NESTJS ENGINEERING
Backend Standards
Build backend modules with clear ownership, validation, authorization, and predictable error handling.
Production stability and security notice
Development changes must preserve working functionality, Provider isolation, role-based access, HIPAA auditability, released Mobile compatibility, and integration stability. Never deploy AI-generated or unreviewed code directly to production.
Controller Responsibilities
- Declare routes, guards, DTOs, and response boundaries.
- Keep business logic in services.
- Use authenticated Provider and user context.
- Apply HIPAA or audit decorators where required.
Service Responsibilities
| Topic | Standard |
|---|---|
| Authorization | Verify the caller is permitted to perform the operation. |
| Provider scoping | Include Provider scope in every query and mutation. |
| Validation | Enforce business rules beyond DTO shape. |
| Transactions | Use database transactions for multi-step state changes. |
| Side effects | Coordinate notifications, audit events, integrations, and exports after core validation. |
| Errors | Return actionable errors without exposing secrets or sensitive internals. |
Stability Rules
- Do not remove existing methods merely because a new flow is added.
- Preserve response fields used by Web or Mobile clients.
- Use feature flags or explicit branches for environment-specific integration behavior.
- Keep external payload builders separate from controller logic.