NestJS.
Interview cheat sheet.

NestJS is a progressive Node.js framework built with TypeScript that provides a robust foundation for building scalable server-side applications. Inspired by Angular's architecture, it combines elements of OOP, FP, and FRP. This cheatsheet covers core NestJS concepts including modules, controllers, providers, dependency injection, middleware, guards, pipes, interceptors, exception handling, database integration with TypeORM, authentication with Passport, testing strategies, microservices, and best practices for enterprise-grade applications.

What is NestJS?

• Progressive Node.js framework built with TypeScript
• Uses Express/Fastify under the hood
• Inspired by Angular's architecture
• Follows SOLID principles and MVC pattern

Key Features

• Modular Architecture: Organize code into modules
• Dependency Injection: IoC container manages dependencies
• Decorators: TypeScript decorators for metadata
• Platform Agnostic: Works with Express, Fastify, etc.

# Install CLI
npm i -g @nestjs/cli

# Create new project
nest new project-name

# Generate resources
nest g module users
nest g controller users
nest g service users

Basic Controller

@Controller('users')
export class UsersController {
  @Get()
  findAll(): string {
    return 'All users';
  }

  @Get(':id')
  findOne(@Param('id') id: string): string {
    return `User ${id}`;
  }

  @Post()
  create(@Body() createUserDto: CreateUserDto) {
    return 'User created';
  }

  @Put(':id')
  update(@Param('id') id: string, @Body() updateUserDto: UpdateUserDto) {
    return `Updated user ${id}`;
  }

  @Delete(':id')
  remove(@Param('id') id: string) {
    return `Removed user ${id}`;
  }
}

Request Decorators

• @Param() - Route parameters
• @Query() - Query parameters
• @Body() - Request body
• @Headers() - Request headers
• @Req() - Full request object
• @Res() - Response object

Basic Service

@Injectable()
export class UsersService {
  private users = [];

  findAll() {
    return this.users;
  }

  findOne(id: number) {
    return this.users.find(user => user.id === id);
  }

  create(user: any) {
    this.users.push(user);
    return user;
  }
}

Dependency Injection

@Controller('users')
export class UsersController {
  constructor(private readonly usersService: UsersService) {}

  @Get()
  findAll() {
    return this.usersService.findAll();
  }
}

Module Structure

@Module({
  imports: [DatabaseModule],     // Other modules
  controllers: [UsersController], // Controllers
  providers: [UsersService],      // Services/Providers
  exports: [UsersService]         // Exported providers
})
export class UsersModule {}

Root Module

@Module({
  imports: [UsersModule, ProductsModule],
  controllers: [AppController],
  providers: [AppService],
})
export class AppModule {}

Custom Middleware

@Injectable()
export class LoggerMiddleware implements NestMiddleware {
  use(req: Request, res: Response, next: NextFunction) {
    console.log(`Request...`);
    next();
  }
}

// Apply in module
export class AppModule implements NestModule {
  configure(consumer: MiddlewareConsumer) {
    consumer
      .apply(LoggerMiddleware)
      .forRoutes('*');
  }
}

Authorization Guard

@Injectable()
export class AuthGuard implements CanActivate {
  canActivate(context: ExecutionContext): boolean {
    const request = context.switchToHttp().getRequest();
    return validateRequest(request);
  }
}

// Usage
@Controller('users')
@UseGuards(AuthGuard)
export class UsersController {}

Response Transform Interceptor

@Injectable()
export class TransformInterceptor implements NestInterceptor {
  intercept(context: ExecutionContext, next: CallHandler): Observable<any> {
    return next.handle().pipe(
      map(data => ({ data, timestamp: new Date().toISOString() }))
    );
  }
}

// Usage
@UseInterceptors(TransformInterceptor)
@Controller('users')
export class UsersController {}

Validation Pipe

// DTO with class-validator
export class CreateUserDto {
  @IsString()
  @IsNotEmpty()
  name: string;

  @IsEmail()
  email: string;

  @IsInt()
  @Min(0)
  age: number;
}

// Global validation pipe
app.useGlobalPipes(new ValidationPipe());

// Controller method
@Post()
create(@Body() createUserDto: CreateUserDto) {
  return this.usersService.create(createUserDto);
}

Custom Pipe

@Injectable()
export class ParseIntPipe implements PipeTransform<string, number> {
  transform(value: string): number {
    const val = parseInt(value, 10);
    if (isNaN(val)) {
      throw new BadRequestException('Validation failed');
    }
    return val;
  }
}

Custom Exception Filter

@Catch(HttpException)
export class HttpExceptionFilter implements ExceptionFilter {
  catch(exception: HttpException, host: ArgumentsHost) {
    const ctx = host.switchToHttp();
    const response = ctx.getResponse<Response>();
    const status = exception.getStatus();

    response.status(status).json({
      statusCode: status,
      timestamp: new Date().toISOString(),
      message: exception.message,
    });
  }
}

// Usage
@UseFilters(HttpExceptionFilter)
@Controller('users')
export class UsersController {}

TypeORM Setup

// app.module.ts
@Module({
  imports: [
    TypeOrmModule.forRoot({
      type: 'postgres',
      host: 'localhost',
      port: 5432,
      username: 'test',
      password: 'test',
      database: 'test',
      entities: [User],
      synchronize: true,
    }),
    UsersModule,
  ],
})
export class AppModule {}

Entity

@Entity()
export class User {
  @PrimaryGeneratedColumn()
  id: number;

  @Column()
  name: string;

  @Column({ unique: true })
  email: string;

  @CreateDateColumn()
  createdAt: Date;
}

Repository Pattern

@Injectable()
export class UsersService {
  constructor(
    @InjectRepository(User)
    private usersRepository: Repository<User>,
  ) {}

  findAll(): Promise<User[]> {
    return this.usersRepository.find();
  }

  findOne(id: number): Promise<User> {
    return this.usersRepository.findOne({ where: { id } });
  }

  create(user: CreateUserDto): Promise<User> {
    return this.usersRepository.save(user);
  }
}

JWT Strategy

@Injectable()
export class JwtStrategy extends PassportStrategy(Strategy) {
  constructor() {
    super({
      jwtFromRequest: ExtractJwt.fromAuthHeaderAsBearerToken(),
      ignoreExpiration: false,
      secretOrKey: 'secret',
    });
  }

  async validate(payload: any) {
    return { userId: payload.sub, username: payload.username };
  }
}

// Auth Service
@Injectable()
export class AuthService {
  constructor(
    private usersService: UsersService,
    private jwtService: JwtService
  ) {}

  async login(user: any) {
    const payload = { username: user.username, sub: user.userId };
    return {
      access_token: this.jwtService.sign(payload),
    };
  }
}

Unit Testing

describe('UsersService', () => {
  let service: UsersService;

  beforeEach(async () => {
    const module: TestingModule = await Test.createTestingModule({
      providers: [UsersService],
    }).compile();

    service = module.get<UsersService>(UsersService);
  });

  it('should be defined', () => {
    expect(service).toBeDefined();
  });

  it('should create a user', () => {
    const user = { name: 'John', email: 'john@example.com' };
    expect(service.create(user)).toEqual(user);
  });
});

E2E Testing

describe('UsersController (e2e)', () => {
  let app: INestApplication;

  beforeEach(async () => {
    const moduleFixture = await Test.createTestingModule({
      imports: [AppModule],
    }).compile();

    app = moduleFixture.createNestApplication();
    await app.init();
  });

  it('/users (GET)', () => {
    return request(app.getHttpServer())
      .get('/users')
      .expect(200)
      .expect([]);
  });
});

Custom Decorators

// Create decorator
export const User = createParamDecorator(
  (data: unknown, ctx: ExecutionContext) => {
    const request = ctx.switchToHttp().getRequest();
    return request.user;
  },
);

// Usage
@Get('profile')
getProfile(@User() user: UserEntity) {
  return user;
}

Dynamic Modules

@Module({})
export class ConfigModule {
  static forRoot(options: ConfigOptions): DynamicModule {
    return {
      module: ConfigModule,
      providers: [
        {
          provide: 'CONFIG_OPTIONS',
          useValue: options,
        },
        ConfigService,
      ],
      exports: [ConfigService],
    };
  }
}

Microservices

// Main.ts for microservice
const app = await NestFactory.createMicroservice<MicroserviceOptions>(
  AppModule,
  {
    transport: Transport.TCP,
    options: {
      host: '127.0.0.1',
      port: 8877,
    },
  },
);

// Message pattern
@MessagePattern('sum')
accumulate(data: number[]): number {
  return data.reduce((a, b) => a + b);
}

1. Use DTOs for Type Safety

export class CreateUserDto {
  @IsString()
  name: string;
  
  @IsEmail()
  email: string;
}

2. Implement Error Handling

@Get(':id')
async findOne(@Param('id') id: string) {
  const user = await this.usersService.findOne(id);
  if (!user) {
    throw new NotFoundException('User not found');
  }
  return user;
}

3. Use Configuration Module

@Module({
  imports: [
    ConfigModule.forRoot({
      isGlobal: true,
      envFilePath: '.env',
    }),
  ],
})
export class AppModule {}

4. Implement Logging

@Injectable()
export class MyService {
  private readonly logger = new Logger(MyService.name);

  doSomething() {
    this.logger.log('Doing something...');
  }
}

5. Use Async/Await

@Get()
async findAll(): Promise<User[]> {
  return await this.usersService.findAll();
}

NestJS Component Hierarchy & Execution Order

Middleware vs Guards vs Interceptors

Dependency Injection Scopes

Provider Registration Patterns

Module Types & Organization

HTTP Decorators & Use Cases

Parameter Decorators

Validation Strategies

Error Handling Patterns

Database Integration Patterns

Authentication Strategies

Testing Strategies

Performance Optimization Techniques

Microservices Communication

Security Best Practices Implementation

Essential NestJS CLI Commands

Core Decorators Reference

TypeORM Entity Quick Reference

@Entity('users')
export class User {
  @PrimaryGeneratedColumn()
  id: number;

  @Column({ unique: true })
  email: string;

  @Column()
  name: string;

  @Column({ nullable: true })
  profilePicture?: string;

  @CreateDateColumn()
  createdAt: Date;

  @UpdateDateColumn()
  updatedAt: Date;

  @OneToMany(() => Order, order => order.user)
  orders: Order[];

  @ManyToOne(() => Role, role => role.users)
  role: Role;
}

Validation Pipe Configuration

// Global validation setup
app.useGlobalPipes(new ValidationPipe({
  whitelist: true,           // Strip non-whitelisted properties
  forbidNonWhitelisted: true, // Throw error for non-whitelisted properties
  transform: true,           // Auto-transform payloads to DTO instances
  transformOptions: {
    enableImplicitConversion: true, // Allow type conversion
  },
}));

// DTO with validation decorators
export class CreateUserDto {
  @IsString()
  @IsNotEmpty()
  @Length(2, 50)
  name: string;

  @IsEmail()
  email: string;

  @IsOptional()
  @IsString()
  @Length(8, 100)
  password?: string;

  @IsInt()
  @Min(18)
  @Max(120)
  age: number;

  @IsArray()
  @ArrayNotEmpty()
  @IsString({ each: true })
  roles: string[];
}

Security Implementation Checklist

// 1. Enable CORS
app.enableCors({
  origin: ['http://localhost:3000'],
  credentials: true,
});

// 2. Add security headers
app.use(helmet());

// 3. Rate limiting
app.use(
  rateLimit({
    windowMs: 15 * 60 * 1000, // 15 minutes
    max: 100, // limit each IP to 100 requests per windowMs
  }),
);

// 4. Global validation
app.useGlobalPipes(new ValidationPipe({
  whitelist: true,
  transform: true,
}));

// 5. Authentication guard
@UseGuards(JwtAuthGuard)
@Controller('protected')
export class ProtectedController {}

// 6. Role-based authorization
@Roles('admin')
@UseGuards(JwtAuthGuard, RolesGuard)
@Delete(':id')
deleteUser() {}

Error Handling Best Practices

// Custom business exception
export class UserAlreadyExistsException extends ConflictException {
  constructor(email: string) {
    super(`User with email ${email} already exists`);
  }
}

// Global exception filter
@Catch()
export class AllExceptionsFilter implements ExceptionFilter {
  private readonly logger = new Logger(AllExceptionsFilter.name);

  catch(exception: unknown, host: ArgumentsHost): void {
    const ctx = host.switchToHttp();
    const response = ctx.getResponse<Response>();
    const request = ctx.getRequest<Request>();

    let status = HttpStatus.INTERNAL_SERVER_ERROR;
    let message = 'Internal server error';

    if (exception instanceof HttpException) {
      status = exception.getStatus();
      message = exception.message;
    }

    this.logger.error(`${request.method} ${request.url}`, exception);

    response.status(status).json({
      statusCode: status,
      timestamp: new Date().toISOString(),
      path: request.url,
      message,
    });
  }
}

Testing Patterns

// Unit test with mocked dependencies
describe('UsersService', () => {
  let service: UsersService;
  let repository: Repository<User>;

  beforeEach(async () => {
    const module: TestingModule = await Test.createTestingModule({
      providers: [
        UsersService,
        {
          provide: getRepositoryToken(User),
          useValue: {
            find: jest.fn(),
            findOne: jest.fn(),
            save: jest.fn(),
            delete: jest.fn(),
          },
        },
      ],
    }).compile();

    service = module.get<UsersService>(UsersService);
    repository = module.get<Repository<User>>(getRepositoryToken(User));
  });

  it('should find all users', async () => {
    const users = [{ id: 1, name: 'John' }];
    jest.spyOn(repository, 'find').mockResolvedValue(users);

    expect(await service.findAll()).toEqual(users);
  });
});

// Integration test
describe('UsersController (e2e)', () => {
  let app: INestApplication;

  beforeEach(async () => {
    const moduleFixture = await Test.createTestingModule({
      imports: [AppModule],
    }).compile();

    app = moduleFixture.createNestApplication();
    await app.init();
  });

  it('/users (POST)', () => {
    return request(app.getHttpServer())
      .post('/users')
      .send({ name: 'John', email: 'john@example.com' })
      .expect(201);
  });
});

Performance Optimization Strategies

// 1. Caching with Redis
@Injectable()
export class UsersService {
  constructor(
    @InjectRepository(User)
    private usersRepository: Repository<User>,
    @Inject(CACHE_MANAGER)
    private cacheManager: Cache,
  ) {}

  async findOne(id: number): Promise<User> {
    const cacheKey = `user:${id}`;
    const cached = await this.cacheManager.get<User>(cacheKey);
    
    if (cached) {
      return cached;
    }

    const user = await this.usersRepository.findOne({ where: { id } });
    await this.cacheManager.set(cacheKey, user, { ttl: 300 });
    
    return user;
  }
}

// 2. Database query optimization
@Injectable()
export class UsersService {
  async getUsersWithOrders(): Promise<User[]> {
    return this.usersRepository.find({
      relations: ['orders'],
      select: ['id', 'name', 'email'], // Only select needed fields
      take: 50, // Limit results
    });
  }
}

// 3. Async initialization
@Injectable()
export class DatabaseService implements OnModuleInit {
  async onModuleInit() {
    await this.connect();
  }
  
  private async connect() {
    // Async initialization logic
  }
}

Configuration Management

// config/configuration.ts
export default () => ({
  port: parseInt(process.env.PORT, 10) || 3000,
  database: {
    host: process.env.DATABASE_HOST,
    port: parseInt(process.env.DATABASE_PORT, 10) || 5432,
    username: process.env.DATABASE_USERNAME,
    password: process.env.DATABASE_PASSWORD,
    name: process.env.DATABASE_NAME,
  },
  jwt: {
    secret: process.env.JWT_SECRET,
    expiresIn: process.env.JWT_EXPIRES_IN || '1h',
  },
});

// app.module.ts
@Module({
  imports: [
    ConfigModule.forRoot({
      load: [configuration],
      isGlobal: true,
      validationSchema: Joi.object({
        NODE_ENV: Joi.string().valid('development', 'production', 'test').required(),
        PORT: Joi.number().default(3000),
        DATABASE_HOST: Joi.string().required(),
        JWT_SECRET: Joi.string().required(),
      }),
    }),
  ],
})
export class AppModule {}

Essential Package Dependencies

{
  "dependencies": {
    "@nestjs/common": "^10.0.0",
    "@nestjs/core": "^10.0.0",
    "@nestjs/platform-express": "^10.0.0",
    "@nestjs/config": "^3.0.0",
    "@nestjs/typeorm": "^10.0.0",
    "@nestjs/jwt": "^10.0.0",
    "@nestjs/passport": "^10.0.0",
    "@nestjs/swagger": "^7.0.0",
    "class-validator": "^0.14.0",
    "class-transformer": "^0.5.0",
    "passport": "^0.6.0",
    "passport-jwt": "^4.0.1",
    "typeorm": "^0.3.0",
    "pg": "^8.11.0"
  },
  "devDependencies": {
    "@nestjs/cli": "^10.0.0",
    "@nestjs/testing": "^10.0.0",
    "@types/jest": "^29.5.0",
    "@types/supertest": "^2.0.12",
    "jest": "^29.5.0",
    "supertest": "^6.3.0",
    "ts-jest": "^29.1.0"
  }
}

Deployment Best Practices

// main.ts - Production configuration
async function bootstrap() {
  const app = await NestFactory.create(AppModule);
  
  // Security
  app.enableCors();
  app.use(helmet());
  
  // Validation
  app.useGlobalPipes(new ValidationPipe({
    whitelist: true,
    transform: true,
  }));
  
  // Global exception filter
  app.useGlobalFilters(new AllExceptionsFilter());
  
  // API documentation
  if (process.env.NODE_ENV !== 'production') {
    const config = new DocumentBuilder()
      .setTitle('API Documentation')
      .setVersion('1.0')
      .addBearerAuth()
      .build();
    const document = SwaggerModule.createDocument(app, config);
    SwaggerModule.setup('api', app, document);
  }
  
  // Graceful shutdown
  process.on('SIGTERM', () => {
    console.log('SIGTERM received');
    app.close();
  });
  
  await app.listen(process.env.PORT || 3000);
}
bootstrap();

Key Interview Topics Summary

1. Architecture: Modular design, dependency injection, decorators
2. Request Lifecycle: Middleware → Guards → Interceptors → Pipes → Handler
3. Database Integration: TypeORM patterns, repository usage, migrations
4. Authentication: JWT strategies, guards, role-based access control
5. Testing: Unit tests with mocking, integration tests, e2e testing
6. Performance: Caching strategies, database optimization, async patterns
7. Security: Input validation, rate limiting, security headers
8. Microservices: Transport layers, message patterns, service communication