Topic

Services

Definition

A Nest service is an @Injectable provider that contains application and data-access logic, kept separate from the HTTP-facing controller so that logic can be reused, tested, and injected independently of any specific route.

In simpler words

A service is where the real work happens — querying the database, applying rules, and shaping the response — while the controller just calls it.

TicketsService is a clear example: repository injection, a DTO in, a mapped response out, and NotFoundException for missing records.

Open official example (opens in new tab)

After this you can

Explain why TicketsService, not TicketsController, injects Repository<Ticket>
Follow a repository-backed service method (list/get/create/update/remove) and describe each step
Explain toResponse() as a boundary between entity and API shape
Throw the correct Nest exception for a missing resource

What belongs in a service

Definition

A service holds business rules, data persistence operations, and any validation beyond what a DTO or pipe already checked, so that controllers can stay limited to request/response translation.

In simpler words

If it queries the database, enforces a domain rule, or would need to be reused by more than one route, put it in the service.

TicketsService owns the TypeORM repository, builds queries, maps entities to API responses, and throws domain-appropriate exceptions — none of that lives in TicketsController.

Keeping this logic out of the controller means it is testable in isolation (mock the repository) and reusable if a second controller or a background job ever needs the same operation.

TicketsService shape

@Injectable()
export class TicketsService {
  constructor(
    @InjectRepository(Ticket)
    private readonly ticketsRepo: Repository<Ticket>,
  ) {}

  async get(id: string) {
    const ticket = await this.ticketsRepo.findOne({ where: { id } });
    if (!ticket) throw new NotFoundException('Ticket not found');
    return this.toResponse(ticket);
  }
}

Throwing NotFoundException here means the controller never writes an if-not-found branch.

Shaping responses: entity in, contract shape out

Definition

A private mapping method that converts a persisted entity into the API’s response shape decouples the database column layout from the HTTP contract clients depend on.

In simpler words

toResponse() takes the raw database row and turns it into exactly the JSON fields the frontend expects — so a column rename does not have to become a breaking API change.

Ticket entity fields include DB-specific columns (assignee_id, created_at) while the mapped response uses camelCase (assigneeId, createdAt) for the JSON contract consumed by @repo/contracts and the web app.

list() applies page/limit/status/q filtering with a query builder, then returns { data, meta } — data is the mapped array, meta carries pagination totals the frontend needs for its table UI.

Paginated list contract

async list(query: ListTicketsQueryDto) {
  const qb = this.ticketsRepo.createQueryBuilder('t');
  if (query.status) qb.andWhere('t.status = :status', { status: query.status });
  qb.skip((query.page - 1) * query.limit).take(query.limit);
  const [rows, total] = await qb.getManyAndCount();
  return {
    data: rows.map((r) => this.toResponse(r)),
    meta: { page: query.page, limit: query.limit, total, totalPages: Math.ceil(total / query.limit) },
  };
}

getManyAndCount runs one query pair instead of a separate hand-written count query.

Mistake: leaking the raw entity

// Wrong — exposes DB-shaped fields, couples clients to schema
async get(id: string) {
  return this.ticketsRepo.findOne({ where: { id } }); // raw entity
}

// Right
async get(id: string) {
  const ticket = await this.ticketsRepo.findOne({ where: { id } });
  if (!ticket) throw new NotFoundException('Ticket not found');
  return this.toResponse(ticket);
}

Without mapping, a future column rename becomes an accidental breaking API change.

Keep in mind

Constructor-inject the repository via @InjectRepository; never query the database from a controller.
Throw NotFoundException / ConflictException / etc. from the service — let the global filter format the error JSON.
A service method should be understandable without knowing which controller calls it.

Test

Check your understanding

At least 10 questions — mix of concept, syntax, practical, and logic. Score ≥80% (enforced by the API) to save progress.

Checking your session…

15 questions · concept 5 · syntax 3 · practical 4 · logic 3

1. What is a Nest service?

Concept

A @Controller-decorated class that maps routes to business logicAn @Injectable provider holding business logic and persistence orchestrationA module that groups related providers and controllers togetherA guard-like provider that runs before each handler to prepare data

2. Who typically injects Repository<Ticket>?

Syntax

TicketsController, which then passes the repo to the serviceTicketsModule, which holds the repository for its providersThe Ticket entity, which injects its own repositoryTicketsService (not the controller)

3. Must a service appear in a controller decorator?

Practical

Yes — via a services array passed to @Controller()No — but it must be listed in the controller providers arrayYes — the @Controller decorator must reference it to enable injectionNo — it is listed in module providers and injected via constructor

4. Why map entities with toResponse()-style helpers?

Logic

To tell TypeORM which columns to persist when saving the entityTo satisfy the global ValidationPipe on the outgoing responseAvoid leaking persistence fields and shape a stable API contractTo convert the entity into JSON, which Nest cannot serialize otherwise

5. Where should NotFoundException for missing tickets be thrown?

Concept

In an exception filter that inspects every null service resultIn a guard that runs before the handler executesIn the service when a lookup returns nullIn the validation pipe when the id has no matching row

6. Can services call other services?

Practical

Yes — but only by constructing them with new inside the methodYes — inject collaborators through DINo — services may only be called from controllers, never each otherYes — but only if the caller is a controller-scoped provider

7. What should services avoid returning casually?

Syntax

Response DTOs that already omit sensitive persistence columnsHTTP exceptions like NotFoundException for missing rowsPlain objects, since only entity instances serialize correctlyRaw entities with password hashes or internal columns

8. How do services get config?

Logic

Inject ConfigService or validated env providersReceive config as constructor arguments passed by the controllerImport the .env file directly as a TypeScript moduleRead config from the request object on each incoming call

9. Which layer applies ticket assignment rules?

Concept

The service implementing domain checks before saveThe controller, which validates the rule before calling the serviceA pipe that enforces the assignment rule on the incoming DTOA guard that checks the assignment rule before the handler runs

10. Why unit-test services with mocked repositories?

Practical

To confirm the repository generates the correct SQL queriesVerify domain behavior without a live databaseTo test that the module registers the repository providerTo validate the HTTP status codes each endpoint returns

11. What should replace the comment so a missing ticket returns 404?

Conceptintermediate

async findOne(id: string) {
  const ticket = await this.repo.findOneBy({ id });
  // ?
  return ticket;
}

if (!ticket) return res.status(404).send() from the serviceif (!ticket) return null, so Nest maps null to a 404 automaticallyif (!ticket) throw new NotFoundException()if (!ticket) throw new Error("404") for the filter to map

12. This handler leaks sensitive data. What is the safe fix?

Syntaxadvanced

async getUser(id: string) {
  const user = await this.repo.findOneBy({ id });
  return user; // entity has a passwordHash column
}

Rely on the frontend to hide passwordHashMap to a response DTO that omits passwordHash before returningReturn the entity; Nest strips password fields by defaultSet passwordHash to undefined only in production

13. Which layer owns the repository in this architecture?

Practicalintermediate

@Injectable()
export class TicketsService {
  constructor(@InjectRepository(Ticket) private repo: Repository<Ticket>) {}
}

The controller injects the repo directlyThe module class holds the repoThe entity injects itselfThe service; controllers delegate to it

14. What must be true for AuditService to inject here?

Logicadvanced

@Injectable()
export class TicketsService {
  constructor(private readonly audit: AuditService) {}
}

AuditService must be listed in the TicketsModule controllers arrayAuditService must be constructed with new inside the constructorAuditService is provided by a module TicketsModule can access via exports/importsAuditService must be passed to NestFactory.create in main.ts

15. Where does the rule "cannot assign a closed ticket" belong?

Conceptintermediate

// enforce: cannot assign a closed ticket

In the controller, before it delegates to the serviceIn a ValidationPipe applied to the update DTOIn the service, before it saves the changeIn a database CHECK constraint on the tickets table

Checking your session…