nestjs-patterns

Keep domain code inside feature modules under src/modules, with each module owning its controller, service, DTOs, and guards. Place cross-cutting filters, interceptors, and pipes in a common directory, and keep controllers thin by delegating business logic to injectable services.

Register a global ValidationPipe in the bootstrap function with whitelist, forbidNonWhitelisted, and transform enabled. Then annotate request DTOs with class-validator decorators like IsEmail, IsString, and Length so every endpoint validates input automatically.

Yes, combine a JwtAuthGuard with a RolesGuard using UseGuards and a Roles decorator to encode coarse access rules. Perform resource-specific authorization inside services rather than in guards for finer control.

Validating env at boot with ConfigModule's validate option prevents the app from starting with invalid or missing configuration. This avoids lazy failures at first request and keeps config access behind typed helpers.

Controllers should only parse HTTP input, call a provider, and return response DTOs. Business logic, multi-step writes, and transaction coordination belong in injectable services that own the unit of work.