How should authentication and permissions work?

Definition:

Authentication establishes who the caller is, and permissions determine which actions and records that caller may access. In Nest, guards commonly apply these checks before controller execution, often using Passport strategies for authentication. Resource-level checks still need enough context to enforce ownership and tenant rules.

Key points:

• An authentication guard validates credentials and attaches the user.

• A permission guard checks access to the action or resource.

• Check ownership and tenant boundaries too; a role alone may not be enough.

• Never accept a requested role or tenant from the body as proof of the caller's authority.

Interview point:

• A valid token proves only the validated claims; it does not automatically authorize every route or database row.