# Guard & Interceptor Chain {#guard--interceptor-chain}


Detailed reference for all guards, interceptors, and decorators used in the API.


## Guards {#guards}



### TenantPermissionGuard {#tenantpermissionguard}


The first guard in the chain. Extracts the tenant from the JWT token and sets it in the `RequestContext`.

```typescript
@UseGuards(TenantPermissionGuard)
```

**Logic:**

1. Extract JWT from `Authorization` header
2. Decode token to get `tenantId`
3. Validate tenant exists and is active
4. Set `RequestContext.currentTenantId`


### PermissionGuard {#permissionguard}


Checks if the current user has the required permission(s).

```typescript
@UseGuards(PermissionGuard)
@Permissions(PermissionsEnum.ORG_USERS_VIEW)
```

**Logic:**

1. Read `@Permissions()` decorator metadata
2. Compare with user's role permissions
3. Allow if any required permission matches


### OrganizationPermissionGuard {#organizationpermissionguard}


Same as `PermissionGuard` but also validates organization context.


### RoleGuard {#roleguard}


Restricts access to specific roles.

```typescript
@UseGuards(RoleGuard)
@Roles(RolesEnum.SUPER_ADMIN)
```


### FeatureFlagGuard {#featureflagguard}


Checks if a feature is enabled for the current tenant.

```typescript
@UseGuards(FeatureFlagGuard)
@Feature(FeatureEnum.FEATURE_SPRINT)
```


## Interceptors {#interceptors}



### TransformInterceptor {#transforminterceptor}


Wraps controller responses in a standard format:

```json
{
  "data": { ... },
  "message": "Success"
}
```


### TimeoutInterceptor {#timeoutinterceptor}


Enforces request timeout:

```typescript
@UseInterceptors(TimeoutInterceptor)
@Timeout(30000) // 30 seconds
```


### LazyLoadInterceptor {#lazyloadinterceptor}


Handles lazy loading of entity relations from query parameters.


## Decorators Reference {#decorators-reference}


| Decorator              | Target    | Description            |
| ---------------------- | --------- | ---------------------- |
| `@Permissions(...)`    | Method    | Required permissions   |
| `@Roles(...)`          | Method    | Required roles         |
| `@Feature(...)`        | Method    | Required feature flag  |
| `@Public()`            | Method    | Skip authentication    |
| `@UseValidationPipe()` | Method    | Apply validation pipe  |
| `@Timeout(ms)`         | Method    | Request timeout        |
| `@RequestContext()`    | Parameter | Inject request context |


## Custom Guard Example {#custom-guard-example}


```typescript
@Injectable()
export class MyCustomGuard implements CanActivate {
  canActivate(context: ExecutionContext): boolean {
    const request = context.switchToHttp().getRequest();
    const user = RequestContext.currentUser();
    return this.validateCustomLogic(user);
  }
}
```


## Related Pages {#related-pages}


- [Request Lifecycle](https://sourcey-gauzy.pages.dev/architecture/request-lifecycle/index.md) — full request flow
- [API Security Best Practices](https://sourcey-gauzy.pages.dev/security/api-security-best-practices/index.md) — security
- [Plugin API Reference](https://sourcey-gauzy.pages.dev/plugins-built-in/plugin-api-reference/index.md) — available decorators