• Files aren't JSON - they use multipart/form-data (multiple parts, one being binary file data).
• Multer (via FileInterceptor) extracts the file and hands it to us.
• Always validate type + size — non-negotiable security (reject wrong types, cap the size).
• Save the file to storage, store only its path/URL in the DB — never raw bytes in the database.
• It's the interceptor pattern again: FileInterceptor pulls the file, @UploadedFile() reads it (like @Body() for JSON).
• lets start

npm i -D @types/multer

nest g module uploads nest g controller uploads

import {
  Controller,
  Post,
  UploadedFile,
  UseInterceptors,
  ParseFilePipe,
  MaxFileSizeValidator,
  FileTypeValidator,
} from '@nestjs/common';
import { FileInterceptor } from '@nestjs/platform-express';
import { diskStorage } from 'multer';
import { extname } from 'path';

@Controller('uploads')
export class UploadsController {
  @Post()
  @UseInterceptors(
    FileInterceptor('file', {
      storage: diskStorage({
        destination: './uploads', // save to this folder
        filename: (req, file, callback) => {
          // make a unique filename so uploads don't overwrite each other
          const uniqueName = `${Date.now()}-${Math.round(Math.random() * 1e9)}`;
          const ext = extname(file.originalname);
          callback(null, `${uniqueName}${ext}`);
        },
      }),
    }),
  )
  uploadFile(
    @UploadedFile(
      new ParseFilePipe({
        validators: [
          new MaxFileSizeValidator({ maxSize: 5 * 1024 * 1024 }), // 5MB
          new FileTypeValidator({ fileType: /(jpg|jpeg|png)$/ }), // images only
        ],
      }),
    )
    file: Express.Multer.File,
  ) {
    return {
      message: 'File uploaded successfully',
      filename: file.filename,
      path: file.path,
      size: file.size,
    };
  }
}