@lenne.tech/nest-server 11.24.3 → 11.25.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lenne.tech/nest-server",
-  "version": "11.24.3",
+  "version": "11.25.0",
   "description": "Modern, fast, powerful Node.js web framework in TypeScript based on Nest with a GraphQL API and a connection to MongoDB (or other databases).",
   "keywords": [
     "node",
@@ -22,9 +22,9 @@
     "build:pack": "pnpm pack && echo 'use file:/ROOT_PATH_TO_TGZ_FILE to integrate the package'",
     "build:dev": "pnpm run build",
     "c": "pnpm run check",
-    "check": "pnpm audit && pnpm run format:check && pnpm run lint && pnpm test && pnpm run build && pnpm start",
-    "check:fix": "pnpm install && pnpm audit --fix && pnpm run format && pnpm run lint:fix && pnpm test && pnpm run build && pnpm start",
-    "check:naf": "pnpm install && pnpm run format && pnpm run lint:fix && pnpm test && pnpm run build && pnpm start",
+    "check": "pnpm audit && pnpm run format:check && pnpm run lint && pnpm test && pnpm run build && bash scripts/check-server-start.sh",
+    "check:fix": "pnpm install && pnpm audit --fix && pnpm run format && pnpm run lint:fix && pnpm test && pnpm run build && bash scripts/check-server-start.sh",
+    "check:naf": "pnpm install && pnpm run format && pnpm run lint:fix && pnpm test && pnpm run build && bash scripts/check-server-start.sh",
     "cf": "pnpm run check:fix",
     "cnaf": "pnpm run check:naf",
     "docs": "pnpm run docs:ci && open http://127.0.0.1:8080/ && open ./public/index.html && compodoc -p tsconfig.json -s ",
@@ -79,17 +79,17 @@
     "@better-auth/passkey": "1.5.5",
     "@getbrevo/brevo": "3.0.1",
     "@nestjs/apollo": "13.2.5",
-    "@nestjs/common": "11.1.18",
-    "@nestjs/core": "11.1.18",
+    "@nestjs/common": "11.1.19",
+    "@nestjs/core": "11.1.19",
     "@nestjs/graphql": "13.2.5",
     "@nestjs/jwt": "11.0.2",
     "@nestjs/mongoose": "11.0.4",
     "@nestjs/passport": "11.0.5",
-    "@nestjs/platform-express": "11.1.18",
-    "@nestjs/schedule": "6.1.1",
-    "@nestjs/swagger": "11.2.7",
+    "@nestjs/platform-express": "11.1.19",
+    "@nestjs/schedule": "6.1.3",
+    "@nestjs/swagger": "11.3.0",
     "@nestjs/terminus": "11.1.1",
-    "@nestjs/websockets": "11.1.18",
+    "@nestjs/websockets": "11.1.19",
     "@tus/file-store": "2.0.0",
     "@tus/server": "2.3.0",
     "@types/supertest": "7.2.0",
@@ -99,8 +99,8 @@
     "class-validator": "0.15.1",
     "compression": "1.8.1",
     "cookie-parser": "1.4.7",
-    "dotenv": "17.4.1",
-    "ejs": "5.0.1",
+    "dotenv": "17.4.2",
+    "ejs": "5.0.2",
     "express": "5.2.1",
     "graphql": "16.13.2",
     "graphql-query-complexity": "1.1.0",
@@ -125,11 +125,11 @@
   },
   "devDependencies": {
     "@compodoc/compodoc": "1.2.1",
-    "@nestjs/cli": "11.0.19",
-    "@nestjs/schematics": "11.0.10",
-    "@nestjs/testing": "11.1.18",
+    "@nestjs/cli": "11.0.21",
+    "@nestjs/schematics": "11.1.0",
+    "@nestjs/testing": "11.1.19",
     "@swc/cli": "0.8.1",
-    "@swc/core": "1.15.24",
+    "@swc/core": "1.15.26",
     "@types/compression": "1.8.1",
     "@types/cookie-parser": "1.4.10",
     "@types/ejs": "3.1.5",
@@ -147,8 +147,8 @@
     "nodemon": "3.1.14",
     "npm-watch": "0.13.0",
     "otpauth": "9.5.0",
-    "oxfmt": "0.44.0",
-    "oxlint": "1.59.0",
+    "oxfmt": "0.45.0",
+    "oxlint": "1.60.0",
     "rimraf": "6.1.3",
     "ts-node": "10.9.2",
     "tsconfig-paths": "4.2.0",
@@ -188,7 +188,7 @@
       "minimatch@>=10.0.0 <10.2.5": "Security: RegExp DoS - transitive via @nestjs/apollo>ts-morph>@ts-morph/common and nodemon",
       "ajv@<6.14.0": "Security: prototype pollution - transitive via @getbrevo/brevo>rewire>eslint",
       "ajv@>=7.0.0-alpha.0 <8.18.0": "Security: prototype pollution - transitive via @nestjs/cli>@angular-devkit",
-      "undici@>=7.0.0 <7.24.7": "Security: various CVEs - transitive via @compodoc/compodoc>cheerio",
+      "undici@>=7.0.0 <7.25.0": "Security: various CVEs - transitive via @compodoc/compodoc>cheerio",
       "srvx@<0.11.15": "Compatibility: @tus/server@2.3.0 requires ~0.8.2 but 0.11.15 needed for security - remove when @tus/server ships with >=0.11.15",
       "handlebars@>=4.0.0 <4.7.9": "Security: prototype pollution (GHSA-q42p-pg8m-cqh6) - transitive via @compodoc/compodoc",
       "brace-expansion@<1.1.13": "Security: RegExp DoS - transitive via eslint>minimatch",
@@ -196,9 +196,10 @@
       "picomatch@<2.3.2": "Security: ReDoS - transitive via @nestjs/graphql>fast-glob>micromatch and @compodoc/compodoc>chokidar",
       "picomatch@>=4.0.0 <4.0.4": "Security: ReDoS - transitive via vitest and vite",
       "path-to-regexp@>=8.0.0 <8.4.2": "Security: ReDoS (GHSA-rhx6-c78j-4q9w) - transitive via express>router",
-      "kysely@>=0.26.0 <0.28.15": "Security: SQL injection - transitive via better-auth",
+      "kysely@>=0.26.0 <0.28.16": "Security: SQL injection - transitive via better-auth",
       "lodash@>=4.0.0 <4.18.0": "Security: CVE in lodash@4.17.x - transitive via @nestjs/graphql. 4.18.1 is the latest patched version",
-      "defu@<=6.1.6": "Security: prototype pollution via __proto__ key - transitive via better-auth"
+      "defu@<=6.1.6": "Security: prototype pollution via __proto__ key - transitive via better-auth",
+      "follow-redirects@<=1.15.11": "Security: Custom Authentication Headers leak on cross-domain redirect (GHSA-r4q5-vmmm-2653) - transitive via axios>@getbrevo/brevo and axios>node-mailjet"
     },
     "overrides": {
       "axios@<1.15.0": "1.15.0",
@@ -207,7 +208,7 @@
       "minimatch@>=10.0.0 <10.2.5": "10.2.5",
       "ajv@<6.14.0": "6.14.0",
       "ajv@>=7.0.0-alpha.0 <8.18.0": "8.18.0",
-      "undici@>=7.0.0 <7.24.7": "7.24.7",
+      "undici@>=7.0.0 <7.25.0": "7.25.0",
       "srvx@<0.11.15": "0.11.15",
       "handlebars@>=4.0.0 <4.7.9": "4.7.9",
       "brace-expansion@<1.1.13": "1.1.13",
@@ -215,9 +216,10 @@
       "picomatch@<2.3.2": "2.3.2",
       "picomatch@>=4.0.0 <4.0.4": "4.0.4",
       "path-to-regexp@>=8.0.0 <8.4.2": "8.4.2",
-      "kysely@>=0.26.0 <0.28.15": "0.28.15",
+      "kysely@>=0.26.0 <0.28.16": "0.28.16",
       "lodash@>=4.0.0 <4.18.0": "4.18.1",
-      "defu@<=6.1.6": "6.1.7"
+      "defu@<=6.1.6": "6.1.7",
+      "follow-redirects@<=1.15.11": "1.16.0"
     },
     "onlyBuiltDependencies": [
       "bcrypt",

package/src/config.env.ts

@@ -7,7 +7,14 @@ import { IServerOptions } from './core/common/interfaces/server-options.interfac
 
 /**
  * Configuration for the different environments
+ *
+ * IMPORTANT: All secrets (passwords, API keys, signing secrets) MUST come from
+ * environment variables. Test environments use fallback values so tests work
+ * without a .env file. Production has no fallbacks — missing secrets will cause
+ * startup errors.
+ *
  * @see IServerOptions for documentation of all options
+ * @see .env.example for all available environment variables
  */
 dotenv.config();
 const config: { [env: string]: IServerOptions } = {
@@ -27,7 +34,7 @@ const config: { [env: string]: IServerOptions } = {
       // Passkey auto-activated when URLs can be resolved (env: 'local' → localhost defaults)
       passkey: { enabled: true, origin: 'http://localhost:3001', rpId: 'localhost', rpName: 'Nest Server Local' },
       rateLimit: { enabled: true, max: 100, windowSeconds: 60 },
-      secret: 'BETTER_AUTH_SECRET_LOCAL_32_CHARS_M',
+      secret: process.env.BETTER_AUTH_SECRET || 'BETTER_AUTH_SECRET_LOCAL_32_CHARS_M',
       // Social providers disabled in local environment (no credentials)
       socialProviders: {
         apple: { clientId: '', clientSecret: '', enabled: false },
@@ -40,7 +47,8 @@ const config: { [env: string]: IServerOptions } = {
       twoFactor: { appName: 'Nest Server Local', enabled: true },
     },
     compression: true,
-    cookies: false,
+    cookies: { exposeTokenInBody: true },
+    cors: { allowAll: true },
     cronJobs: {
       sayHello: {
         cronTime: CronExpression.EVERY_10_SECONDS,
@@ -53,24 +61,19 @@ const config: { [env: string]: IServerOptions } = {
     },
     email: {
       defaultSender: {
-        email: 'oren.satterfield@ethereal.email',
-        name: 'Nest Server Local',
-      },
-      mailjet: {
-        api_key_private: 'MAILJET_API_KEY_PRIVATE',
-        api_key_public: 'MAILJET_API_KEY_PUBLIC',
+        email: process.env.EMAIL_DEFAULT_SENDER || 'noreply@test.local',
+        name: 'Nest Server CI',
       },
-      passwordResetLink: 'http://localhost:4200/user/password-reset',
       smtp: {
         auth: {
-          pass: 'K4DvD8U31VKseT7vQC',
-          user: 'oren.satterfield@ethereal.email',
+          pass: process.env.SMTP_PASS || '',
+          user: process.env.SMTP_USER || '',
         },
-        host: 'mailhog.lenne.tech',
-        port: 1025,
+        host: process.env.SMTP_HOST || 'mailhog.lenne.tech',
+        jsonTransport: !process.env.SMTP_HOST || undefined,
+        port: parseInt(process.env.SMTP_PORT || '1025', 10),
         secure: false,
       },
-      verificationLink: 'http://localhost:4200/user/verification',
     },
     env: 'ci',
     // Disable auto-registration to allow Server ErrorCodeModule with SRV_* codes
@@ -98,21 +101,15 @@ const config: { [env: string]: IServerOptions } = {
     hostname: '127.0.0.1',
     ignoreSelectionsForPopulate: true,
     jwt: {
-      // Each secret should be unique and not reused in other environments,
-      // also the JWT secret should be different from the Refresh secret!
-      // crypto.randomBytes(512).toString('base64') (see https://nodejs.org/api/crypto.html#crypto)
       refresh: {
         renewal: true,
-        // Each secret should be unique and not reused in other environments,
-        // also the JWT secret should be different from the Refresh secret!
-        // crypto.randomBytes(512).toString('base64') (see https://nodejs.org/api/crypto.html#crypto)
-        secret: 'SECRET_OR_PRIVATE_KEY_LOCAL_REFRESH',
+        secret: process.env.JWT_REFRESH_SECRET || 'SECRET_OR_PRIVATE_KEY_LOCAL_REFRESH',
         signInOptions: {
           expiresIn: '7d',
         },
       },
       sameTokenIdPeriod: 2000,
-      secret: 'SECRET_OR_PRIVATE_KEY_LOCAL',
+      secret: process.env.JWT_SECRET || 'SECRET_OR_PRIVATE_KEY_LOCAL',
       signInOptions: {
         expiresIn: '15m',
       },
@@ -124,7 +121,7 @@ const config: { [env: string]: IServerOptions } = {
         locale: 'de',
       },
       modelDocumentation: false,
-      uri: 'mongodb://127.0.0.1/nest-server-ci',
+      uri: process.env.MONGODB_URI || 'mongodb://127.0.0.1/nest-server-ci',
     },
     permissions: true,
     port: 3000,
@@ -159,29 +156,44 @@ const config: { [env: string]: IServerOptions } = {
       legacyEndpoints: { enabled: true },
     },
     automaticObjectIdFiltering: true,
-    baseUrl: 'http://localhost:3000',
+    baseUrl: process.env.BASE_URL || 'http://localhost:3000',
+    betterAuth: {
+      emailVerification: false,
+      jwt: { enabled: true, expiresIn: '15m' },
+      rateLimit: { enabled: true, max: 100, windowSeconds: 60 },
+      secret: process.env.BETTER_AUTH_SECRET || 'BETTER_AUTH_SECRET_LOCAL_32_CHARS_M',
+      twoFactor: { appName: 'Nest Server Dev', enabled: true },
+    },
+    // Brevo transactional API — optional overlay for template-based emails.
+    // Activated only when BREVO_API_KEY is set; otherwise SMTP handles everything.
+    ...(process.env.BREVO_API_KEY
+      ? {
+          brevo: {
+            apiKey: process.env.BREVO_API_KEY,
+            sender: {
+              email: process.env.EMAIL_DEFAULT_SENDER || 'noreply@test.local',
+              name: process.env.EMAIL_DEFAULT_SENDER_NAME || 'Nest Server Development',
+            },
+          },
+        }
+      : {}),
     compression: true,
-    cookies: false,
+    cors: { allowAll: true },
     email: {
       defaultSender: {
-        email: 'oren.satterfield@ethereal.email',
+        email: process.env.EMAIL_DEFAULT_SENDER || 'noreply@test.local',
         name: 'Nest Server Development',
       },
-      mailjet: {
-        api_key_private: 'MAILJET_API_KEY_PRIVATE',
-        api_key_public: 'MAILJET_API_KEY_PUBLIC',
-      },
-      passwordResetLink: 'http://localhost:4200/user/password-reset',
       smtp: {
         auth: {
-          pass: 'K4DvD8U31VKseT7vQC',
-          user: 'oren.satterfield@ethereal.email',
+          pass: process.env.SMTP_PASS || '',
+          user: process.env.SMTP_USER || '',
         },
-        host: 'mailhog.lenne.tech',
-        port: 1025,
+        host: process.env.SMTP_HOST || 'mailhog.lenne.tech',
+        jsonTransport: !process.env.SMTP_HOST || undefined,
+        port: parseInt(process.env.SMTP_PORT || '1025', 10),
         secure: false,
       },
-      verificationLink: 'http://localhost:4200/user/verification',
     },
     env: 'development',
     execAfterInit: 'pnpm run docs:bootstrap',
@@ -204,21 +216,15 @@ const config: { [env: string]: IServerOptions } = {
     },
     ignoreSelectionsForPopulate: true,
     jwt: {
-      // Each secret should be unique and not reused in other environments,
-      // also the JWT secret should be different from the Refresh secret!
-      // crypto.randomBytes(512).toString('base64') (see https://nodejs.org/api/crypto.html#crypto)
       refresh: {
         renewal: true,
-        // Each secret should be unique and not reused in other environments,
-        // also the JWT secret should be different from the Refresh secret!
-        // crypto.randomBytes(512).toString('base64') (see https://nodejs.org/api/crypto.html#crypto)
-        secret: 'SECRET_OR_PRIVATE_KEY_DEV_REFRESH',
+        secret: process.env.JWT_REFRESH_SECRET || 'SECRET_OR_PRIVATE_KEY_DEV_REFRESH',
         signInOptions: {
           expiresIn: '7d',
         },
       },
       sameTokenIdPeriod: 2000,
-      secret: 'SECRET_OR_PRIVATE_KEY_DEV',
+      secret: process.env.JWT_SECRET || 'SECRET_OR_PRIVATE_KEY_DEV',
       signInOptions: {
         expiresIn: '15m',
       },
@@ -230,7 +236,7 @@ const config: { [env: string]: IServerOptions } = {
         locale: 'de',
       },
       modelDocumentation: false,
-      uri: 'mongodb://127.0.0.1/nest-server-dev',
+      uri: process.env.MONGODB_URI || 'mongodb://127.0.0.1/nest-server-dev',
     },
     permissions: true,
     port: 3000,
@@ -273,7 +279,7 @@ const config: { [env: string]: IServerOptions } = {
       // Passkey auto-activated when URLs can be resolved (env: 'local' → localhost defaults)
       passkey: { enabled: true, origin: 'http://localhost:3001', rpId: 'localhost', rpName: 'Nest Server Local' },
       rateLimit: { enabled: true, max: 100, windowSeconds: 60 },
-      secret: 'BETTER_AUTH_SECRET_LOCAL_32_CHARS_M',
+      secret: process.env.BETTER_AUTH_SECRET || 'BETTER_AUTH_SECRET_LOCAL_32_CHARS_M',
       // Social providers disabled in local environment (no credentials)
       socialProviders: {
         apple: { clientId: '', clientSecret: '', enabled: false },
@@ -286,7 +292,8 @@ const config: { [env: string]: IServerOptions } = {
       twoFactor: { appName: 'Nest Server Local', enabled: true },
     },
     compression: true,
-    cookies: false,
+    cookies: { exposeTokenInBody: true },
+    cors: { allowAll: true },
     cronJobs: {
       sayHello: {
         cronTime: CronExpression.EVERY_10_SECONDS,
@@ -299,24 +306,19 @@ const config: { [env: string]: IServerOptions } = {
     },
     email: {
       defaultSender: {
-        email: 'oren.satterfield@ethereal.email',
-        name: 'Nest Server Local',
-      },
-      mailjet: {
-        api_key_private: 'MAILJET_API_KEY_PRIVATE',
-        api_key_public: 'MAILJET_API_KEY_PUBLIC',
+        email: process.env.EMAIL_DEFAULT_SENDER || 'noreply@test.local',
+        name: 'Nest Server E2E',
       },
-      passwordResetLink: 'http://localhost:4200/user/password-reset',
       smtp: {
         auth: {
-          pass: 'K4DvD8U31VKseT7vQC',
-          user: 'oren.satterfield@ethereal.email',
+          pass: process.env.SMTP_PASS || '',
+          user: process.env.SMTP_USER || '',
         },
-        host: 'mailhog.lenne.tech',
-        port: 1025,
+        host: process.env.SMTP_HOST || 'mailhog.lenne.tech',
+        jsonTransport: !process.env.SMTP_HOST || undefined,
+        port: parseInt(process.env.SMTP_PORT || '1025', 10),
         secure: false,
       },
-      verificationLink: 'http://localhost:4200/user/verification',
     },
     env: 'e2e',
     // Disable auto-registration to allow Server ErrorCodeModule with SRV_* codes
@@ -344,21 +346,15 @@ const config: { [env: string]: IServerOptions } = {
     hostname: '127.0.0.1',
     ignoreSelectionsForPopulate: true,
     jwt: {
-      // Each secret should be unique and not reused in other environments,
-      // also the JWT secret should be different from the Refresh secret!
-      // crypto.randomBytes(512).toString('base64') (see https://nodejs.org/api/crypto.html#crypto)
       refresh: {
         renewal: true,
-        // Each secret should be unique and not reused in other environments,
-        // also the JWT secret should be different from the Refresh secret!
-        // crypto.randomBytes(512).toString('base64') (see https://nodejs.org/api/crypto.html#crypto)
-        secret: 'SECRET_OR_PRIVATE_KEY_LOCAL_REFRESH',
+        secret: process.env.JWT_REFRESH_SECRET || 'SECRET_OR_PRIVATE_KEY_LOCAL_REFRESH',
         signInOptions: {
           expiresIn: '7d',
         },
       },
       sameTokenIdPeriod: 2000,
-      secret: 'SECRET_OR_PRIVATE_KEY_LOCAL',
+      secret: process.env.JWT_SECRET || 'SECRET_OR_PRIVATE_KEY_LOCAL',
       signInOptions: {
         expiresIn: '15m',
       },
@@ -370,7 +366,7 @@ const config: { [env: string]: IServerOptions } = {
         locale: 'de',
       },
       modelDocumentation: false,
-      uri: 'mongodb://127.0.0.1/nest-server-e2e',
+      uri: process.env.MONGODB_URI || 'mongodb://127.0.0.1/nest-server-e2e',
     },
     permissions: true,
     port: 3000,
@@ -405,7 +401,21 @@ const config: { [env: string]: IServerOptions } = {
       legacyEndpoints: { enabled: true },
     },
     automaticObjectIdFiltering: true,
+    // Brevo transactional API — optional overlay for template-based emails.
+    // Activated only when BREVO_API_KEY is set; otherwise SMTP handles everything.
+    ...(process.env.BREVO_API_KEY
+      ? {
+          brevo: {
+            apiKey: process.env.BREVO_API_KEY,
+            sender: {
+              email: process.env.EMAIL_DEFAULT_SENDER || 'noreply@test.local',
+              name: process.env.EMAIL_DEFAULT_SENDER_NAME || 'Nest Server Local',
+            },
+          },
+        }
+      : {}),
     compression: true,
+    cors: { allowAll: true },
     cronJobs: {
       sayHello: {
         cronTime: CronExpression.EVERY_10_SECONDS,
@@ -418,24 +428,19 @@ const config: { [env: string]: IServerOptions } = {
     },
     email: {
       defaultSender: {
-        email: 'oren.satterfield@ethereal.email',
+        email: process.env.EMAIL_DEFAULT_SENDER || 'noreply@test.local',
         name: 'Nest Server Local',
       },
-      mailjet: {
-        api_key_private: 'MAILJET_API_KEY_PRIVATE',
-        api_key_public: 'MAILJET_API_KEY_PUBLIC',
-      },
-      passwordResetLink: 'http://localhost:4200/user/password-reset',
       smtp: {
         auth: {
-          pass: 'K4DvD8U31VKseT7vQC',
-          user: 'oren.satterfield@ethereal.email',
+          pass: process.env.SMTP_PASS || '',
+          user: process.env.SMTP_USER || '',
         },
-        host: 'mailhog.lenne.tech',
-        port: 1025,
+        host: process.env.SMTP_HOST || 'mailhog.lenne.tech',
+        jsonTransport: !process.env.SMTP_HOST || undefined,
+        port: parseInt(process.env.SMTP_PORT || '1025', 10),
         secure: false,
       },
-      verificationLink: 'http://localhost:4200/user/verification',
     },
     env: 'local',
     // Disable auto-registration to allow Server ErrorCodeModule with SRV_* codes
@@ -463,21 +468,15 @@ const config: { [env: string]: IServerOptions } = {
     hostname: '127.0.0.1',
     ignoreSelectionsForPopulate: true,
     jwt: {
-      // Each secret should be unique and not reused in other environments,
-      // also the JWT secret should be different from the Refresh secret!
-      // crypto.randomBytes(512).toString('base64') (see https://nodejs.org/api/crypto.html#crypto)
       refresh: {
         renewal: true,
-        // Each secret should be unique and not reused in other environments,
-        // also the JWT secret should be different from the Refresh secret!
-        // crypto.randomBytes(512).toString('base64') (see https://nodejs.org/api/crypto.html#crypto)
-        secret: 'SECRET_OR_PRIVATE_KEY_LOCAL_REFRESH',
+        secret: process.env.JWT_REFRESH_SECRET || 'SECRET_OR_PRIVATE_KEY_LOCAL_REFRESH',
         signInOptions: {
           expiresIn: '7d',
         },
       },
       sameTokenIdPeriod: 2000,
-      secret: 'SECRET_OR_PRIVATE_KEY_LOCAL',
+      secret: process.env.JWT_SECRET || 'SECRET_OR_PRIVATE_KEY_LOCAL',
       signInOptions: {
         expiresIn: '15m',
       },
@@ -489,7 +488,7 @@ const config: { [env: string]: IServerOptions } = {
         locale: 'de',
       },
       modelDocumentation: true,
-      uri: 'mongodb://127.0.0.1/nest-server-local',
+      uri: process.env.MONGODB_URI || 'mongodb://127.0.0.1/nest-server-local',
     },
     permissions: {
       role: false,
@@ -545,28 +544,38 @@ const config: { [env: string]: IServerOptions } = {
       },
       twoFactor: { appName: process.env.TWO_FACTOR_APP_NAME || 'Nest Server' },
     },
+    // Brevo transactional API (optional overlay for template-based emails).
+    // Activated only when BREVO_API_KEY is set — otherwise remains undefined
+    // and all emails flow through the SMTP transport below.
+    ...(process.env.BREVO_API_KEY
+      ? {
+          brevo: {
+            apiKey: process.env.BREVO_API_KEY,
+            sender: {
+              email: process.env.EMAIL_DEFAULT_SENDER || 'noreply@example.com',
+              name: process.env.EMAIL_DEFAULT_SENDER_NAME || 'Nest Server',
+            },
+          },
+        }
+      : {}),
     compression: true,
-    cookies: false,
+    cors: {
+      allowedOrigins: process.env.CORS_ALLOWED_ORIGINS?.split(',').filter(Boolean),
+    },
     email: {
       defaultSender: {
-        email: 'oren.satterfield@ethereal.email',
-        name: 'Nest Server Production',
-      },
-      mailjet: {
-        api_key_private: 'MAILJET_API_KEY_PRIVATE',
-        api_key_public: 'MAILJET_API_KEY_PUBLIC',
+        email: process.env.EMAIL_DEFAULT_SENDER || 'noreply@example.com',
+        name: process.env.EMAIL_DEFAULT_SENDER_NAME || 'Nest Server',
       },
-      passwordResetLink: 'http://localhost:4200/user/password-reset',
       smtp: {
         auth: {
-          pass: 'K4DvD8U31VKseT7vQC',
-          user: 'oren.satterfield@ethereal.email',
+          pass: process.env.SMTP_PASS,
+          user: process.env.SMTP_USER,
         },
-        host: 'mailhog.lenne.tech',
-        port: 1025,
-        secure: false,
+        host: process.env.SMTP_HOST,
+        port: parseInt(process.env.SMTP_PORT || '587', 10),
+        secure: process.env.SMTP_SECURE !== 'false',
       },
-      verificationLink: 'http://localhost:4200/user/verification',
     },
     env: 'production',
     execAfterInit: 'pnpm run docs:bootstrap',
@@ -589,21 +598,15 @@ const config: { [env: string]: IServerOptions } = {
     },
     ignoreSelectionsForPopulate: true,
     jwt: {
-      // Each secret should be unique and not reused in other environments,
-      // also the JWT secret should be different from the Refresh secret!
-      // crypto.randomBytes(512).toString('base64') (see https://nodejs.org/api/crypto.html#crypto)
       refresh: {
         renewal: true,
-        // Each secret should be unique and not reused in other environments,
-        // also the JWT secret should be different from the Refresh secret!
-        // crypto.randomBytes(512).toString('base64') (see https://nodejs.org/api/crypto.html#crypto)
-        secret: 'SECRET_OR_PRIVATE_KEY_PROD_REFRESH',
+        secret: process.env.JWT_REFRESH_SECRET,
         signInOptions: {
           expiresIn: '7d',
         },
       },
       sameTokenIdPeriod: 2000,
-      secret: 'SECRET_OR_PRIVATE_KEY_PROD',
+      secret: process.env.JWT_SECRET,
       signInOptions: {
         expiresIn: '15m',
       },
@@ -615,7 +618,9 @@ const config: { [env: string]: IServerOptions } = {
         locale: 'de',
       },
       modelDocumentation: false,
-      uri: 'mongodb://127.0.0.1/nest-server-prod',
+      // No fallback in production — missing MONGODB_URI must cause immediate startup failure
+      // to prevent accidental connection to localhost (silent data-integrity risk).
+      uri: process.env.MONGODB_URI,
     },
     port: 3000,
     security: {