Role-based authentication is a method of access control that regulates user permissions and privileges within a system based on their assigned roles. In this approach, users are categorized into roles based on their job responsibilities, functions, or levels of authority within an organization.

Each role is associated with a set of permissions that determine what actions and resources a user with that role can access. These permissions can include read, write, modify, delete, and other operations on various system resources such as files, databases, or functionalities.

We have to restrict the access of creating songs endpoint. Only artists can access this endpoint and create a song

import { Module } from "@nestjs/common";
import { ArtistsService } from "./artists.service";
import { TypeOrmModule } from "@nestjs/typeorm";
import { Artist } from "./artist.entity";

@Module({
  imports: [TypeOrmModule.forFeature([Artist])],
  providers: [ArtistsService],
  exports: [ArtistsService],
})
export class ArtistsModule {}

import { AuthModule } from './auth/auth.module';


@Module({
imports: [
  PlayListModule,
  UsersModule,
  AuthModule,
  ArtistsModule,
],
})

import { Injectable } from "@nestjs/common";
import { InjectRepository } from "@nestjs/typeorm";
import { Repository } from "typeorm";
import { Artist } from "./artist.entity";

@Injectable()
export class ArtistsService {
  constructor(
    @InjectRepository(Artist)
    private artistRepo: Repository<Artist>
  ) {}

  findArtist(userId: number): Promise<Artist> {
    return this.artistRepo.findOneBy({ user: { id: userId } });
  }
}

We will use the findArtist method to check if the current logged in user is an artist or not.

constructor(
private userService: UsersService,
private jwtService: JwtService,
private artistService: ArtistsService,
) {}

---
title: Role-Based Authentication
privateVideoUrl: https://fullstack.wistia.com/medias/i4t0vkpxgq
isPublicLesson: true
---

### What is Role-based Authentication

Role-based authentication is a method of access control that regulates user permissions and privileges within a system based on their assigned roles. In this approach, users are categorized into roles based on their job responsibilities, functions, or levels of authority within an organization.

Each role is associated with a set of permissions that determine what actions and resources a user with that role can access. These permissions can include read, write, modify, delete, and other operations on various system resources such as files, databases, or functionalities.

We are going to implement this scenario:

-   An artist can upload/create the song

We have to restrict the access of creating songs endpoint. Only artists can access this endpoint and create a song

### Create an Artists Module

```ts
import { Module } from "@nestjs/common";
import { ArtistsService } from "./artists.service";
import { TypeOrmModule } from "@nestjs/typeorm";
import { Artist } from "./artist.entity";

@Module({
  imports: [TypeOrmModule.forFeature([Artist])],
  providers: [ArtistsService],
  exports: [ArtistsService],
})
export class ArtistsModule {}
```

### Add ArtistsModule into AppModule

```ts
import { AuthModule } from './auth/auth.module';


@Module({
imports: [
  PlayListModule,
  UsersModule,
  AuthModule,
  ArtistsModule,
],
})
```

### Create ArtistsService

```ts
import { Injectable } from "@nestjs/common";
import { InjectRepository } from "@nestjs/typeorm";
import { Repository } from "typeorm";
import { Artist } from "./artist.entity";

@Injectable()
export class ArtistsService {
  constructor(
    @InjectRepository(Artist)
    private artistRepo: Repository<Artist>
  ) {}

  findArtist(userId: number): Promise<Artist> {
    return this.artistRepo.findOneBy({ user: { id: userId } });
  }
}
```

We will use the findArtist method to check if the current logged in user is an artist or not.

### Refactor login method in AuthService

```ts
constructor(
private userService: UsersService,
private jwtService: JwtService,
private artistService: ArtistsService,
) {}
```

You have to inject the artist's service in the `AuthService` constructor

```ts
const payload: PayloadType = { email: user.email, userId: user.id }; // 1

// find if it is an artist then the add the artist id to payload
const artist = await this.artistService.findArtist(user.id); // 2
if (artist) {
  // 3
  payload.artistId = artist.id;
}
```

1.  Refactor the payload method in the login function by changing `sub: user.id` to `userId: user.id`.
2.  Find the artist based on the logged-in user.
3.  If the user is an artist, save the artist ID in the payload; this artist ID will be used when decoding the token in the ArtistGuard.

Haider Malik

Role-Based Authentication

In this lesson, I'm going to teach you how to implement role-based

If your application has multiple roles like artist, manager, user, accountant,

you can have different functionalities for each role.

In Spotify clone, when you look at this Spotify clone, only artist can upload a

If you are a user, let me show you with the help of Spotify.

If I go to my profile, I don't have any feature to upload a song.

Only approved artist can upload this song or delete this song.

In this way, you can divide your application into multiple roles.

I would like to restrict this endpoint for other users.

Only artist should access this create song endpoint.

We don't have artist module, we have to create artist module.

Then we are going to implement the artist module into import the artist module

We have to write a method, find artist on the base on user ID.

Then we got to add a logic here inside the login method.

We will save the artist ID in the payload object.

Then you have to create a new payload type.

Remember, I told you, if you want to customize or add a logic in the guard, you

Then here we are using the handle request method.

This function will check if you have artist, if you are an artist, then it is

We have to refactor the validate method in JWT strategy.

Then here you will have to apply JWT artist guard on the create song endpoint.

You can do that as well or you can follow me.

It has already imported into my app module.

You have to import type oram artist entity module.for feature because I would

We have to provide the artist as an entity.

We have the artist service and we also need artist controller.

I can use li, nest generate controller artist.

Now we are going to create the find artist method.

I am going to copy my code inside the artist service.

We need to import couple of dependencies.

We have to find the artist on the based on user ID.

Our next step is to refactor the login method inside the auth service.

We need to add artist ID inside the payload type inside the payload.

If password matched find if user is an artist then we need to add the artist ID

I can say because I can save the artist ID in the payload object.

User. payload.artist ID should be it is saying that you don't have artist ID in

You can create a payload type inside the types payload.type.

We have mentioned the artist ID is an optional property.

Let's say I am going to create a new guard inside the auth.

All I need to call this super constructor.

Superdome can activate and provide the context.

If there is an error or there is no user, then you have to throw the

If everything is good to go, you have to return the user.

If there is an artist ID, then we should return the user.

When you apply the artist JWT guard, it should call the handle request.

It will extract the user and try to check the artist ID from the user.

If you want to log the user, you can also do that.

I will show you what will happen inside the user.

Learn

The newline Guide to Building Your First GraphQL Server with Node and TypeScript

Teach

Amelia Wattenberger

Author of Fullstack D3

Community

Masterclasses

Tutorials

Fullstack React with TypeScript