JWTs vs. Sessions: Lessons from Building a Real-World Auth Kit in NestJS

A small open-source NestJS and TypeORM decorator library to validate DTOs

How to Implement Attribute-Based Access Control (ABAC) in NestJS

Hey HN!Suites is a unit-testing framework for TypeScript backend systems working with dependency injection.It introduces a single declarative API for unit testing: wrap any unit with a single call and receive a correct test environment for the unit and its dependencies.<pre><code> &#x2F;&#x2F; Test a class in complete isolation, all dependencies mocked
 TestBed.solitary(OrderService).compile();

 &#x2F;&#x2F; Or, test how it integrates with a real dependency
 TestBed.sociable(OrderService)
 .expose(PaymentProcessor) &#x2F;&#x2F; Use the real class
 .compile();
</code></pre>
The backstory: while working for a fast-growing fintech startup 4 years ago, my team had to write thousands of unit tests for our NestJS backend. To scale our efforts, I&#x27;ve built a unit-testing framework which eliminated a significant part of the tests&#x27; code and made them a whole lot more maintainable. I open-sourced it, generalized it to support more tech stacks, and soon it gained traction.The problem - unit testing becomes a nightmare very fast:- You mock dependencies by hand, wire them up manually, and spend more time maintaining tests than writing them.
 - Unit tests are leaky and error-prone since it&#x27;s unclear which dependencies are mocked
 - Test intention is lost in the boilerplate
 - Each engineer invents their own conventions
 - Tests break during refactors because of untyped, loosely connected mocks
 - Missing mock implementations go unnoticed, so tests falsely fail on unexpected undefined returns or validate the wrong behavior
 - Test errors for wrong mocking are confusing to engineers and coding agents alikeThe nitty-gritty details:- Fluent, auto-discoverable, fully-typed API.
 - DI Framework Adapters: Works out of the box with NestJS and InversifyJS
 - Testing Library Adapters: Works out of the box with Jest, Sinon, and VitestSuites provide two modes of testing: (inspired by Martin Fowler&#x27;s writings [0])- Solitary: For testing units in a vacuum, it creates type-safe mocks of all the unit&#x27;s direct dependencies.
 - Sociable: For testing units with other related units, it allows the developer to define which dependencies to mock.Eliminating boilerplate and making mocks type-safe drastically helps coding agents (e.g. Claude Code) to write correct tests in a single pass and avoid entering infinite loops, significantly reducing token cost.You can read more about Suites on our website: <a href="https:&#x2F;&#x2F;suites.dev" rel="nofollow">https:&#x2F;&#x2F;suites.dev</a>What&#x27;s next?- A dedicated skill for Claude Code
 - Extended docs with real-world patterns
 - More test utilities for common backend scenariosSuites is fully open-source and actively maintained for 4 years. I would love you to check it out and get your honest feedback![0] <a href="https:&#x2F;&#x2F;martinfowler.com&#x2F;bliki&#x2F;UnitTest.html" rel="nofollow">https:&#x2F;&#x2F;martinfowler.com&#x2F;bliki&#x2F;UnitTest.html</a>

Show HN: Suites – modern unit tests framework for TypeScript back ends

I’m launching UsageFlow, a simple tool for API owners who want automatic API usage metering and full control over their endpoints — all without any hassle.With just a few lines of code, the UsageFlow SDK gives you:Automatic discovery of API endpointsUser identificationUsage meteringRate-limits and automatic blockingReporting usage events to your existing billing or metering systemSupports: Go (Gin), Python (FastAPI, Flask), Node.js (Express, Fastify, NestJS)Perfect for AI APIs or SaaS platforms that want to scale fast — focus on building your product while UsageFlow handles usage tracking automatically.No developer skills required to:Update usage rulesApply limitsReport usageEverything works with a few clicks — your entire usage platform is in your hands, instantly.I’m opening this for first testers. If you run an API and want to try UsageFlow, comment below or DM me — I will create your account and get you started in minutes.Learn more at: <a href="https:&#x2F;&#x2F;usageflow.io" rel="nofollow">https:&#x2F;&#x2F;usageflow.io</a>

Show HN: UsageFlow – API usage metering, rate-limits and usage reporting

Hey HN — I&#x27;m David, and I built Photerra to solve a problem I kept running into: planning trips meant juggling dozens of browser tabs, Google Sheets, and the same recycled &quot;top 10&quot; lists everyone else sees.Photerra turns geolocated photos into map spots you can organize into trips, share with friends, and book from — all in one flow.The core idea: photos with GPS → actual spots on a map → drag into trip days → share → book.What makes Photerra different:• Real locations, not just POIs — Your photos have EXIF GPS data, so you&#x27;re adding exact spots (that actual spot on the trail, not just “Yosemite” - no address needed).• End-to-end flow — Discover → plan → coordinate → book, without switching between 5 apps.• Photo-grounded data — Community spots come from real photos, not scraped listicles, so you find more off-path places.• Works for everyday wandering — Not just big trips. Save local spots and open them in Maps or Uber with one tap.Try it: iOS and Android apps are live (links in comments). I&#x27;ve seeded content in SF, Portland, LA, San Diego, Hawaii, Philly, Yosemite, and Mexico City.Tech: React Native + RN-Maps on mobile; NestJS + TypeORM&#x2F;MySQL + AWS on backend.What I&#x27;d love feedback on:• Is the photo→spot→trip flow intuitive on first use?• What&#x27;s missing to make this truly start-to-finish for your trips?• Any friction in auth, maps, or sharing?Be blunt — it&#x27;s helpful. Happy to answer questions!— David (solo, first-time founder)

Show HN: Photerra – One app to discover hidden gems, plan with friends, and book

Hi all, I&#x27;m Dante, and I&#x27;m building Echos, a platform that gives you pre-built AI agents so you can stop rebuilding orchestrators, database agents, and retry logic every time.What it does:- Pre-built agents: Database queries, API calls, web search, data analysis, code generation.- YAML-based workflows: Define your agent architecture without rebuilding orchestrators.- Built-in guardrails: SQL injection protection, SSRF blocking, table&#x2F;domain whitelisting.- Visual traces: See what happened, where it failed, and how much it cost.Why I built it:Every time I build a multi-agent system, I spend 2-3 weeks creating the same infrastructure: orchestrators that route tasks, database agents with SQL guardrails, retry logic, loop limiting, and cost tracking. Then another week of debugging when things break. I wanted to ship features, not plumbing.Most frameworks are bulky and complex. You just want pre-built components you can compose like AWS services.What Echos gives you:- Ship faster: Pre-built agents you compose in YAML.- Debug in minutes: Visual traces show exactly what happened, where it failed, and how much it cost.- Prevent disasters: Built-in guardrails (SQL injection protection, SSRF blocking, loop limiting) catch 80% of dangerous operations.- Control costs: Per-agent spending limits prevent runaway bills.Try it:
Clone <a href="https:&#x2F;&#x2F;github.com&#x2F;treadiehq&#x2F;echos" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;treadiehq&#x2F;echos</a> or go to <a href="https:&#x2F;&#x2F;echoshq.com" rel="nofollow">https:&#x2F;&#x2F;echoshq.com</a>import { EchosRuntime } from &#x27;@echoshq&#x2F;runtime&#x27;;const runtime = new EchosRuntime({
 apiKey: process.env.ECHOS_API_KEY,
 apiUrl: process.env.ECHOS_API_URL,
 workflow: &#x27;.&#x2F;workflow.yaml&#x27; &#x2F;&#x2F; Define agents and routes in YAML
});&#x2F;&#x2F; Simple usage
await runtime.run({
 task: &#x27;Analyze customer churn&#x27;,
 memory: { year: 2024, region: &#x27;north&#x27; }
});Tech:- NestJS for the backend API: Needed structured DI and middleware for auth.- Postgres for trace storage: JSON columns for flexible span logs, native SQL performance.- Resend for magic link authentication: Reliable email delivery without managing SMTP.- Nuxt 3 for the dashboard: SSR for fast initial load, client-side interactivity for live traces.- Railway for deployment: Fast deploys. First time trying it. My previous default is Digital Ocean.What I learned:- Time saved is the real value: Teams don&#x27;t want another framework, they want to ship faster.- Debugging is 50% of the work: Visual traces that show the full execution path are essential.- Simple guardrails work: Blocking DELETE&#x2F;DROP and unknown domains catches most disasters.- YAML &gt; Code for config: Non-engineers can edit workflows without touching code.Looking for feedback:- Does this solve a real problem for you?- Which agents would you use most? database, API calls, web search, data analysis, or code generation?- Is YAML configuration expressive enough, or do you need more programmatic control?- What agents should we add next? (GitHub, Slack, email, cloud APIs?)- Would you use this for autonomous agents, or just one-off tasks?- Would this save you time on your next multi-agent project?- What&#x27;s missing that would make this immediately useful?Thank you!

Show HN: Echos – A lightweight multi-agent AI system with pre-built agents

Hello Hacker News,Wikipedia remains an invaluable resource for structured knowledge, yet its traditional search mechanisms can feel outdated in an era of conversational interfaces. AikiPedia addresses this by providing an open-source layer that integrates AI capabilities directly with Wikipedia&#x27;s content, enabling more intuitive exploration and synthesis of information.Overview
AikiPedia is a web application that leverages the Wikipedia API to access comprehensive documentation, enhanced by AI-driven tools for natural language interaction. It allows users to query, summarize, and personalize content without compromising on factual accuracy.Key Features (v0.2)
* Natural Language Search: Submit queries in everyday language, such as &quot;Explain blockchain for beginners,&quot; to retrieve Wikipedia-sourced results refined by AI for clarity and relevance.* Generated Overviews: Produce customized summaries, comparison tables, or timelines from any topic, facilitating efficient research and knowledge distillation.* Save and Share Functionality: Use local storage for bookmarking and exporting content in Markdown or PDF formats, with AI-assisted previews for easy dissemination.Future enhancements will be guided by community feedback, potentially including voice-based queries, multilingual support, and collaborative annotation tools.
The platform ensures reliability by sourcing facts exclusively from Wikipedia&#x27;s API, while employing the Gemini API for intelligent processing—minimizing errors and maintaining transparency in outputs.I developed AikiPedia in a single evening, inspired by interactions with similar AI-augmented knowledge tools like Grokipedia. This project emphasizes an open-source, Wikipedia-centric approach, prioritizing ease of extension and deployment.Technical Stack
* Frontend: Next.js 16 (App Router) with Shadcn UI, utilizing server-side rendering for optimal performance.* Backend: NestJS 16 (App Router) for robust API management, including caching of Wikipedia responses and coordination of Gemini integrations.* Storage and Integrations: LocalStorage for user data persistence; Gemini API (via Ai SDK) for AI functionalities; Wikipedia API for content retrieval.* Deployment: Hosted on Vercel for scalable, edge-optimized delivery.License: MIT, permitting unrestricted modification and redistribution.Repository: <a href="https:&#x2F;&#x2F;github.com&#x2F;Grenish&#x2F;aikipedia" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;Grenish&#x2F;aikipedia</a>. Live demo: <a href="https:&#x2F;&#x2F;aikipedia.vercel.app&#x2F;" rel="nofollow">https:&#x2F;&#x2F;aikipedia.vercel.app&#x2F;</a>I welcome your insights: Any observations on usability, particularly across devices? Contributions via stars, pull requests, or issues are greatly appreciated.Thank you for your time and consideration.

Show HN: AikiPedia – An Open-Source AI-Enhanced Interface for Wikipedia

Hi HN!I&#x27;m a solo developer from Korea, and I’ve been building Culink, a social platform for curating and sharing link collections — kind of like Pinterest for links (articles, tools, videos, resources, etc).Why I built this:
I kept losing interesting links across scattered bookmarks. GitHub “awesome lists” are great, but they’re static — I wanted something more social, searchable, and collaborative.What you can do:
- Create themed collections (AI tools, dev resources, startup guides, etc)
- Collaborate and share collections with others
- Follow curators you trust
- Discover quality links through your network
- Enjoy a simple, clean interfaceTech stack:
Next.js 15, NestJS, PostgreSQL, Azure Container AppsCurrent status:
Just launched the English version on US servers, with example collections so you can explore right away.Try it:
<a href="https:&#x2F;&#x2F;www.culink.io&#x2F;discover" rel="nofollow">https:&#x2F;&#x2F;www.culink.io&#x2F;discover</a>Would love your feedback on:
- Potential use cases I might be missing
- Features you&#x27;d find useful
- UX or onboarding improvementsThanks for checking it out — happy to answer any questions!

Show HN: Culink – A social platform for curating and sharing link collections

This is essentially how we write our NestJS backend at work, nice guide.

TypeScript is Like C# – A Backend Guide

Email shane.vierra [at] vestwell [dot] com with your resume as soon as possible if interested:Senior Software Engineer - HYBRID - New York, NY | Austin, TX | Phoenix AZ | King of Prussia, PAVestwell, a Series D fintech startup, is hiring for a Senior Software Engineer that is primarily back end, and must have experience in Typescript, Node.js and NestJSThese positions are HYBRID meaning that you must be less than 2 hours commuting distance from either our New York, NY | Austin, TX | Phoenix AZ | King of Prussia, PA office.

[dead]

Different scope. NestJS organizes app code, Effect does functional composition - both still need separate infra tooling. Encore handles services + infrastructure + deployment as one thing. You could use Effect&#x2F;NestJS patterns inside Encore apps though. Happy to answer specifics!

Show HN: Encore – Type-safe back end framework that generates infra from code

the type-safe infrastructure primitives are interesting, curious how it compares to something like effect or nestjs for actual production use

Location: Kathmandu, NepalRemote: YesWilling to relocate: No&#x2F;Remote worldwideTechnologies: Go, Typescript, NestJS, Next.js, React, Linux, AWS, Docker, PostgreSQLRésumé&#x2F;CV: <a href="https:&#x2F;&#x2F;rajibbajracharya.com.np" rel="nofollow">https:&#x2F;&#x2F;rajibbajracharya.com.np</a>Email: contact@rajibbajracharya.com.np

Ask HN: Who wants to be hired? (November 2025)

PetsApp – The future of pet care | Remote (US&#x2F;UK&#x2F;EU)Open roles:
 - Full Stack Engineer $150k–$230k | Full-time
We’re building an AI-powered clinic assistant that actually gets things done—booking appointments, managing vaccine records, handling FAQs, and even sounding like the clinic itself. This is multi-modal AI in the real world, not a demo.
⸻
We’re looking for product-minded engineers who want to push the boundaries of generative AI, RAG, and intelligent automation. You’ll ship fast, solve real user problems, and help us make AI feel magical, not clunky.
Tech stack: TypeScript, NestJS, React, React Native, AWS. Bonus: AI experience, but what matters most is product intuition and the drive to build useful things.
Apply here: <a href="https:&#x2F;&#x2F;forms.gle&#x2F;5fww8HDwRrP6c6Fo9" rel="nofollow">https:&#x2F;&#x2F;forms.gle&#x2F;5fww8HDwRrP6c6Fo9</a>

Ask HN: Who is hiring? (November 2025)

Location: Romania (EU)Remote: YesWilling to relocate: YesTechnologies: Go, Node.js&#x2F;TypeScript, NestJS, Java, SpringBoot, OpenAPI, PostgreSQL, AWS (Lambda, DynamoDB, RDS, ECS, EKS, VPC, SQS, SNS, CFN, CDK and many others), Serverless, Docker, Kubernetes, Helm, FluxCD, GitOps, Terraform, Ansible, React, Next.js, Webpack, Vite, Tailwind CSSRésumé&#x2F;CV: <a href="https:&#x2F;&#x2F;ionutmilica.com&#x2F;resume-da6234caddd2b5.pdf" rel="nofollow">https:&#x2F;&#x2F;ionutmilica.com&#x2F;resume-da6234caddd2b5.pdf</a>Email: ionut.milica@gmail.comHello. I&#x27;m Ionut - Polyglot software engineer with over 9 years of experience across backend, frontend, distributed systems and DevOps.My website: <a href="https:&#x2F;&#x2F;ionutmilica.com" rel="nofollow">https:&#x2F;&#x2F;ionutmilica.com</a>Github: <a href="https:&#x2F;&#x2F;github.com&#x2F;ionutmilica" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;ionutmilica</a>

I built a full-stack Auth Kit with NestJS and Next.js, and found myself stuck in the usual JWT vs Sessions debate.After testing both under real-world conditions — logout, refresh rotation, and device tracking — I realized neither model was enough on its own.This post shares what I learned about blending them into a hybrid approach.Curious to hear how others are handling this balance in production systems.

SEEKING WORKLocation: Germany (Dusseldorf)Remote: YesWilling to relocate: NoTechnologies: React, Next.js, TypeScript, Mantine UI, Tailwind CSS, shadcn, Material UI, Bootstrap, Node.js, Express, NestJS, PostgreSQL, various auth solutions (Supabase Auth, Auth0, Firebase Auth etc.), Golang, Kubernetes, AWS, Swift, Unity, various analytics and monitoring solutions (Prometheus, Grafana, Pendo etc.), OpenAI API, AI agents.Résumé&#x2F;CV: <a href="https:&#x2F;&#x2F;drive.google.com&#x2F;file&#x2F;d&#x2F;1UVHNlrDhIZwHV2N0XmGhOluLguZbZSiK&#x2F;view?usp=sharing" rel="nofollow">https:&#x2F;&#x2F;drive.google.com&#x2F;file&#x2F;d&#x2F;1UVHNlrDhIZwHV2N0XmGhOluLguZ...</a>Email: opudrovs@gmail.comAvailable for remote work worldwide, very flexible across time zones. Looking for permanent or contract positions.Hi! I’m Olga, an experienced software engineer looking for frontend or fullstack projects.I have experience building greenfield projects and complex features that “just work,” as well as diving into complex legacy codebases, fixing “unfixable” bugs, and performing major refactoring.In addition to React&#x2F;Next.js and Node&#x2F;Express.js development, I also have experience with cloud-native workflows (Golang + Kubernetes), OpenAI API integration and agentic workflows, native iOS development, and game development. Thanks to my multi-platform experience, I can help you port large products across different platforms.LinkedIn: <a href="https:&#x2F;&#x2F;www.linkedin.com&#x2F;in&#x2F;olga-pudrovska&#x2F;" rel="nofollow">https:&#x2F;&#x2F;www.linkedin.com&#x2F;in&#x2F;olga-pudrovska&#x2F;</a>My contributions to Weave GitOps (React&#x2F;Golang Kubernetes dashboard project): <a href="https:&#x2F;&#x2F;github.com&#x2F;weaveworks&#x2F;weave-gitops&#x2F;commits?author=opudrovs" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;weaveworks&#x2F;weave-gitops&#x2F;commits?author=op...</a>
<a href="https:&#x2F;&#x2F;github.com&#x2F;weaveworks&#x2F;weave-gitops-enterprise&#x2F;commits?author=opudrovs" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;weaveworks&#x2F;weave-gitops-enterprise&#x2F;commit...</a>My latest fullstack code samples:
<a href="https:&#x2F;&#x2F;github.com&#x2F;opudrovs&#x2F;react-api-data-sample&#x2F;" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;opudrovs&#x2F;react-api-data-sample&#x2F;</a>
<a href="https:&#x2F;&#x2F;github.com&#x2F;opudrovs&#x2F;nestjs-demo&#x2F;" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;opudrovs&#x2F;nestjs-demo&#x2F;</a>

Ask HN: Freelancer? Seeking freelancer?

Hi! I am Shawn, an experienced Full Stack developer familiar across both the frontend and backend having worked for a number of years across multiple startups, and am confident that I would be able to bring value and contribute as an engineer given my prior experience be it in a part-time or full-time capacity.I’ve spent the last several years as a full stack engineer, working with both startups and big tech companies in the US, Europe and in Singapore. I thrive in environments where I can collaborate, solve complex problems, and see my work make a difference.I would be more than happy to jump on a call and see if I can help contribute and add value to your team as an engineer.---Location: Bangkok, Thailand (Asia)Remote: Yes (Asia or EU time zone)Willing to relocate: NoTechnologies: JavaScript, TypeScript, React, Next.js, VueJS, NuxtJS, NestJS, Node.js, TailwindCSS, GraphQL&#x2F;REST API, LLMs, Langchain, Langgraph, OpenAI APIs, Solidity, Rust, Docker, AWS, web3, Python, FastAPIWebsite: <a href="https:&#x2F;&#x2F;developerlim.com&#x2F;" rel="nofollow">https:&#x2F;&#x2F;developerlim.com&#x2F;</a>LinkedIn: <a href="https:&#x2F;&#x2F;www.linkedin.com&#x2F;in&#x2F;ke-qin-lim-103a99342&#x2F;" rel="nofollow">https:&#x2F;&#x2F;www.linkedin.com&#x2F;in&#x2F;ke-qin-lim-103a99342&#x2F;</a>Email: slkq.dev@gmail.com

<pre><code> SEEKING WORK | CENTRAL EUROPE | REMOTE

 Premium service, fourteen person team of developers + 2 PMs + 1 QA + 1 UI&#x2F;UX designer, focused on the design &amp;
 development of web and mobile products and AI integrations.

 Working with EU &amp; USA (EST &amp; PST) clients from funded startups to corporations (Fortune500) 

 Can work as an outsourced team or cover the full product development cycle.

 Email: info [at] higroup.io
 Website with portfolio: www.higroup.io 
 Rate: Either fixed per project or $75&#x2F;hour; Fast turn around. You receive a quote in 48 hours.

 -----------------------------------------------------------
 Location: Slovenia, Ljubljana, European Union 
 Frontend: HTML5 (Bootstrap,Tailwind etc.), CSS3 (Sass), JavaScript (Vue.js, Nuxt.js, React), Three.js
 Backend: PHP (Laravel), GO and Node.js (NestJS), Python (FastAPI)
 Mobile: Flutter
 Databases: MySQL, NoSQL, MongoDB
 Platform: AWS, Azure, Oracle, DotDigital, Terraform
 Integration experience: Stripe, Mollie, PayPal, Klarna, BigCommerce, Contentful, hygraph, Directus ...
 -----------------------------------------------------------

 We always listen to the needs and wishes of our customers when advising on product 
 realization, we can proudly say that customer satisfaction is our guarantee.</code></pre>


  [![Backers on Open Collective](https://opencollective.com/nest/backers/badge.svg)](https://opencollective.com/nest#backer)
  [![Sponsors on Open Collective](https://opencollective.com/nest/sponsors/badge.svg)](https://opencollective.com/nest#sponsor)

## Description

Nest is a framework for building efficient, scalable [Node.js](http://nodejs.org) server-side applications. It uses modern JavaScript, is built with  [TypeScript](http://www.typescriptlang.org) preserves compatibility with pure JavaScript and combines elements of OOP (Object Oriented Programming), FP (Functional Programming), and FRP (Functional Reactive Programming).

Under the hood, Nest makes use of [Express](https://expressjs.com/), but also, provides compatibility with a wide range of other libraries, like e.g. [Fastify](https://github.com/fastify/fastify), allowing for easy use of the myriad third-party plugins which are available.

## Installation

```js
$ npm install
```

## Getting Started

Setting up a new project is quite simple. With npm installed, you can create a new Nest project with the following commands in your OS terminal:

```js
$ npm i -g @nestjs/cli
$ nest new project-name
```

## Running the app

```js
# development
$ npm run start

# watch mode
$ npm run start:dev

# production mode
$ npm run start:prod
```

## Test

```js
# unit tests
$ npm run test

# e2e tests
$ npm run test:e2e

# test coverage
$ npm run test:cov
```

## Support

Nest is an MIT-licensed open source project. It can grow thanks to the sponsors and support by the amazing backers. If you'd like to join them, please [read more here](https://opencollective.com/nest).

## Stay in touch

- Website - [https://nestjs.com](https://nestjs.com/)
- Twitter - [@nestframework](https://twitter.com/nestframework)

... More content comming soon ...

NestJS News

News From: hn.algolia.com