@lenne.tech/nest-server 11.10.2 → 11.10.4

package/src/core.module.ts

@@ -247,12 +247,25 @@ export class CoreModule implements NestModule {
     }
 
     // Add CoreBetterAuthModule based on mode
-    // IAM-only mode: Always register CoreBetterAuthModule (required for subscription auth)
+    // IAM-only mode: BetterAuth is enabled by default (it's the only auth option)
     // Legacy mode: Only register if autoRegister is explicitly true
     // betterAuth can be: boolean | IBetterAuth | undefined
     const betterAuthConfig = config.betterAuth;
-    const isBetterAuthEnabled =
-      betterAuthConfig === true || (typeof betterAuthConfig === 'object' && betterAuthConfig?.enabled !== false);
+
+    // Determine if BetterAuth is explicitly disabled
+    // In IAM-only mode: enabled by default (undefined = true), only false or { enabled: false } disables
+    // In Legacy mode: disabled by default (undefined = false), must be explicitly enabled
+    const isExplicitlyDisabled = betterAuthConfig === false ||
+      (typeof betterAuthConfig === 'object' && betterAuthConfig?.enabled === false);
+    const isExplicitlyEnabled = betterAuthConfig === true ||
+      (typeof betterAuthConfig === 'object' && betterAuthConfig?.enabled !== false);
+
+    // IAM-only mode: enabled unless explicitly disabled
+    // Legacy mode: enabled only if explicitly enabled
+    const isBetterAuthEnabled = isIamOnlyMode
+      ? !isExplicitlyDisabled
+      : isExplicitlyEnabled;
+
     const isAutoRegister = typeof betterAuthConfig === 'object' && betterAuthConfig?.autoRegister === true;
 
     if (isBetterAuthEnabled) {
@@ -265,6 +278,11 @@ export class CoreModule implements NestModule {
             // In IAM-only mode, register RolesGuard globally to enforce @Roles() decorators
             // In Legacy mode (autoRegister), RolesGuard is already registered via CoreAuthModule
             registerRolesGuardGlobally: isIamOnlyMode,
+            // Pass server-level URLs for Passkey auto-detection
+            // When env: 'local', defaults are: baseUrl=localhost:3000, appUrl=localhost:3001
+            serverAppUrl: config.appUrl,
+            serverBaseUrl: config.baseUrl,
+            serverEnv: config.env,
           }),
         );
       }

package/src/index.ts

@@ -112,6 +112,7 @@ export * from './core/modules/auth/exceptions/invalid-token.exception';
 export * from './core/modules/auth/exceptions/legacy-auth-disabled.exception';
 export * from './core/modules/auth/guards/auth.guard';
 export * from './core/modules/auth/guards/legacy-auth-rate-limit.guard';
+export * from './core/modules/auth/guards/roles-guard-registry';
 export * from './core/modules/auth/guards/roles.guard';
 export * from './core/modules/auth/inputs/core-auth-sign-in.input';
 export * from './core/modules/auth/inputs/core-auth-sign-up.input';

package/src/server/modules/better-auth/better-auth.module.ts

@@ -7,6 +7,19 @@ import { BetterAuthResolver } from './better-auth.resolver';
 
 /**
  * Options for BetterAuthModule.forRoot()
+ *
+ * All options are optional when using Zero-Config:
+ * All values are auto-read from ConfigService (set by CoreModule.forRoot)
+ *
+ * @example
+ * // Zero-Config - all values auto-detected from ConfigService
+ * BetterAuthModule.forRoot({})
+ *
+ * // Or with explicit overrides
+ * BetterAuthModule.forRoot({
+ *   config: { secret: 'custom-secret' },
+ *   serverAppUrl: 'https://custom-app.com',
+ * })
  */
 export interface ServerBetterAuthModuleOptions {
   /**
@@ -15,14 +28,33 @@ export interface ServerBetterAuthModuleOptions {
    * - `true`: Enable with all defaults (including JWT)
    * - `false`: Disable BetterAuth
    * - `{ ... }`: Enable with custom configuration
+   * - `undefined`: Auto-read from ConfigService (Zero-Config)
    */
-  config: boolean | IBetterAuth;
+  config?: boolean | IBetterAuth;
 
   /**
    * Fallback secrets for backwards compatibility with JWT config.
    * If no betterAuth.secret is configured, these secrets are tried in order.
    */
   fallbackSecrets?: (string | undefined)[];
+
+  /**
+   * Server-level app URL for Passkey auto-detection.
+   * @see IServerOptions.appUrl
+   */
+  serverAppUrl?: string;
+
+  /**
+   * Server-level base URL for Passkey auto-detection.
+   * @see IServerOptions.baseUrl
+   */
+  serverBaseUrl?: string;
+
+  /**
+   * Server environment for localhost defaults (local, ci, e2e).
+   * @see IServerOptions.env
+   */
+  serverEnv?: string;
 }
 
 /**
@@ -42,14 +74,9 @@ export interface ServerBetterAuthModuleOptions {
  *
  * @Module({
  *   imports: [
- *     CoreModule.forRoot(CoreAuthService, AuthModule.forRoot(envConfig.jwt), {
- *       ...envConfig,
- *       betterAuth: { ...envConfig.betterAuth, autoRegister: false },
- *     }),
- *     BetterAuthModule.forRoot({
- *       config: envConfig.betterAuth,
- *       fallbackSecrets: [envConfig.jwt?.secret, envConfig.jwt?.refresh?.secret],
- *     }),
+ *     CoreModule.forRoot(CoreAuthService, AuthModule.forRoot(envConfig.jwt), envConfig),
+ *     // Zero-Config: All values auto-read from ConfigService
+ *     BetterAuthModule.forRoot({}),
  *   ],
  * })
  * export class ServerModule {}
@@ -64,7 +91,7 @@ export class BetterAuthModule {
    * @returns Dynamic module configuration
    */
   static forRoot(options: ServerBetterAuthModuleOptions): DynamicModule {
-    const { config, fallbackSecrets } = options;
+    const { config, fallbackSecrets, serverAppUrl, serverBaseUrl, serverEnv } = options;
 
     // If better-auth is explicitly disabled, return minimal module
     // Supports: false, { enabled: false }, or undefined/null
@@ -85,6 +112,9 @@ export class BetterAuthModule {
           controller: BetterAuthController,
           fallbackSecrets,
           resolver: BetterAuthResolver,
+          serverAppUrl,
+          serverBaseUrl,
+          serverEnv,
         }),
       ],
       module: BetterAuthModule,

package/src/server/server.module.ts

@@ -45,11 +45,9 @@ import { ServerController } from './server.controller';
     AuthModule.forRoot(envConfig.jwt),
 
     // Include BetterAuthModule for better-auth integration
+    // Zero-Config: All values are auto-read from ConfigService (set by CoreModule.forRoot)
     // This allows project-specific customization via BetterAuthResolver
-    BetterAuthModule.forRoot({
-      config: envConfig.betterAuth,
-      fallbackSecrets: [envConfig.jwt?.secret, envConfig.jwt?.refresh?.secret],
-    }),
+    BetterAuthModule.forRoot({}),
 
     // Include ErrorCodeModule with project-specific error codes
     // Uses Core ErrorCodeModule.forRoot() with custom service and controller