@yohangel / auth-nest

1.0.0 ▾

1.0.0

MIT

GitHub

适用于 NestJS 的 Better Auth：带 @AllowAnonymous、@OptionalAuth 和 @Session 的全局守卫

代码3 个文件上下文约 369 个 token扫描通过

安装

$genpm add @yohangel/auth-nest

你将获得

源代码位于 src/lib/auth-nest/，共 3 个文件。 (3.3 kB)
AI 规则位于 src/lib/auth-nest/AGENTS.md，另附 IDE 规则文件。
自动为你解析 @yohangel/auth。

README

此包没有 README。

约 369 个 token→ src/lib/auth-nest/AGENTS.md→ .cursor/rules/genpm-yohangel-auth-nest.mdc

这正是你的 AI 在 src/lib/auth-nest 中工作时读取的内容。不会向其上下文添加其他任何内容。

@yohangel/auth-nest — rules for AI agents

Purpose

Connects @yohangel/auth to NestJS (Express platform) through @thallesp/nestjs-better-auth: Better Auth routes on /api/auth/* and a GLOBAL guard — every route requires a session unless marked otherwise.

Module map

index.ts — authModule(opts), and the decorators AllowAnonymous, OptionalAuth, Session, type UserSession, AuthGuard.

Integration (do this after installing)

main.ts: const app = await NestFactory.create(AppModule, { bodyParser: false }); (required).
app.module.ts: imports: [authModule({ sendEmail })].
Public routes: @AllowAnonymous() on the handler or controller. Optional session: @OptionalAuth().
Read the user: me(@Session() session: UserSession) { return session.user; }.
Fastify is not supported by this package; use the Express platform.

Conventions

Default-deny: new controllers are private automatically; mark public ones explicitly and review every @AllowAnonymous().
System roles need Better Auth's admin() plugin (createAuth({ plugins: [admin()] })) and @Roles(['admin']) from @thallesp/nestjs-better-auth; organization roles use @OrgRoles — never mix them.

Don't

Don't re-enable Nest's body parser globally (bodyParser: true): it breaks Better Auth.
Don't disable the global guard to "make it work"; add @AllowAnonymous() where intended.
Don't return the session token or session object to clients.

# @yohangel/auth-nest — rules for AI agents

## Purpose
Connects `@yohangel/auth` to NestJS (Express platform) through `@thallesp/nestjs-better-auth`: Better Auth routes on `/api/auth/*` and a GLOBAL guard — every route requires a session unless marked otherwise.

## Module map
- `index.ts` — `authModule(opts)`, and the decorators `AllowAnonymous`, `OptionalAuth`, `Session`, type `UserSession`, `AuthGuard`.

## Integration (do this after installing)
1. `main.ts`: `const app = await NestFactory.create(AppModule, { bodyParser: false });` (required).
2. `app.module.ts`: `imports: [authModule({ sendEmail })]`.
3. Public routes: `@AllowAnonymous()` on the handler or controller. Optional session: `@OptionalAuth()`.
4. Read the user: `me(@Session() session: UserSession) { return session.user; }`.
5. Fastify is not supported by this package; use the Express platform.

## Conventions
- Default-deny: new controllers are private automatically; mark public ones explicitly and review every `@AllowAnonymous()`.
- System roles need Better Auth's `admin()` plugin (`createAuth({ plugins: [admin()] })`) and `@Roles(['admin'])` from `@thallesp/nestjs-better-auth`; organization roles use `@OrgRoles` — never mix them.

## Don't
- Don't re-enable Nest's body parser globally (`bodyParser: true`): it breaks Better Auth.
- Don't disable the global guard to "make it work"; add `@AllowAnonymous()` where intended.
- Don't return the session token or `session` object to clients.