How to Hire a Backend Developer (Nest.js)

• aapp.enableVersioning({ type: VersioningType.URI }) and put @Version('1') / @Version('2') on the two controller methods that share CheckoutServiceCorrect
• bRename the v1 controller file; Nest will route by filename
• cPut both handlers on the same @Post('checkout') without @Version; Nest picks by User-Agent
• dUse only VersioningType.HEADER and tell iOS to keep calling /v1/checkout

Explanation: URI versioning maps /v1 and /v2 onto versioned handlers while sharing providers. Filenames (b) are not a router. Unversioned duplicate routes (c) collide. HEADER versioning (d) would not serve path-prefixed /v1 calls from iOS.

Why it matters: Evaluates practical understanding of Nest.js core principles, execution model, and runtime characteristics in production.

• aforRoutes('*') is enough; Nest skips paths that start with health automatically
• bconsumer.apply(JwtMiddleware).exclude({ path: 'health/live', method: RequestMethod.GET }).forRoutes('*')Correct
• cPut @Public() on the health controller; middleware honors that decorator
• dMove the probe to POST /health/live so JWT middleware ignores it

Explanation: Middleware exclusions are explicit via exclude() on the consumer. Nest does not skip health by convention (a). @Public() is typically read by a guard via Reflector, not by Express middleware (c). Changing the probe method (d) does not bypass JWT middleware.

Why it matters: Evaluates practical understanding of Nest.js core principles, execution model, and runtime characteristics in production.

• acouponCode is stripped and the order is created without a discount
• b400 because couponCode is not on the DTO and forbidNonWhitelisted rejects unknown propertiesCorrect
• cThe pipe copies couponCode onto the entity because whitelist only affects query params
• d201, and class-transformer stores couponCode in a hidden Symbol

Explanation: whitelist strips unknown keys; forbidNonWhitelisted turns those keys into a 400 instead of silently dropping them. Silent strip (a) is whitelist without forbid. Whitelist applies to the validated object, not only query (c). There is no hidden Symbol store (d).

Why it matters: Evaluates practical understanding of Nest.js core principles, execution model, and runtime characteristics in production.

• aforwardRef(() => PaymentsModule) in OrdersModule imports and forwardRef(() => OrdersModule) in PaymentsModule, then prefer extracting a third module if the cycle remains messyCorrect
• bMark both modules @Global() so imports are unnecessary
• cPut TypeOrmModule.forRoot in both modules to break the cycle
• dSwitch both services to REQUEST scope; circular modules are then allowed

Explanation: Nest documents forwardRef for circular module/provider graphs, and extracting a shared module is cleaner when the cycle is accidental. @Global (b) hides the cycle, it does not resolve constructor injection. Duplicate forRoot (c) is harmful. REQUEST scope (d) does not fix module import cycles.

Why it matters: Evaluates practical understanding of Nest.js core principles, execution model, and runtime characteristics in production.

• aUsing @Res() without passthrough: true takes the native response over; interceptors that wrap the handler return value never see itCorrect
• bDELETE cannot use interceptors in Nest
• cLoggingInterceptor only works with Fastify, not Express
• d@HttpCode(204) is required in addition to @Res() or Nest ignores send()

Explanation: Library-mode @Res() bypasses Nest's interceptor/exception pipeline unless you pass { passthrough: true }. Prefer @HttpCode(204) and return undefined. Interceptors work on DELETE (b). They work on Express (c). Mixing @Res().send with @HttpCode is not the requirement (d).

Why it matters: Evaluates practical understanding of Nest.js core principles, execution model, and runtime characteristics in production.

• aNest bubbles OrderService to REQUEST scope as well; accidentally sharing a singleton OrderService across tenants is avoided, but you pay per-request constructionCorrect
• bTenantService is cached on the first request and reused for all tenants
• cNest refuses to boot with a clear error and never bubbles scopes
• dx-tenant-id is copied into ConfigService, so scope does not matter

Explanation: Injecting a REQUEST-scoped provider into a singleton forces that consumer to become REQUEST-scoped (scope bubbling). It does not freeze the first tenant (b). Boot usually succeeds (c is false). ConfigService is not a tenant header store (d).

Why it matters: Evaluates practical understanding of Nest.js core principles, execution model, and runtime characteristics in production.

• aParseIntPipe on both query params, then a custom pipe or DTO with Max(100) / Min(1); "abc" becomes 400, limit 500 becomes 400Correct
• bNumber(page) in the controller and Math.min(limit, 100) after the database query
• cParseBoolPipe, because query strings are booleans in HTTP
• dDefaultValuePipe('1') alone, which also caps 500 at 100

Explanation: ParseIntPipe fails "abc" with 400 before the handler. A DTO or custom pipe enforces Max(100). Coercing after the query (b) still hits the DB with 500. ParseBoolPipe (c) is the wrong transform. DefaultValuePipe (d) only fills missing values.

Why it matters: Evaluates practical understanding of Nest.js core principles, execution model, and runtime characteristics in production.

• aReuse JwtAuthGuard unchanged; ExecutionContext.getRequest() is always HTTP
• bWrite a WsJwtGuard that uses context.switchToWs().getClient() (or handshake.auth) to verify the token, and apply it with @UseGuards on the gatewayCorrect
• cPut ThrottlerGuard on the gateway; it validates JWTs for sockets
• dEnable CORS on the HTTP app; that authenticates the namespace

Explanation: WebSocket ExecutionContext is not HTTP; a WS-aware guard must read handshake auth. Reusing the HTTP guard (a) looks for headers that are not there. Throttler (c) rate-limits. CORS (d) is origin policy, not auth.

Why it matters: Evaluates practical understanding of Nest.js core principles, execution model, and runtime characteristics in production.