verify-auth

To enforce server-side authentication patterns in NestJS controllers, verify that endpoints extract userId via req.user.userId, apply permission checks using guards like @RequirePermissions, and trigger @AuditLog for state-changing operations.

UserId should not be included in the request body for backend authorization because state-changing operations must extract it securely from req.user.userId on the server side, adhering to SSOT principles and preventing insecure client-side data manipulation.

The best way to verify backend permission guards and audit logs is to validate that protected endpoints use a Permission Guard such as @RequirePermissions and that all modifications trigger an audit log with the @AuditLog decorator.

You need to use the @Public decorator for backend endpoints that do not require authentication, explicitly flagging them to bypass permission checks while documenting related references for auditing compliance.

Yes, verify-auth works with existing or newly updated backend controllers to identify and enforce server-side authentication and authorization rules, preventing security gaps and insecure patterns.