Authentication

How sign in, sign up, sessions, and guards work in ngXpress.

Authentication is handled by Better Auth, backed by Prisma. It's wired up end to end, not just scaffolded.

What's included

  • Email/password sign up and sign in
  • Session cookies, validated on both the Express API and the Angular SSR render
  • Forgot password / reset password flow
  • SSR session hydration via Angular's TransferState, so the server-rendered page already knows if a visitor is signed in — no client-side flash while a session check resolves

Guards and layouts

Routes are split by two layouts under src/app/shared/layouts:

  • Guest layout — sign in, sign up, forgot/reset password. A logged-in visitor is redirected away from these.
  • Admin layout — the authenticated /admin workspace (dashboard, tasks). authGuard (from @core/guards/auth.guard) protects everything under it and redirects anonymous visitors to sign in.
Example: protecting a route
import { authGuard } from '@core/guards/auth.guard';
 
export const routes: Routes = [
  {
    path: 'admin',
    canActivate: [authGuard],
    loadComponent: () => import('@layouts/admin.layout'),
    children: [
      // dashboard, tasks, etc.
    ],
  },
];

Session-scoped data

The Tasks API scopes every query to the signed-in user's session — there's no cross-user leakage to guard against manually when you add new authenticated features; follow the same pattern used in src/api/features/tasks.

Wire up real email before going live

The dev email logger at src/api/lib/email.ts just logs password-reset emails to the console. In production it throws until you replace it with a real provider (Resend, Postmark, SES, etc.) — do this before you rely on the forgot-password flow.

Related

PreviousImport AliasesNextDatabase & Prisma