CollatzConjecture/nestjs-clean-architecture

This is a NestJS-based backend service that manages user authentication and profile data using a structured, domain-driven architecture. It implements role-based access control, event-driven workflows, and standardized API responses across versioned endpoints. The system includes comprehensive test coverage for both domain logic and infrastructure layers.

The application now supports command-query separation and event-driven architecture for user registration and deletion, with sagas coordinating profile creation and cleanup. A new global response service standardizes API output, while role-based access control is enforced via a \RolesGuard\ and \@Roles\ decorator. Additionally, a \ResponseInterceptor\ and \ApiExceptionFilter\ ensure consistent, structured JSON responses and error handling across the application.

src/application · high confidence

The application now exposes a /health endpoint for monitoring, as seen in the new health.controller.ts and its registration in app.module.ts. API versioning is enabled via URI, and a global 'api' prefix is applied to all routes except health. A global response interceptor and exception filter are registered to standardize API responses. Additionally, Swagger documentation is restricted to non-production environments, and middleware for request ID and logging is applied to specific routes.

src · high confidence

The API layer now uses a standardized \ResponseService\ and \SuccessResponseDto\/\ErrorResponseDto\ to wrap all API responses, ensuring consistent error and success payloads across the board. Additionally, new endpoints have been added for user registration, login, logout, password changes, and token refresh, alongside a basic 'hello' endpoint and profile management routes, all versioned under 'v1'.

src/api · medium confidence

Added AuthDomainService and ProfileDomainService to encapsulate business logic for user authentication, password validation, and profile creation/update rules. New repository interfaces (IAuthRepository, IProfileRepository) define data access contracts. The legacy LoggerService and UserService were removed from the domain layer.

src/domain/services · high confidence

Documentation files in the doc directory have been updated to reflect the new API versioning structure. Endpoints such as /hello, /all, and /uuser have been migrated to /api/v1/hello, /api/v1/profile/all, and /api/v1/profile/me respectively. The health check endpoint remains at /health without versioning. Additionally, the user profile documentation was renamed from users.http to profile.http to better reflect its content.

doc · high confidence

Added new domain entities to support authentication and user management. The AuthUser entity now includes a role field to support role-based access control, while the Profile entity has been defined to store additional user data. Both entities include standard audit fields (createdAt, updatedAt) and support soft deletion via a deletedAt field.

src/domain/entities · medium confidence

The project has replaced the deprecated TSLint tool with ESLint, introducing a new eslint.config.mjs file and removing the old tslint.json configuration. Additionally, the TypeScript configuration (tsconfig.json) has been updated to enable esModuleInterop, allowSyntheticDefaultImports, skipLibCheck, and resolveJsonModule, while also adding an @api path alias. The Dockerfile has also been updated to use Node 20 and switch from npm to pnpm for package management.

(repo-wide) · high confidence

The legacy user repository has been removed and replaced with new, dedicated repositories for authentication and profile management. The new auth repository introduces methods for finding users by email, ID, or Google ID, and handles soft deletion and refresh token management. The profile repository now supports role-based queries and links profiles to authentication records, providing a more structured approach to user data access.

src/infrastructure/repository · high confidence

The previous User model has been removed and replaced with two new models: Auth, which handles email encryption, password hashing, and role-based authentication, and Profile, which stores user details like name and age. The model provider configuration has been updated to register these new schemas, reflecting a shift from a single-user data structure to a separated authentication and profile management system.

src/infrastructure/models · high confidence

Added unit tests for constants and profile repository; Added unit tests for profile domain and application services; Expanded end-to-end test coverage for authentication and application bootstrap.

The project has switched its package manager from npm to pnpm, evidenced by the addition of pnpm-lock.yaml and the removal of package-lock.json. This is accompanied by a significant upgrade of the NestJS framework to version 11.1.6 and the addition of several new dependencies including @nestjs/cqrs, @nestjs/event-emitter, @nestjs/jwt, @nestjs/passport, and @nestjs/throttler. Additionally, the build scripts have been updated to use pnpm, and the ESLint configuration has been modernized with @typescript-eslint and eslint v9, while dev dependencies like Jest and TypeScript have also been updated.

(dependencies) · high confidence

Written by watchdog.canine.dev from the codebase's own history, inside the signed delivery this page is composed from.

• CAI 47 → 49 (+1.1)
• Rubric changed (rubric-2026.08.19 → rubric-2026.09.15) — scores are not directly comparable.

• Code Health 94 → 95 (+0.8)
• Architecture 57 → 59 (+2.3)
• Maturity 69 → 69 (+0.0)
• Readiness 24 → 27 (+3.8)
• Security 79 → 78 (-1.0)

• Coverage not included — suite not readable by the collector
• Critical CVE: [GHSA redacted] (pnpm-lock.yaml)
• Critical CVE: [GHSA redacted] (pnpm-lock.yaml)
• Dependency hygiene not measured — dependency manifest found but not parsed for hygiene
• High CVE: [GHSA redacted] (pnpm-lock.yaml)
• High CVE: [GHSA redacted] (pnpm-lock.yaml)
• High CVE: [GHSA redacted] (pnpm-lock.yaml)
• High CVE: [GHSA redacted] (pnpm-lock.yaml)
• High CVE: [GHSA redacted] (pnpm-lock.yaml)
• High CVE: [GHSA redacted] (pnpm-lock.yaml)
• High CVE: [GHSA redacted] (pnpm-lock.yaml)
• High CVE: [GHSA redacted] (pnpm-lock.yaml)
• High CVE: [GHSA redacted] (pnpm-lock.yaml)
• High CVE: [GHSA redacted] (pnpm-lock.yaml)
• High CVE: [GHSA redacted] (pnpm-lock.yaml)
• High CVE: [GHSA redacted] (pnpm-lock.yaml)
• High CVE: [GHSA redacted] (pnpm-lock.yaml)
• High CVE: [GHSA redacted] (pnpm-lock.yaml)
• High CVE: [GHSA redacted] (pnpm-lock.yaml)
• High CVE: [GHSA redacted] (pnpm-lock.yaml)
• …and 21 more

• ApiExceptionFilter.catch (cognitive 18) (src/application/filters/api-exception.filter.ts)
• ApiExceptionFilter.catch (cyclomatic 16) (src/application/filters/api-exception.filter.ts)
• Critical CVE: [GHSA redacted] (pnpm-lock.yaml)
• Critical CVE: [GHSA redacted] (pnpm-lock.yaml)
• Documentation: no installation or build instructions (README.md)
• Documentation: no usage examples (README.md)
• High CVE: [GHSA redacted] (pnpm-lock.yaml)
• High CVE: [GHSA redacted] (pnpm-lock.yaml)
• High CVE: [GHSA redacted] (pnpm-lock.yaml)
• High CVE: [GHSA redacted] (pnpm-lock.yaml)
• High CVE: [GHSA redacted] (pnpm-lock.yaml)
• High CVE: [GHSA redacted] (pnpm-lock.yaml)
• High CVE: [GHSA redacted] (pnpm-lock.yaml)
• High CVE: [GHSA redacted] (pnpm-lock.yaml)
• High CVE: [GHSA redacted] (pnpm-lock.yaml)
• High CVE: [GHSA redacted] (pnpm-lock.yaml)
• High CVE: [GHSA redacted] (pnpm-lock.yaml)
• High CVE: [GHSA redacted] (pnpm-lock.yaml)
• High CVE: [GHSA redacted] (pnpm-lock.yaml)
• High CVE: [GHSA redacted] (pnpm-lock.yaml)
• …and 54 more

Written by watchdog.canine.dev from the codebase's own history, inside the signed delivery this page is composed from.

CollatzConjecture/nestjs-clean-architecture was measured the same way every project in this corpus was: the same rubric, at a pinned commit, with the result published in full. Point a surveyor at a repository you know and see whether you agree with it.