Designing Zero-Trust Enterprise Security Architectures for Next.js & NestJS API Platforms

// src/core/guards/jwt-auth.guard.ts
import { Injectable, CanActivate, ExecutionContext, UnauthorizedException } from '@nestjs/common';
import { expressJwtSecret } from 'jwks-rsa';
import * as jwt from 'jsonwebtoken';
import { RedisCacheService } from '../cache/redis-cache.service';

@Injectable()
export class JwtAuthGuard implements CanActivate {
  private jwksClient = expressJwtSecret({
    cache: true,
    rateLimit: true,
    jwksRequestsPerMinute: 10,
    jwksUri: process.env.OIDC_JWKS_URI,
  });

  constructor(private readonly cacheService: RedisCacheService) {}

  async canActivate(context: ExecutionContext): Promise<boolean> {
    const request = context.switchToHttp().getRequest();
    const token = this.extractTokenFromHeader(request);
    if (!token) throw new UnauthorizedException('Missing bearer authorization token');

    try {
      // 1. Verify Asymmetric RS256 Signature via JWKS
      const decodedHeader = jwt.decode(token, { complete: true });
      const key = await this.getSigningKey(decodedHeader.header.kid);
      const payload = jwt.verify(token, key.getPublicKey()) as jwt.JwtPayload;

      // 2. High-Performance Token Revocation Check (Redis Bloom Filter / Blacklist)
      const isRevoked = await this.cacheService.isTokenRevoked(payload.jti);
      if (isRevoked) {
        throw new UnauthorizedException('Token has been explicitly revoked');
      }

      request.user = payload;
      return true;
    } catch (err) {
      throw new UnauthorizedException('Invalid or expired authentication token');
    }
  }

  private extractTokenFromHeader(request: any): string | null {
    const [type, token] = request.headers.authorization?.split(' ') ?? [];
    return type === 'Bearer' ? token : null;
  }
}

// src/modules/acl/casl-ability.factory.ts
import { AbilityBuilder, createMongoAbility, MongoAbility, ExtractSubjectType } from '@casl/ability';
import { Injectable } from '@nestjs/common';
import { User } from '../users/entities/user.entity';
import { Story } from '../stories/entities/story.entity';

export type Action = 'create' | 'read' | 'update' | 'delete' | 'manage';
export type Subjects = typeof Story | typeof User | Story | User | 'all';
export type AppAbility = MongoAbility<[Action, Subjects]>;

@Injectable()
export class CaslAbilityFactory {
  createForUser(user: User): AppAbility {
    const { can, cannot, build } = new AbilityBuilder<AppAbility>(createMongoAbility);

    if (user.isSystemAdmin) {
      can('manage', 'all'); // Global System Admin
    } else {
      // 1. Tenant Isolation Rule: Users can only read stories within their organization
      can('read', Story, { organizationId: user.organizationId });

      // 2. Ownership ABAC Rule: Users can edit stories if they are the author AND story is draft
      can('update', Story, { 
        authorId: user.id, 
        organizationId: user.organizationId,
        status: 'draft' 
      });

      // 3. Security Restriction: Users cannot delete published stories
      cannot('delete', Story, { status: 'published' });
    }

    return build({
      detectSubjectType: (item) => item.constructor as ExtractSubjectType<Subjects>,
    });
  }
}

// src/modules/stories/stories.controller.ts
// Apply CheckPolicies guard to validate CASL abilities
async updateStory(id: string, dto: UpdateStoryDto) {
  return this.storiesService.update(id, dto);
}

// src/middleware.ts
import { NextResponse } from 'next/server';
import type { NextRequest } from 'next/server';
import { jwtVerify } from 'jose';

export async function middleware(request: NextRequest) {
  const response = NextResponse.next();

  // 1. Enforce HSTS and Security Headers at Edge
  response.headers.set('Strict-Transport-Security', 'max-age=63072000; includeSubDomains; preload');
  response.headers.set('X-Frame-Options', 'DENY');
  response.headers.set('X-Content-Type-Options', 'nosniff');

  // 2. Protect Admin & API Routes
  if (request.nextUrl.pathname.startsWith('/admin')) {
    const token = request.cookies.get('session_token')?.value;
    if (!token) {
      return NextResponse.redirect(new URL('/login', request.url));
    }

    try {
      const secret = new TextEncoder().encode(process.env.JWT_SECRET);
      await jwtVerify(token, secret);
    } catch {
      return NextResponse.redirect(new URL('/login?error=session_expired', request.url));
    }
  }

  return response;
}

// src/core/interceptors/audit-log.interceptor.ts
import { Injectable, NestInterceptor, ExecutionContext, CallHandler } from '@nestjs/common';
import { tap } from 'rxjs/operators';
import { AuditLogService } from '../audit/audit-log.service';

@Injectable()
export class AuditLogInterceptor implements NestInterceptor {
  constructor(private readonly auditService: AuditLogService) {}

  intercept(context: ExecutionContext, next: CallHandler) {
    const req = context.switchToHttp().getRequest();
    const startTime = Date.now();

    return next.handle().pipe(
      tap(async (responseData) => {
        if (['POST', 'PUT', 'PATCH', 'DELETE'].includes(req.method)) {
          await this.auditService.recordEvent({
            timestamp: new Date().toISOString(),
            actorId: req.user?.sub || 'anonymous',
            action: `${req.method} ${req.route.path}`,
            clientIp: req.headers['x-forwarded-for'] || req.ip,
            userAgent: req.headers['user-agent'],
            durationMs: Date.now() - startTime,
            statusCode: context.switchToHttp().getResponse().statusCode,
          });
        }
      }),
    );
  }
}