davidbirchall/squad-skills-backend

REST API design rules - resource naming, HTTP methods and status codes, pagination, filtering and sorting, error format (RFC 9457 problem details), idempotency, versioning, and deprecation. Load when designing endpoints, response shapes, error handling, or breaking changes.

Authentication and authorization for NestJS APIs on Fastify - secure-by-default global guard with @Public(), session vs JWT tradeoffs, OIDC/OAuth2 via an IdP, JWT validation and JWKS key rotation, short-lived access and rotating hashed refresh tokens, argon2id password hashing, MFA hooks, API keys and service-to-service auth, cookie and CSRF settings, logout and revocation, RBAC vs ABAC, default-deny guards with Reflector, object-level authorization (BOLA/IDOR), tenant isolation, WebSocket and SSE auth, and 401 vs 403 testing. Load when adding login or tokens, writing guards, changing access control, or reviewing who can reach which data.

Layered and modular architecture for NestJS and Node services - modular monolith by default, module boundaries and dependency direction, domain vs application vs infrastructure, ports and adapters, DTO/domain/persistence mapping, transaction boundaries, sync vs async communication, events, idempotency, when to split a service, config and feature flags, multi-tenancy, orchestration and BFF layers for chat and AI-style apps, and versioning boundaries. Load when designing service structure, adding a module or integration, deciding sync vs async, or considering splitting a service.

Observability for NestJS backends - structured pino logging with redaction and correlation ids via nestjs-cls, RED and USE metrics with low-cardinality Prometheus labels, OpenTelemetry tracing and context propagation across HTTP and queues, @nestjs/terminus liveness/readiness/startup health, SLIs/SLOs and symptom-based alerting, error tracking with PII scrubbing, audit versus application logs, dashboards and runbooks, tracing LLM and upstream calls, retention, testing, and performance triage. Load when adding logging, health endpoints, metrics, tracing, alerts, or debugging production behaviour.

Non-auth security for NestJS APIs on Fastify - OWASP API Top 10 mapping, security headers with @fastify/helmet, CORS allowlist, TLS at the edge, rate limiting with @nestjs/throttler and Redis, trustProxy, body and time limits, injection, SSRF, mass assignment, file uploads, secrets management and rotation, log and PII redaction, dependency and supply-chain hygiene, container hardening, SAST/DAST in CI, error message hygiene, and a per-endpoint review checklist. Load when hardening an API, adding uploads or outbound calls, configuring headers or limits, or reviewing an endpoint for security.

Testing NestJS APIs on Fastify with Vitest - backend test pyramid, SWC config for decorator metadata, Test.createTestingModule with provider overrides, Fastify inject e2e with a shared configureApp, disposable database strategy with Prisma, test data builders, fakes for clock, ids, mail, queues and HTTP upstreams, OpenAPI contract tests, background job tests, auth, validation and error-shape tests, flaky-test rules, and coverage as a signal. Load when writing or fixing API tests, configuring Vitest, setting up test databases, or deciding what level to test at.

Background work for NestJS backends - deciding what leaves the request path, 202 plus status resource/webhook/SSE, BullMQ queues via @nestjs/bullmq on Redis, queue/worker separation, small idempotent jobs, retries with backoff and jitter, dead-letter handling, concurrency, rate limits, priorities, delayed and repeatable jobs versus @nestjs/schedule cron, the outbox pattern, graceful worker shutdown, queue observability, testing, and worker threads. Load when adding queues, scheduled jobs, long-running or LLM calls, retries, fan-out, or reliable event publishing.

Caching for NestJS APIs on Fastify with Redis - when to cache, HTTP caching (Cache-Control, ETag), application caching with @nestjs/cache-manager, cache-aside versus read-through versus write-through, TTLs, key design, invalidation, stampede protection, negative caching, in-memory versus distributed, consistency, Redis memory and eviction, hit-rate observability, testing, plus a short performance triage. Load when adding or debugging a cache, setting HTTP cache headers, or when an endpoint is slow.

Data access in NestJS with Prisma and PostgreSQL - PrismaService lifecycle, repository versus direct service access, select and include discipline, N+1 avoidance, cursor pagination, transactions and isolation, optimistic concurrency, idempotent writes and upserts, bulk operations, parameterised raw SQL, soft-delete filtering, connection pools, slow-query logging, Prisma error mapping, testing against a real database, and seeding. Load when writing or reviewing queries, transactions, the Prisma integration, or database performance code.

Validating and shaping data at every trust boundary in Node.js and NestJS services - HTTP input, env config, queue messages, upstream responses, and webhooks - with class-validator DTOs or Zod, whitelisting against mass assignment, coercion, query and pagination bounds, file upload validation, sanitisation versus validation, custom and cross-field validators, normalisation, response serialization, persisted JSON columns, unknown-field policy, and testing validators. Load when writing DTOs or schemas, validating input or config, handling uploads or webhooks, or shaping responses.

Relational schema and data modelling for backend services - entity modelling, normalisation versus deliberate denormalisation, key and id strategy (UUID v4 versus v7 versus sequences), constraints, foreign keys with explicit onDelete, indexing strategy, data types (timestamptz, money, enums, JSONB), soft versus hard delete and audit tables, multi-tenancy models, naming, migrations as the schema change process (expand/contract), seed data, retention and PII classification, and scaling levers. Load when designing or changing tables, ids, indexes, constraints, or migrations.

Transactional email and notifications for NestJS backends - queueing sends through background jobs, outbox and idempotency keys, a provider-neutral mail interface, MJML/HTML plus plain-text templates with typed data, deliverability (SPF, DKIM, DMARC, bounce and complaint webhooks, suppression lists), unsubscribe and preference models for non-transactional mail, local catcher and fake provider testing, rate limits and retries, PII-safe logging, and brief in-app and push notification patterns. Load when sending email, adding notification types, wiring a mail provider, building templates, or handling bounces and user notification preferences.

Error handling for Node and NestJS backends - operational vs programmer errors, domain vs transport errors, custom error classes with codes, one global exception filter, RFC 9457 problem+json mapping, mapping domain, Prisma and upstream errors to HTTP statuses, logging once with correlation id, retries, timeouts and circuit breakers, errors in jobs, streams and SSE, process-level handlers, transaction rollback, Result-style returns, error code catalogue, and testing error paths. Load when adding failure paths, writing exception filters or error classes, mapping errors to responses, or debugging unhandled errors.

Running NestJS on Fastify with @nestjs/platform-fastify - bootstrap, Fastify plugin registration (helmet, cors, multipart, compress), Express vs Fastify differences, typed request and reply, serialization, and testing with inject. Load when setting up or changing the Fastify adapter or using Fastify-specific features in a Nest app.

File upload and storage for NestJS and Prisma backends - S3-compatible object storage behind an interface with local disk for dev, presigned URL uploads versus API-proxied uploads, size and type limits with content sniffing, virus scanning hooks, safe key naming, file metadata in Prisma, private-by-default access with short-lived signed download URLs, thumbnails via jobs, streaming, multipart and resumable uploads, lifecycle and orphan cleanup, backups, CDN caching, and testing with a fake store. Load when accepting uploads, serving user files, adding image processing, or designing object storage and file metadata.

Enforce owner-scoped data isolation across NestJS, Prisma, caches, queues, files, and exports; derive scope from trusted auth context, keep the design tenancy-ready for later, and test cross-user leaks. Load when adding ownership checks, workspaces, tenant IDs, or reviewing whether one user's data can reach another's.

conventions for NestJS APIs - module and provider design, dynamic modules, custom providers and injection tokens, provider scopes, typed ConfigModule configuration, lifecycle and shutdown hooks, the request pipeline (middleware, guards, interceptors, pipes, filters) and when to use each, custom decorators, event emitter, CQRS only when justified, circular dependency avoidance, testing-friendly design, versioning, nest-cli plugins, and common pitfalls. Load when creating or changing NestJS modules, controllers, services, providers, decorators, or cross-cutting request pipeline pieces.

Node.js and TypeScript conventions for backend services - LTS pinning, ESM vs CJS, config validation at boot, graceful shutdown, process-level error policy, process model and scaling, strict tsconfig and typing rules, Oxlint and Prettier setup, server-side axios clients with timeouts, retries and AbortSignal, event-loop protection, streams, logging, dependency hygiene and project layout. Load when setting up or changing a Node service, tsconfig, lint and format tooling, outbound HTTP clients, or when code may block the event loop.

OpenAPI and Swagger docs for NestJS with @nestjs/swagger - DocumentBuilder setup, decorators, DTO schemas, the Nest swagger CLI plugin, auth schemes, versioning, spec export, and keeping the spec as the API contract for Postman and generated clients. Load when documenting endpoints, DTOs, or changing the public API contract.

Postman workflows for APIs - generating collections from the OpenAPI spec, environments and variables, secrets handling, test scripts, collection structure, and running with Newman or the Postman CLI in CI. Load when creating or maintaining Postman collections, environments, or automated API contract checks.

Prisma with PostgreSQL in NestJS - schema conventions (uuid ids, createdAt/updatedAt, soft delete policy, enums), PrismaService lifecycle, migrate dev versus deploy workflow, interactive versus batch transactions, N+1 and select/include discipline, cursor pagination, raw query safety, error mapping (P2002, P2025), real-database testing, indexes, JSON columns for message parts, DTO mapping instead of exposing models, and connection pool sizing. Load when writing or changing schema.prisma, migrations, Prisma queries, transactions, or repository code.

Cost and abuse protection for an LLM-backed NestJS API - token and cost budget caps, concurrent stream limits, runaway agent loop guards, leaked key containment, token bucket and sliding window rate limits, @nestjs/throttler with Redis storage, reserve-and-settle token accounting, 429 with Retry-After and stable error codes, soft versus hard limits, and a when-you-grow section on per-tenant quotas and plans. Load when adding throttling, spend or token caps, stream concurrency limits, agent loop limits, or investigating runaway LLM cost or abuse.

Token streaming from NestJS on Fastify to a browser client - SSE versus WebSocket decision, @Sse with Observable and raw Fastify reply handling, event framing and types (delta, done, error, heartbeat), event IDs and resumable streams via Last-Event-ID with a Redis stream or DB buffer, client disconnect detection and AbortSignal cancellation of upstream LLM calls, backpressure, heartbeats and proxy buffering headers, timeouts, one stream per request, persisting the final message after disconnect, error-after-start semantics, and load limits. Load when building or debugging streaming chat responses, SSE endpoints, resumable streams, or LLM token delivery.

RxJS in NestJS APIs - when to use observables versus async/await, interceptor and microservice patterns, operator choice (map, switchMap, mergeMap, catchError, timeout, retry), subscription leaks, firstValueFrom, SSE, and error handling. Load when writing interceptors, SSE endpoints, HttpService calls, or other observable code.