NestJS Authentication Guards

# Phase 18 test matrix

| Scenario | Expected |
|---|---|
| No Authorization header | 401 |
| Wrong scheme | 401 |
| Malformed JWT | 401 |
| Expired JWT | 401 |
| Token from wrong Supabase project | 401 |
| Valid current access token | 200 and verified identity |
| Protected tasks without token | 401 |
| Health endpoint | 200 without token |

SUPABASE_URL=https://<project-ref>.supabase.co
SUPABASE_PUBLISHABLE_KEY=sb_publishable_...

# Run from apps/api
pnpm add @supabase/supabase-js@2.116.0

import { Controller, Get, UseGuards } from '@nestjs/common'
import { CurrentUser } from '../common/decorators/current-user.decorator'
import type { AuthenticatedUser } from './authenticated-user'
import { SupabaseAuthGuard } from './supabase-auth.guard'

@Controller('auth')
export class AuthController {
  @UseGuards(SupabaseAuthGuard)
  @Get('me')
  me(@CurrentUser() user: AuthenticatedUser) {
    return { user }
  }
}

import { Module } from '@nestjs/common'
import { AuthController } from './auth.controller'
import { SupabaseAuthGuard } from './supabase-auth.guard'
import { SupabaseAuthService } from './supabase-auth.service'

@Module({
  controllers: [AuthController],
  providers: [SupabaseAuthService, SupabaseAuthGuard],
  exports: [SupabaseAuthService, SupabaseAuthGuard],
})
export class AuthModule {}

export type AuthenticatedUser = {
  id: string
  email?: string
  role?: string
  sessionId?: string
}

import { CanActivate, ExecutionContext, Injectable, UnauthorizedException } from '@nestjs/common'
import type { FastifyRequest } from 'fastify'
import { SupabaseAuthService } from './supabase-auth.service'
import type { AuthenticatedUser } from './authenticated-user'

type AuthenticatedRequest = FastifyRequest & { user?: AuthenticatedUser }

@Injectable()
export class SupabaseAuthGuard implements CanActivate {
  constructor(private readonly auth: SupabaseAuthService) {}

  async canActivate(context: ExecutionContext): Promise<boolean> {
    const request = context.switchToHttp().getRequest<AuthenticatedRequest>()
    const value = request.headers.authorization
    const [scheme, token] = value?.split(' ') ?? []
    if (scheme !== 'Bearer' || !token) {
      throw new UnauthorizedException('Bearer access token required')
    }

    const claims = await this.auth.verifyAccessToken(token)

import { Injectable, UnauthorizedException } from '@nestjs/common'
import { ConfigService } from '@nestjs/config'
import { createClient } from '@supabase/supabase-js'

@Injectable()
export class SupabaseAuthService {
  private readonly url: string
  private readonly client

  constructor(config: ConfigService) {
    this.url = config.getOrThrow<string>('SUPABASE_URL')
    const key = config.getOrThrow<string>('SUPABASE_PUBLISHABLE_KEY')

    this.client = createClient(this.url, key, {
      auth: {
        persistSession: false,
        autoRefreshToken: false,
      },
    })
  }

import { createParamDecorator, ExecutionContext } from '@nestjs/common'
import type { FastifyRequest } from 'fastify'
import type { AuthenticatedUser } from '../../auth/authenticated-user'

type AuthenticatedRequest = FastifyRequest & { user: AuthenticatedUser }

export const CurrentUser = createParamDecorator(
  (_data: unknown, ctx: ExecutionContext) => {
    return ctx.switchToHttp().getRequest<AuthenticatedRequest>().user
  },
)

import { Controller, Get, UseGuards } from '@nestjs/common'
import { SupabaseAuthGuard } from '../auth/supabase-auth.guard'

@Controller('tasks')
@UseGuards(SupabaseAuthGuard)
export class TasksController {
  @Get()
  findAll() {
    // Existing Phase 15 implementation remains here.
  }
}

import { Module } from '@nestjs/common'
import { AuthModule } from '../auth/auth.module'
import { TasksController } from './tasks.controller'
import { TasksService } from './tasks.service'

@Module({
  imports: [AuthModule],
  controllers: [TasksController],
  providers: [TasksService],
})
export class TasksModule {}

import { createClient } from '@/lib/supabase/server'

export async function authenticatedApiFetch(path: string, init: RequestInit = {}) {
  const supabase = await createClient()
  const { data, error } = await supabase.auth.getSession()
  if (error || !data.session?.access_token) {
    throw new Error('Authenticated session required')
  }
  const headers = new Headers(init.headers)
  headers.set('Authorization', `Bearer ${data.session.access_token}`)
  return fetch(`${process.env.API_BASE_URL}${path}`, { ...init, headers, cache: 'no-store' })
}

$api = 'http://127.0.0.1:4000'

Write-Host '1) No token -> expect 401'
try { Invoke-RestMethod -Uri "$api/auth/me" } catch { $_.Exception.Response.StatusCode.value__ }

Write-Host '2) Malformed token -> expect 401'
try { Invoke-RestMethod -Uri "$api/auth/me" -Headers @{ Authorization = 'Bearer not-a-jwt' } } catch { $_.Exception.Response.StatusCode.value__ }

Write-Host '3) Valid current development token -> expect 200'
$token = Read-Host 'Paste a current DEVELOPMENT access token'
Invoke-RestMethod -Uri "$api/auth/me" -Headers @{ Authorization = "Bearer $token" }