title: Nest JS role and permission based access control
body: <p>I've already worked with nodeJS and express. Now I came across NestJS and found it quite interesting.</p>
  <p>There are several references to authorization in the NestJS documentation.</p>
  <ul>
  <li>RBAC (role-based access control)</li>
  <li>CASL (claims-based authorization)</li>
  </ul>
  <p>But I'm not sure which of the many variants meet my requirements.</p>
  <p>The aim is to create a REST API where on the one hand server-side permissions (rights to call up the route or change data records) and client-side permissions (which widgets are displayed in the frontend, what can the user see ) covers.</p>
  <p>I programmed everything myself in NodeJS and express, but in NestJS it is certainly easier to solve than to reinvent the wheel.</p>
  <p>The question arises with which packages i covered everything.</p>
  <p><strong>example for server side permissions</strong></p>
  <pre><code>
  PUT api-domain / api / v1 / users /: id
  
  </code></pre>
  <p>It should be ensured that the user has the permission to call the route and of course it should also be ensured that, for example, a normal user can only edit his own user, but an admin in turn can edit everything.</p>
  <p><strong>example for client side permissions</strong></p>
  <p>payload from JWT token</p>
  <pre><code>
  userID: 15af1as85f1as81f8as1f
  client-permissions: [“DASHBOARD”, “USER_MENUE_WIDGET”, “NAVIGATION_TOP_WIDGET”]
  
  </code></pre>
  <p>The payload of the JWT token contains an array with the required client permissions which the user is presented with.</p>
  <p>I hope this is understandable am open to any kind of suggestions :)</p>
  <p>Many thanks in advance,
  Alessandro</p>