@lenne.tech/nest-server 11.10.1 → 11.10.3

package/src/core.module.ts

@@ -262,6 +262,14 @@ export class CoreModule implements NestModule {
             config: betterAuthConfig === true ? {} : betterAuthConfig || {},
             // Pass JWT secrets for backwards compatibility fallback
             fallbackSecrets: [config.jwt?.secret, config.jwt?.refresh?.secret],
+            // In IAM-only mode, register RolesGuard globally to enforce @Roles() decorators
+            // In Legacy mode (autoRegister), RolesGuard is already registered via CoreAuthModule
+            registerRolesGuardGlobally: isIamOnlyMode,
+            // Pass server-level URLs for Passkey auto-detection
+            // When env: 'local', defaults are: baseUrl=localhost:3000, appUrl=localhost:3001
+            serverAppUrl: config.appUrl,
+            serverBaseUrl: config.baseUrl,
+            serverEnv: config.env,
           }),
         );
       }

package/src/server/modules/better-auth/better-auth.module.ts

@@ -7,6 +7,19 @@ import { BetterAuthResolver } from './better-auth.resolver';
 
 /**
  * Options for BetterAuthModule.forRoot()
+ *
+ * All options are optional when using Zero-Config:
+ * All values are auto-read from ConfigService (set by CoreModule.forRoot)
+ *
+ * @example
+ * // Zero-Config - all values auto-detected from ConfigService
+ * BetterAuthModule.forRoot({})
+ *
+ * // Or with explicit overrides
+ * BetterAuthModule.forRoot({
+ *   config: { secret: 'custom-secret' },
+ *   serverAppUrl: 'https://custom-app.com',
+ * })
  */
 export interface ServerBetterAuthModuleOptions {
   /**
@@ -15,14 +28,33 @@ export interface ServerBetterAuthModuleOptions {
    * - `true`: Enable with all defaults (including JWT)
    * - `false`: Disable BetterAuth
    * - `{ ... }`: Enable with custom configuration
+   * - `undefined`: Auto-read from ConfigService (Zero-Config)
    */
-  config: boolean | IBetterAuth;
+  config?: boolean | IBetterAuth;
 
   /**
    * Fallback secrets for backwards compatibility with JWT config.
    * If no betterAuth.secret is configured, these secrets are tried in order.
    */
   fallbackSecrets?: (string | undefined)[];
+
+  /**
+   * Server-level app URL for Passkey auto-detection.
+   * @see IServerOptions.appUrl
+   */
+  serverAppUrl?: string;
+
+  /**
+   * Server-level base URL for Passkey auto-detection.
+   * @see IServerOptions.baseUrl
+   */
+  serverBaseUrl?: string;
+
+  /**
+   * Server environment for localhost defaults (local, ci, e2e).
+   * @see IServerOptions.env
+   */
+  serverEnv?: string;
 }
 
 /**
@@ -42,14 +74,9 @@ export interface ServerBetterAuthModuleOptions {
  *
  * @Module({
  *   imports: [
- *     CoreModule.forRoot(CoreAuthService, AuthModule.forRoot(envConfig.jwt), {
- *       ...envConfig,
- *       betterAuth: { ...envConfig.betterAuth, autoRegister: false },
- *     }),
- *     BetterAuthModule.forRoot({
- *       config: envConfig.betterAuth,
- *       fallbackSecrets: [envConfig.jwt?.secret, envConfig.jwt?.refresh?.secret],
- *     }),
+ *     CoreModule.forRoot(CoreAuthService, AuthModule.forRoot(envConfig.jwt), envConfig),
+ *     // Zero-Config: All values auto-read from ConfigService
+ *     BetterAuthModule.forRoot({}),
  *   ],
  * })
  * export class ServerModule {}
@@ -64,7 +91,7 @@ export class BetterAuthModule {
    * @returns Dynamic module configuration
    */
   static forRoot(options: ServerBetterAuthModuleOptions): DynamicModule {
-    const { config, fallbackSecrets } = options;
+    const { config, fallbackSecrets, serverAppUrl, serverBaseUrl, serverEnv } = options;
 
     // If better-auth is explicitly disabled, return minimal module
     // Supports: false, { enabled: false }, or undefined/null
@@ -85,6 +112,9 @@ export class BetterAuthModule {
           controller: BetterAuthController,
           fallbackSecrets,
           resolver: BetterAuthResolver,
+          serverAppUrl,
+          serverBaseUrl,
+          serverEnv,
         }),
       ],
       module: BetterAuthModule,

package/src/server/server.module.ts

@@ -45,11 +45,9 @@ import { ServerController } from './server.controller';
     AuthModule.forRoot(envConfig.jwt),
 
     // Include BetterAuthModule for better-auth integration
+    // Zero-Config: All values are auto-read from ConfigService (set by CoreModule.forRoot)
     // This allows project-specific customization via BetterAuthResolver
-    BetterAuthModule.forRoot({
-      config: envConfig.betterAuth,
-      fallbackSecrets: [envConfig.jwt?.secret, envConfig.jwt?.refresh?.secret],
-    }),
+    BetterAuthModule.forRoot({}),
 
     // Include ErrorCodeModule with project-specific error codes
     // Uses Core ErrorCodeModule.forRoot() with custom service and controller