Skip to content

backend.md

Latest commit

 

History

History
39 lines (26 loc) · 1.6 KB

backend.md

File metadata and controls

39 lines (26 loc) · 1.6 KB
Raw

app-backend

The NestJS API behind /api/*: it verifies Supabase JWTs and issues RLS-scoped clients per caller.

Purpose

The server-side API for the app. It authenticates requests against Supabase and talks to the database through Row-Level-Security-scoped clients, never with a service-role key. Architecture and the hard-won constraints are in docs/architecture/backend.md.

Structure

Standard Nest module layout: words, user, auth, supabase, config, common. SupabaseService is the only place Supabase clients are created. Auth is a global AuthGuard (opt out with @Public()), exposing the caller via @CurrentUser().

Depends on

  • No workspace packages at runtime. It produces artifacts consumed by @languages-learner/api (OpenAPI schema and database types).

Used in

  • Consumed over HTTP by apps/web (via the generated SDK), not imported as a package.

Notes

  • No Scope.REQUEST, and never authenticate inside a provider factory — it short-circuits the guard chain (including ThrottlerGuard). Covered by test/rate-limit.e2e.test.ts.
  • Env is validated at startup (src/config/env.validation.ts).
  • After changing a DTO or handler return type, regenerate the contract: pnpm --filter app-backend generate:api-schemas — see api-contract.md.
  • database.types.ts is generated (generate-types) and copied into packages/api; do not edit.

Links