NestJS Tutorials

NestJS from your first controller to an API you would put in front of real users — modules and dependency injection, then the request pipeline in the order it actually runs: pipes, guards, interceptors, middleware and exception filters. Then the parts a real service needs: typed configuration, TypeORM with transactions, JWT authentication, role-based authorization, uploads and tests. Every example is lifted from a working contractor marketplace API, so code in these posts is code that runs.

• NestJS – Interview Questions
  The questions that actually get asked, with answers drawn from the nineteen lessons before this one — module scope and why a provider is not global, guards versus middleware versus interceptors, how Nest resolves a dependency, why the global ValidationPipe matters, and what happens to an exception on its way out.
• NestJS – Testing
  Test.createTestingModule, mocking a provider with useValue, and getting the token right — @InjectDataSource does not ask for the class, so overriding the class leaves your test talking to the real database. Then e2e with supertest, and the trap that makes a whole suite pass vacuously: forgetting the global pipe.
• NestJS – File Upload
  FileInterceptor and multer, and the fact that decides everything else about an upload endpoint: the Content-Type is whatever the client typed. Memory storage versus disk and why it is a security choice, stopping a 2 GB request at 5 MB, sniffing magic bytes, and generating the stored filename rather than sanitising one.
• NestJS – Authorization and Roles
  Role-based access with @Roles and a RolesGuard, and the harder half nobody shows: ownership. Why the role never comes from a request body, why a foreign resource returns 404 rather than 403, and why the route whose rules depend on the row deliberately has no @Roles decorator at all.
• NestJS – Authentication with JWT
  Register and login end to end: bcrypt with a cost that is slow on purpose, what goes in a token and what must never, signing with @nestjs/jwt, and the two defences that keep a login form from confirming which addresses are registered — one message for every failure, and a dummy hash comparison so they take the same time.
• NestJS – Databases with TypeORM
  Entities, repositories, migrations and transactions. forRoot and forFeature, why synchronize must stay false, the column types that bite — bigint and numeric come back as strings — and a real transaction with a pessimistic row lock, which is the reason this app's writes go through NestJS rather than through a generated mutation.
• NestJS – Configuration
  @nestjs/config, and why the useful pattern is not reading process.env through ConfigService but parsing every variable once into a typed object. Validating at startup so a bad value is an error that names it, isGlobal, getOrThrow, and registerAsync for the modules that need a value config has not produced yet.
• NestJS – The Request Lifecycle
  The order everything runs in, traced through one real request from the contractor API. Middleware, guards, interceptors, pipes, the handler, then interceptors and filters on the way back out — and the practical consequences of that order, which is where most of the confusing bugs in a Nest app come from.
• NestJS – Exception Filters
  HttpException and the built-in subclasses, throwing from a service without importing anything HTTP-shaped, and writing a @Catch() filter that turns a database constraint violation into a 409 instead of the bare 500 it would otherwise be. Plus the rule that keeps a filter from being a breaking change: add to the body, never reshape it.
• NestJS – Middleware
  The outermost layer, and the only one that is not really Nest — it is Express, with a class around it. What that buys and what it costs, why there is no APP_MIDDLEWARE token, and the question that decides between middleware and an interceptor: does this need to run even when a guard rejects the request?
• NestJS – Interceptors
  The only part of the pipeline that sees both sides of a request. Wrapping a handler in an RxJS stream, why tap and not map when you are only observing, logging an outcome you cannot get from middleware, and the three ways to bind one — including the provider token that makes globals injectable and testable.
• NestJS – Custom Decorators
  The two kinds worth writing. createParamDecorator for pulling the current user out of a request, and SetMetadata plus Reflector for attaching data to a route that a guard reads back — the indirection that lets one guard serve every controller instead of each one writing its own check.
• NestJS – Guards
  CanActivate, and the one question a guard answers: may this request proceed? A real JWT guard in about thirty lines, why verifyAsync and never decode, why guard order in @UseGuards is load-bearing, and where a guard stops being the right tool — the check that needs to read the row belongs in the service.
• NestJS – Pipes
  What a pipe is — transform, validate, or both — the built-in ones worth knowing, and writing your own PipeTransform. Built around a real bug this app had: @Length(1, 80) happily passed three spaces that the service then stored as an empty string, because the validator and the service disagreed about what the value was.
• NestJS – DTOs and Validation
  class-validator, the global ValidationPipe, and the failure mode that ships more often than any other in Nest: an app with beautifully annotated DTOs and no global pipe is completely unvalidated, and nothing about it looks wrong. Plus whitelist, forbidNonWhitelisted, and why the response DTO is a separate idea from the request one.
• NestJS – Providers and Dependency Injection
  How Nest builds your object graph. @Injectable, constructor injection and what the emitted metadata is actually doing, provider tokens beyond the class — useValue, useFactory and useClass, why an async factory is the only way to configure a module from config, injection scopes and the reason singletons are the right default.
• NestJS – Controllers
  Routing, and the line between HTTP and everything else. Route decorators, @Body, @Param and @Query, why POST answers 201 by default and when that is wrong, choosing 204 over an empty 200, and the rule that keeps controllers thin — a controller that decides who may do something is in the wrong layer.
• NestJS – Modules
  The unit Nest is organised around. What imports, providers, controllers and exports each mean, why a provider is private to its module until you export it, when @Global() is right and why it is used exactly once in this app, and how forRoot/forFeature dynamic modules differ from ordinary ones.
• NestJS – Setting Up a Project
  Creating a project with the Nest CLI, what each generated file is for, and the tsconfig flags Nest actually needs — experimentalDecorators and emitDecoratorMetadata are not style settings, they are what makes injection work. Plus the ESM trap that costs everyone an afternoon: why every relative import in this codebase ends in .js even though the file is .ts.
• NestJS – Get Started
  Start here. What NestJS actually is — a structure for a Node server, not a runtime — why it looks like Angular and Spring, when the structure earns its cost and when it does not, the exact versions this track is written against, the contractor marketplace API every example is taken from, and the full lesson index in reading order.