verify-auth

What problem does it solve?

Verifies that backend controllers comply with server-side authentication and authorization rules to prevent security gaps and insecure patterns.

Core Features & Use Cases

• Enforces extraction of userId from req.user.userId (no body userId) and ensures DTOs do not define userId fields for state-changing operations.
• Ensures protected endpoints use a Permission Guard such as @RequirePermissions and that modifications trigger an audit log with @AuditLog.
• Flags and guides proper use of @Public on endpoints that do not require authentication, and documents related references for auditing checks.

Quick Start

Run verify-auth after adding or modifying controller endpoints to validate authentication and authorization patterns.