> ## Documentation Index
> Fetch the complete documentation index at: https://nestrs.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# nestrs-better-auth

> Nest the better-auth.rs Axum router into nestrs and guard routes with the Better Auth session cookie.

This crate does **not** reimplement Better Auth. You build the Axum router from [better-auth.rs](https://github.com/better-auth-rs/better-auth-rs) in your app, then nest it and protect nestrs handlers with `BetterAuthGuard`.

The crate does not depend on a specific `better-auth` package so MSRV 1.88 stays intact.

## Install

```toml theme={null}
[dependencies]
nestrs = "1.3.0"
nestrs-better-auth = "1.3.0"
```

## Nest the auth router

`BetterAuthModule::for_root` returns a `DynamicModule` that mounts `auth_router` at `options.path` (default `/api/auth`). Merge it with `NestFactory::create_with_modules`:

```rust theme={null}
use nestrs::prelude::*;
use nestrs_better_auth::{BetterAuthGuard, BetterAuthModule, BetterAuthOptions};

#[derive(Default)]
#[injectable]
struct AppState;

#[controller(prefix = "/account")]
struct AccountController;

#[routes(state = AppState)]
impl AccountController {
    #[get("/")]
    #[use_guards(BetterAuthGuard)]
    async fn account() -> &'static str {
        "signed-in"
    }
}

#[module(controllers = [AccountController], providers = [AppState])]
struct AppModule;

#[tokio::main]
async fn main() {
    // Build this with better-auth.rs in your app:
    let auth_router = axum::Router::new();

    let auth = BetterAuthModule::for_root(
        auth_router,
        BetterAuthOptions::default(), // path `/api/auth`, cookie `better-auth.session_token`
    );

    NestFactory::create_with_modules::<AppModule, _>([auth])
        .listen_graceful(3000)
        .await;
}
```

## Guard

`BetterAuthGuard` implements `CanActivate`. It looks at the raw `Cookie` header (no extra cookie crate), so it works whether or not `NestApplication::use_cookies` is on.

| Constructor                                | Cookie name                                            |
| ------------------------------------------ | ------------------------------------------------------ |
| `BetterAuthGuard::new()` / `Default`       | `better-auth.session_token` (`DEFAULT_SESSION_COOKIE`) |
| `BetterAuthGuard::with_cookie_name("sid")` | `sid`                                                  |

Missing or empty cookie → `401 unauthorized`.

## Options

```rust theme={null}
BetterAuthOptions {
    path: "/api/auth".into(),
    session_cookie: "better-auth.session_token".into(),
}
```

`path` is normalized to an absolute prefix without a trailing slash (`"api/auth"` → `"/api/auth"`).