@yohangel / auth-nest

1.0.0 ▾

1.0.0

MIT

GitHub

适用于 NestJS 的 Better Auth：带 @AllowAnonymous、@OptionalAuth 和 @Session 的全局守卫

代码3 个文件上下文约 369 个 token扫描通过

约 369 个 token→ src/lib/auth-nest/AGENTS.md→ .cursor/rules/genpm-yohangel-auth-nest.mdc

这正是你的 AI 在 src/lib/auth-nest 中工作时读取的内容。不会向其上下文添加其他任何内容。

@yohangel/auth-nest — rules for AI agents

Purpose

Connects @yohangel/auth to NestJS (Express platform) through @thallesp/nestjs-better-auth: Better Auth routes on /api/auth/* and a GLOBAL guard — every route requires a session unless marked otherwise.

Module map

index.ts — authModule(opts), and the decorators AllowAnonymous, OptionalAuth, Session, type UserSession, AuthGuard.

Integration (do this after installing)

main.ts: const app = await NestFactory.create(AppModule, { bodyParser: false }); (required).
app.module.ts: imports: [authModule({ sendEmail })].
Public routes: @AllowAnonymous() on the handler or controller. Optional session: @OptionalAuth().
Read the user: me(@Session() session: UserSession) { return session.user; }.
Fastify is not supported by this package; use the Express platform.

Conventions

Default-deny: new controllers are private automatically; mark public ones explicitly and review every @AllowAnonymous().
System roles need Better Auth's admin() plugin (createAuth({ plugins: [admin()] })) and @Roles(['admin']) from @thallesp/nestjs-better-auth; organization roles use @OrgRoles — never mix them.

Don't

Don't re-enable Nest's body parser globally (bodyParser: true): it breaks Better Auth.
Don't disable the global guard to "make it work"; add @AllowAnonymous() where intended.
Don't return the session token or session object to clients.

# @yohangel/auth-nest — rules for AI agents

## Purpose
Connects `@yohangel/auth` to NestJS (Express platform) through `@thallesp/nestjs-better-auth`: Better Auth routes on `/api/auth/*` and a GLOBAL guard — every route requires a session unless marked otherwise.

## Module map
- `index.ts` — `authModule(opts)`, and the decorators `AllowAnonymous`, `OptionalAuth`, `Session`, type `UserSession`, `AuthGuard`.

## Integration (do this after installing)
1. `main.ts`: `const app = await NestFactory.create(AppModule, { bodyParser: false });` (required).
2. `app.module.ts`: `imports: [authModule({ sendEmail })]`.
3. Public routes: `@AllowAnonymous()` on the handler or controller. Optional session: `@OptionalAuth()`.
4. Read the user: `me(@Session() session: UserSession) { return session.user; }`.
5. Fastify is not supported by this package; use the Express platform.

## Conventions
- Default-deny: new controllers are private automatically; mark public ones explicitly and review every `@AllowAnonymous()`.
- System roles need Better Auth's `admin()` plugin (`createAuth({ plugins: [admin()] })`) and `@Roles(['admin'])` from `@thallesp/nestjs-better-auth`; organization roles use `@OrgRoles` — never mix them.

## Don't
- Don't re-enable Nest's body parser globally (`bodyParser: true`): it breaks Better Auth.
- Don't disable the global guard to "make it work"; add `@AllowAnonymous()` where intended.
- Don't return the session token or `session` object to clients.

应用 .genpmignore 后将被注入的确切目录树。固定于

src/lib/auth-nest/LICENSE只读 · 7145b9d

MIT License

Copyright (c) 2026 Yohangel

Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:

The above copyright notice and this permission notice shall be included in all
copies or substantial portions of the Software.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
SOFTWARE.