@lenne.tech/nest-server 11.26.0 → 11.26.2

package/src/core/modules/better-auth/core-better-auth.controller.ts

@@ -75,6 +75,14 @@ export class CoreBetterAuthUserResponse {
   @ApiProperty({ description: 'User display name' })
   name: string;
 
+  @ApiProperty({
+    description: 'Roles of the user (e.g. ["admin"]) — populated from the synced legacy user.',
+    isArray: true,
+    required: false,
+    type: String,
+  })
+  roles?: string[];
+
   @ApiProperty({ description: 'Whether 2FA is enabled', required: false })
   twoFactorEnabled?: boolean;
 }
@@ -768,8 +776,7 @@ export class CoreBetterAuthController {
     }
 
     // Check cookies - Better-Auth native cookie first, then legacy token
-    const basePath = this.betterAuthService.getBasePath().replace(/^\//, '').replace(/\//g, '.');
-    const cookieName = `${basePath}.session_token`;
+    const cookieName = this.betterAuthService.getSessionCookieName();
     return req.cookies?.[cookieName] || req.cookies?.['token'] || null;
   }
 
@@ -799,16 +806,25 @@ export class CoreBetterAuthController {
 
   /**
    * Map user to response format
+   *
+   * The `mappedUser` parameter is the synced legacy user from `mapSessionUser()` — it
+   * carries DB-only fields like `roles` that are not part of the Better-Auth session
+   * payload but are required by consumers for admin gating / RBAC. The base
+   * implementation forwards `roles` so the client-side state (`useLtAuth().setUser()`
+   * cache, `lt-auth-state` cookie) can route admin areas without a second round-trip.
+   *
+   * Subclasses can override to add project-specific fields (e.g. `status`, `type`).
+   *
    * @param sessionUser - The user from Better-Auth session
-   * @param _mappedUser - The synced user from legacy system (available for override customization)
+   * @param mappedUser - The synced user from legacy system (includes `roles`)
    */
-
-  protected mapUser(sessionUser: BetterAuthSessionUser, _mappedUser: any): CoreBetterAuthUserResponse {
+  protected mapUser(sessionUser: BetterAuthSessionUser, mappedUser: any): CoreBetterAuthUserResponse {
     return {
       email: sessionUser.email,
       emailVerified: sessionUser.emailVerified || false,
       id: sessionUser.id,
       name: sessionUser.name || sessionUser.email.split('@')[0],
+      roles: Array.isArray(mappedUser?.roles) ? mappedUser.roles : [],
     };
   }
 

package/src/core/modules/better-auth/core-better-auth.service.ts

@@ -9,6 +9,7 @@ import { maskEmail, maskToken } from '../../common/helpers/logging.helper';
 import { IBetterAuth, ICookiesConfig } from '../../common/interfaces/server-options.interface';
 import { ConfigService } from '../../common/services/config.service';
 import { ErrorCode } from '../error-code/error-codes';
+import { resolveBetterAuthCookiePrefix } from './better-auth-cookie-prefix.helper';
 import { BetterAuthInstance } from './better-auth.config';
 import { BetterAuthSessionUser } from './core-better-auth-user.mapper';
 import { convertExpressHeaders, parseCookieHeader, signCookieValueIfNeeded } from './core-better-auth-web.helper';
@@ -65,6 +66,11 @@ export const BETTER_AUTH_COOKIE_DOMAIN = 'BETTER_AUTH_COOKIE_DOMAIN';
 export class CoreBetterAuthService implements OnModuleInit {
   private readonly logger = new Logger(CoreBetterAuthService.name);
   private readonly config: IBetterAuth;
+  // Cached cookie prefix — frozen on first read so the value cannot drift away
+  // from the Better-Auth instance (which captured it at bootstrap). Without
+  // this cache a test or fork that mutates `process.env.COOKIE_PREFIX` after
+  // boot would push the service and the Better-Auth instance out of lockstep.
+  private cachedCookiePrefix: null | string = null;
 
   constructor(
     @Optional() @Inject(BETTER_AUTH_INSTANCE) private readonly authInstance: BetterAuthInstance | null,
@@ -280,8 +286,28 @@ export class CoreBetterAuthService implements OnModuleInit {
    * @returns The session cookie name
    */
   getSessionCookieName(): string {
-    const basePath = this.getBasePath()?.replace(/^\//, '').replace(/\//g, '.') || 'iam';
-    return `${basePath}.session_token`;
+    return `${this.getCookiePrefix()}.session_token`;
+  }
+
+  /**
+   * Gets the cookie prefix (the `iam` in `iam.session_token`).
+   *
+   * Single source of truth: honours the `COOKIE_PREFIX` env override and falls
+   * back to the basePath-derived prefix. Every session-cookie call site must
+   * resolve the name through this (or {@link getSessionCookieName}) so the name
+   * stays in lockstep across the whole auth pipeline.
+   *
+   * The resolved value is cached on first read and reused for the lifetime of
+   * the service so it cannot drift away from the Better-Auth instance, which
+   * captures the prefix once at bootstrap. A late mutation of
+   * `process.env.COOKIE_PREFIX` (typical in tests / forked workers) would
+   * otherwise make set, read and clear use different names.
+   */
+  getCookiePrefix(): string {
+    if (this.cachedCookiePrefix === null) {
+      this.cachedCookiePrefix = resolveBetterAuthCookiePrefix(this.getBasePath() || '/iam');
+    }
+    return this.cachedCookiePrefix;
   }
 
   // ===================================================================================================================
@@ -434,8 +460,7 @@ export class CoreBetterAuthService implements OnModuleInit {
       // Browser clients send unsigned cookies, but Better-Auth expects signed cookies
       const cookieHeader = headers.get('cookie');
       if (cookieHeader && this.config?.secret) {
-        const basePath = this.getBasePath()?.replace(/^\//, '').replace(/\//g, '.') || 'iam';
-        const sessionCookieName = `${basePath}.session_token`;
+        const sessionCookieName = this.getSessionCookieName();
         const cookies = parseCookieHeader(cookieHeader);
         let modified = false;
 

package/src/test/test.helper.ts

@@ -8,6 +8,7 @@ import util = require('util');
 import ws = require('ws');
 
 import { getStringIds } from '../core/common/helpers/db.helper';
+import { resolveBetterAuthSessionCookieName } from '../core/modules/better-auth/better-auth-cookie-prefix.helper';
 
 /**
  * GraphQL request type
@@ -830,8 +831,11 @@ export class TestHelper {
    * Sets the token in all relevant cookie names for compatibility.
    */
   static buildBetterAuthCookies(sessionToken: string, basePath: string = 'iam'): Record<string, string> {
+    // Resolve the session cookie name through the shared resolver so tests honour
+    // a COOKIE_PREFIX override exactly like the runtime (otherwise an authenticated
+    // request in a COOKIE_PREFIX=acme app would send the wrong cookie name).
     return {
-      [`${basePath}.session_token`]: sessionToken,
+      [resolveBetterAuthSessionCookieName(basePath)]: sessionToken,
       token: sessionToken,
     };
   }
@@ -861,10 +865,16 @@ export class TestHelper {
   /**
    * Extract a session token from Set-Cookie headers of a supertest response.
    * Handles signed cookies (value.signature format) by returning only the value part.
+   *
+   * The default cookie name is resolved through the shared resolver so it
+   * honours a `COOKIE_PREFIX` env override exactly like the runtime (otherwise
+   * tests against a `COOKIE_PREFIX=acme` app would look for the wrong cookie
+   * and silently return `null`). Tests can still pass an explicit name.
    */
-  static extractSessionToken(response: any, cookieName: string = 'iam.session_token'): null | string {
+  static extractSessionToken(response: any, cookieName?: string): null | string {
+    const resolvedCookieName = cookieName ?? resolveBetterAuthSessionCookieName('/iam');
     const cookies = TestHelper.extractCookies(response);
-    const value = cookies[cookieName];
+    const value = cookies[resolvedCookieName];
     if (!value) {
       return null;
     }