What problem does it solve? Backend APIs that receive requests carrying an Overlens IDP access token need to verify that JWT locally — without calling the IDP on every request. This Skill provides the decision logic, security rules, and copy-paste templates to build that token-validation layer correctly, avoiding common mistakes like accepting HS256, skipping audience checks, or fetching the JWKS per request. ## Core Features & Use Cases - Copy-paste validation templates: NestJS JwtStrategy with Bearer+cookie extraction, RS256 pinning, and iss/aud validation, plus JwtAuthGuard, RequireRole, RequireScope, and a @CurrentPrincipal() decorator, and a single-file Express middleware. - User vs M2M discrimination: Builds a typed Principal that tells user tokens (authorize by role) apart from service tokens (authorize by scope) using the client_id/email claim rule. - Security guidance: Explains why RS256 pinning stops algorithm-confusion attacks, how JWKS caching and key rotation work, and why you must never poll the IDP per request. - Use Case: You are adding a JwtAuthGuard to a NestJS API so that requests with an Overlens Bearer token or access_token cookie get a typed req.user principal, with admin routes gated by role and service routes gated by scope. ## Quick Start Ask the assistant to add Overlens JWT validation with a JwtAuthGuard and req.user principal to your NestJS or Express API.
