nestjs-backend-patterns

Use the provider pattern: define a client interface, create a factory provider that returns the configured adapter based on environment config, wrap it in an injectable service, and export it from a module. This lets you swap providers like Stripe, Paddle, or LemonSqueezy via configuration.

Use a shared schema with tenant ID enforced by ZenStack access policies. Store the current user in CLS (Continuation Local Storage) via middleware, then return an enhanced Prisma client from a request-scoped service so all queries are automatically filtered by tenant.

Prisma provides type-safe database access only, while ZenStack extends it with declarative @@allow policies defined in the schema. ZenStack's enhance() function wraps the Prisma client to enforce read, create, update, and delete rules at the data layer based on the authenticated user.

Yes, register JwtAuthGuard, RolesGuard, and PermissionsGuard globally via APP_GUARD in order. The JWT guard populates request.user, then role and permission guards read metadata from @Roles and @RequirePermissions decorators to allow or deny access.

Use database-per-tenant for enterprise or compliance-heavy workloads needing the highest isolation, accepting higher cost and complexity. Shared schema with tenant ID suits most SaaS applications due to lower cost and simpler operations.