Why NestJS Is the Best Backend Framework

// Express Project A: Function-based handlers
app.get('/users', getUsersHandler);
app.post('/users', createUserHandler);
 
// Express Project B: Class-based controllers
router.get('/users', userController.getAll.bind(userController));
router.post('/users', userController.create.bind(userController));
 
// Express Project C: Route configuration objects
const routes = [
  { method: 'get', path: '/users', handler: 'UserController.getAll' },
  { method: 'post', path: '/users', handler: 'UserController.create' },
];
routes.forEach(r => {
  const [ctrl, method] = r.handler.split('.');
  apiRouter[r.method](r.path, controllers[ctrl][method]);
});
 
// Express Project D: Some hybrid monstrosity
app.use('/api/v1', apiRouter);
app.use('/api/v2', apiRouterV2);
legacyRoutes.forEach(r => app[r.method](r.path, legacyMiddleware, r.handler));

// Every NestJS project follows this structure
src/
├── users/
│   ├── users.module.ts          // Module declaration
│   ├── users.controller.ts      // HTTP request handling
│   ├── users.service.ts         // Business logic
│   ├── users.repository.ts      // Data access (optional)
│   ├── entities/
│   │   └── user.entity.ts       // Database entity
│   ├── dto/
│   │   ├── create-user.dto.ts   // Input validation
│   │   └── update-user.dto.ts
│   └── interfaces/
│       └── user.interface.ts    // Type definitions
├── auth/
│   ├── auth.module.ts
│   ├── auth.controller.ts
│   ├── auth.service.ts
│   ├── strategies/
│   │   ├── jwt.strategy.ts      // Passport strategies
│   │   └── local.strategy.ts
│   └── guards/
│       ├── jwt-auth.guard.ts    // Route protection
│       └── roles.guard.ts
├── common/
│   ├── decorators/              // Custom decorators
│   ├── filters/                 // Exception filters
│   ├── interceptors/            // Request/response interceptors
│   ├── pipes/                   // Validation/transformation pipes
│   └── guards/                  // Shared guards
├── config/
│   ├── config.module.ts
│   └── configuration.ts
├── database/
│   ├── database.module.ts
│   └── migrations/
├── app.module.ts                // Root module
└── main.ts                      // Application bootstrap

# Generate a complete module with controller, service, and tests
nest generate resource users
 
# Creates:
# src/users/users.module.ts
# src/users/users.controller.ts
# src/users/users.controller.spec.ts
# src/users/users.service.ts
# src/users/users.service.spec.ts
# src/users/dto/create-user.dto.ts
# src/users/dto/update-user.dto.ts
# src/users/entities/user.entity.ts

// Declare what your module provides and needs
@Module({
  imports: [DatabaseModule, EmailModule],
  controllers: [UsersController],
  providers: [UsersService, UsersRepository],
  exports: [UsersService], // Available to modules that import UsersModule
})
export class UsersModule {}
 
// Services declare their dependencies via constructor
@Injectable()
export class UsersService {
  constructor(
    private readonly usersRepository: UsersRepository,
    private readonly emailService: EmailService,
    private readonly configService: ConfigService,
  ) {}
 
  async createUser(dto: CreateUserDto): Promise<User> {
    const user = await this.usersRepository.create(dto);
    await this.emailService.sendWelcomeEmail(user.email);
    return user;
  }
}

@Module({
  providers: [
    // Standard class provider
    UsersService,
 
    // Custom value provider (great for configs)
    {
      provide: 'API_KEY',
      useValue: process.env.API_KEY,
    },
 
    // Factory provider (for complex initialization)
    {
      provide: 'DATABASE_CONNECTION',
      useFactory: async (configService: ConfigService) => {
        const config = configService.get('database');
        return createConnection(config);
      },
      inject: [ConfigService],
    },
 
    // Class provider with different implementation
    {
      provide: PaymentProcessor,
      useClass: process.env.NODE_ENV === 'test'
        ? MockPaymentProcessor
        : StripePaymentProcessor,
    },
 
    // Existing provider (alias)
    {
      provide: 'AliasedService',
      useExisting: UsersService,
    },
  ],
})
export class AppModule {}

// Singleton (default): One instance for entire application
@Injectable()
export class ConfigService {}
 
// Request-scoped: New instance per HTTP request
@Injectable({ scope: Scope.REQUEST })
export class RequestContextService {
  constructor(@Inject(REQUEST) private request: Request) {}
}
 
// Transient: New instance every time it's injected
@Injectable({ scope: Scope.TRANSIENT })
export class HelperService {}

// Spring Boot: Multiple ways to do the same thing, some bad
@Service
public class UserService {
    // Field injection: Easy to write, hard to test
    @Autowired
    private UserRepository userRepository;
 
    @Autowired
    private EmailService emailService;
 
    // To test this, you need reflection or Spring's test context
    // No compile-time safety
    // Circular dependencies fail at runtime
}
 
// "Proper" Spring Boot
@Service
public class UserService {
    private final UserRepository userRepository;
    private final EmailService emailService;
 
    // Constructor injection: The right way
    // But why does the framework encourage the wrong way?
    public UserService(UserRepository userRepository, EmailService emailService) {
        this.userRepository = userRepository;
        this.emailService = emailService;
    }
}
 
// Also Spring Boot: XML config that nobody understands anymore
<bean id="userService" class="com.example.UserService">
    <property name="userRepository" ref="userRepository"/>
    <property name="emailService" ref="emailService"/>
</bean>

# FastAPI: Types exist but are advisory
from pydantic import BaseModel
from fastapi import FastAPI
 
class CreateUserDto(BaseModel):
    name: str
    email: str
    age: int
 
@app.post("/users")
async def create_user(dto: CreateUserDto) -> User:
    # Pydantic validates at runtime, which is good
    # But what about internal code?
    return await user_service.create(dto)
 
# Internal service: Types are suggestions
class UserService:
    async def create(self, dto: CreateUserDto) -> User:
        # Your IDE might help here
        # But nothing enforces it
        # Refactoring is still scary
        user = await self.repo.save(dto)
        return user  # Is this actually a User? Who knows.
 
# Dependencies often ignore types entirely
import some_library
result = some_library.do_thing()  # Returns Any, good luck

// NestJS: Types are enforced throughout the stack
@Controller('users')
export class UsersController {
  constructor(private readonly usersService: UsersService) {}
 
  @Post()
  @HttpCode(HttpStatus.CREATED)
  async create(@Body() dto: CreateUserDto): Promise<UserResponseDto> {
    // TypeScript knows dto is CreateUserDto
    // TypeScript knows the return type must be UserResponseDto
    // The compiler catches mistakes
    return this.usersService.create(dto);
  }
 
  @Get(':id')
  async findOne(@Param('id', ParseUUIDPipe) id: string): Promise<UserResponseDto> {
    // ParseUUIDPipe validates and transforms the param
    // Type safety from HTTP layer to database
    const user = await this.usersService.findOne(id);
    if (!user) {
      throw new NotFoundException(`User ${id} not found`);
    }
    return user;
  }
}
 
// DTOs with runtime validation that matches compile-time types
export class CreateUserDto {
  @IsString()
  @MinLength(2)
  @MaxLength(100)
  name: string;
 
  @IsEmail()
  email: string;
 
  @IsInt()
  @Min(0)
  @Max(150)
  age: number;
 
  @IsOptional()
  @IsArray()
  @IsString({ each: true })
  roles?: string[];
}
 
// Response DTOs for documentation and transformation
export class UserResponseDto {
  @Expose()
  id: string;
 
  @Expose()
  name: string;
 
  @Expose()
  email: string;
 
  @Exclude()
  passwordHash: string; // Never sent to client
 
  @Expose()
  @Transform(({ value }) => value.toISOString())
  createdAt: Date;
}

// Complex validation rules
export class CreateOrderDto {
  @IsUUID()
  customerId: string;
 
  @IsArray()
  @ValidateNested({ each: true })
  @Type(() => OrderItemDto)
  items: OrderItemDto[];
 
  @IsOptional()
  @ValidateNested()
  @Type(() => ShippingAddressDto)
  shippingAddress?: ShippingAddressDto;
 
  @IsEnum(PaymentMethod)
  paymentMethod: PaymentMethod;
 
  @ValidateIf(o => o.paymentMethod === PaymentMethod.CREDIT_CARD)
  @IsNotEmpty()
  @IsCreditCard()
  cardNumber?: string;
}
 
// Custom validation decorators
@ValidatorConstraint({ async: true })
export class IsUniqueEmailConstraint implements ValidatorConstraintInterface {
  constructor(private usersService: UsersService) {}
 
  async validate(email: string): Promise<boolean> {
    const user = await this.usersService.findByEmail(email);
    return !user;
  }
 
  defaultMessage(): string {
    return 'Email $value is already registered';
  }
}
 
export function IsUniqueEmail(validationOptions?: ValidationOptions) {
  return function (object: object, propertyName: string) {
    registerDecorator({
      target: object.constructor,
      propertyName,
      options: validationOptions,
      constraints: [],
      validator: IsUniqueEmailConstraint,
    });
  };
}
 
// Usage
export class RegisterUserDto {
  @IsEmail()
  @IsUniqueEmail()
  email: string;
}

// Go: A simple CRUD endpoint
func (h *UserHandler) CreateUser(w http.ResponseWriter, r *http.Request) {
    // Parse request body
    var dto CreateUserDTO
    if err := json.NewDecoder(r.Body).Decode(&dto); err != nil {
        h.logger.Error("failed to decode request body", zap.Error(err))
        http.Error(w, "invalid request body", http.StatusBadRequest)
        return
    }
 
    // Validate
    if err := h.validator.Struct(dto); err != nil {
        validationErrors := err.(validator.ValidationErrors)
        errors := make([]string, len(validationErrors))
        for i, e := range validationErrors {
            errors[i] = fmt.Sprintf("%s: %s", e.Field(), e.Tag())
        }
        w.Header().Set("Content-Type", "application/json")
        w.WriteHeader(http.StatusBadRequest)
        json.NewEncoder(w).Encode(map[string]interface{}{
            "errors": errors,
        })
        return
    }
 
    // Call service
    user, err := h.service.CreateUser(r.Context(), dto)
    if err != nil {
        if errors.Is(err, ErrEmailExists) {
            http.Error(w, "email already exists", http.StatusConflict)
            return
        }
        h.logger.Error("failed to create user", zap.Error(err))
        http.Error(w, "internal server error", http.StatusInternalServerError)
        return
    }
 
    // Send response
    w.Header().Set("Content-Type", "application/json")
    w.WriteHeader(http.StatusCreated)
    if err := json.NewEncoder(w).Encode(user); err != nil {
        h.logger.Error("failed to encode response", zap.Error(err))
    }
}
 
// Now repeat this for GetUser, UpdateUser, DeleteUser, ListUsers...
// And do it again for every resource in your API

// NestJS: Same functionality
@Post()
@HttpCode(HttpStatus.CREATED)
create(@Body() dto: CreateUserDto): Promise<User> {
  return this.usersService.create(dto);
}
 
// Validation? Handled by ValidationPipe
// Error responses? Handled by exception filters
// JSON encoding? Handled by the framework
// Logging? Handled by interceptors
// Content-Type headers? Handled automatically

// Go: Every function call needs error handling
func (s *UserService) CreateUser(ctx context.Context, dto CreateUserDTO) (*User, error) {
    // Validate email uniqueness
    exists, err := s.repo.EmailExists(ctx, dto.Email)
    if err != nil {
        return nil, fmt.Errorf("checking email existence: %w", err)
    }
    if exists {
        return nil, ErrEmailExists
    }
 
    // Hash password
    hashedPassword, err := bcrypt.GenerateFromPassword([]byte(dto.Password), bcrypt.DefaultCost)
    if err != nil {
        return nil, fmt.Errorf("hashing password: %w", err)
    }
 
    // Create user
    user, err := s.repo.Create(ctx, User{
        Email:    dto.Email,
        Password: string(hashedPassword),
        Name:     dto.Name,
    })
    if err != nil {
        return nil, fmt.Errorf("creating user: %w", err)
    }
 
    // Send welcome email
    err = s.emailService.SendWelcome(ctx, user.Email)
    if err != nil {
        // Log but don't fail the request
        s.logger.Warn("failed to send welcome email", zap.Error(err))
    }
 
    return user, nil
}

// NestJS: Exceptions handle errors naturally
@Injectable()
export class UsersService {
  async create(dto: CreateUserDto): Promise<User> {
    const exists = await this.usersRepository.emailExists(dto.email);
    if (exists) {
      throw new ConflictException('Email already exists');
    }
 
    const hashedPassword = await bcrypt.hash(dto.password, 10);
 
    const user = await this.usersRepository.create({
      ...dto,
      password: hashedPassword,
    });
 
    // Fire and forget, or use a queue
    this.emailService.sendWelcome(user.email).catch(err => {
      this.logger.warn('Failed to send welcome email', err);
    });
 
    return user;
  }
}

// Logging middleware
@Injectable()
export class LoggerMiddleware implements NestMiddleware {
  private readonly logger = new Logger('HTTP');
 
  use(req: Request, res: Response, next: NextFunction) {
    const { method, originalUrl } = req;
    const startTime = Date.now();
 
    res.on('finish', () => {
      const { statusCode } = res;
      const duration = Date.now() - startTime;
      this.logger.log(`${method} ${originalUrl} ${statusCode} ${duration}ms`);
    });
 
    next();
  }
}
 
// Apply in module
export class AppModule implements NestModule {
  configure(consumer: MiddlewareConsumer) {
    consumer
      .apply(LoggerMiddleware, CorrelationIdMiddleware)
      .forRoutes('*');
  }
}

// Role-based access control
@Injectable()
export class RolesGuard implements CanActivate {
  constructor(private reflector: Reflector) {}
 
  canActivate(context: ExecutionContext): boolean {
    const requiredRoles = this.reflector.getAllAndOverride<Role[]>('roles', [
      context.getHandler(),
      context.getClass(),
    ]);
 
    if (!requiredRoles) {
      return true;
    }
 
    const { user } = context.switchToHttp().getRequest();
    return requiredRoles.some(role => user.roles?.includes(role));
  }
}
 
// Decorator for setting required roles
export const Roles = (...roles: Role[]) => SetMetadata('roles', roles);
 
// Usage
@Controller('admin')
@UseGuards(JwtAuthGuard, RolesGuard)
export class AdminController {
  @Get('users')
  @Roles(Role.ADMIN, Role.SUPER_ADMIN)
  findAllUsers() {
    return this.adminService.findAllUsers();
  }
 
  @Delete('users/:id')
  @Roles(Role.SUPER_ADMIN)
  deleteUser(@Param('id') id: string) {
    return this.adminService.deleteUser(id);
  }
}

// Transform all responses to a standard format
@Injectable()
export class TransformInterceptor<T> implements NestInterceptor<T, Response<T>> {
  intercept(context: ExecutionContext, next: CallHandler): Observable<Response<T>> {
    return next.handle().pipe(
      map(data => ({
        success: true,
        data,
        timestamp: new Date().toISOString(),
      })),
    );
  }
}
 
// Cache interceptor
@Injectable()
export class CacheInterceptor implements NestInterceptor {
  constructor(private cacheManager: Cache) {}
 
  async intercept(context: ExecutionContext, next: CallHandler): Promise<Observable<any>> {
    const request = context.switchToHttp().getRequest();
    const cacheKey = `${request.method}:${request.url}`;
 
    const cached = await this.cacheManager.get(cacheKey);
    if (cached) {
      return of(cached);
    }
 
    return next.handle().pipe(
      tap(response => {
        this.cacheManager.set(cacheKey, response, 60000);
      }),
    );
  }
}
 
// Timing interceptor
@Injectable()
export class TimingInterceptor implements NestInterceptor {
  private readonly logger = new Logger('Timing');
 
  intercept(context: ExecutionContext, next: CallHandler): Observable<any> {
    const start = Date.now();
    const handler = context.getHandler().name;
 
    return next.handle().pipe(
      tap(() => {
        const duration = Date.now() - start;
        this.logger.debug(`${handler} completed in ${duration}ms`);
      }),
    );
  }
}

// Built-in validation pipe with options
app.useGlobalPipes(
  new ValidationPipe({
    whitelist: true,           // Strip unknown properties
    forbidNonWhitelisted: true, // Throw on unknown properties
    transform: true,           // Auto-transform to DTO types
    transformOptions: {
      enableImplicitConversion: true,
    },
  }),
);
 
// Custom transformation pipe
@Injectable()
export class ParseDatePipe implements PipeTransform<string, Date> {
  transform(value: string): Date {
    const date = new Date(value);
    if (isNaN(date.getTime())) {
      throw new BadRequestException(`Invalid date: ${value}`);
    }
    return date;
  }
}
 
// Usage
@Get('events')
findEvents(
  @Query('from', ParseDatePipe) from: Date,
  @Query('to', ParseDatePipe) to: Date,
) {
  return this.eventsService.findBetween(from, to);
}
 
// File validation pipe
@Injectable()
export class FileValidationPipe implements PipeTransform {
  constructor(
    private readonly maxSize: number,
    private readonly allowedMimes: string[],
  ) {}
 
  transform(file: Express.Multer.File): Express.Multer.File {
    if (!file) {
      throw new BadRequestException('File is required');
    }
 
    if (file.size > this.maxSize) {
      throw new BadRequestException(`File size exceeds ${this.maxSize} bytes`);
    }
 
    if (!this.allowedMimes.includes(file.mimetype)) {
      throw new BadRequestException(`Invalid file type: ${file.mimetype}`);
    }
 
    return file;
  }
}

// Global exception filter for consistent error responses
@Catch()
export class GlobalExceptionFilter implements ExceptionFilter {
  private readonly logger = new Logger('ExceptionFilter');
 
  catch(exception: unknown, host: ArgumentsHost) {
    const ctx = host.switchToHttp();
    const response = ctx.getResponse<Response>();
    const request = ctx.getRequest<Request>();
 
    let status = HttpStatus.INTERNAL_SERVER_ERROR;
    let message = 'Internal server error';
    let errors: string[] | undefined;
 
    if (exception instanceof HttpException) {
      status = exception.getStatus();
      const exceptionResponse = exception.getResponse();
 
      if (typeof exceptionResponse === 'string') {
        message = exceptionResponse;
      } else if (typeof exceptionResponse === 'object') {
        message = (exceptionResponse as any).message || message;
        errors = (exceptionResponse as any).errors;
      }
    } else if (exception instanceof Error) {
      this.logger.error(
        `Unhandled exception: ${exception.message}`,
        exception.stack,
      );
    }
 
    response.status(status).json({
      success: false,
      statusCode: status,
      message,
      errors,
      path: request.url,
      timestamp: new Date().toISOString(),
    });
  }
}
 
// Domain-specific exception filter
@Catch(PrismaClientKnownRequestError)
export class PrismaExceptionFilter implements ExceptionFilter {
  catch(exception: PrismaClientKnownRequestError, host: ArgumentsHost) {
    const ctx = host.switchToHttp();
    const response = ctx.getResponse<Response>();
 
    switch (exception.code) {
      case 'P2002':
        response.status(HttpStatus.CONFLICT).json({
          success: false,
          statusCode: HttpStatus.CONFLICT,
          message: 'Resource already exists',
        });
        break;
 
      case 'P2025':
        response.status(HttpStatus.NOT_FOUND).json({
          success: false,
          statusCode: HttpStatus.NOT_FOUND,
          message: 'Resource not found',
        });
        break;
 
      default:
        response.status(HttpStatus.INTERNAL_SERVER_ERROR).json({
          success: false,
          statusCode: HttpStatus.INTERNAL_SERVER_ERROR,
          message: 'Database error',
        });
    }
  }
}

// config/configuration.ts
export default () => ({
  port: parseInt(process.env.PORT, 10) || 3000,
  database: {
    host: process.env.DATABASE_HOST,
    port: parseInt(process.env.DATABASE_PORT, 10) || 5432,
    username: process.env.DATABASE_USER,
    password: process.env.DATABASE_PASSWORD,
    name: process.env.DATABASE_NAME,
  },
  jwt: {
    secret: process.env.JWT_SECRET,
    expiresIn: process.env.JWT_EXPIRES_IN || '1d',
  },
  redis: {
    host: process.env.REDIS_HOST || 'localhost',
    port: parseInt(process.env.REDIS_PORT, 10) || 6379,
  },
});
 
// config/env.validation.ts
import { plainToInstance } from 'class-transformer';
import { IsNumber, IsString, validateSync, Min, IsOptional } from 'class-validator';
 
class EnvironmentVariables {
  @IsNumber()
  @Min(1)
  @IsOptional()
  PORT: number = 3000;
 
  @IsString()
  DATABASE_HOST: string;
 
  @IsNumber()
  DATABASE_PORT: number = 5432;
 
  @IsString()
  DATABASE_USER: string;
 
  @IsString()
  DATABASE_PASSWORD: string;
 
  @IsString()
  DATABASE_NAME: string;
 
  @IsString()
  JWT_SECRET: string;
}
 
export function validate(config: Record<string, unknown>) {
  const validatedConfig = plainToInstance(EnvironmentVariables, config, {
    enableImplicitConversion: true,
  });
 
  const errors = validateSync(validatedConfig, {
    skipMissingProperties: false,
  });
 
  if (errors.length > 0) {
    throw new Error(errors.toString());
  }
 
  return validatedConfig;
}
 
// app.module.ts
@Module({
  imports: [
    ConfigModule.forRoot({
      isGlobal: true,
      load: [configuration],
      validate,
    }),
  ],
})
export class AppModule {}
 
// Type-safe configuration access
@Injectable()
export class DatabaseService {
  constructor(private configService: ConfigService) {}
 
  getConnectionConfig() {
    return {
      host: this.configService.get<string>('database.host'),
      port: this.configService.get<number>('database.port'),
      // TypeScript knows the types
    };
  }
}

// Express Project A
const config = require('./config.json');
 
// Express Project B
const config = yaml.parse(fs.readFileSync('./config.yml'));
 
// Express Project C
const config = {
  port: process.env.PORT || 3000,
  db: process.env.DATABASE_URL,
  // No validation, strings everywhere
};
 
// Express Project D
import convict from 'convict';
const config = convict(schema);
config.loadFile('./config.json');
config.validate();
 
// None of them are wrong. All of them are different.

// prisma/prisma.service.ts
@Injectable()
export class PrismaService extends PrismaClient implements OnModuleInit, OnModuleDestroy {
  async onModuleInit() {
    await this.$connect();
  }
 
  async onModuleDestroy() {
    await this.$disconnect();
  }
}
 
// users/users.repository.ts
@Injectable()
export class UsersRepository {
  constructor(private prisma: PrismaService) {}
 
  async findById(id: string): Promise<User | null> {
    return this.prisma.user.findUnique({
      where: { id },
      include: { profile: true },
    });
  }
 
  async findByEmail(email: string): Promise<User | null> {
    return this.prisma.user.findUnique({
      where: { email },
    });
  }
 
  async create(data: CreateUserData): Promise<User> {
    return this.prisma.user.create({
      data,
      include: { profile: true },
    });
  }
 
  async update(id: string, data: UpdateUserData): Promise<User> {
    return this.prisma.user.update({
      where: { id },
      data,
      include: { profile: true },
    });
  }
 
  async delete(id: string): Promise<void> {
    await this.prisma.user.delete({ where: { id } });
  }
 
  async findWithPagination(params: PaginationParams): Promise<PaginatedResult<User>> {
    const { page, limit, orderBy, order } = params;
 
    const [users, total] = await Promise.all([
      this.prisma.user.findMany({
        skip: (page - 1) * limit,
        take: limit,
        orderBy: { [orderBy]: order },
        include: { profile: true },
      }),
      this.prisma.user.count(),
    ]);
 
    return {
      data: users,
      meta: {
        total,
        page,
        limit,
        totalPages: Math.ceil(total / limit),
      },
    };
  }
}

@Injectable()
export class OrdersService {
  constructor(private prisma: PrismaService) {}
 
  async createOrder(dto: CreateOrderDto): Promise<Order> {
    return this.prisma.$transaction(async (tx) => {
      // Check inventory
      for (const item of dto.items) {
        const product = await tx.product.findUnique({
          where: { id: item.productId },
        });
 
        if (!product || product.stock < item.quantity) {
          throw new BadRequestException(`Insufficient stock for ${item.productId}`);
        }
      }
 
      // Create order
      const order = await tx.order.create({
        data: {
          customerId: dto.customerId,
          items: {
            create: dto.items.map(item => ({
              productId: item.productId,
              quantity: item.quantity,
              price: item.price,
            })),
          },
          total: dto.items.reduce((sum, item) => sum + item.price * item.quantity, 0),
        },
        include: { items: true },
      });
 
      // Decrement inventory
      for (const item of dto.items) {
        await tx.product.update({
          where: { id: item.productId },
          data: { stock: { decrement: item.quantity } },
        });
      }
 
      return order;
    });
  }
}

// auth/strategies/jwt.strategy.ts
@Injectable()
export class JwtStrategy extends PassportStrategy(Strategy) {
  constructor(
    private configService: ConfigService,
    private usersService: UsersService,
  ) {
    super({
      jwtFromRequest: ExtractJwt.fromAuthHeaderAsBearerToken(),
      ignoreExpiration: false,
      secretOrKey: configService.get('jwt.secret'),
    });
  }
 
  async validate(payload: JwtPayload): Promise<User> {
    const user = await this.usersService.findById(payload.sub);
    if (!user) {
      throw new UnauthorizedException();
    }
    return user;
  }
}
 
// auth/strategies/local.strategy.ts
@Injectable()
export class LocalStrategy extends PassportStrategy(Strategy) {
  constructor(private authService: AuthService) {
    super({ usernameField: 'email' });
  }
 
  async validate(email: string, password: string): Promise<User> {
    const user = await this.authService.validateUser(email, password);
    if (!user) {
      throw new UnauthorizedException('Invalid credentials');
    }
    return user;
  }
}
 
// auth/auth.service.ts
@Injectable()
export class AuthService {
  constructor(
    private usersService: UsersService,
    private jwtService: JwtService,
  ) {}
 
  async validateUser(email: string, password: string): Promise<User | null> {
    const user = await this.usersService.findByEmail(email);
    if (user && await bcrypt.compare(password, user.password)) {
      return user;
    }
    return null;
  }
 
  async login(user: User): Promise<TokenResponse> {
    const payload: JwtPayload = { sub: user.id, email: user.email };
 
    const [accessToken, refreshToken] = await Promise.all([
      this.jwtService.signAsync(payload, { expiresIn: '15m' }),
      this.jwtService.signAsync(payload, { expiresIn: '7d' }),
    ]);
 
    return { accessToken, refreshToken };
  }
 
  async refreshTokens(refreshToken: string): Promise<TokenResponse> {
    try {
      const payload = await this.jwtService.verifyAsync(refreshToken);
      const user = await this.usersService.findById(payload.sub);
      if (!user) {
        throw new UnauthorizedException();
      }
      return this.login(user);
    } catch {
      throw new UnauthorizedException('Invalid refresh token');
    }
  }
}
 
// auth/auth.controller.ts
@Controller('auth')
export class AuthController {
  constructor(private authService: AuthService) {}
 
  @Post('login')
  @UseGuards(LocalAuthGuard)
  @HttpCode(HttpStatus.OK)
  async login(@User() user: UserEntity): Promise<TokenResponse> {
    return this.authService.login(user);
  }
 
  @Post('refresh')
  @HttpCode(HttpStatus.OK)
  async refresh(@Body() dto: RefreshTokenDto): Promise<TokenResponse> {
    return this.authService.refreshTokens(dto.refreshToken);
  }
 
  @Post('logout')
  @UseGuards(JwtAuthGuard)
  @HttpCode(HttpStatus.NO_CONTENT)
  async logout(@User() user: UserEntity): Promise<void> {
    // Invalidate refresh token in database/redis
    await this.authService.logout(user.id);
  }
}
 
// Custom decorator to extract user from request
export const User = createParamDecorator(
  (data: keyof UserEntity | undefined, ctx: ExecutionContext) => {
    const request = ctx.switchToHttp().getRequest();
    const user = request.user;
    return data ? user?.[data] : user;
  },
);

// main.ts
async function bootstrap() {
  const app = await NestFactory.create(AppModule);
 
  const config = new DocumentBuilder()
    .setTitle('My API')
    .setDescription('API documentation')
    .setVersion('1.0')
    .addBearerAuth()
    .addTag('users', 'User management endpoints')
    .addTag('orders', 'Order management endpoints')
    .build();
 
  const document = SwaggerModule.createDocument(app, config);
  SwaggerModule.setup('api/docs', app, document);
 
  await app.listen(3000);
}
 
// Detailed endpoint documentation
@Controller('orders')
@ApiTags('orders')
@ApiBearerAuth()
@UseGuards(JwtAuthGuard)
export class OrdersController {
  @Post()
  @ApiOperation({ summary: 'Create a new order' })
  @ApiBody({ type: CreateOrderDto })
  @ApiResponse({
    status: 201,
    description: 'Order created successfully',
    type: OrderResponseDto,
  })
  @ApiResponse({
    status: 400,
    description: 'Invalid input or insufficient stock',
  })
  @ApiResponse({
    status: 401,
    description: 'Unauthorized',
  })
  create(@Body() dto: CreateOrderDto, @User() user: UserEntity): Promise<OrderResponseDto> {
    return this.ordersService.create(dto, user.id);
  }
 
  @Get()
  @ApiOperation({ summary: 'List orders with pagination' })
  @ApiQuery({ name: 'page', required: false, type: Number })
  @ApiQuery({ name: 'limit', required: false, type: Number })
  @ApiQuery({ name: 'status', required: false, enum: OrderStatus })
  @ApiResponse({
    status: 200,
    description: 'Paginated list of orders',
    type: PaginatedOrdersResponseDto,
  })
  findAll(@Query() query: OrderQueryDto, @User() user: UserEntity) {
    return this.ordersService.findByCustomer(user.id, query);
  }
}
 
// DTOs with Swagger decorators
export class CreateOrderDto {
  @ApiProperty({
    description: 'Array of items to order',
    type: [OrderItemDto],
    example: [{ productId: 'uuid', quantity: 2 }],
  })
  @IsArray()
  @ValidateNested({ each: true })
  @Type(() => OrderItemDto)
  items: OrderItemDto[];
 
  @ApiPropertyOptional({
    description: 'Shipping address',
    type: ShippingAddressDto,
  })
  @IsOptional()
  @ValidateNested()
  @Type(() => ShippingAddressDto)
  shippingAddress?: ShippingAddressDto;
}

// Hybrid application: HTTP + Message Queue
async function bootstrap() {
  const app = await NestFactory.create(AppModule);
 
  // Connect to RabbitMQ
  app.connectMicroservice<MicroserviceOptions>({
    transport: Transport.RMQ,
    options: {
      urls: ['amqp://localhost:5672'],
      queue: 'orders_queue',
      queueOptions: { durable: true },
    },
  });
 
  // Connect to Redis pub/sub
  app.connectMicroservice<MicroserviceOptions>({
    transport: Transport.REDIS,
    options: {
      host: 'localhost',
      port: 6379,
    },
  });
 
  await app.startAllMicroservices();
  await app.listen(3000);
}
 
// Message handlers look like HTTP handlers
@Controller()
export class OrdersMessageController {
  constructor(private ordersService: OrdersService) {}
 
  @MessagePattern('order.created')
  async handleOrderCreated(@Payload() data: OrderCreatedEvent) {
    await this.ordersService.processNewOrder(data);
  }
 
  @EventPattern('inventory.updated')
  async handleInventoryUpdate(@Payload() data: InventoryUpdatedEvent) {
    await this.ordersService.checkPendingOrders(data.productId);
  }
}
 
// Sending messages to other services
@Injectable()
export class OrdersService {
  constructor(
    @Inject('INVENTORY_SERVICE') private inventoryClient: ClientProxy,
    @Inject('NOTIFICATION_SERVICE') private notificationClient: ClientProxy,
  ) {}
 
  async create(dto: CreateOrderDto): Promise<Order> {
    // Request-response pattern
    const stockCheck = await firstValueFrom(
      this.inventoryClient.send('inventory.check', dto.items),
    );
 
    if (!stockCheck.available) {
      throw new BadRequestException('Insufficient stock');
    }
 
    const order = await this.ordersRepository.create(dto);
 
    // Fire-and-forget event
    this.notificationClient.emit('order.created', {
      orderId: order.id,
      customerId: order.customerId,
    });
 
    return order;
  }
}

// Unit test with mocked dependencies
describe('UsersService', () => {
  let service: UsersService;
  let repository: jest.Mocked<UsersRepository>;
  let emailService: jest.Mocked<EmailService>;
 
  beforeEach(async () => {
    const module = await Test.createTestingModule({
      providers: [
        UsersService,
        {
          provide: UsersRepository,
          useValue: {
            findById: jest.fn(),
            findByEmail: jest.fn(),
            create: jest.fn(),
            update: jest.fn(),
          },
        },
        {
          provide: EmailService,
          useValue: {
            sendWelcome: jest.fn(),
          },
        },
      ],
    }).compile();
 
    service = module.get(UsersService);
    repository = module.get(UsersRepository);
    emailService = module.get(EmailService);
  });
 
  describe('create', () => {
    it('creates a user and sends welcome email', async () => {
      const dto = { email: '[email protected]', name: 'Test', password: 'password' };
      const createdUser = { id: '1', ...dto, createdAt: new Date() };
 
      repository.findByEmail.mockResolvedValue(null);
      repository.create.mockResolvedValue(createdUser);
      emailService.sendWelcome.mockResolvedValue(undefined);
 
      const result = await service.create(dto);
 
      expect(result).toEqual(createdUser);
      expect(repository.create).toHaveBeenCalled();
      expect(emailService.sendWelcome).toHaveBeenCalledWith(dto.email);
    });
 
    it('throws ConflictException if email exists', async () => {
      const dto = { email: '[email protected]', name: 'Test', password: 'password' };
      repository.findByEmail.mockResolvedValue({ id: '1', ...dto });
 
      await expect(service.create(dto)).rejects.toThrow(ConflictException);
    });
  });
});
 
// E2E test with real database
describe('Users (e2e)', () => {
  let app: INestApplication;
  let prisma: PrismaService;
 
  beforeAll(async () => {
    const moduleFixture = await Test.createTestingModule({
      imports: [AppModule],
    }).compile();
 
    app = moduleFixture.createNestApplication();
    app.useGlobalPipes(new ValidationPipe({ whitelist: true }));
    await app.init();
 
    prisma = app.get(PrismaService);
  });
 
  beforeEach(async () => {
    await prisma.user.deleteMany();
  });
 
  afterAll(async () => {
    await app.close();
  });
 
  describe('POST /users', () => {
    it('creates a new user', async () => {
      const response = await request(app.getHttpServer())
        .post('/users')
        .send({
          email: '[email protected]',
          name: 'Test User',
          password: 'password123',
        })
        .expect(201);
 
      expect(response.body).toMatchObject({
        id: expect.any(String),
        email: '[email protected]',
        name: 'Test User',
      });
      expect(response.body.password).toBeUndefined();
    });
 
    it('returns 400 for invalid email', async () => {
      await request(app.getHttpServer())
        .post('/users')
        .send({
          email: 'invalid',
          name: 'Test',
          password: 'password',
        })
        .expect(400);
    });
 
    it('returns 409 for duplicate email', async () => {
      await prisma.user.create({
        data: {
          email: '[email protected]',
          name: 'Existing',
          password: 'hash',
        },
      });
 
      await request(app.getHttpServer())
        .post('/users')
        .send({
          email: '[email protected]',
          name: 'New User',
          password: 'password',
        })
        .expect(409);
    });
  });
});