Topic

Notes API — Auth + list craft milestone

Definition

Milestone P3 proves cookie JWT auth, RBAC, paginated { data, meta } lists, and soft deletes with consistent counts on the Notes API.

In simpler words

Understand how to secure Notes with cookie JWT, RBAC, pagination, and soft deletes.

Maps to Week 3 auth and API craft. Follow standard cookie JWT + RolesGuard patterns.

Open official example (opens in new tab)

After this you can

Login that sets httpOnly cookie; JwtAuthGuard + RolesGuard
Return paginated meta with page/limit/total/totalPages
Soft-delete with matching list and count filters

What this stage covers

Definition

This stage is a Notes API build slice: read the official Nest chapter, understand the matching Nest concepts, then take the quiz to lock it in.

In simpler words

Score ≥80% on the quiz below to save roadmap progress — exactly like every other topic.

Official docs: Nest Authentication + Authorization — https://docs.nestjs.com/security/authentication

Key Nest pieces to understand: the auth module, role/auth decorators, and paginated list querying

Supplemental Nest/SQL links live under /resources.

Optional practice: rebuild the same slice for Notes in your own workspace to cement the pattern.

What a correct build includes

- [ ] httpOnly cookie login
- [ ] @Roles('admin') on delete + ForbiddenException path
- [ ] { data, meta } pagination + soft-delete filters

Use this as the acceptance checklist while you study the concepts and answer the quiz.

Deliverables

Definition

Deliverables are the concrete Nest files and behaviors a correct version of this stage produces.

In simpler words

Aim for the smallest vertical slice that satisfies these — not a sprawling redesign.

Cookie JWT login; @Public on login/health

Admin-only soft delete; member ownership on update

Paginated list excluding soft-deleted rows in data and total

Keep in mind

401 = not authenticated; 403 = authenticated but wrong role.
Reuse the same QueryBuilder filters for page and count.

Test

Check your understanding

At least 10 questions — mix of concept, syntax, practical, and logic. Score ≥80% (enforced by the API) to save progress.

Checking your session…

15 questions · concept 5 · syntax 3 · practical 4 · logic 3

1. What does Notes P3 add?

Concept

A JWT kept in localStorage with the role read from the request bodyJwtAuthGuard only, returning 401 whenever a member lacks the admin rolehttpOnly cookie JWT with JwtAuthGuard + RolesGuard, paginated { data, meta }, soft-delete-safe countsPagination that hides soft-deleted notes but still counts them in meta.total

2. How do you prove P3?

Syntax

pnpm course:validate-milestone be-notes-p3 with RolesGuard disabled for testingConfirm the Delete button is hidden for non-admins in the UIpnpm course:validate-milestone be-notes-p3pnpm course:validate-milestone be-notes-p4 once auth is added

3. What status for logged-in member lacking admin?

Practical

403 Forbidden — not 401401 Unauthorized, since the role claim is missing404 Not Found to avoid leaking that the route exists400 Bad Request because the role claim is invalid

4. Why cookie JWT over localStorage here?

Logic

Cookies are automatically encrypted by the browser while localStorage is notlocalStorage tokens are readable by any script, but cookies stop all CSRFhttpOnly cookies reduce XSS token theft versus JS-readable storageCookies let Nest verify the JWT without a signing secret

5. What must soft-delete list math do?

Concept

Count every row and subtract the deleted ones in the clientFilter deletedAt on the page rows but leave count() unfilteredApply the same visibility filter to page rows and meta.totalReturn meta.total from the array length after pagination

6. Is UI hiding authorization for P3?

Practical

Yes — hiding the button plus a client-side role check is enoughNo — RolesGuard must enforce on the serverYes — as long as the route also returns 404 to non-adminsYes — server guards are only needed once attachments exist

7. What list response shape is required?

Syntax

An array plus a separate X-Total-Count response header{ data, meta } pagination contractA { items, page, total } object instead of { data, meta }A { results, pagination } wrapper with nested links

8. Should body.role authorize deletes?

Logic

No — use authenticated user role from token/guardsYes — body.role is fine once ValidationPipe checks it is a stringYes — compare body.role to the query.role for confirmationYes — as long as a valid cookie JWT is also present

9. What does soft-delete-safe mean for counts?

Concept

Hidden soft-deleted notes are excluded from totals tooDeleted notes stay in meta.total but drop out of the data arrayDeleted notes are permanently removed so counts can include themThe total counts all rows while the page filters deleted ones out

10. Which P3 approach is wrong?

Practical

Returning 401 when an authenticated user lacks the admin roleEnforcing roles with RolesGuard and the @Roles decoratorStoring the JWT in an httpOnly cookieAligning soft-delete filters across page rows and totals

11. Why httpOnly for the notes auth cookie?

Conceptintermediate

res.cookie('access_token', token, { httpOnly: true, sameSite: 'lax' });

So the browser encrypts the cookie value at restPage JavaScript cannot read it, reducing XSS token theftSo the cookie is automatically protected against CSRFSo the token is transmitted only over HTTPS connections

12. A logged-in member calls this. What status must they receive?

Syntaxadvanced

@Roles('admin')
@Delete(':id')
remove() {}

401 Unauthorized because the role claim is absent405 Method Not Allowed for the disallowed role403 Forbidden — authenticated but lacking the role400 Bad Request since the role check failed validation

13. What is the pagination bug here?

Practicaladvanced

const [data] = await repo.findAndCount({ where: { deletedAt: null }, take, skip });
const total = await repo.count();

findAndCount already returns the total, so the extra count() double-countstake and skip are applied to count(), shrinking the totalcount() ignores the deletedAt filter, so total overcountsdeletedAt: null misses rows where deletedAt is undefined

14. Why return this shape for P3?

Logicintermediate

return { data, meta: { page, limit, total, totalPages } };

The nested meta object is what triggers TypeORM to paginateReturning meta lets Nest set the Content-Range header automaticallyThe { data, meta } contract gives clients pagination infoThe data key is required so class-serializer can strip fields

15. Why is this authorization wrong for P3?

Conceptadvanced

if (req.body.role === 'admin') return this.svc.remove(id);

The bug is comparing to a literal string instead of a Role enumIt should read the role from query params, which the guard populatesIt trusts client-supplied body.role instead of the authenticated user rolebody.role is safe here because the cookie JWT was already verified

Checking your session…