NestjsAuthTagger

A project decorator that bundles a guard, as the Nest docs' Auth() recipe does: export function Auth() { return applyDecorators( UseGuards(AuthGuard), ApiBearerAuth()) }.

NestJS auth-related decorators

Global guards are as often throttling or role checks; only a guard named for authentication counts.

Authentication starts once the guard touches the request or hands over to Passport; a return true after that (if (!roles) return true) admits only callers who already logged in.

ponytail: a name heuristic for what the guard hands on to the auth service (admin, permission, roles are checked after login); reading that service is the upgrade.

What a canActivate does with a caller: throws 401 outright; throws 403 or returns false (Nest answers 403) on what it read from the request; or only ever returns true.

A guard registered for every route: { provide: APP_GUARD, useClass: JwtAuthGuard } in a module, or app.useGlobalGuards(new JwtAuthGuard()). The Nest docs' authentication recipe does exactly this and opts routes out with @Public().

NestJS authentication guards — verify who the caller is.

A Passport guard's handleRequest override that hands back no user (return user || null) where the stock one throws Unauthorized: the guard authenticates whoever presents credentials and lets everyone else through, so it does not guard the route.

The start of the next top-level statement after a declaration: a line that starts in column 0 with anything but a closing bracket.

Its strategy list: AuthGuard('google'), AuthGuard(['jwt', 'api-key']).

Passport's AuthGuard(...) (called inline, or extended) refuses a caller its strategy cannot authenticate with 401.

A strategy that signs a caller in rather than checking one: a password form or an OAuth/OIDC/SAML provider's redirect. Exact names: local_apikey checks a key, google-id-token, auth0 and magic-link verify a token.

Public/skip auth markers (negative signal)

What a global guard does with route metadata, read from its source: the metadata keys it reads through Reflector, and the if (isPublic) return true / if (options.public) return true / if (!options) return true branches that let a request through before any authentication runs.

NestJS authorization decorators/guards — verify what the caller may do. Distinct from authentication so JwtAuthGuard + @Roles stack as auth_guard + authz_guard rather than collapsing into a single auth tag.

export const Public = () => SetMetadata(IS_PUBLIC_KEY, true), or a decorator that hands its own argument over, as Authenticated = (options = {}) => applyDecorators(SetMetadata(KEY, options), ...).

One literal strategy name.

Test harnesses (test/app.e2e-spec.ts, *.spec.ts) bootstrap the app with their own guards, which must not leak onto real routes.

The per-endpoint shape: look at each endpoint, tag in place, hand the array back. Taggers declare only check_endpoint; those that need a pass over the whole set first (a project pre-scan, mcp's legacy prefixes) override perform and call super or loop themselves.