5-implementing-role-based-access-control-with-jwt-in-a-nestjs-application.html

Implementing Role-Based Access Control with JWT in a NestJS Application

In today’s digital landscape, security is paramount, especially as applications scale and handle sensitive user data. One effective strategy to enhance security is implementing Role-Based Access Control (RBAC). In this article, we will explore how to implement RBAC using JSON Web Tokens (JWT) in a NestJS application, ensuring that your application is both secure and maintainable.

Understanding Role-Based Access Control (RBAC)

RBAC is a method for regulating access to computer or network resources based on the roles of individual users within an organization. Here’s how it works:

Roles: Defined sets of permissions assigned to users based on their job responsibilities.
Users: Individuals who have roles assigned to them, which dictate their access levels.
Permissions: Specific actions that users can perform, such as reading, writing, or executing.

Why Use RBAC?

Implementing RBAC can help:

Enhance Security: By limiting access, you reduce the risk of unauthorized actions.
Simplify Management: Easily manage user permissions by grouping them into roles.
Improve Compliance: Meet regulatory requirements by controlling user access to critical data.

Setting Up a NestJS Application

Before we dive into the implementation, let's set up a basic NestJS application. If you haven't already, make sure to install the NestJS CLI and create a new project:

npm i -g @nestjs/cli
nest new jwt-rbac-example
cd jwt-rbac-example

Installing Required Packages

To implement JWT and RBAC, we'll need the following packages:

npm install @nestjs/jwt @nestjs/passport passport passport-jwt bcryptjs
npm install --save-dev @types/passport-jwt

Implementing JWT Authentication

Step 1: Create the Authentication Module

First, create an authentication module to handle user login and token generation.

nest g module auth
nest g service auth
nest g controller auth

Step 2: User Entity and Service

Define a User entity and a simple service to simulate user fetching. For simplicity, we will hard-code users with roles.

// src/auth/user.entity.ts
export class User {
  id: number;
  username: string;
  password: string;
  role: string; // e.g., 'admin', 'user'
}

// src/auth/auth.service.ts
import { Injectable } from '@nestjs/common';
import { User } from './user.entity';

@Injectable()
export class AuthService {
  private readonly users: User[] = [
    { id: 1, username: 'admin', password: 'admin', role: 'admin' },
    { id: 2, username: 'user', password: 'user', role: 'user' },
  ];

  async validateUser(username: string, password: string): Promise<User | null> {
    const user = this.users.find(
      (user) => user.username === username && user.password === password,
    );
    return user || null;
  }
}

Step 3: Generating JWT Tokens

Next, use the JwtService to generate a token upon successful login.

import { Injectable } from '@nestjs/common';
import { JwtService } from '@nestjs/jwt';

@Injectable()
export class AuthService {
  constructor(private jwtService: JwtService) {}

  async login(user: User) {
    const payload = { username: user.username, role: user.role };
    return {
      access_token: this.jwtService.sign(payload),
    };
  }
}

Step 4: Creating the Auth Controller

Now, create an endpoint for user login in the Auth controller.

// src/auth/auth.controller.ts
import { Controller, Post, Body } from '@nestjs/common';
import { AuthService } from './auth.service';

@Controller('auth')
export class AuthController {
  constructor(private readonly authService: AuthService) {}

  @Post('login')
  async login(@Body() user: { username: string; password: string }) {
    const validatedUser = await this.authService.validateUser(user.username, user.password);
    if (!validatedUser) {
      throw new Error('Invalid credentials');
    }
    return this.authService.login(validatedUser);
  }
}