RBAC (Role-Based Access Control) với custom Guards và Decorators trong NestJS?

export const Roles = (...roles: Role[]) => SetMetadata(ROLES_KEY, roles);

@Injectable()
export class RolesGuard implements CanActivate {
  constructor(private reflector: Reflector) {}
  canActivate(ctx: ExecutionContext): boolean {
    const required = this.reflector.getAllAndOverride<Role[]>(ROLES_KEY, [
      ctx.getHandler(), ctx.getClass(),
    ]);
    if (!required) return true; // No roles required
    const { user } = ctx.switchToHttp().getRequest();
    return required.some(role => user.roles?.includes(role));
  }
}

@Roles(Role.ADMIN)
@Get('admin-only')
getAdminData() { ... }