auth-patterns

# Auth Patterns ## JWT Access + Refresh Token Flow ``` Login → API issues access_token (15min) + refresh_token (7d) → Frontend stores access_token in memory, refresh_token in httpOnly cookie Request → Attach Authorization: Bearer <access_token> → If 401 → POST /auth/refresh with httpOnly cookie → If refresh valid → new access_token → If refresh expired → redirect to login ``` ## NestJS Auth Module ```typescript // auth/auth.module.ts @Module({ imports: [ PassportModule, JwtModule.registerAsync({ inject: [ConfigService], useFactory: (config: ConfigService) => ({ secret: config.get('JWT_SECRET'), signOptions: { expiresIn: '15m' }, }), }), UsersModule, ], controllers: [AuthController], providers: [ AuthService, JwtStrategy, LocalStrategy, JwtRefreshStrategy, ], exports: [AuthService], }) export class AuthModule {} ``` ## Strategies ```typescript // auth/strategies/local.strategy.ts import { Strategy } from 'passport-local' import { PassportStrategy } from '@nestjs/passport' @Injectable() export class LocalStrategy extends PassportStrategy(Strategy) { constructor(private auth: AuthService) { super({ usernameField: 'email' }) } async validate(email: string, password: string): Promise<AuthUser> { const user = await this.auth.validateCredentials(email, password) if (!user) throw new UnauthorizedException('Invalid email or password') return user } } // auth...