---
title: "@playstack/nest-accounts"
description: "NestJS request scope and role guards for Playstack accounts."
tags: ["package","identity","accounts","nestjs","pro"]
---

{/* package-access:start */}

> **Pro.** Covered by the Playstack Pro License. Registry access is required; check preview availability before installing. See [package access](/docs/packages#access-policy).

{/* package-access:end */}

`@playstack/nest-accounts` revalidates account membership and carries the resulting scope into NestJS requests.

{/* package-install:start */}

## Install

After confirming [preview access](/docs/packages#access-policy), install the package at your application's shared Playstack version:

```sh
npm install --save-exact @playstack/nest-accounts@0.1.0-beta.1
```

Check the peer requirements below before choosing a runtime or provider.

{/* package-install:end */}

## Compose and order guards

```ts
PlaystackAccountsModule.forRoot({ accounts })

@UseGuards(PlaystackAuthGuard, PlaystackAccountGuard)
@AccountRoles('owner', 'admin')
@Get('/settings')
settings(@CurrentAccount() account: AccountResolution) {}
```

Run `PlaystackAuthGuard` first. The account guard requires an account-scoped session, calls the configured service’s `resolve(userId, accountId)` on every request, attaches `request.playstackAccount`, then enforces optional role metadata.

## Configuration and request bridge

| Surface | Contract |
| --- | --- |
| `NestAccountsOptions.accounts` | An object exposing `resolve(userId, accountId)`. |
| `AccountRequest.playstackSession` | Session claims supplied by the auth guard. |
| `AccountRequest.playstackAccount` | Validated `AccountResolution` attached by this guard. |
| `@AccountRoles(...roles)` | Optional allowlist checked after membership resolution. |

Use `forRootAsync({ imports, inject, useFactory })` for DI-based configuration. Guards and decorators are exported rather than installed globally so their order remains visible.

## Boundary

The adapter does not create memberships, infer tenancy from arbitrary request values, scope database clients, or replace domain authorization. It translates only already-defined auth and account contracts into Nest request state.

## Request-selected account strategy

Supply `resolveRequestAccount(context, session)` only after authenticating the request. The guard revalidates live membership, roles and named permissions; selection alone grants nothing. Already scoped sessions cannot select another account. Without this resolver, the default remains account-scoped sessions. Keep resource ownership checks inside each product operation.

{/* package-reference:start */}

## API entry points and requirements

Reference snapshot: `@playstack/nest-accounts@0.1.0-beta.1`. Import only the entry point your runtime needs. Paths below are relative to the installed package; use **Go to Definition** in your editor to inspect exact parameters, return types and overloads. Do not import the declaration-file paths directly.

| Public entry point | Declaration file |
| --- | --- |
| `@playstack/nest-accounts` | `./dist/index.d.ts` |
| `@playstack/nest-accounts/package.json` | No TypeScript declaration (asset or metadata export). |

Node.js engine requirement: `>=20`. This is not a claim that every entry point works in browsers or Workers.

### Peer dependencies

Keep existing framework versions that satisfy these ranges. Install optional peers only when using the corresponding adapter. The package manager resolves ordinary dependencies separately.

| Peer | Compatible range | When needed |
| --- | --- | --- |
| `@nestjs/common` | `^10.0.0 \|\| ^11.0.0` | Required by the package. |
| `@nestjs/core` | `^10.0.0 \|\| ^11.0.0` | Required by the package. |
| `@playstack/accounts` | `0.1.0-beta.1` | Required by the package. |
| `@playstack/auth` | `0.1.0-beta.1` | Required by the package. |
| `reflect-metadata` | `^0.1.13 \|\| ^0.2.0` | Required by the package. |
| `rxjs` | `^7.0.0` | Required by the package. |

For a complete first program, start with [Getting started](/docs/getting-started). For API lookup and partial-example conventions, see [Reading the reference](/docs/packages#reading-the-reference). Provider failures, lifecycle requirements and application responsibilities remain described in the guide above; types alone do not establish production safety.

{/* package-reference:end */}