@ackplus/nest-auth

Full-featured authentication module for NestJS. Sessions, MFA, OAuth, passwordless, multi-tenancy, RBAC, audit logging, and an embedded admin console — all type-safe end to end.

📚 Full documentation: ack-solutions.github.io/nest-auth

Why

Modern auth has a long checklist: email + password, OAuth, MFA, refresh-token rotation, RBAC, multi-tenancy, audit logs, an admin console. Most teams glue together five libraries (and own the integration risk) or buy a hosted vendor (and lose data ownership). @ackplus/nest-auth picks a third path: a single, modular library you install in your own NestJS app, backed by your own database.

Install

pnpm add @ackplus/nest-auth @ackplus/nest-auth-contracts

Required peer dependencies:

pnpm add @nestjs/common @nestjs/core @nestjs/typeorm @nestjs/swagger \
  @nestjs/event-emitter @nestjs/platform-express \
  typeorm class-validator class-transformer reflect-metadata rxjs

Optional, only if you enable the matching feature:

Full install guide →

AI coding agents

Using Claude Code, Codex, Cursor or another AI coding agent? Install the Nest Auth skill so it knows this SDK's real API:

npx @ackplus/nest-auth-skill

It detects your stack (or pass --stack backend) and only adds agent instruction files; your app is not changed.

What's included

Minimal example

import { Module } from '@nestjs/common';
import { TypeOrmModule } from '@nestjs/typeorm';
import { EventEmitterModule } from '@nestjs/event-emitter';
import { NestAuthModule, NestAuthEntities } from '@ackplus/nest-auth';

@Module({
  imports: [
    EventEmitterModule.forRoot(),
    TypeOrmModule.forRoot({
      type: 'postgres',
      url: process.env.DATABASE_URL,
      entities: [...NestAuthEntities],
      synchronize: process.env.NODE_ENV === 'development',
    }),
    TypeOrmModule.forFeature([...NestAuthEntities]),

    NestAuthModule.forRoot({
      appName: 'My App',
      session: { jwt: { secret: process.env.JWT_SECRET! } },
      // emailAuth: { enabled: true },        // default
      // google: { clientId, clientSecret },  // opt-in OAuth
      // mfa: { enabled: true, required: true },
      // tenant: { enabled: true, mode: TenantModeEnum.SHARED },
    }),
  ],
})
export class AppModule {}

That's it — you immediately get POST /auth/signup, POST /auth/login, /auth/refresh-token, password-reset, MFA, OAuth callbacks, and the rest of the API. Wire EventEmitterModule.forRoot(), cookie-parser, and the AuthExceptionFilter from the setup checklist and ship.

Documentation

Companion packages

All four packages release together with the same version number. Pin them all to the same version.

Links

• 📚 Documentation
• 💬 Issue Tracker
• 📦 GitHub Repository

License

MIT