@lenne.tech/nest-server 11.27.6 → 11.28.0

package/src/core/modules/tenant/core-tenant.guard.ts

@@ -1,4 +1,12 @@
-import { CanActivate, ExecutionContext, ForbiddenException, Injectable, Logger, OnModuleDestroy } from '@nestjs/common';
+import {
+  CanActivate,
+  ExecutionContext,
+  ForbiddenException,
+  Injectable,
+  Logger,
+  OnModuleDestroy,
+  UnauthorizedException,
+} from '@nestjs/common';
 import { Reflector } from '@nestjs/core';
 import { GqlContextType, GqlExecutionContext } from '@nestjs/graphql';
 import { InjectModel } from '@nestjs/mongoose';
@@ -6,6 +14,7 @@ import { Model } from 'mongoose';
 
 import { RoleEnum } from '../../common/enums/role.enum';
 import { ConfigService } from '../../common/services/config.service';
+import { ErrorCode } from '../error-code/error-codes';
 import { CoreTenantMemberModel } from './core-tenant-member.model';
 import { SKIP_TENANT_CHECK_KEY } from './core-tenant.decorators';
 import { TENANT_MEMBER_MODEL_TOKEN, TenantMemberStatus } from './core-tenant.enums';
@@ -73,9 +82,14 @@ interface CachedTenantIds {
  * 5. @SkipTenantCheck → role check against user.roles, no tenant context
  * 6. BetterAuth auto-skip (betterAuth.skipTenantCheck config + no header) → skip, no tenant context
  *
+ * Status codes (RFC 9110, aligned with RolesGuard since v11.28.0):
+ * - Missing authentication → 401 (re-authenticating IS the remedy, so the client must be told to)
+ * - Authenticated but lacking a right / membership → 403
+ * - S_NO_ONE → always 403 (authenticating can never unlock it)
+ *
  * HEADER PRESENT:
  *   - System ADMIN (adminBypass: true) → set req.tenantId + isAdminBypass
- *   - No user → 403 "Authentication required for tenant access"
+ *   - No user → 401 (tenant access requires authentication)
  *   - Authenticated non-admin user:
  *     - Active member → checkRoleAccess against membership.role → set req.tenantId + tenantRole
  *     - Not active member → ALWAYS 403
@@ -86,7 +100,7 @@ interface CachedTenantIds {
  *     → resolveUserTenantIds with minLevel filter
  *   - Authenticated + no checkable roles → resolveUserTenantIds (all memberships)
  *   - No user + no checkable roles → pass (plugin safety net catches tenantId-schema access)
- *   - No user + checkable roles → 403 "Authentication required"
+ *   - No user + checkable roles → 401 (authentication required)
  */
 @Injectable()
 export class CoreTenantGuard implements CanActivate, OnModuleDestroy {
@@ -216,8 +230,9 @@ export class CoreTenantGuard implements CanActivate, OnModuleDestroy {
 
     // Defense-in-depth: S_NO_ONE is normally caught by RolesGuard/BetterAuthRolesGuard upstream,
     // but guard it here too in case CoreTenantGuard runs standalone (e.g., custom guard chains).
+    // Always 403 — the same code the role guards return since v11.28.0.
     if (roles.includes(RoleEnum.S_NO_ONE)) {
-      throw new ForbiddenException('Access denied');
+      throw new ForbiddenException(ErrorCode.ACCESS_DENIED);
     }
 
     const sEveryoneGrantsAccess: boolean = systemCheckRoles.includes(RoleEnum.S_EVERYONE);
@@ -258,7 +273,7 @@ export class CoreTenantGuard implements CanActivate, OnModuleDestroy {
     const sUserGrantsAccess: boolean = systemCheckRoles.includes(RoleEnum.S_USER);
     if (sUserGrantsAccess) {
       if (!user) {
-        throw new ForbiddenException('Authentication required');
+        throw new UnauthorizedException(ErrorCode.UNAUTHORIZED);
       }
       if (headerTenantId && !hasSkipDecorator) {
         return this.handleSystemRoleWithTenantHeader(user, headerTenantId, request, isAdmin);
@@ -276,7 +291,7 @@ export class CoreTenantGuard implements CanActivate, OnModuleDestroy {
     const sVerifiedGrantsAccess: boolean = systemCheckRoles.includes(RoleEnum.S_VERIFIED);
     if (sVerifiedGrantsAccess) {
       if (!user) {
-        throw new ForbiddenException('Authentication required');
+        throw new UnauthorizedException(ErrorCode.UNAUTHORIZED);
       }
       const isVerified = !!(user.verified || user.verifiedAt || user.emailVerified);
       if (!isVerified) {
@@ -337,9 +352,9 @@ export class CoreTenantGuard implements CanActivate, OnModuleDestroy {
         return true;
       }
 
-      // No user + header → 403 (tenant access requires authentication)
+      // No user + header → 401 (tenant access requires authentication; re-auth is the remedy)
       if (!user) {
-        throw new ForbiddenException('Authentication required for tenant access');
+        throw new UnauthorizedException(ErrorCode.UNAUTHORIZED);
       }
 
       // Authenticated non-admin user: MUST be active member
@@ -375,9 +390,9 @@ export class CoreTenantGuard implements CanActivate, OnModuleDestroy {
 
     // Checkable roles present
     if (checkableRoles.length > 0) {
-      // No user + roles required → 403
+      // No user + roles required → 401 (re-auth is the remedy, so it must not be a 403)
       if (!user) {
-        throw new ForbiddenException('Authentication required');
+        throw new UnauthorizedException(ErrorCode.UNAUTHORIZED);
       }
 
       // Check role access against user.roles (hierarchy: level comparison, normal: exact match)
@@ -604,7 +619,7 @@ export class CoreTenantGuard implements CanActivate, OnModuleDestroy {
     if (checkableRoles.length > 0) {
       // Defense-in-depth: reject unauthenticated access even if RolesGuard is absent
       if (!user) {
-        throw new ForbiddenException('Authentication required');
+        throw new UnauthorizedException(ErrorCode.UNAUTHORIZED);
       }
       if (!isAdmin && !checkRoleAccess(checkableRoles, user.roles, undefined)) {
         throw new ForbiddenException('Insufficient role');

package/src/core/modules/tus/tus.constants.ts

@@ -0,0 +1,25 @@
+/**
+ * Dependency-injection tokens of the TUS module.
+ *
+ * They live in a dedicated, import-free leaf file — never in `tus.module.ts` or a service — so that
+ * no file needing a token has to import the module (or vice versa) and close an import cycle.
+ *
+ * On a cycle, a token read at MODULE-EVALUATION time — inside an `@Inject()` decorator argument, in
+ * `design:paramtypes` metadata, or in a static field initializer — reads a `const` still in its
+ * temporal dead zone, and SWC-compiled builds (`nest start -b swc`) die at startup with:
+ *
+ *   ReferenceError: Cannot access 'TUS_CONFIG' before initialization
+ *
+ * A file that imports nothing can never be mid-evaluation when someone imports it, in any module
+ * system, under any compiler. That is the whole point — keep it import-free.
+ *
+ * `tsc`, `pnpm test` and `oxlint` are all blind to a regression here; only `pnpm run check:swc-tdz`
+ * sees it. See .claude/rules/architecture.md → "DI Token Placement (SWC-Safe)".
+ */
+
+/**
+ * Token for injecting the resolved TUS configuration.
+ *
+ * Injected type: `Required<ITusConfig>`.
+ */
+export const TUS_CONFIG = 'TUS_CONFIG';

package/src/core/modules/tus/tus.module.ts

@@ -5,12 +5,17 @@ import { Connection } from 'mongoose';
 import { ITusConfig } from '../../common/interfaces/server-options.interface';
 import { CoreTusController } from './core-tus.controller';
 import { CoreTusService } from './core-tus.service';
+import { TUS_CONFIG } from './tus.constants';
 import { normalizeTusConfig } from './interfaces/tus-config.interface';
 
 /**
- * Token for injecting the TUS configuration
+ * @deprecated Import from `./tus.constants` instead. Re-exported only so existing deep imports keep
+ * working; the token is declared in an import-free leaf so module and services stay acyclic
+ * (SWC-safe — see tus.constants.ts).
+ *
+ * Do NOT import it from here inside the TUS module itself — that is what re-creates the cycle.
  */
-export const TUS_CONFIG = 'TUS_CONFIG';
+export { TUS_CONFIG } from './tus.constants';
 
 /**
  * Options for TusModule.forRoot()

package/src/index.ts

@@ -26,6 +26,7 @@ export * from './core/common/enums/logical-operator.enum';
 export * from './core/common/enums/process-type.enum';
 export * from './core/common/enums/role.enum';
 export * from './core/common/enums/sort-order.emum';
+export * from './core/common/exceptions/access-denied.exception';
 export * from './core/common/filters/http-exception-log.filter';
 export * from './core/common/helpers/common.helper';
 export * from './core/common/helpers/config.helper';

package/src/server/modules/user/user.service.ts

@@ -98,9 +98,10 @@ export class UserService extends CoreUserService<User, UserInput, UserCreateInpu
    */
   async setAvatar(file: Express.Multer.File, user: User): Promise<string> {
     const dbUser = await this.mainDbModel.findOne({ id: user.id }).exec();
-    // Check user
+    // Check user: the token is valid but the account no longer exists, so the session really is
+    // invalid — 401 is right here. (A permission error would have to be 403, see accessDeniedException.)
     if (!dbUser) {
-      throw new UnauthorizedException('User is not allowed to set the avatar');
+      throw new UnauthorizedException('User of the current session no longer exists');
     }
 
     // Check file