Security

Sign the shelter's staff in: exchange a username and password for a signed JWT, verify it on every later request in a guard bound to the whole app, and mark the routes anyone may use with @Public().

Stop storing passwords: hash them with bcrypt at registration and compare at sign-in. Then the other direction, for data that must be read back: encrypt each cat's microchip number with AES under a key derived with scrypt, a fresh IV per record.

Signed in is not the same as allowed: give each member of staff roles, carry them in the token, and let a second global guard decide, route by route, which role a request needs.

Roles run out when the answer depends on the thing itself: a member of staff may rename the cat they adopted, nobody may delete an adopted cat. Describe abilities with CASL, check them in a guard for the route and in the service for the record.

The same sign-in, the way most of the Node world writes it: Passport strategies for the password check and for the bearer token, wrapped by @nestjs/passport into guards, with one Nest 12 trap the docs' recipe walks into.

A dozen response headers that tell browsers what not to do with your responses, set once by helmet on every response the API sends, with one directive adjusted for the shelter's image CDN.

A browser will not let a page on one site read this API's answers unless the API says so: cross-origin resource sharing is that permission, granted origin by origin, method by method, in headers, with a preflight request the browser sends first.

When the browser sends the login cookie by itself, any page can make it send one: cross-site request forgery. Protect the routes that change state with a double-submit token that only your own page can present, bound to the session it was issued for.

Nothing in the API stops a script from trying ten thousand passwords, or from calling one route until the database gives up. A throttler counts requests per caller and route and answers 429 past the limit, tighter on sign-in, not at all on the health check.

Everything from the course on one service, in the order the request meets it: helmet's headers and CORS at the door, the throttler, then who is asking, then what they may do, with passwords hashed and a health check that is never counted.