Nestjs auth

Skill DIYA73/nestjs-skills/nestjs-auth

8 Claude Code skills for NestJS backend development — module scaffolding, TypeORM, BullMQ queues, WebSocket gateways, JWT auth, Redis caching, Docker, and testing patterns.

Install

npx -y skills add DIYA73/nestjs-skills --skill nestjs-auth

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

2 things to look at

no licenseNo license file was found in the repository. Code published without one is not open source by default, so using it at work is a question for whoever answers licensing questions where you are.
0 stars0 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its author says it does

Copied from the file, not written here

JWT authentication with guards, decorators, and role-based access in NestJS.

SKILL.md

3.4 KB, 790 tokens by cl100k_base, as published. Nobody here has run it

nestjs-auth

JWT authentication with guards, decorators, and role-based access in NestJS.

Trigger

Use this skill when asked to:

Add authentication to a NestJS app
Protect routes with JWT
Add role-based access control
Get the current user in a controller

Setup

npm install @nestjs/jwt @nestjs/passport passport passport-jwt bcryptjs
npm install -D @types/passport-jwt @types/bcryptjs

JWT Payload

export interface JwtPayload {
  sub: string;
  email: string;
  role: string;
}

Auth Service

@Injectable()
export class AuthService {
  constructor(
    @InjectRepository(User) private readonly users: Repository<User>,
    private readonly jwt: JwtService,
  ) {}

  async register(email: string, password: string): Promise<{ token: string }> {
    const existing = await this.users.findOne({ where: { email } });
    if (existing) throw new ConflictException('Email already in use');
    const hash = await bcrypt.hash(password, 12);
    const user = await this.users.save(this.users.create({ email, password: hash }));
    return { token: this.sign(user) };
  }

  async login(email: string, password: string): Promise<{ token: string }> {
    const user = await this.users.findOne({
      where: { email },
      select: ['id', 'email', 'password', 'role'],
    });
    if (!user || !(await bcrypt.compare(password, user.password))) {
      throw new UnauthorizedException('Invalid credentials');
    }
    return { token: this.sign(user) };
  }

  private sign(user: User): string {
    const payload: JwtPayload = { sub: user.id, email: user.email, role: user.role };
    return this.jwt.sign(payload);
  }
}

JWT Strategy

@Injectable()
export class JwtStrategy extends PassportStrategy(Strategy) {
  constructor(config: ConfigService, @InjectRepository(User) private readonly users: Repository<User>) {
    super({
      jwtFromRequest: ExtractJwt.fromAuthHeaderAsBearerToken(),
      secretOrKey: config.getOrThrow<string>('JWT_SECRET'),
    });
  }

  async validate(payload: JwtPayload): Promise<User> {
    const user = await this.users.findOne({ where: { id: payload.sub } });
    if (!user) throw new UnauthorizedException();
    return user;
  }
}

Guards

// jwt-auth.guard.ts
@Injectable()
export class JwtAuthGuard extends AuthGuard('jwt') {}

// roles.guard.ts
@Injectable()
export class RolesGuard implements CanActivate {
  constructor(private reflector: Reflector) {}
  canActivate(ctx: ExecutionContext): boolean {
    const roles = this.reflector.getAllAndOverride<string[]>('roles', [ctx.getHandler(), ctx.getClass()]);
    if (!roles?.length) return true;
    const { user } = ctx.switchToHttp().getRequest<{ user: User }>();
    return roles.includes(user.role);
  }
}

Decorators

// current-user.decorator.ts
export const CurrentUser = createParamDecorator(
  (_data: unknown, ctx: ExecutionContext): User =>
    ctx.switchToHttp().getRequest<{ user: User }>().user,
);

// roles.decorator.ts
export const Roles = (...roles: string[]) => SetMetadata('roles', roles);

Controller Usage

@Get('me')
@UseGuards(JwtAuthGuard)
me(@CurrentUser() user: User) { return user; }

@Delete(':id')
@UseGuards(JwtAuthGuard, RolesGuard)
@Roles('admin')
delete(@Param('id') id: string) { return this.service.remove(id); }

Gives 0 of the 12 instructions most auth identity skills give in 790 tokens

Counted across 409 of the 410 authors here whose files we hold, read 2026-08-06

hash passwords with bcrypt or argon2in 53 of 409, across 43 files
use parameterized queriesin 47 of 409, across 39 files
load SECRET_KEY from environment variablesin 23 of 409, across 14 files
validate all input server-sidein 19 of 409, across 11 files
refresh access tokens before expiryin 17 of 409, across 9 files
store tokens in httponly cookiesin 17 of 409, across 16 files
store refresh tokens securelyin 16 of 409, across 6 files
validate webhook signatures before processingin 15 of 409, across 5 files
sanitize user inputsin 15 of 409, across 9 files
implement rate limiting on auth endpointsin 14 of 409, across 9 files
encrypt sensitive data at restin 13 of 409, across 10 files
validate uploaded file extensions and sizesin 12 of 409, across 5 files

Said here and by no other author read

define a jwt payload interface
hash passwords during registration
throw conflict exception on duplicate email
sign the jwt payload on login
validate the jwt payload against the database
create a guard for jwt authentication

Grouped from the skills themselves: near-identical wordings counted once, and counted by distinct author, so one author publishing three of these counts once. Length counted with cl100k_base; the agent that loads this file may tokenize it differently.