nest-profiler-auth

@eleven-labs/nest-profiler-auth

@eleven-labs/nest-profiler-auth captures the authentication context (Passport user, JWT claims, roles) of the current execution and displays it in a Security panel.

Installation

pnpm add @eleven-labs/nest-profiler-auth

No additional peer dependencies beyond nestjs-cls (already required by @eleven-labs/nest-profiler).

Setup

import { ConditionalModule } from '@nestjs/config';
import { AuthCollectorModule } from '@eleven-labs/nest-profiler-auth';

const isProfilerEnabled = (env: NodeJS.ProcessEnv) => env['PROFILER_ENABLED'] === 'true';

@Module({
  imports: [
    ConditionalModule.registerWhen(
      AuthCollectorModule.forRoot({ maskUserFields: ['password', 'refreshToken'] }),
      isProfilerEnabled,
    ),
  ],
})
export class AppModule {}

Enabling / disabling — gate the collector with ConditionalModule.registerWhen(..., isProfilerEnabled) as shown, so it loads only when PROFILER_ENABLED is on. Wire the core ProfilerModule once at the root — the recommended setup bundles the root-level profiler modules into a single ProfilingModule behind a ConditionalModule gate (see Enabling and disabling the profiler and the example app). A top-level enabled option is also supported as an alternative.

What it collects

Automatic masking: Fields matching password|secret|key|token|credential are replaced with ***. Additional fields can be specified via maskUserFields.

Note: The JWT is decoded without verification (display only). Never rely on this data for security decisions.

Toolbar badge

Unauthenticated requests always show a compact anon. For authenticated requests, the badge content is configurable via the badge option (default: 'status'), so a long email no longer wraps the sidebar row — the full identity stays in the panel detail:

AuthCollectorModule.forRoot({
  badge: 'role', // 'status' (default) | 'role' | 'identifier'
});

For full control, provide a badgeValue resolver — it takes precedence over badge, receives the collected SecurityContext, and may return null to hide the badge. It runs only for authenticated requests (unauthenticated stays anon):

AuthCollectorModule.forRoot({
  badgeValue: (security) => security.roles?.[0] ?? 'auth',
});

How it works

The collector reads request.user and the Authorization header from the current CLS context (set by the profiler middleware). It decodes the JWT payload using Buffer.from(payload, 'base64url') without any cryptographic verification.