auth-patterns

Name: auth-patterns
Author: sabahattink

27stars9forks

How to install auth-patterns?

sabahattink/antigravity-fullstack-hq/auth-patterns

$npx -y skills add sabahattink/antigravity-fullstack-hq --skill auth-patterns

Installs into the current project.

Summary

JWT access/refresh tokens, Passport.js strategies, session management, OAuth. Use when implementing authentication, authorization, or setting up OAuth providers in a NestJS + Next.js app.

Files · 1

View on GitHub

SKILL.md

1	# Auth Patterns
2
3	## JWT Access + Refresh Token Flow
4
5	```
6	Login
7	→ API issues access_token (15min) + refresh_token (7d)
8	→ Frontend stores access_token in memory, refresh_token in httpOnly cookie
9
10	Request
11	→ Attach Authorization: Bearer <access_token>
12	→ If 401 → POST /auth/refresh with httpOnly cookie
13	→ If refresh valid → new access_token
14	→ If refresh expired → redirect to login
15	```
16
17	## NestJS Auth Module
18
19	```typescript
20	// auth/auth.module.ts
21	@Module({
22	imports: [
23	PassportModule,
24	JwtModule.registerAsync({
25	inject: [ConfigService],
26	useFactory: (config: ConfigService) => ({
27	secret: config.get('JWT_SECRET'),
28	signOptions: { expiresIn: '15m' },
29	}),
30	}),
31	UsersModule,
32	],
33	controllers: [AuthController],
34	providers: [
35	AuthService,
36	JwtStrategy,
37	LocalStrategy,
38	JwtRefreshStrategy,
39	],
40	exports: [AuthService],
41	})
42	export class AuthModule {}
43	```
44
45	## Strategies
46
47	```typescript
48	// auth/strategies/local.strategy.ts
49	import { Strategy } from 'passport-local'
50	import { PassportStrategy } from '@nestjs/passport'
51
52	@Injectable()
53	export class LocalStrategy extends PassportStrategy(Strategy) {
54	constructor(private auth: AuthService) {
55	super({ usernameField: 'email' })
56	}
57
58	async validate(email: string, password: string): Promise<AuthUser> {
59	const user = await this.auth.validateCredentials(email, password)
60	if (!user) throw new UnauthorizedException('Invalid email or password')
61	return user
62	}
63	}
64
65	// auth/strategies/jwt.strategy.ts
66	import { ExtractJwt, Strategy } from 'passport-jwt'
67
68	@Injectable()
69	export class JwtStrategy extends PassportStrategy(Strategy, 'jwt') {
70	constructor(config: ConfigService) {
71	super({
72	jwtFromRequest: ExtractJwt.fromAuthHeaderAsBearerToken(),
73	ignoreExpiration: false,
74	secretOrKey: config.get<string>('JWT_SECRET'),
75	})
76	}
77
78	async validate(payload: JwtPayload): Promise<AuthUser> {
79	return { id: payload.sub, email: payload.email, role: payload.role }
80	}
81	}
82
83	// auth/strategies/jwt-refresh.strategy.ts
84	@Injectable()
85	export class JwtRefreshStrategy extends PassportStrategy(Strategy, 'jwt-refresh') {
86	constructor(config: ConfigService, private auth: AuthService) {
87	super({
88	jwtFromRequest: ExtractJwt.fromExtractors([
89	(req: Request) => req?.cookies?.['refresh_token'],
90	]),
91	ignoreExpiration: false,
92	secretOrKey: config.get<string>('JWT_REFRESH_SECRET'),
93	passReqToCallback: true,
94	})
95	}
96
97	async validate(req: Request, payload: JwtPayload): Promise<AuthUser> {
98	const refreshToken = req.cookies['refresh_token']
99	return this.auth.validateRefreshToken(payload.sub, refreshToken)
100	}
101	}
102	```
103
104	## Auth Service
105
106	```typescript
107	// auth/auth.service.ts
108	@Injectable()
109	export class AuthService {
110	constructor(
111	private usersService: UsersService,
112	private jwtService: JwtService,
113	private config: ConfigService,
114	) {}
115
116	async validateCredentials(email: string, password: string): Promise<AuthUser \| null> {
117	const user = await this.usersService.findByEmail(email)
118	if (!user) return null
119
120	const valid = await compare(password, user.passwordHash)
121	return valid ? { id: user.id, email: user.email, role: user.role } : null
122	}
123
124	async login(user: AuthUser): Promise<TokenPair> {
125	const payload: JwtPayload = { sub: user.id, email: user.email, role: user.role }
126
127	const [accessToken, refreshToken] = await Promise.all([
128	this.jwtService.signAsync(payload, { expiresIn: '15m' }),
129	this.jwtService.signAsync(payload, {
130	secret: this.config.get('JWT_REFRESH_SECRET'),
131	expiresIn: '7d',
132	}),
133	])
134
135	// Store hashed refresh token
136	const hash = await bcrypt.hash(refreshToken, 10)
137	await this.usersService.saveRefreshToken(user.id, hash)
138
139	return { accessToken, refreshToken }
140	}
141
142	async validateRefreshToken(userId: string, token: string): Promise<AuthUser> {
143	const user = await this.usersService.findById(userId)
144	if (!user?.refreshTokenHash) throw new UnauthorizedException()
145
146	const valid = await compare(token, user.refreshTokenHash)
147	if (!valid) throw new UnauthorizedException()
148
149	return { id: user.id, email: user.email, role: user.role }
150	}
151
152	async logout(userId: string): Promise<void> {
153	await this.usersService.clearRefreshToken(userId)
154	}
155	}
156	```
157
158	## Auth Controller
159
160	```typescript
161	// auth/auth.controller.ts
162	@Controller('auth')
163	export class AuthController {
164	constructor(private auth: AuthService) {}
165
166	@Post('login')
167	@UseGuards(LocalAuthGuard)
168	@HttpCode(HttpStatus.OK)
169	async login(
170	@CurrentUser() user: AuthUser,
171	@Res({ passthrough: true }) res: Response,
172	) {
173	const { accessToken, refreshToken } = await this.auth.login(user)

People who liked this also viewed

6 picks

Type

auth-patterns

27stars9forks

View on GitHub

How to install auth-patterns?

sabahattink/antigravity-fullstack-hq/auth-patterns

$npx -y skills add sabahattink/antigravity-fullstack-hq --skill auth-patterns

Installs into the current project.

Summary

JWT access/refresh tokens, Passport.js strategies, session management, OAuth. Use when implementing authentication, authorization, or setting up OAuth providers in a NestJS + Next.js app.

Files · 1

View on GitHub

SKILL.md

1	# Auth Patterns
2
3	## JWT Access + Refresh Token Flow
4
5	```
6	Login
7	→ API issues access_token (15min) + refresh_token (7d)
8	→ Frontend stores access_token in memory, refresh_token in httpOnly cookie
9
10	Request
11	→ Attach Authorization: Bearer <access_token>
12	→ If 401 → POST /auth/refresh with httpOnly cookie
13	→ If refresh valid → new access_token
14	→ If refresh expired → redirect to login
15	```
16
17	## NestJS Auth Module
18
19	```typescript
20	// auth/auth.module.ts
21	@Module({
22	imports: [
23	PassportModule,
24	JwtModule.registerAsync({
25	inject: [ConfigService],
26	useFactory: (config: ConfigService) => ({
27	secret: config.get('JWT_SECRET'),
28	signOptions: { expiresIn: '15m' },
29	}),
30	}),
31	UsersModule,
32	],
33	controllers: [AuthController],
34	providers: [
35	AuthService,
36	JwtStrategy,
37	LocalStrategy,
38	JwtRefreshStrategy,
39	],
40	exports: [AuthService],
41	})
42	export class AuthModule {}
43	```
44
45	## Strategies
46
47	```typescript
48	// auth/strategies/local.strategy.ts
49	import { Strategy } from 'passport-local'
50	import { PassportStrategy } from '@nestjs/passport'
51
52	@Injectable()
53	export class LocalStrategy extends PassportStrategy(Strategy) {
54	constructor(private auth: AuthService) {
55	super({ usernameField: 'email' })
56	}
57
58	async validate(email: string, password: string): Promise<AuthUser> {
59	const user = await this.auth.validateCredentials(email, password)
60	if (!user) throw new UnauthorizedException('Invalid email or password')
61	return user
62	}
63	}
64
65	// auth/strategies/jwt.strategy.ts
66	import { ExtractJwt, Strategy } from 'passport-jwt'
67
68	@Injectable()
69	export class JwtStrategy extends PassportStrategy(Strategy, 'jwt') {
70	constructor(config: ConfigService) {
71	super({
72	jwtFromRequest: ExtractJwt.fromAuthHeaderAsBearerToken(),
73	ignoreExpiration: false,
74	secretOrKey: config.get<string>('JWT_SECRET'),
75	})
76	}
77
78	async validate(payload: JwtPayload): Promise<AuthUser> {
79	return { id: payload.sub, email: payload.email, role: payload.role }
80	}
81	}
82
83	// auth/strategies/jwt-refresh.strategy.ts
84	@Injectable()
85	export class JwtRefreshStrategy extends PassportStrategy(Strategy, 'jwt-refresh') {
86	constructor(config: ConfigService, private auth: AuthService) {
87	super({
88	jwtFromRequest: ExtractJwt.fromExtractors([
89	(req: Request) => req?.cookies?.['refresh_token'],
90	]),
91	ignoreExpiration: false,
92	secretOrKey: config.get<string>('JWT_REFRESH_SECRET'),
93	passReqToCallback: true,
94	})
95	}
96
97	async validate(req: Request, payload: JwtPayload): Promise<AuthUser> {
98	const refreshToken = req.cookies['refresh_token']
99	return this.auth.validateRefreshToken(payload.sub, refreshToken)
100	}
101	}
102	```
103
104	## Auth Service
105
106	```typescript
107	// auth/auth.service.ts
108	@Injectable()
109	export class AuthService {
110	constructor(
111	private usersService: UsersService,
112	private jwtService: JwtService,
113	private config: ConfigService,
114	) {}
115
116	async validateCredentials(email: string, password: string): Promise<AuthUser \| null> {
117	const user = await this.usersService.findByEmail(email)
118	if (!user) return null
119
120	const valid = await compare(password, user.passwordHash)
121	return valid ? { id: user.id, email: user.email, role: user.role } : null
122	}
123
124	async login(user: AuthUser): Promise<TokenPair> {
125	const payload: JwtPayload = { sub: user.id, email: user.email, role: user.role }
126
127	const [accessToken, refreshToken] = await Promise.all([
128	this.jwtService.signAsync(payload, { expiresIn: '15m' }),
129	this.jwtService.signAsync(payload, {
130	secret: this.config.get('JWT_REFRESH_SECRET'),
131	expiresIn: '7d',
132	}),
133	])
134
135	// Store hashed refresh token
136	const hash = await bcrypt.hash(refreshToken, 10)
137	await this.usersService.saveRefreshToken(user.id, hash)
138
139	return { accessToken, refreshToken }
140	}
141
142	async validateRefreshToken(userId: string, token: string): Promise<AuthUser> {
143	const user = await this.usersService.findById(userId)
144	if (!user?.refreshTokenHash) throw new UnauthorizedException()
145
146	const valid = await compare(token, user.refreshTokenHash)
147	if (!valid) throw new UnauthorizedException()
148
149	return { id: user.id, email: user.email, role: user.role }
150	}
151
152	async logout(userId: string): Promise<void> {
153	await this.usersService.clearRefreshToken(userId)
154	}
155	}
156	```
157
158	## Auth Controller
159
160	```typescript
161	// auth/auth.controller.ts
162	@Controller('auth')
163	export class AuthController {
164	constructor(private auth: AuthService) {}
165
166	@Post('login')
167	@UseGuards(LocalAuthGuard)
168	@HttpCode(HttpStatus.OK)
169	async login(
170	@CurrentUser() user: AuthUser,
171	@Res({ passthrough: true }) res: Response,
172	) {
173	const { accessToken, refreshToken } = await this.auth.login(user)

People who liked this also viewed

6 picks

Type