AIKIDO-2026-378356

TL;DR

The oRPC NestJS integration lets a controller method implement a whole contract router by decorating it with @Implement, which synthesizes a separate route function per procedure and registers those as the real Nest handlers. Nest reads method-level enhancer metadata such as @UseGuards, @UsePipes, @UseFilters, and @SetMetadata from the synthesized functions rather than from the original decorated method, so those guards never execute. Routes that appear protected are reachable without passing the configured authentication or authorization checks, regardless of decorator order. The fix links each synthesized route function to the original method through its prototype chain so Nest resolves the enhancer metadata and runs the guards.