esc
Server → external: dedicated client module per vendor integrations Third-Party APIs integrations-third-party-dedicated-client-module **Scope: server → external vendor** (server-to-external). Your backend calling Stripe, SendGrid, or other third-party APIs — not browser-to-server calls to your API, not server-to-internal calls between your domains. External service calls go through one client module per vendor — not scattered `fetch` or SDK usage across features. External API responses use schema allowlists, not blocklist sanitization integrations Third-Party APIs integrations-third-party-response-schema-required Declare a response schema per integration and parse at the client boundary — never strip unknown fields with a deny list. Passport Strategies — one per auth method, no more NestJS Auth & Security nestjs-auth-one-passport-strategy-per-method One huge Strategy with `if`s = you can't add a new auth method without risking the existing ones. Authorization = Policies, not decorators sprinkled across the code NestJS Auth & Security nestjs-auth-policies-not-decorators Authorization lives in testable policy functions — not scattered `@RequireRole` decorators on controllers. Authentication and Authorization are two different layers NestJS Auth & Security nestjs-auth-separate-authn-authz Authentication (who you are) and authorization (what you may do) stay in separate guards and services. `forRootAsync` for modules with dependent configuration NestJS NestJS Modules nestjs-config-for-root-async Hard-coded module config — environments differ only by editing code. Configuration via ConfigModule, not `process.env` NestJS NestJS Modules nestjs-config-module-not-process-env Inject ConfigService — services never read `process.env` directly. OpenAPI / Swagger is generated from code, not maintained by hand NestJS NestJS Modules nestjs-config-openapi-from-code Generate OpenAPI from controllers and DTOs — the spec follows the code, not a hand-edited file. Background jobs and events — inside the owning domain NestJS NestJS Data & Errors nestjs-data-jobs-in-owning-domain Background jobs enqueue from the domain that owns the work — callers must not know another domain's queue shape. Errors — NestJS exceptions, not `throw new Error` NestJS NestJS Data & Errors nestjs-data-nestjs-exceptions Map domain failures to NestJS HTTP exceptions — clients and logs get consistent, classifiable errors. Repository pattern — don't expose the ORM to services NestJS NestJS Data & Errors nestjs-data-repository-pattern Tomorrow you swap TypeORM for Prisma or vice versa — change the repository only, services don't move. Transactions sit at the use-case boundary, not inside a repository call NestJS NestJS Data & Errors nestjs-data-transactions-at-use-case Transactions start and end at the use-case service — not in repositories or controllers. 