# Nestjs Auth Guard

> Use when implementing auth or authorization in NestJS. Use when asked "add auth guard", "protect this endpoint", "JWT auth", "add permissions to route", "role-based access", "CASL permissions", "secure this controller".

- Skill: `uner4s/nestjs-auth-guard` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add uner4s/nestjs-auth-guard`
- Raw SKILL.md: https://api.skillmd.com/api/skills/uner4s/nestjs-auth-guard/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: Uner4s (https://skillmd.com/u/uner4s)
- Updated: 2026-09-22
- Page: https://skillmd.com/skills/uner4s/nestjs-auth-guard

---


# NestJS Auth Guard

**Rule:** Before writing any guard, confirm which permission strategy the project uses. Never mix strategies in the same project.

## Before Starting

1. Check what already exists in `src/auth/` and `src/security/`:
   ```bash
   bash ~/.claude/skills/project-scan/scripts/scan.sh
   ```
2. Load `references/strategies.md` — the two available strategies

## Steps

### Adding to an existing auth setup
1. Follow the exact same guard and decorator pattern already in the project
2. Never create a second auth module — extend the existing one

### Setting up auth from scratch
1. **Ask first:** "Does this project need simple role-based guards or dynamic permission-based (CASL)?"
2. Implement the chosen strategy fully before writing any feature code
3. Place everything in `src/auth/` — JWT guard, strategy, decorators, and types
4. Configure `JwtModule.registerAsync` with env-based secret in `auth.module.ts`
5. Register `JwtAuthGuard` as a global guard in `AppModule` — opt-out with `@Public()` decorator