src/auth/guards/roles.guard.ts implements role-based authorization (and has a passing unit test), but RolesGuard is never registered as a global guard nor applied anywhere, so it's dead code that looks like an active security control.
Suggested fix: Register it globally in AppModule: add { provide: APP_GUARD, useClass: RolesGuard } to providers (importing APP_GUARD from @nestjs/core), matching the existing pattern of registering JwtAuthGuard the same way. Only wire this in if the guard already defaults to allow-when-no-@roles()-metadata (verify before applying) so no existing route's behavior changes.
src/auth/guards/roles.guard.tsimplements role-based authorization (and has a passing unit test), butRolesGuardis never registered as a global guard nor applied anywhere, so it's dead code that looks like an active security control.Suggested fix: Register it globally in
AppModule: add{ provide: APP_GUARD, useClass: RolesGuard }toproviders(importingAPP_GUARDfrom@nestjs/core), matching the existing pattern of registeringJwtAuthGuardthe same way. Only wire this in if the guard already defaults to allow-when-no-@roles()-metadata (verify before applying) so no existing route's behavior changes.