Auth Internals & OAuth2

Preview — 3 of 10 questions

For SaaS multi-tenancy, what is the most robust way to enforce tenant isolation using JWTs?

javascript

async validate(payload: { sub: string; tenantId: string }): Promise<RequestUser> {
  return { id: payload.sub, tenantId: payload.tenantId };
}
// every query scoped by req.user.tenantId
this.repo.find({ where: { tenantId: user.tenantId, id } });

ATrust a X-Tenant-Id header sent by the client

BUse a separate JWT secret per request

CEmbed a verified tenantId claim in the token and scope every data query by it server-side, never trusting client-supplied tenant headers

DStore tenant data in the access token body unencrypted as the source of truth

What distinguishes attribute-based access control (ABAC) from RBAC in a NestJS guard?

javascript

type Policy = (user: User, resource: Doc) => boolean;
const canEditDoc: Policy = (u, d) => d.ownerId === u.id && d.status === 'draft';

@Injectable()
export class PolicyGuard implements CanActivate {
  async canActivate(ctx: ExecutionContext): Promise<boolean> {
    const req = ctx.switchToHttp().getRequest();
    const doc = await this.docs.findById(req.params.id);
    return canEditDoc(req.user, doc);
  }
}

AABAC evaluates a policy over attributes of the subject, resource, action, and environment (e.g., "owner can edit own draft"), not just static role membership

BABAC only checks the user's role name

CABAC cannot be implemented in a guard

DABAC is identical to permission lists

How does NestJSs `AuthGuard` ultimately invoke Passports authentication for a request?

javascript

@Injectable()
export class JwtGuard extends AuthGuard('jwt') {
  handleRequest<TUser = RequestUser>(err: unknown, user: TUser, info: unknown): TUser {
    if (err || !user) throw new UnauthorizedException(info?.toString());
    return user; // becomes req.user
  }
}

AIt calls validate() directly, skipping Passport

BcanActivate adapts the request and calls passport.authenticate(strategy, options, callback), then routes the result through handleRequest

CIt signs a JWT inside the guard

DIt uses Express sessions exclusively

Answer all 10 questions (7 more), see explanations for every answer, and track your score.