@lenne.tech/nest-server 11.27.4 → 11.27.6

package/src/core/modules/better-auth/better-auth.config.ts

@@ -7,6 +7,7 @@ import * as crypto from 'crypto';
 import * as fs from 'fs';
 import * as path from 'path';
 
+import { resolveServerUrls, strippedApiHostname } from '../../common/helpers/cookies.helper';
 import { IBetterAuth, ICorsConfig } from '../../common/interfaces/server-options.interface';
 import { detectCookiePrefixDrift, resolveBetterAuthCookiePrefix } from './better-auth-cookie-prefix.helper';
 
@@ -379,15 +380,47 @@ export function createBetterAuthInstance(options: CreateBetterAuthOptions): Crea
     );
   }
 
+  // Better-Auth base URL (resolved localhost defaults → explicit config → fallback).
+  const betterAuthBaseUrl = resolvedUrls.baseUrl || config.baseUrl || 'http://localhost:3000';
+  // The `Secure` attribute Better-Auth WOULD derive for its cookies if `useSecureCookies`
+  // were not pinned below: an `https://` baseURL is Better-Auth's own signal
+  // (createCookieGetter → `baseURLString.startsWith('https://')`). We keep exactly this value so
+  // the pinned `useSecureCookies: false` (needed for name alignment, see below) does not silently
+  // strip `Secure` from the cookies Better-Auth's native handlers forward.
+  const secureCookies = betterAuthBaseUrl.startsWith('https://');
+
   const betterAuthConfig: Record<string, unknown> = {
     advanced: {
       cookiePrefix,
       ...(crossSubDomain.enabled && {
         crossSubDomainCookies: { domain: crossSubDomain.domain, enabled: true },
       }),
+      // Keep Better-Auth's NATIVE handlers on the SAME cookie name the
+      // nest-server cookie helpers actually write. Those helpers always emit
+      // the UNPREFIXED `<cookiePrefix>.session_token`. Better-Auth, left to its
+      // own devices on an `https://` baseURL, auto-enables secure cookies AND
+      // prefixes the name with `__Secure-`, so its native handlers (2FA
+      // enable/disable, passkey register/list, backup codes, `/token`) look for
+      // `__Secure-<cookiePrefix>.session_token` — a cookie that is never written
+      // — and return `401 UNAUTHORIZED`, while the project's own session
+      // resolver (which reads the unprefixed cookie) still returns a session: a
+      // split-brain where `GET /iam/get-session` is 200 but every sensitive
+      // Better-Auth endpoint is 401. Pinning `useSecureCookies: false` keeps the
+      // native read path aligned with the cookie helper.
+      useSecureCookies: false,
+      // …BUT `useSecureCookies: false` also forces `secure: false` on EVERY cookie
+      // Better-Auth sets (createCookieGetter → `secure: !!secureCookiePrefix`), and the
+      // native handlers forward their `Set-Cookie` VERBATIM via `sendWebResponse`
+      // (2FA verify, social callback, magic link, passkey) WITHOUT passing through the
+      // cookie helper — so those session cookies would ship without `Secure` in
+      // production. Restore the exact Secure flag Better-Auth itself would have derived
+      // (an `https://` baseURL), keeping the unprefixed NAME while preserving the
+      // `Secure` TRANSPORT flag. Only injected on https so http/local and a consumer's
+      // own `options.advanced.useSecureCookies` override are left untouched.
+      ...(secureCookies && { defaultCookieAttributes: { secure: true } }),
     },
     basePath,
-    baseURL: resolvedUrls.baseUrl || config.baseUrl || 'http://localhost:3000',
+    baseURL: betterAuthBaseUrl,
     database: mongodbAdapter(db),
     // Enable email/password authentication by default (required by Better-Auth 1.x)
     // Can be disabled by setting config.emailAndPassword.enabled = false
@@ -680,12 +713,20 @@ function buildSocialProviders(config: IBetterAuth): Record<string, SocialProvide
  *
  * Behavior (in priority order):
  * 1. Explicit betterAuth.trustedOrigins → use those (always takes precedence)
- * 2. Server CORS disabled → empty array (BetterAuth CORS also disabled)
- * 3. Server CORS allowAll → undefined (BetterAuth allows all origins)
+ * 2. Server CORS disabled → empty array (adds no extra trusted origins beyond BetterAuth's own
+ *    baseURL — see NOTE; it does NOT switch BetterAuth's origin check off)
+ * 3. Server CORS allowAll → fall through to rules 4-7 (see below)
  * 4. Server CORS allowedOrigins → merge with appUrl/baseUrl
  * 5. Passkey trustedOrigins → use from normalizePasskeyConfig()
  * 6. Fallback to resolved appUrl
- * 7. Otherwise → undefined (allows all origins via Better-Auth's default)
+ * 7. Otherwise → undefined (Better-Auth then trusts only its own baseURL)
+ *
+ * NOTE on rules 2 and 7: neither an empty array (rule 2) nor `undefined` (rule 7) means "any
+ * origin is allowed", and neither disables BetterAuth's origin check. In both cases BetterAuth
+ * still derives and trusts its own `baseURL` origin (see `getTrustedOrigins()` in
+ * `better-auth/context`, which unconditionally pushes `new URL(baseURL).origin` before appending
+ * `options.trustedOrigins`), so `[]` and `undefined` are behaviorally identical here: a
+ * separately hosted frontend is still rejected by every origin-checked endpoint.
  *
  * @param config - Better-auth configuration
  * @param options - Passkey normalization, resolved URLs, and server CORS context
@@ -705,15 +746,25 @@ export function buildTrustedOrigins(
     return config.trustedOrigins;
   }
 
-  // 2. Server CORS disabled → BetterAuth CORS also disabled
+  // 2. Server CORS disabled → add no extra trusted origins. BetterAuth still trusts its own
+  //    baseURL (see the NOTE above), so this does NOT turn its origin check off — it only means
+  //    "no separately hosted frontend is trusted". Behaviorally identical to rule 7's undefined.
   if (serverCorsConfig === false || (typeof serverCorsConfig === 'object' && serverCorsConfig?.enabled === false)) {
     return [];
   }
 
-  // 3. Server CORS allowAll → BetterAuth allows all origins
-  if (typeof serverCorsConfig === 'object' && serverCorsConfig?.allowAll) {
-    return undefined;
-  }
+  // 3. Server CORS allowAll → fall through to the appUrl / passkey rules below.
+  //
+  // This used to `return undefined` in the belief that BetterAuth then "allows all
+  // origins". It does not: without trustedOrigins BetterAuth trusts only its own
+  // baseURL, so the *app* origin is rejected and every origin-checked endpoint
+  // (two-factor/enable, passkey) answers 403 INVALID_ORIGIN. That silently broke
+  // 2FA and passkeys in exactly the setups that use allowAll — local dev and CI.
+  //
+  // An origin check has no meaningful "allow everything" mode — that is the very
+  // thing it defends against — so allowAll now yields the known-good origins
+  // (appUrl, passkey) instead of none. Projects that really do want to accept
+  // arbitrary origins can still set `betterAuth.trustedOrigins` explicitly (rule 1).
 
   // 4. Server allowedOrigins → merge with appUrl/baseUrl.
   // Order (appUrl, baseUrl, allowedOrigins) mirrors buildCorsConfig() in cookies.helper.ts
@@ -914,21 +965,6 @@ function readProjectNameFromPackageJson(): string {
   return fallback;
 }
 
-/**
- * Default URLs for local/test environments (local, ci, e2e)
- * These environments typically run on localhost and don't have a deployed domain.
- */
-const LOCALHOST_DEFAULTS = {
-  API_URL: 'http://localhost:3000',
-  APP_URL: 'http://localhost:3001',
-};
-
-/**
- * Environments that use localhost defaults for URLs.
- * These are typically development/test environments without deployed domains.
- */
-const LOCALHOST_ENVS = ['local', 'ci', 'e2e'];
-
 /**
  * Resolves the effective URLs for BetterAuth configuration.
  *
@@ -948,37 +984,6 @@ interface ResolvedUrls {
   warnings: string[];
 }
 
-/**
- * Derives appUrl from baseUrl by removing 'api.' prefix from subdomain.
- *
- * Examples:
- * - 'https://api.example.com' → 'https://example.com'
- * - 'https://api.dev.example.com' → 'https://dev.example.com'
- * - 'https://example.com' → 'https://example.com' (unchanged)
- * - 'http://localhost:3000' → 'http://localhost:3000' (unchanged)
- *
- * @param baseUrl - The API base URL
- * @returns Derived app URL or the original URL if no 'api.' prefix
- */
-function deriveAppUrlFromBaseUrl(baseUrl: string): string {
-  try {
-    const url = new URL(baseUrl);
-    const hostname = url.hostname;
-
-    // Check if hostname starts with 'api.'
-    if (hostname.startsWith('api.')) {
-      // Remove 'api.' prefix
-      url.hostname = hostname.substring(4);
-      return url.origin;
-    }
-
-    // Return original URL if no 'api.' prefix
-    return url.origin;
-  } catch {
-    return baseUrl;
-  }
-}
-
 /**
  * Extracts the root domain from a URL for use as Passkey rpId.
  *
@@ -1228,6 +1233,17 @@ export function resolveCrossSubDomainCookies(
  * 3. Use baseUrl hostname as-is
  *
  * Returns undefined for localhost (cross-subdomain not meaningful there).
+ *
+ * The `api.` strip reuses {@link strippedApiHostname} so it shares that helper's guard against
+ * bogus results: `api.dev` → `dev` would set a public-suffix cookie domain that browsers reject
+ * outright (dropping every session cookie), so `api.dev` is kept as-is instead.
+ *
+ * KNOWN LIMITATION (fails closed, no leak): the single-label guard cannot recognise a MULTI-label
+ * public suffix — `api.co.uk` still strips to `co.uk`, a Public-Suffix-List entry browsers also
+ * reject, so cross-subdomain auth would break (cookie dropped) rather than over-scope. A full PSL
+ * check would need a dependency, which this security-critical module deliberately avoids; for such
+ * apex domains set `betterAuth.crossSubDomainCookies.domain` explicitly instead of relying on
+ * derivation. See migration guide 11.27.5 → 11.27.6.
  */
 function deriveCookieDomainFromUrls(appUrl?: string, baseUrl?: string): string | undefined {
   // Priority 1: appUrl hostname (this IS the parent domain in typical setups)
@@ -1249,11 +1265,9 @@ function deriveCookieDomainFromUrls(appUrl?: string, baseUrl?: string): string |
       if (hostname === 'localhost' || hostname === '127.0.0.1') {
         return undefined;
       }
-      // Strip api. prefix to get parent domain
-      if (hostname.startsWith('api.')) {
-        return hostname.substring(4);
-      }
-      return hostname;
+      // Strip api. prefix to get parent domain — but keep the host unchanged when stripping
+      // would leave a bare TLD (`api.dev`) or empty host (`api.`).
+      return strippedApiHostname(hostname) ?? hostname;
     } catch {
       return undefined;
     }
@@ -1263,36 +1277,31 @@ function deriveCookieDomainFromUrls(appUrl?: string, baseUrl?: string): string |
 }
 
 function resolveUrls(options: CreateBetterAuthOptions): ResolvedUrls {
-  const { config, serverAppUrl, serverBaseUrl, serverEnv } = options;
+  const { config, serverAppUrl, serverBaseUrl, serverCorsConfig, serverEnv } = options;
   const warnings: string[] = [];
-  const usesLocalhostDefaults = LOCALHOST_ENVS.includes(serverEnv || '');
 
-  // Step 1: Resolve baseUrl
-  // Priority: betterAuth.baseUrl > serverBaseUrl > localhost default (for local/ci/e2e)
-  let baseUrl = config.baseUrl || serverBaseUrl;
-  if (!baseUrl && usesLocalhostDefaults) {
-    baseUrl = LOCALHOST_DEFAULTS.API_URL;
+  // Steps 1+2 (baseUrl, appUrl) are delegated to the shared resolver in cookies.helper so that
+  // BetterAuth's trustedOrigins and the REST/GraphQL CORS allowlist can never disagree about
+  // which app origin this server is reachable under. `cors.deriveAppUrl: false` therefore
+  // suppresses the `api.`-strip derivation on this layer too.
+  const corsObj = typeof serverCorsConfig === 'object' && serverCorsConfig !== null ? serverCorsConfig : undefined;
+  const resolved = resolveServerUrls({
+    appUrl: serverAppUrl,
+    // Priority: betterAuth.baseUrl > serverBaseUrl (> localhost default, applied by the resolver)
+    baseUrl: config.baseUrl || serverBaseUrl,
+    deriveAppUrl: corsObj?.deriveAppUrl,
+    env: serverEnv,
+  });
+  const { appUrl, baseUrl } = resolved;
+
+  if (resolved.baseUrlSource === 'localhost-default') {
     warnings.push(`URL: Using localhost default baseUrl="${baseUrl}" (env: '${serverEnv}')`);
   }
-
-  // Step 2: Resolve appUrl
-  // Priority: serverAppUrl > localhost default (when baseUrl is localhost) > derived from baseUrl
-  let appUrl = serverAppUrl;
-
-  // For localhost environments with localhost baseUrl, use localhost app default
-  // This handles the common case where API runs on :3000 and App on :3001
-  const isBaseUrlLocalhost = baseUrl && (baseUrl.includes('localhost') || baseUrl.includes('127.0.0.1'));
-  if (!appUrl && usesLocalhostDefaults && isBaseUrlLocalhost) {
-    appUrl = LOCALHOST_DEFAULTS.APP_URL;
+  if (resolved.appUrlSource === 'localhost-default') {
     warnings.push(`URL: Using localhost default appUrl="${appUrl}" (env: '${serverEnv}')`);
   }
-
-  // For non-localhost environments, try to derive appUrl from baseUrl
-  if (!appUrl && baseUrl) {
-    appUrl = deriveAppUrlFromBaseUrl(baseUrl);
-    if (appUrl !== baseUrl) {
-      warnings.push(`URL: Auto-derived appUrl="${appUrl}" from baseUrl="${baseUrl}"`);
-    }
+  if (resolved.appUrlSource === 'derived' && appUrl !== baseUrl) {
+    warnings.push(`URL: Auto-derived appUrl="${appUrl}" from baseUrl="${baseUrl}"`);
   }
 
   // Step 3: Resolve rpId from appUrl (not baseUrl!)

package/src/core/modules/migrate/migration-runner.ts

@@ -19,13 +19,27 @@ export interface MigrationFile {
   up: () => Promise<void>;
 }
 
+/**
+ * Default file pattern for migration files: `*.ts` and `*.js`, but never `*.d.ts`.
+ *
+ * A compiled migration ships `foo.js` next to `foo.d.ts` (whenever the project
+ * builds with `declaration: true`). A plain `/\.(ts|js)$/` matches the
+ * declaration file too, so the runner would load it as a *second* migration and
+ * throw — `export declare …` is not valid CommonJS.
+ *
+ * The lookbehind guards the `.ts` branch only. Writing it as `(?<!\.d)\.(ts|js)$`
+ * would also reject a perfectly valid `foo.d.js`, since `.d` precedes `.js` there
+ * as well.
+ */
+export const DEFAULT_MIGRATION_FILE_PATTERN = /(?:(?<!\.d)\.ts|\.js)$/;
+
 /**
  * Migration runner configuration
  */
 export interface MigrationRunnerOptions {
   /** Directory containing migration files */
   migrationsDirectory: string;
-  /** Pattern to match migration files (default: *.ts, *.js) */
+  /** Pattern to match migration files (default: {@link DEFAULT_MIGRATION_FILE_PATTERN}) */
   pattern?: RegExp;
   /** State store for tracking migrations */
   stateStore: MongoStateStore;
@@ -59,7 +73,7 @@ export class MigrationRunner {
 
   constructor(options: MigrationRunnerOptions) {
     this.options = options;
-    this.pattern = options.pattern || /\.(ts|js)$/;
+    this.pattern = options.pattern || DEFAULT_MIGRATION_FILE_PATTERN;
   }
 
   /**