Loading...
Loading...
Understand how authentication works in EventZR, the structure of JWT tokens, and how to extract user, tenant, and role information from claims.
EventZR uses a 3-tier authentication system: the @eventzr/auth core library provides guards and decorators, auth-svc manages sessions and credentials, and @eventzr/auth-client provides the frontend SDK. Tokens are signed using HS256 via @nestjs/jwt.
| Claim | Type | Description |
|---|---|---|
| sub | string (UUID) | User ID (subject) |
| tenantId | string (UUID) | Tenant context for RLS isolation |
| string | User email address | |
| roles | string[] | Assigned roles (e.g., user, organizer, admin) |
| teamId | string (UUID) | null | Active team context (if team-scoped) |
| tier | string | Subscription tier (BASE, PRO, ENTERPRISE, etc.) |
| iat | number | Issued at (Unix timestamp) |
| exp | number | Expiration (Unix timestamp) |
// Server-side: Extract claims from request
import { CurrentUser, CurrentTenant } from '@eventzr/auth';
@Controller('events')
export class EventsController {
@Get()
@Roles('user', 'organizer')
async findAll(
@CurrentTenant() tenantId: string,
@CurrentUser() user: { sub: string; roles: string[] },
) {
// tenantId and user are extracted from JWT
return this.eventsService.findByTenantId(tenantId);
}
}import { useAuth } from '@eventzr/react-auth';
function Dashboard() {
const { user, token, isAuthenticated, logout } = useAuth();
if (!isAuthenticated) return <LoginRedirect />;
return (
<div>
<p>Welcome, {user.email}</p>
<p>Tenant: {user.tenantId}</p>
<p>Roles: {user.roles.join(', ')}</p>
</div>
);
}tenantId, tenant_id, and tenant variants.