Skip to main content
The NestJS request pipeline processes each request through multiple layers before it reaches the controller. 
Request → Middleware → Guard → Interceptor → Controller → Exception Filter → Response

​
Middleware

​
Global Middleware

MiddlewareDescription
withCorrelationIdAttaches a unique correlation ID to every request for distributed tracing
CorsMiddlewareConfigures Cross-Origin Resource Sharing rules

​
Guards

Guards handle authentication and authorization. They run before the controller and can reject requests.

​
Authentication Guards

GuardToken TypeUsed By
RetailerAuthGuardRetailer JWTRetailer management endpoints
AdminAuthGuardAdmin JWTAdmin panel operations
ApiKeyAuthGuardAPI KeyReporting API, external integrations
PortalAuthGuardPortal JWTMerchant portal SSO
ReactivateAuthGuardReactivate tokenReactivate module endpoints
ReactivateApiKeyGuardAPI KeyReactivate API access

​
Rate Limiting Guards

GuardDescription
GqlThrottlerGuardRate limiting for GraphQL operations (Redis-backed)
EmailRateLimitGuardPer-email address rate limiting
IpRateLimitGuardPer-IP address rate limiting
IpBlacklistGuardIP blacklist filtering

​
Access Control Guards

GuardDescription
WorkEmailGuardValidates work email domains for access
CachedReportGuardServes cached reports when available
CustomerManagementGuardControls bulk customer operations
InternalCatalogGuardRestricts product catalog access

​
Interceptors

Interceptors wrap the execution of controllers, allowing pre- and post-processing.
InterceptorDescription
AuditLoggingInterceptorRecords audit trail for retailer operations
ReportDeduplicationInterceptorPrevents duplicate webhook processing

​
Exception Filters

Exception filters transform errors into consistent API responses.
FilterDescription
ShoptokenErrorFilterCustom error formatting for domain-specific errors
BadRequestExceptionFilterTransforms validation errors into readable responses

​
Request Pipeline Example

// A typical protected endpoint
@Controller('reactivate')
@UseGuards(ReactivateAuthGuard)       // 1. Validate reactivate token
@UseInterceptors(AuditLoggingInterceptor) // 2. Log the operation
export class CampaignController {

  @Post('campaigns')
  @UseGuards(IpRateLimitGuard)        // 3. Rate limit by IP
  async createCampaign(@Req() req) {
    // 4. Controller logic
    return this.campaignService.create(req.body);
  }
}