Метаданные и свои декораторы

export const ROLE = 'required-role';
export const RequireRole = (role: string) => SetMetadata(ROLE, role);

@Controller('admin')
class AdminController {
  @Get()
  @RequireRole('admin')
  @UseGuards(RoleGuard)
  index() { return { ok: true }; }
}

@Injectable()
class RoleGuard implements CanActivate {
  constructor(private readonly reflector: Reflector) {}
  canActivate(context: ExecutionContext) {
    const role = this.reflector.getAllAndOverride<string>(ROLE, [
      context.getHandler(), context.getClass(),
    ]);
    const req = context.switchToHttp().getRequest<{ user?: { role: string } }>();
    return role === undefined || req.user?.role === role;
  }
}

const CurrentUser = createParamDecorator(
  (_data: unknown, context: ExecutionContext) =>
    context.switchToHttp().getRequest<{ user: { id: string } }>().user,
);