Linkiess

Auth state (isLogged, username) lives in Redux persisted to localStorage. The same store manages success/error messages via messageSlice — no external toast library.

Before rendering the customization screen, the token is decoded with jwt-decodeand the payload’s username is compared against the URL and localStorage. Any divergence logs out and redirects the user.

Write actions (image upload, edit link, change color) toggle a boolean trigger in local state. The page’s useEffect depends on this value — when it flips, it re-fetches the profile data.

Multer saves the file to ./uploads (local disk). After writing, S3Storage.saveFile() reads the buffer, puts the object in the bucket with ACL public-read and deletes the temp file via fs/promises unlink. Multer requires a synchronous destination at multipart parse time — the local stage acts as a staging area before persisting to object store.

JwtAuthGuard is applied globally in the root module — all routes are protected by default. Public routes (account creation, profile read) receive the @IsPublic() decorator, which sets isPublic: true metadata. The guard reads this metadata before validating the token; if present, it passes.

Edit routes receive the Authorization header and pass it to authorizationMiddleware() in the service, which uses jwt_decodeto extract the payload username and compares it with the resource’s id_user. On divergence, throws 401. The guard validates signature + expiration via Passport; the middleware validates that the token owner is the resource owner.