@lenne.tech/nest-server 11.26.1 → 11.26.3

package/src/core/modules/better-auth/core-better-auth-web.helper.ts

@@ -2,6 +2,7 @@ import { Logger } from '@nestjs/common';
 import * as crypto from 'crypto';
 import { Request, Response } from 'express';
 
+import { resolveBetterAuthSessionCookieName } from './better-auth-cookie-prefix.helper';
 import { isSessionToken } from './core-better-auth-token.helper';
 
 /**
@@ -94,13 +95,12 @@ export function extractSessionToken(
     }
   }
 
-  // Normalize basePath (remove leading slash, replace slashes with dots)
-  const normalizedBasePath = basePath.replace(/^\//, '').replace(/\//g, '.');
-
   // Cookie names to check (in order of priority)
-  // v11.12+: Only native Better-Auth cookie and legacy token
+  // v11.12+: Only native Better-Auth cookie and legacy token. The session cookie
+  // name is resolved through the single shared resolver (honours COOKIE_PREFIX),
+  // so it always matches what Better-Auth actually sets.
   const cookieNames = [
-    `${normalizedBasePath}.session_token`, // Better-Auth native (PRIMARY)
+    resolveBetterAuthSessionCookieName(basePath), // Better-Auth native (PRIMARY)
     BETTER_AUTH_COOKIE_NAMES.TOKEN, // Legacy nest-server cookie
   ];
 
@@ -320,8 +320,7 @@ export async function toWebRequest(req: Request, options: ToWebRequestOptions):
   if (sessionToken) {
     headers.set('authorization', `Bearer ${sessionToken}`);
 
-    const normalizedBasePath = basePath?.replace(/^\//, '').replace(/\//g, '.') || 'iam';
-    const primaryCookieName = `${normalizedBasePath}.session_token`;
+    const primaryCookieName = resolveBetterAuthSessionCookieName(basePath || '/iam');
     const existingCookieString = headers.get('cookie') || '';
 
     // Check if the request already has a signed session cookie.

package/src/core/modules/better-auth/core-better-auth.controller.ts

@@ -776,8 +776,7 @@ export class CoreBetterAuthController {
     }
 
     // Check cookies - Better-Auth native cookie first, then legacy token
-    const basePath = this.betterAuthService.getBasePath().replace(/^\//, '').replace(/\//g, '.');
-    const cookieName = `${basePath}.session_token`;
+    const cookieName = this.betterAuthService.getSessionCookieName();
     return req.cookies?.[cookieName] || req.cookies?.['token'] || null;
   }
 

package/src/core/modules/better-auth/core-better-auth.service.ts

@@ -9,6 +9,7 @@ import { maskEmail, maskToken } from '../../common/helpers/logging.helper';
 import { IBetterAuth, ICookiesConfig } from '../../common/interfaces/server-options.interface';
 import { ConfigService } from '../../common/services/config.service';
 import { ErrorCode } from '../error-code/error-codes';
+import { resolveBetterAuthCookiePrefix } from './better-auth-cookie-prefix.helper';
 import { BetterAuthInstance } from './better-auth.config';
 import { BetterAuthSessionUser } from './core-better-auth-user.mapper';
 import { convertExpressHeaders, parseCookieHeader, signCookieValueIfNeeded } from './core-better-auth-web.helper';
@@ -65,6 +66,11 @@ export const BETTER_AUTH_COOKIE_DOMAIN = 'BETTER_AUTH_COOKIE_DOMAIN';
 export class CoreBetterAuthService implements OnModuleInit {
   private readonly logger = new Logger(CoreBetterAuthService.name);
   private readonly config: IBetterAuth;
+  // Cached cookie prefix — frozen on first read so the value cannot drift away
+  // from the Better-Auth instance (which captured it at bootstrap). Without
+  // this cache a test or fork that mutates `process.env.COOKIE_PREFIX` after
+  // boot would push the service and the Better-Auth instance out of lockstep.
+  private cachedCookiePrefix: null | string = null;
 
   constructor(
     @Optional() @Inject(BETTER_AUTH_INSTANCE) private readonly authInstance: BetterAuthInstance | null,
@@ -280,8 +286,28 @@ export class CoreBetterAuthService implements OnModuleInit {
    * @returns The session cookie name
    */
   getSessionCookieName(): string {
-    const basePath = this.getBasePath()?.replace(/^\//, '').replace(/\//g, '.') || 'iam';
-    return `${basePath}.session_token`;
+    return `${this.getCookiePrefix()}.session_token`;
+  }
+
+  /**
+   * Gets the cookie prefix (the `iam` in `iam.session_token`).
+   *
+   * Single source of truth: honours the `COOKIE_PREFIX` env override and falls
+   * back to the basePath-derived prefix. Every session-cookie call site must
+   * resolve the name through this (or {@link getSessionCookieName}) so the name
+   * stays in lockstep across the whole auth pipeline.
+   *
+   * The resolved value is cached on first read and reused for the lifetime of
+   * the service so it cannot drift away from the Better-Auth instance, which
+   * captures the prefix once at bootstrap. A late mutation of
+   * `process.env.COOKIE_PREFIX` (typical in tests / forked workers) would
+   * otherwise make set, read and clear use different names.
+   */
+  getCookiePrefix(): string {
+    if (this.cachedCookiePrefix === null) {
+      this.cachedCookiePrefix = resolveBetterAuthCookiePrefix(this.getBasePath() || '/iam');
+    }
+    return this.cachedCookiePrefix;
   }
 
   // ===================================================================================================================
@@ -434,8 +460,7 @@ export class CoreBetterAuthService implements OnModuleInit {
       // Browser clients send unsigned cookies, but Better-Auth expects signed cookies
       const cookieHeader = headers.get('cookie');
       if (cookieHeader && this.config?.secret) {
-        const basePath = this.getBasePath()?.replace(/^\//, '').replace(/\//g, '.') || 'iam';
-        const sessionCookieName = `${basePath}.session_token`;
+        const sessionCookieName = this.getSessionCookieName();
         const cookies = parseCookieHeader(cookieHeader);
         let modified = false;
 

package/src/test/test.helper.ts

@@ -8,6 +8,7 @@ import util = require('util');
 import ws = require('ws');
 
 import { getStringIds } from '../core/common/helpers/db.helper';
+import { resolveBetterAuthSessionCookieName } from '../core/modules/better-auth/better-auth-cookie-prefix.helper';
 
 /**
  * GraphQL request type
@@ -830,8 +831,11 @@ export class TestHelper {
    * Sets the token in all relevant cookie names for compatibility.
    */
   static buildBetterAuthCookies(sessionToken: string, basePath: string = 'iam'): Record<string, string> {
+    // Resolve the session cookie name through the shared resolver so tests honour
+    // a COOKIE_PREFIX override exactly like the runtime (otherwise an authenticated
+    // request in a COOKIE_PREFIX=acme app would send the wrong cookie name).
     return {
-      [`${basePath}.session_token`]: sessionToken,
+      [resolveBetterAuthSessionCookieName(basePath)]: sessionToken,
       token: sessionToken,
     };
   }
@@ -861,10 +865,16 @@ export class TestHelper {
   /**
    * Extract a session token from Set-Cookie headers of a supertest response.
    * Handles signed cookies (value.signature format) by returning only the value part.
+   *
+   * The default cookie name is resolved through the shared resolver so it
+   * honours a `COOKIE_PREFIX` env override exactly like the runtime (otherwise
+   * tests against a `COOKIE_PREFIX=acme` app would look for the wrong cookie
+   * and silently return `null`). Tests can still pass an explicit name.
    */
-  static extractSessionToken(response: any, cookieName: string = 'iam.session_token'): null | string {
+  static extractSessionToken(response: any, cookieName?: string): null | string {
+    const resolvedCookieName = cookieName ?? resolveBetterAuthSessionCookieName('/iam');
     const cookies = TestHelper.extractCookies(response);
-    const value = cookies[cookieName];
+    const value = cookies[resolvedCookieName];
     if (!value) {
       return null;
     }