Guard routes with a Passport JWT strategy

One guard for every protected route

The client now sends Authorization: Bearer <token> on each request. You could re-verify the token inside every controller method — but that's exactly what a guard exists to prevent. In Nest, a guard runs before the handler, decides whether the request may proceed, and either lets it through or throws 401. Protect a route (or a whole controller) with @UseGuards(...); leave login and signup unguarded.

Nest leans on Passport, the standard Node auth toolkit, for the token-checking half. You write a tiny strategy that says how to extract and verify the JWT, and a one-line guard that activates it. Install the pieces once: @nestjs/passport, passport, passport-jwt.