hiro1107/nestjs-supabase-auth

Summary

nestjs-supabase-auth is a NestJS Passport strategy that lets a NestJS application verify JWTs issued by Supabase Auth on incoming requests. The README shows how to subclass SupabaseAuthStrategy, supply your Supabase URL, key, and JWT secret, and then guard NestJS (and GraphQL) endpoints so that the decoded Supabase user becomes available on the request.

What it is useful for

This package is useful when you have a NestJS backend and you want Supabase to handle authentication (sign-up, sign-in, password reset, social providers, etc.) but you still need server-side verification of the JWT that the client sends on each request. Typical scenarios include:

• A NestJS HTTP or GraphQL API whose frontend authenticates with Supabase and then calls your API with a Supabase access token.
• Resolvers or controllers that need the authenticated SupabaseAuthUser object (for example, to scope database queries by user.id).
• Centralizing auth checks with a standard @UseGuards(AuthGuard('supabase')) pattern rather than hand-rolling JWT verification per route.

The README also shows how a custom GqlAuthGuard and a CurrentUser param decorator expose the user inside @nestjs/graphql resolvers, which is the main demonstrated flow.

How engineers can use it

The README documents a concrete setup. The steps below use only the commands and code shown in the README; the example also assumes you load Supabase credentials via environment variables (the README uses dotenv with env-cmd).

1. Install the peer dependencies and the strategy:

   npm install passport passport-jwt @nestjs/passport
   npm install --save-dev @types/passport-jwt
   npm install nestjs-supabase-auth
   

   (Yarn equivalents are also listed.)
2. Create a strategy class that extends SupabaseAuthStrategy via PassportStrategy, supplying supabaseUrl, supabaseKey, supabaseOptions, supabaseJwtSecret, and a JWT extractor such as ExtractJwt.fromAuthHeaderAsBearerToken().
3. Register PassportModule and your SupabaseStrategy in an AuthModule providers list, exporting it as needed.
4. Protect routes with @UseGuards(AuthGuard('supabase')) for REST controllers, or the README's GqlAuthGuard for GraphQL resolvers, and read the user with the documented CurrentUser decorator.

Documented gaps to be aware of: the README only demonstrates Bearer-token extraction from the Authorization header and a GraphQL guard; cookie- or query-based JWT extraction is not shown. Token refresh, role/permission checks, and revocation handling are not described, so you would need to handle those yourself or check the README for updates.