Not everyone can cook
Anyone may read the menu of orders, but only staff may create orders, and only the kitchen may move them along. A guard decides before the route runs: unknown caller → 401, known but not allowed → 403.
staff.guard.ts
import { CanActivate, ExecutionContext, ForbiddenException, Injectable, UnauthorizedException } from "@nestjs/common";
@Injectable()
export class StaffGuard implements CanActivate {
canActivate(context: ExecutionContext): boolean {
const req = context.switchToHttp().getRequest();
if (req.headers["x-staff-key"] !== "momo-123") throw new UnauthorizedException("Staff only");
if (req.url.includes("/advance") && req.headers["x-role"] !== "kitchen") throw new ForbiddenException("Kitchen only");
return true;
}
}