NestJS · Middle · Question 30 of 75

How do you implement permission rules more fine-grained than roles, e.g. 'users can edit only their own posts'?

1Roles are the only option in Nest
✓Correct answer: With policy-based authorization (e.g. CASL abilities) checked in a guard or in the service, comparing the resource owner to the user
3With ValidationPipe

Explanation

Ownership checks often need the loaded resource, so they usually live in the service after fetching it.

Further reading

Test yourself

Take the NestJS · Middle quiz: questions and options are shuffled, and you get a review of your mistakes at the end.