email, firstname, lastname } = user;
return {
email,
firstname,
lastname
}
}
}
Here is what it looks like in the decorator.
// authentication.decorator.ts
import { createParamDecorator, ExecutionContext, UnauthorizedException } from '@nestjs/common';
import { Request } from 'express';
export const AuthenticationToken = createParamDecorator((_data: unknown, context: ExecutionContext) => {
const request = context.switchToHttp().getRequest<Request>();
const authorizationToken = request.headers.authorization;
if (!authorizationToken) {
throw new UnauthorizedException("Missing authorization token");
}
const [bearer, token] = authorizationToken.split(' ');
if (bearer !== 'Bearer') {
throw new UnauthorizedException("Invalid authorization token type");
}
return token;
});
And here is what it looks like in the pipe.
// users.pipe.ts
import { ArgumentMetadata, Injectable, PipeTransform, UnauthorizedException } from '@nestjs/common';
import { JwtService } from '@nestjs/jwt';
import { UserRole } from './users.enum';
import { UsersService } from './users.service';
@Injectable()
export class UserFromTokenPipe implements PipeTransform {
public constructor(
private readonly jsonWebTokenService: JwtService,
private readonly usersService: UsersService
) { }
public async transform(token: string, _metadata: ArgumentMetadata) {
try {
const payload = this.jsonWebTokenService.verify(token);
const user = await this.usersService.findOneById(payload.id);
if (!user) {
throw new UnauthorizedException("Invalid user");
}
return user;
} catch (error) {
if (error instanceof UnauthorizedException) {
throw error;
}
throw new UnauthorizedException("Token");
}
}
}
By creating a parameter decorator and a pipe, you can virtually turn anything from the request into a concrete object, the most obvious is to turn a JSON Web Token into an authenticated user but I'll let you find other use cases as well.
as other guys said you can pass data on the request object on the guard but receiving them through the @Req decorator is not fancy, especially if you don't have any other use for the request object. You can create a custom decorator that will retrieve the data you want and inject them into any controller
