@lenne.tech/nest-server 11.32.4 → 11.33.1

package/dist/core/common/services/core-redis.service.js

@@ -0,0 +1,154 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var CoreRedisService_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CoreRedisService = void 0;
+const common_1 = require("@nestjs/common");
+const project_name_helper_1 = require("../helpers/project-name.helper");
+const config_service_1 = require("./config.service");
+let CoreRedisService = CoreRedisService_1 = class CoreRedisService {
+    configService;
+    logger = new common_1.Logger(CoreRedisService_1.name);
+    clients = [];
+    config;
+    RedisCtor;
+    sharedClient;
+    subscriberClient;
+    constructor(configService) {
+        this.configService = configService;
+        const raw = this.configService.getFastButReadOnly('redis');
+        if (raw === undefined || raw === null || raw === false) {
+            return;
+        }
+        const partial = typeof raw === 'boolean' ? {} : raw;
+        if (partial.enabled === false) {
+            return;
+        }
+        this.config = {
+            db: partial.db ?? 0,
+            host: partial.host ?? 'localhost',
+            keyPrefix: partial.keyPrefix ?? (0, project_name_helper_1.getProjectSlug)(),
+            options: partial.options,
+            password: partial.password,
+            port: partial.port ?? 6379,
+            url: partial.url,
+            username: partial.username,
+        };
+    }
+    get enabled() {
+        return !!this.config;
+    }
+    getConfig() {
+        return this.config;
+    }
+    key(...parts) {
+        return [this.config?.keyPrefix ?? (0, project_name_helper_1.getProjectSlug)(), ...parts].join(':');
+    }
+    async onModuleInit() {
+        if (!this.config) {
+            return;
+        }
+        try {
+            const mod = await Promise.resolve().then(() => require('ioredis'));
+            this.RedisCtor = mod.Redis ?? mod.default;
+        }
+        catch {
+            throw new Error('Redis is configured (ServerOptions.redis) but the optional peer dependency "ioredis" is not installed. ' +
+                'Run: pnpm add ioredis');
+        }
+        this.sharedClient = this.newConnection('shared');
+        this.logActivationSummary();
+    }
+    logActivationSummary() {
+        if (!this.config) {
+            return;
+        }
+        const cfg = this.configService.configFastButReadOnly ?? {};
+        const changed = [
+            'rate limits (legacy auth, better-auth, AI) — now exact across replicas instead of per replica',
+            'cron jobs — deduplicated fleet-wide; per-job opt-out via `distributed: false`',
+            'email-verification cooldown — one slot fleet-wide instead of one per replica',
+        ];
+        if (cfg.graphQl !== false) {
+            changed.push('GraphQL subscriptions — via Redis pub/sub; payloads must be JSON-serializable');
+        }
+        if (cfg.multiTenancy) {
+            changed.push('tenant-membership cache — invalidation is broadcast to every replica');
+        }
+        if (cfg.hub) {
+            changed.push('Hub log/trace/query buffers — mirrored to Redis, so they outlive the process');
+        }
+        if (cfg.ai?.mcp) {
+            changed.push('MCP sessions — ownership registry (sticky sessions still required)');
+        }
+        this.logger.log(`Redis configured (${this.config.url ? 'url' : `${this.config.host}:${this.config.port}`}, ` +
+            `db ${this.config.db}, keyPrefix "${this.config.keyPrefix}") — these subsystems are now ` +
+            `distributed:\n  - ${changed.join('\n  - ')}`);
+    }
+    getClient() {
+        if (!this.config) {
+            throw new Error('Redis is not configured/enabled (ServerOptions.redis)');
+        }
+        if (!this.sharedClient) {
+            throw new Error('CoreRedisService is not initialized yet (onModuleInit pending)');
+        }
+        return this.sharedClient;
+    }
+    getSubscriber() {
+        this.getClient();
+        if (!this.subscriberClient) {
+            this.subscriberClient = this.newConnection('subscriber');
+        }
+        return this.subscriberClient;
+    }
+    createClient(label = 'extra', overrides) {
+        this.getClient();
+        return this.newConnection(label, overrides);
+    }
+    async onApplicationShutdown() {
+        await Promise.allSettled(this.clients.map(async (client) => {
+            try {
+                await Promise.race([client.quit(), new Promise((resolve) => setTimeout(resolve, 2000).unref())]);
+            }
+            finally {
+                client.disconnect();
+            }
+        }));
+        this.clients = [];
+        this.sharedClient = undefined;
+        this.subscriberClient = undefined;
+    }
+    newConnection(label, overrides) {
+        if (!this.config || !this.RedisCtor) {
+            throw new Error('CoreRedisService is not initialized yet (onModuleInit pending)');
+        }
+        const { db, host, options, password, port, url, username } = this.config;
+        const baseOptions = {
+            commandTimeout: 2000,
+            ...options,
+            ...overrides,
+        };
+        const client = url
+            ? new this.RedisCtor(url, baseOptions)
+            : new this.RedisCtor({ db, host, password, port, username, ...baseOptions });
+        client.on?.('error', (error) => {
+            this.logger.error(`Redis connection error (${label}): ${error.message}`);
+        });
+        this.clients.push(client);
+        return client;
+    }
+};
+exports.CoreRedisService = CoreRedisService;
+exports.CoreRedisService = CoreRedisService = CoreRedisService_1 = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [config_service_1.ConfigService])
+], CoreRedisService);
+//# sourceMappingURL=core-redis.service.js.map

package/dist/core/common/services/core-redis.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"core-redis.service.js","sourceRoot":"","sources":["../../../../src/core/common/services/core-redis.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;AAAA,2CAAyF;AAEzF,wEAAgE;AAChE,qDAAiD;AAyB1C,IAAM,gBAAgB,wBAAtB,MAAM,gBAAgB;IAkBI;IAjBZ,MAAM,GAAG,IAAI,eAAM,CAAC,kBAAgB,CAAC,IAAI,CAAC,CAAC;IAGpD,OAAO,GAAY,EAAE,CAAC;IAGtB,MAAM,CAAyB;IAG/B,SAAS,CAAiC;IAG1C,YAAY,CAAS;IAGrB,gBAAgB,CAAS;IAEnC,YAA+B,aAA4B;QAA5B,kBAAa,GAAb,aAAa,CAAe;QACzD,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,CAAC,kBAAkB,CAAqC,OAAO,CAAC,CAAC;QAC/F,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,KAAK,EAAE,CAAC;YACvD,OAAO;QACT,CAAC;QACD,MAAM,OAAO,GAAiB,OAAO,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;QAClE,IAAI,OAAO,CAAC,OAAO,KAAK,KAAK,EAAE,CAAC;YAC9B,OAAO;QACT,CAAC;QACD,IAAI,CAAC,MAAM,GAAG;YACZ,EAAE,EAAE,OAAO,CAAC,EAAE,IAAI,CAAC;YACnB,IAAI,EAAE,OAAO,CAAC,IAAI,IAAI,WAAW;YAMjC,SAAS,EAAE,OAAO,CAAC,SAAS,IAAI,IAAA,oCAAc,GAAE;YAChD,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,IAAI,EAAE,OAAO,CAAC,IAAI,IAAI,IAAI;YAC1B,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,QAAQ,EAAE,OAAO,CAAC,QAAQ;SAC3B,CAAC;IACJ,CAAC;IAKD,IAAI,OAAO;QACT,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC;IACvB,CAAC;IAKD,SAAS;QACP,OAAO,IAAI,CAAC,MAAM,CAAC;IACrB,CAAC;IAQD,GAAG,CAAC,GAAG,KAAe;QACpB,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,IAAI,IAAA,oCAAc,GAAE,EAAE,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC1E,CAAC;IAMD,KAAK,CAAC,YAAY;QAChB,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YACjB,OAAO;QACT,CAAC;QACD,IAAI,CAAC;YACH,MAAM,GAAG,GAAQ,2CAAa,SAAS,EAAC,CAAC;YACzC,IAAI,CAAC,SAAS,GAAG,GAAG,CAAC,KAAK,IAAI,GAAG,CAAC,OAAO,CAAC;QAC5C,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,KAAK,CACb,yGAAyG;gBACvG,uBAAuB,CAC1B,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;QACjD,IAAI,CAAC,oBAAoB,EAAE,CAAC;IAC9B,CAAC;IAgBS,oBAAoB;QAC5B,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YACjB,OAAO;QACT,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,CAAC,qBAAqB,IAAK,EAA0B,CAAC;QACpF,MAAM,OAAO,GAAa;YACxB,+FAA+F;YAC/F,+EAA+E;YAC/E,8EAA8E;SAC/E,CAAC;QAEF,IAAI,GAAG,CAAC,OAAO,KAAK,KAAK,EAAE,CAAC;YAC1B,OAAO,CAAC,IAAI,CAAC,+EAA+E,CAAC,CAAC;QAChG,CAAC;QACD,IAAI,GAAG,CAAC,YAAY,EAAE,CAAC;YACrB,OAAO,CAAC,IAAI,CAAC,sEAAsE,CAAC,CAAC;QACvF,CAAC;QACD,IAAI,GAAG,CAAC,GAAG,EAAE,CAAC;YACZ,OAAO,CAAC,IAAI,CAAC,8EAA8E,CAAC,CAAC;QAC/F,CAAC;QACD,IAAI,GAAG,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC;YAChB,OAAO,CAAC,IAAI,CAAC,oEAAoE,CAAC,CAAC;QACrF,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,GAAG,CACb,qBAAqB,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI;YAC1F,MAAM,IAAI,CAAC,MAAM,CAAC,EAAE,gBAAgB,IAAI,CAAC,MAAM,CAAC,SAAS,gCAAgC;YACzF,qBAAqB,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAChD,CAAC;IACJ,CAAC;IAMD,SAAS;QACP,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;QAC3E,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CAAC,gEAAgE,CAAC,CAAC;QACpF,CAAC;QACD,OAAO,IAAI,CAAC,YAAY,CAAC;IAC3B,CAAC;IAMD,aAAa;QACX,IAAI,CAAC,SAAS,EAAE,CAAC;QACjB,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,CAAC;YAC3B,IAAI,CAAC,gBAAgB,GAAG,IAAI,CAAC,aAAa,CAAC,YAAY,CAAC,CAAC;QAC3D,CAAC;QACD,OAAO,IAAI,CAAC,gBAAgB,CAAC;IAC/B,CAAC;IAMD,YAAY,CAAC,KAAK,GAAG,OAAO,EAAE,SAAwB;QACpD,IAAI,CAAC,SAAS,EAAE,CAAC;QACjB,OAAO,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;IAC9C,CAAC;IAKD,KAAK,CAAC,qBAAqB;QACzB,MAAM,OAAO,CAAC,UAAU,CACtB,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE;YAChC,IAAI,CAAC;gBAIH,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;YACnG,CAAC;oBAAS,CAAC;gBACT,MAAM,CAAC,UAAU,EAAE,CAAC;YACtB,CAAC;QACH,CAAC,CAAC,CACH,CAAC;QACF,IAAI,CAAC,OAAO,GAAG,EAAE,CAAC;QAClB,IAAI,CAAC,YAAY,GAAG,SAAS,CAAC;QAC9B,IAAI,CAAC,gBAAgB,GAAG,SAAS,CAAC;IACpC,CAAC;IAKS,aAAa,CAAC,KAAa,EAAE,SAAwB;QAC7D,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;YACpC,MAAM,IAAI,KAAK,CAAC,gEAAgE,CAAC,CAAC;QACpF,CAAC;QACD,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC;QACzE,MAAM,WAAW,GAAiB;YAKhC,cAAc,EAAE,IAAI;YACpB,GAAI,OAAwB;YAI5B,GAAG,SAAS;SACb,CAAC;QACF,MAAM,MAAM,GAAG,GAAG;YAChB,CAAC,CAAC,IAAI,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,WAAW,CAAC;YACtC,CAAC,CAAC,IAAI,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,WAAW,EAAE,CAAC,CAAC;QAC/E,MAAM,CAAC,EAAE,EAAE,CAAC,OAAO,EAAE,CAAC,KAAY,EAAE,EAAE;YACpC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,2BAA2B,KAAK,MAAM,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QAC3E,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC1B,OAAO,MAAM,CAAC;IAChB,CAAC;CACF,CAAA;AA5NY,4CAAgB;2BAAhB,gBAAgB;IAD5B,IAAA,mBAAU,GAAE;qCAmBmC,8BAAa;GAlBhD,gBAAgB,CA4N5B"}

package/dist/core/common/services/core-s3.service.d.ts

@@ -0,0 +1,51 @@
+import { Logger, OnApplicationShutdown, OnModuleInit } from '@nestjs/common';
+import { ConfigService } from './config.service';
+import type { IS3Config } from '../interfaces/server-options.interface';
+import type { S3Client } from '@aws-sdk/client-s3';
+import type { Readable } from 'stream';
+export type NormalizedS3Config = Omit<IS3Config, 'enabled' | 'presignedDownloads'> & {
+    bucket: string;
+    forcePathStyle: boolean;
+    presignedDownloads?: {
+        expiresInSeconds: number;
+    };
+    region: string;
+    stagingBucket: string;
+};
+export declare class CoreS3Service implements OnApplicationShutdown, OnModuleInit {
+    protected readonly configService: ConfigService;
+    protected readonly logger: Logger;
+    protected config?: NormalizedS3Config;
+    protected client?: S3Client;
+    protected sdk?: typeof import('@aws-sdk/client-s3');
+    protected presigner?: typeof import('@aws-sdk/s3-request-presigner');
+    constructor(configService: ConfigService);
+    protected clampPresignedExpiry(seconds: number): number;
+    get enabled(): boolean;
+    getConfig(): NormalizedS3Config | undefined;
+    onModuleInit(): Promise<void>;
+    protected verifyBuckets(): Promise<void>;
+    protected bucketExists(bucket: string): Promise<boolean>;
+    getClient(): S3Client;
+    putObject(key: string, body: Buffer | Readable | string, contentType?: string, contentLength?: number): Promise<void>;
+    copyObject(sourceKey: string, destinationKey: string, sourceBucket?: string, contentType?: string): Promise<void>;
+    static readonly MAX_COPY_OBJECT_BYTES: number;
+    protected copySource(bucket: string, key: string): string;
+    protected isStream(body: unknown): body is Readable;
+    protected collect(stream: Readable): Promise<Buffer>;
+    getObject(key: string): Promise<{
+        body: Readable;
+        contentLength?: number;
+        contentType?: string;
+    }>;
+    deleteObject(key: string, bucket?: string): Promise<void>;
+    objectExists(key: string): Promise<boolean>;
+    getPresignedDownloadUrl(key: string, filename?: string): Promise<string | undefined>;
+    ensureBucket(bucket: string): Promise<void>;
+    onApplicationShutdown(): Promise<void>;
+    protected requireInit(): {
+        client: S3Client;
+        config: NormalizedS3Config;
+        sdk: typeof import('@aws-sdk/client-s3');
+    };
+}

package/dist/core/common/services/core-s3.service.js

@@ -0,0 +1,261 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var CoreS3Service_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CoreS3Service = void 0;
+const common_1 = require("@nestjs/common");
+const content_disposition_helper_1 = require("../helpers/content-disposition.helper");
+const config_service_1 = require("./config.service");
+const MAX_PRESIGNED_EXPIRY_SECONDS = 604_800;
+const PRESIGNED_EXPIRY_ADVISORY_SECONDS = 900;
+let CoreS3Service = class CoreS3Service {
+    static { CoreS3Service_1 = this; }
+    configService;
+    logger = new common_1.Logger(CoreS3Service_1.name);
+    config;
+    client;
+    sdk;
+    presigner;
+    constructor(configService) {
+        this.configService = configService;
+        const raw = this.configService.getFastButReadOnly('s3');
+        if (!raw || raw.enabled === false) {
+            return;
+        }
+        if (!raw.bucket) {
+            this.logger.warn('Ignoring the `s3` configuration: no `bucket` is set, so S3 cannot be used.');
+            return;
+        }
+        const presigned = raw.presignedDownloads;
+        this.config = {
+            accessKeyId: raw.accessKeyId,
+            autoCreateBucket: raw.autoCreateBucket ?? false,
+            bucket: raw.bucket,
+            endpoint: raw.endpoint,
+            forcePathStyle: raw.forcePathStyle ?? false,
+            presignedDownloads: presigned
+                ? {
+                    expiresInSeconds: this.clampPresignedExpiry((typeof presigned === 'object' ? presigned.expiresInSeconds : undefined) ?? 300),
+                }
+                : undefined,
+            region: raw.region ?? 'us-east-1',
+            secretAccessKey: raw.secretAccessKey,
+            stagingBucket: raw.stagingBucket ?? raw.bucket,
+        };
+    }
+    clampPresignedExpiry(seconds) {
+        if (!Number.isFinite(seconds) || seconds <= 0) {
+            this.logger.warn(`s3.presignedDownloads.expiresInSeconds is "${seconds}", which is not a positive number — using 300s.`);
+            return 300;
+        }
+        if (seconds > MAX_PRESIGNED_EXPIRY_SECONDS) {
+            this.logger.warn(`s3.presignedDownloads.expiresInSeconds is ${seconds}s, above the ${MAX_PRESIGNED_EXPIRY_SECONDS}s AWS SigV4 ` +
+                'maximum — capping it, since a longer signature is rejected by S3 rather than honored.');
+            return MAX_PRESIGNED_EXPIRY_SECONDS;
+        }
+        if (seconds > PRESIGNED_EXPIRY_ADVISORY_SECONDS) {
+            this.logger.warn(`s3.presignedDownloads.expiresInSeconds is ${seconds}s. A presigned URL is an unrevocable bearer capability ` +
+                'authorized once at issue time — keep it just long enough for the download to start (a few minutes), not ' +
+                'long enough for the link to be forwarded, logged and reused.');
+        }
+        return seconds;
+    }
+    get enabled() {
+        return !!this.config;
+    }
+    getConfig() {
+        return this.config;
+    }
+    async onModuleInit() {
+        if (!this.config) {
+            return;
+        }
+        try {
+            this.sdk = await Promise.resolve().then(() => require('@aws-sdk/client-s3'));
+        }
+        catch {
+            throw new Error('S3 is configured (ServerOptions.s3) but the optional peer dependency "@aws-sdk/client-s3" is not installed. ' +
+                'Run: pnpm add @aws-sdk/client-s3');
+        }
+        const { accessKeyId, endpoint, forcePathStyle, region, secretAccessKey } = this.config;
+        this.client = new this.sdk.S3Client({
+            ...(endpoint ? { endpoint } : {}),
+            forcePathStyle,
+            region,
+            ...(accessKeyId && secretAccessKey ? { credentials: { accessKeyId, secretAccessKey } } : {}),
+        });
+        await this.verifyBuckets();
+    }
+    async verifyBuckets() {
+        const buckets = [...new Set([this.config.bucket, this.config.stagingBucket])];
+        for (const bucket of buckets) {
+            try {
+                if (await this.bucketExists(bucket)) {
+                    continue;
+                }
+                if (this.config.autoCreateBucket) {
+                    await this.ensureBucket(bucket);
+                    this.logger.log(`Created S3 bucket "${bucket}" (s3.autoCreateBucket is on)`);
+                    continue;
+                }
+                this.logger.error(`S3 bucket "${bucket}" does not exist. Every upload will fail until it is created. ` +
+                    'Create it in your object storage, or set s3.autoCreateBucket: true to have the server create it.');
+            }
+            catch (error) {
+                this.logger.error(`Could not verify S3 bucket "${bucket}": ${error instanceof Error ? error.message : 'Unknown error'}`);
+            }
+        }
+    }
+    async bucketExists(bucket) {
+        const { client, sdk } = this.requireInit();
+        try {
+            await client.send(new sdk.HeadBucketCommand({ Bucket: bucket }));
+            return true;
+        }
+        catch (error) {
+            const status = error?.$metadata?.httpStatusCode;
+            if (status === 404 || error?.name === 'NotFound' || error?.name === 'NoSuchBucket') {
+                return false;
+            }
+            throw error;
+        }
+    }
+    getClient() {
+        if (!this.config) {
+            throw new Error('S3 is not configured/enabled (ServerOptions.s3)');
+        }
+        if (!this.client || !this.sdk) {
+            throw new Error('CoreS3Service is not initialized yet (onModuleInit pending)');
+        }
+        return this.client;
+    }
+    async putObject(key, body, contentType, contentLength) {
+        const { client, config, sdk } = this.requireInit();
+        let payload = body;
+        let length = contentLength;
+        if (this.isStream(body) && length === undefined) {
+            payload = await this.collect(body);
+            length = payload.length;
+        }
+        else if (length === undefined && typeof body !== 'string') {
+            length = body.length;
+        }
+        await client.send(new sdk.PutObjectCommand({
+            Body: payload,
+            Bucket: config.bucket,
+            ...(contentType ? { ContentType: contentType } : {}),
+            ...(length === undefined ? {} : { ContentLength: length }),
+            Key: key,
+        }));
+    }
+    async copyObject(sourceKey, destinationKey, sourceBucket, contentType) {
+        const { client, config, sdk } = this.requireInit();
+        await client.send(new sdk.CopyObjectCommand({
+            Bucket: config.bucket,
+            CopySource: this.copySource(sourceBucket ?? config.bucket, sourceKey),
+            Key: destinationKey,
+            ...(contentType ? { ContentType: contentType, MetadataDirective: 'REPLACE' } : {}),
+        }));
+    }
+    static MAX_COPY_OBJECT_BYTES = 5 * 1024 * 1024 * 1024;
+    copySource(bucket, key) {
+        const encoded = key
+            .split('/')
+            .map((segment) => encodeURIComponent(segment))
+            .join('/');
+        return `/${encodeURIComponent(bucket)}/${encoded}`;
+    }
+    isStream(body) {
+        return !!body && typeof body.pipe === 'function';
+    }
+    async collect(stream) {
+        const chunks = [];
+        for await (const chunk of stream) {
+            chunks.push(Buffer.from(chunk));
+        }
+        return Buffer.concat(chunks);
+    }
+    async getObject(key) {
+        const { client, config, sdk } = this.requireInit();
+        const result = await client.send(new sdk.GetObjectCommand({ Bucket: config.bucket, Key: key }));
+        return {
+            body: result.Body,
+            contentLength: result.ContentLength,
+            contentType: result.ContentType,
+        };
+    }
+    async deleteObject(key, bucket) {
+        const { client, config, sdk } = this.requireInit();
+        await client.send(new sdk.DeleteObjectCommand({ Bucket: bucket ?? config.bucket, Key: key }));
+    }
+    async objectExists(key) {
+        const { client, config, sdk } = this.requireInit();
+        try {
+            await client.send(new sdk.HeadObjectCommand({ Bucket: config.bucket, Key: key }));
+            return true;
+        }
+        catch (error) {
+            if (error?.$metadata?.httpStatusCode === 404 || error?.name === 'NotFound') {
+                return false;
+            }
+            throw error;
+        }
+    }
+    async getPresignedDownloadUrl(key, filename) {
+        const { client, config, sdk } = this.requireInit();
+        if (!config.presignedDownloads) {
+            return undefined;
+        }
+        if (!this.presigner) {
+            try {
+                this.presigner = await Promise.resolve().then(() => require('@aws-sdk/s3-request-presigner'));
+            }
+            catch {
+                throw new Error('s3.presignedDownloads is enabled but the optional peer dependency "@aws-sdk/s3-request-presigner" is not installed. ' +
+                    'Run: pnpm add @aws-sdk/s3-request-presigner');
+            }
+        }
+        const command = new sdk.GetObjectCommand({
+            Bucket: config.bucket,
+            Key: key,
+            ...(filename ? { ResponseContentDisposition: (0, content_disposition_helper_1.buildContentDisposition)(filename) } : {}),
+        });
+        return this.presigner.getSignedUrl(client, command, { expiresIn: config.presignedDownloads.expiresInSeconds });
+    }
+    async ensureBucket(bucket) {
+        const { client, sdk } = this.requireInit();
+        try {
+            await client.send(new sdk.HeadBucketCommand({ Bucket: bucket }));
+        }
+        catch {
+            await client.send(new sdk.CreateBucketCommand({ Bucket: bucket }));
+        }
+    }
+    async onApplicationShutdown() {
+        this.client?.destroy();
+        this.client = undefined;
+    }
+    requireInit() {
+        if (!this.config) {
+            throw new Error('S3 is not configured/enabled (ServerOptions.s3)');
+        }
+        if (!this.client || !this.sdk) {
+            throw new Error('CoreS3Service is not initialized yet (onModuleInit pending)');
+        }
+        return { client: this.client, config: this.config, sdk: this.sdk };
+    }
+};
+exports.CoreS3Service = CoreS3Service;
+exports.CoreS3Service = CoreS3Service = CoreS3Service_1 = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [config_service_1.ConfigService])
+], CoreS3Service);
+//# sourceMappingURL=core-s3.service.js.map

package/dist/core/common/services/core-s3.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"core-s3.service.js","sourceRoot":"","sources":["../../../../src/core/common/services/core-s3.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;AAAA,2CAAyF;AAEzF,sFAAgF;AAChF,qDAAiD;AAYjD,MAAM,4BAA4B,GAAG,OAAO,CAAC;AAY7C,MAAM,iCAAiC,GAAG,GAAG,CAAC;AA2BvC,IAAM,aAAa,GAAnB,MAAM,aAAa;;IAqBO;IApBZ,MAAM,GAAG,IAAI,eAAM,CAAC,eAAa,CAAC,IAAI,CAAC,CAAC;IAGjD,MAAM,CAAsB;IAG5B,MAAM,CAAY;IAGlB,GAAG,CAAuC;IAS1C,SAAS,CAAkD;IAErE,YAA+B,aAA4B;QAA5B,kBAAa,GAAb,aAAa,CAAe;QACzD,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,CAAC,kBAAkB,CAAwB,IAAI,CAAC,CAAC;QAC/E,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,KAAK,KAAK,EAAE,CAAC;YAClC,OAAO;QACT,CAAC;QAUD,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC;YAChB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,4EAA4E,CAAC,CAAC;YAC/F,OAAO;QACT,CAAC;QACD,MAAM,SAAS,GAAG,GAAG,CAAC,kBAAkB,CAAC;QACzC,IAAI,CAAC,MAAM,GAAG;YACZ,WAAW,EAAE,GAAG,CAAC,WAAW;YAC5B,gBAAgB,EAAE,GAAG,CAAC,gBAAgB,IAAI,KAAK;YAC/C,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,QAAQ,EAAE,GAAG,CAAC,QAAQ;YACtB,cAAc,EAAE,GAAG,CAAC,cAAc,IAAI,KAAK;YAC3C,kBAAkB,EAAE,SAAS;gBAC3B,CAAC,CAAC;oBACE,gBAAgB,EAAE,IAAI,CAAC,oBAAoB,CACzC,CAAC,OAAO,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,gBAAgB,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,GAAG,CAChF;iBACF;gBACH,CAAC,CAAC,SAAS;YACb,MAAM,EAAE,GAAG,CAAC,MAAM,IAAI,WAAW;YACjC,eAAe,EAAE,GAAG,CAAC,eAAe;YACpC,aAAa,EAAE,GAAG,CAAC,aAAa,IAAI,GAAG,CAAC,MAAM;SAC/C,CAAC;IACJ,CAAC;IAQS,oBAAoB,CAAC,OAAe;QAC5C,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,OAAO,IAAI,CAAC,EAAE,CAAC;YAC9C,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,8CAA8C,OAAO,iDAAiD,CACvG,CAAC;YACF,OAAO,GAAG,CAAC;QACb,CAAC;QACD,IAAI,OAAO,GAAG,4BAA4B,EAAE,CAAC;YAC3C,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,6CAA6C,OAAO,gBAAgB,4BAA4B,cAAc;gBAC5G,uFAAuF,CAC1F,CAAC;YACF,OAAO,4BAA4B,CAAC;QACtC,CAAC;QACD,IAAI,OAAO,GAAG,iCAAiC,EAAE,CAAC;YAChD,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,6CAA6C,OAAO,yDAAyD;gBAC3G,0GAA0G;gBAC1G,8DAA8D,CACjE,CAAC;QACJ,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAKD,IAAI,OAAO;QACT,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC;IACvB,CAAC;IAKD,SAAS;QACP,OAAO,IAAI,CAAC,MAAM,CAAC;IACrB,CAAC;IAMD,KAAK,CAAC,YAAY;QAChB,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YACjB,OAAO;QACT,CAAC;QACD,IAAI,CAAC;YACH,IAAI,CAAC,GAAG,GAAG,2CAAa,oBAAoB,EAAC,CAAC;QAChD,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,KAAK,CACb,8GAA8G;gBAC5G,kCAAkC,CACrC,CAAC;QACJ,CAAC;QACD,MAAM,EAAE,WAAW,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,EAAE,eAAe,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC;QACvF,IAAI,CAAC,MAAM,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC;YAClC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACjC,cAAc;YACd,MAAM;YAEN,GAAG,CAAC,WAAW,IAAI,eAAe,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,EAAE,WAAW,EAAE,eAAe,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC7F,CAAC,CAAC;QAEH,MAAM,IAAI,CAAC,aAAa,EAAE,CAAC;IAC7B,CAAC;IAeS,KAAK,CAAC,aAAa;QAC3B,MAAM,OAAO,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC;QAC9E,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC7B,IAAI,CAAC;gBACH,IAAI,MAAM,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,EAAE,CAAC;oBACpC,SAAS;gBACX,CAAC;gBACD,IAAI,IAAI,CAAC,MAAM,CAAC,gBAAgB,EAAE,CAAC;oBACjC,MAAM,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;oBAChC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,sBAAsB,MAAM,+BAA+B,CAAC,CAAC;oBAC7E,SAAS;gBACX,CAAC;gBACD,IAAI,CAAC,MAAM,CAAC,KAAK,CACf,cAAc,MAAM,gEAAgE;oBAClF,kGAAkG,CACrG,CAAC;YACJ,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,CAAC,MAAM,CAAC,KAAK,CACf,+BAA+B,MAAM,MAAM,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,EAAE,CACtG,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAKS,KAAK,CAAC,YAAY,CAAC,MAAc;QACzC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;QAC3C,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,iBAAiB,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;YACjE,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,KAAU,EAAE,CAAC;YACpB,MAAM,MAAM,GAAG,KAAK,EAAE,SAAS,EAAE,cAAc,CAAC;YAChD,IAAI,MAAM,KAAK,GAAG,IAAI,KAAK,EAAE,IAAI,KAAK,UAAU,IAAI,KAAK,EAAE,IAAI,KAAK,cAAc,EAAE,CAAC;gBACnF,OAAO,KAAK,CAAC;YACf,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAMD,SAAS;QACP,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;QACrE,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;YAC9B,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAC;QACjF,CAAC;QACD,OAAO,IAAI,CAAC,MAAM,CAAC;IACrB,CAAC;IAUD,KAAK,CAAC,SAAS,CACb,GAAW,EACX,IAAgC,EAChC,WAAoB,EACpB,aAAsB;QAEtB,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;QAEnD,IAAI,OAAO,GAA+B,IAAI,CAAC;QAC/C,IAAI,MAAM,GAAG,aAAa,CAAC;QAC3B,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YAChD,OAAO,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YACnC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAC1B,CAAC;aAAM,IAAI,MAAM,KAAK,SAAS,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC5D,MAAM,GAAI,IAAe,CAAC,MAAM,CAAC;QACnC,CAAC;QAED,MAAM,MAAM,CAAC,IAAI,CACf,IAAI,GAAG,CAAC,gBAAgB,CAAC;YACvB,IAAI,EAAE,OAAO;YACb,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACpD,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,MAAM,EAAE,CAAC;YAC1D,GAAG,EAAE,GAAG;SACT,CAAC,CACH,CAAC;IACJ,CAAC;IAoBD,KAAK,CAAC,UAAU,CAAC,SAAiB,EAAE,cAAsB,EAAE,YAAqB,EAAE,WAAoB;QACrG,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;QACnD,MAAM,MAAM,CAAC,IAAI,CACf,IAAI,GAAG,CAAC,iBAAiB,CAAC;YACxB,MAAM,EAAE,MAAM,CAAC,MAAM;YAGrB,UAAU,EAAE,IAAI,CAAC,UAAU,CAAC,YAAY,IAAI,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC;YACrE,GAAG,EAAE,cAAc;YAGnB,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,WAAW,EAAE,iBAAiB,EAAE,SAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC5F,CAAC,CACH,CAAC;IACJ,CAAC;IAMD,MAAM,CAAU,qBAAqB,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,GAAG,IAAI,CAAC;IAKrD,UAAU,CAAC,MAAc,EAAE,GAAW;QAC9C,MAAM,OAAO,GAAG,GAAG;aAChB,KAAK,CAAC,GAAG,CAAC;aACV,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC;aAC7C,IAAI,CAAC,GAAG,CAAC,CAAC;QACb,OAAO,IAAI,kBAAkB,CAAC,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;IACrD,CAAC;IAKS,QAAQ,CAAC,IAAa;QAC9B,OAAO,CAAC,CAAC,IAAI,IAAI,OAAQ,IAAiB,CAAC,IAAI,KAAK,UAAU,CAAC;IACjE,CAAC;IAKS,KAAK,CAAC,OAAO,CAAC,MAAgB;QACtC,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YACjC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;QAClC,CAAC;QACD,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC/B,CAAC;IAMD,KAAK,CAAC,SAAS,CAAC,GAAW;QACzB,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;QACnD,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,gBAAgB,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;QAChG,OAAO;YACL,IAAI,EAAE,MAAM,CAAC,IAAgB;YAC7B,aAAa,EAAE,MAAM,CAAC,aAAa;YACnC,WAAW,EAAE,MAAM,CAAC,WAAW;SAChC,CAAC;IACJ,CAAC;IAMD,KAAK,CAAC,YAAY,CAAC,GAAW,EAAE,MAAe;QAC7C,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;QACnD,MAAM,MAAM,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,mBAAmB,CAAC,EAAE,MAAM,EAAE,MAAM,IAAI,MAAM,CAAC,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;IAChG,CAAC;IAKD,KAAK,CAAC,YAAY,CAAC,GAAW;QAC5B,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;QACnD,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,iBAAiB,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;YAClF,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,KAAU,EAAE,CAAC;YACpB,IAAI,KAAK,EAAE,SAAS,EAAE,cAAc,KAAK,GAAG,IAAI,KAAK,EAAE,IAAI,KAAK,UAAU,EAAE,CAAC;gBAC3E,OAAO,KAAK,CAAC;YACf,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAOD,KAAK,CAAC,uBAAuB,CAAC,GAAW,EAAE,QAAiB;QAC1D,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;QACnD,IAAI,CAAC,MAAM,CAAC,kBAAkB,EAAE,CAAC;YAC/B,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;YACpB,IAAI,CAAC;gBACH,IAAI,CAAC,SAAS,GAAG,2CAAa,+BAA+B,EAAC,CAAC;YACjE,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,IAAI,KAAK,CACb,sHAAsH;oBACpH,6CAA6C,CAChD,CAAC;YACJ,CAAC;QACH,CAAC;QACD,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,gBAAgB,CAAC;YACvC,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,GAAG,EAAE,GAAG;YAOR,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,0BAA0B,EAAE,IAAA,oDAAuB,EAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACvF,CAAC,CAAC;QACH,OAAO,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,MAAM,EAAE,OAAO,EAAE,EAAE,SAAS,EAAE,MAAM,CAAC,kBAAkB,CAAC,gBAAgB,EAAE,CAAC,CAAC;IACjH,CAAC;IAMD,KAAK,CAAC,YAAY,CAAC,MAAc;QAC/B,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;QAC3C,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,iBAAiB,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;QACnE,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,MAAM,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,mBAAmB,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;QACrE,CAAC;IACH,CAAC;IAKD,KAAK,CAAC,qBAAqB;QACzB,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC;QACvB,IAAI,CAAC,MAAM,GAAG,SAAS,CAAC;IAC1B,CAAC;IAKS,WAAW;QACnB,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;QACrE,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;YAC9B,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAC;QACjF,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC;IACrE,CAAC;;AAzZU,sCAAa;wBAAb,aAAa;IADzB,IAAA,mBAAU,GAAE;qCAsBmC,8BAAa;GArBhD,aAAa,CA0ZzB"}

package/dist/core/common/services/core-trust-proxy.initializer.d.ts

@@ -0,0 +1,16 @@
+import { Logger, OnApplicationBootstrap, OnModuleInit } from '@nestjs/common';
+import { HttpAdapterHost } from '@nestjs/core';
+import { IServerOptions } from '../interfaces/server-options.interface';
+export declare class CoreTrustProxyInitializer implements OnApplicationBootstrap, OnModuleInit {
+    protected readonly httpAdapterHost?: HttpAdapterHost;
+    protected readonly logger: Logger;
+    constructor(httpAdapterHost?: HttpAdapterHost);
+    onModuleInit(): void;
+    onApplicationBootstrap(): void;
+    protected enabledIpRateLimiters(): string[];
+    protected getConfigured(): IServerOptions['trustProxy'];
+    protected getExpressApp(): undefined | {
+        get: (name: string) => any;
+        set: (name: string, value: any) => void;
+    };
+}

package/dist/core/common/services/core-trust-proxy.initializer.js

@@ -0,0 +1,77 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+var CoreTrustProxyInitializer_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CoreTrustProxyInitializer = void 0;
+const common_1 = require("@nestjs/common");
+const core_1 = require("@nestjs/core");
+const config_service_1 = require("./config.service");
+const TRUST_PROXY = 'trust proxy';
+let CoreTrustProxyInitializer = CoreTrustProxyInitializer_1 = class CoreTrustProxyInitializer {
+    httpAdapterHost;
+    logger = new common_1.Logger(CoreTrustProxyInitializer_1.name);
+    constructor(httpAdapterHost) {
+        this.httpAdapterHost = httpAdapterHost;
+    }
+    onModuleInit() {
+        const configured = this.getConfigured();
+        if (configured === undefined) {
+            return;
+        }
+        const app = this.getExpressApp();
+        if (!app) {
+            return;
+        }
+        app.set(TRUST_PROXY, configured);
+        this.logger.log(`Express "trust proxy" set to ${JSON.stringify(configured)} — request.ip follows X-Forwarded-For accordingly`);
+    }
+    onApplicationBootstrap() {
+        const limiters = this.enabledIpRateLimiters();
+        if (this.getConfigured() !== undefined || !limiters.length) {
+            return;
+        }
+        const app = this.getExpressApp();
+        if (!app || app.get(TRUST_PROXY)) {
+            return;
+        }
+        this.logger.warn(`Rate limiting is enabled (${limiters.join(', ')}) but Express "trust proxy" is not set. ` +
+            'Behind a reverse proxy (Caddy, nginx, a Kubernetes ingress) request.ip is then the PROXY address for every ' +
+            'request, so every client behind a reverse proxy shares one bucket and the limit throttles all of them at ' +
+            'once. Set `trustProxy` in your server options to the number of proxy hops in front of this app ' +
+            '(e.g. `trustProxy: 1`), or `trustProxy: false` if nothing proxies it — which also silences this warning.');
+    }
+    enabledIpRateLimiters() {
+        return ['auth.rateLimit', 'betterAuth.rateLimit'].filter((path) => {
+            const config = config_service_1.ConfigService.getFastButReadOnly(path);
+            if (config === undefined || config === null || config === false) {
+                return false;
+            }
+            return typeof config === 'boolean' ? config : config.enabled !== false;
+        });
+    }
+    getConfigured() {
+        return config_service_1.ConfigService.getFastButReadOnly('trustProxy');
+    }
+    getExpressApp() {
+        const instance = this.httpAdapterHost?.httpAdapter?.getInstance?.();
+        return typeof instance?.set === 'function' && typeof instance?.get === 'function' ? instance : undefined;
+    }
+};
+exports.CoreTrustProxyInitializer = CoreTrustProxyInitializer;
+exports.CoreTrustProxyInitializer = CoreTrustProxyInitializer = CoreTrustProxyInitializer_1 = __decorate([
+    (0, common_1.Injectable)(),
+    __param(0, (0, common_1.Optional)()),
+    __metadata("design:paramtypes", [core_1.HttpAdapterHost])
+], CoreTrustProxyInitializer);
+//# sourceMappingURL=core-trust-proxy.initializer.js.map

package/dist/core/common/services/core-trust-proxy.initializer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"core-trust-proxy.initializer.js","sourceRoot":"","sources":["../../../../src/core/common/services/core-trust-proxy.initializer.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,2CAAoG;AACpG,uCAA+C;AAG/C,qDAAiD;AAGjD,MAAM,WAAW,GAAG,aAAa,CAAC;AAe3B,IAAM,yBAAyB,iCAA/B,MAAM,yBAAyB;IAGO;IAFxB,MAAM,GAAG,IAAI,eAAM,CAAC,2BAAyB,CAAC,IAAI,CAAC,CAAC;IAEvE,YAA2C,eAAiC;QAAjC,oBAAe,GAAf,eAAe,CAAkB;IAAG,CAAC;IAShF,YAAY;QACV,MAAM,UAAU,GAAG,IAAI,CAAC,aAAa,EAAE,CAAC;QACxC,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;YAC7B,OAAO;QACT,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,EAAE,CAAC;QACjC,IAAI,CAAC,GAAG,EAAE,CAAC;YAGT,OAAO;QACT,CAAC;QAED,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC;QACjC,IAAI,CAAC,MAAM,CAAC,GAAG,CACb,gCAAgC,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,mDAAmD,CAC9G,CAAC;IACJ,CAAC;IAaD,sBAAsB;QACpB,MAAM,QAAQ,GAAG,IAAI,CAAC,qBAAqB,EAAE,CAAC;QAC9C,IAAI,IAAI,CAAC,aAAa,EAAE,KAAK,SAAS,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;YAC3D,OAAO;QACT,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,EAAE,CAAC;QACjC,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;YACjC,OAAO;QACT,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,6BAA6B,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,0CAA0C;YACxF,6GAA6G;YAC7G,2GAA2G;YAC3G,iGAAiG;YACjG,0GAA0G,CAC7G,CAAC;IACJ,CAAC;IASS,qBAAqB;QAC7B,OAAQ,CAAC,gBAAgB,EAAE,sBAAsB,CAAW,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE;YAC3E,MAAM,MAAM,GAAG,8BAAa,CAAC,kBAAkB,CAAkC,IAAI,CAAC,CAAC;YACvF,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,IAAI,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;gBAChE,OAAO,KAAK,CAAC;YACf,CAAC;YACD,OAAO,OAAO,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,KAAK,KAAK,CAAC;QACzE,CAAC,CAAC,CAAC;IACL,CAAC;IAGS,aAAa;QACrB,OAAO,8BAAa,CAAC,kBAAkB,CAA+B,YAAY,CAAC,CAAC;IACtF,CAAC;IAGS,aAAa;QACrB,MAAM,QAAQ,GAAG,IAAI,CAAC,eAAe,EAAE,WAAW,EAAE,WAAW,EAAE,EAAE,CAAC;QACpE,OAAO,OAAO,QAAQ,EAAE,GAAG,KAAK,UAAU,IAAI,OAAO,QAAQ,EAAE,GAAG,KAAK,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;IAC3G,CAAC;CACF,CAAA;AAzFY,8DAAyB;oCAAzB,yBAAyB;IADrC,IAAA,mBAAU,GAAE;IAIE,WAAA,IAAA,iBAAQ,GAAE,CAAA;qCAAsC,sBAAe;GAHjE,yBAAyB,CAyFrC"}

package/dist/core/common/services/rate-limit-store.d.ts

@@ -0,0 +1,61 @@
+import { Logger } from '@nestjs/common';
+import type { CoreRedisService } from './core-redis.service';
+export declare function rateLimitKey(...parts: string[]): string;
+export declare function rateLimitKeyPrefix(...parts: string[]): string;
+export interface RateLimitStoreHit {
+    count: number;
+    resetIn: number;
+}
+export interface RateLimitStore {
+    clear(): Promise<void>;
+    hit(key: string, windowSeconds: number): Promise<RateLimitStoreHit>;
+    resetByPrefix(prefix: string): Promise<void>;
+    size(): number;
+    destroy?(): void;
+}
+export declare class InMemoryRateLimitStore implements RateLimitStore {
+    protected readonly maxEntries: number;
+    protected readonly store: Map<string, {
+        count: number;
+        resetTime: number;
+    }>;
+    protected cleanupInterval: NodeJS.Timeout | null;
+    protected atCapacity: boolean;
+    protected capacityWarned: boolean;
+    protected readonly overflow: Map<number, {
+        count: number;
+        resetTime: number;
+    }>;
+    constructor(maxEntries?: number);
+    clear(): Promise<void>;
+    hit(key: string, windowSeconds: number): Promise<RateLimitStoreHit>;
+    resetByPrefix(prefix: string): Promise<void>;
+    protected hitOverflow(key: string, windowSeconds: number, now: number): RateLimitStoreHit;
+    size(): number;
+    destroy(): void;
+    protected removeExpired(): number;
+    protected evictOldest(): void;
+}
+export declare class RedisRateLimitStore implements RateLimitStore {
+    protected readonly redisService: CoreRedisService;
+    protected readonly namespace: string;
+    protected readonly maxKeys: number;
+    protected readonly fallback: InMemoryRateLimitStore;
+    protected degraded: boolean;
+    protected readonly logger: Logger;
+    protected capacityWarned: boolean;
+    protected readonly prepared: WeakSet<object>;
+    constructor(redisService: CoreRedisService, namespace: string, maxKeys?: number);
+    clear(): Promise<void>;
+    hit(key: string, windowSeconds: number): Promise<RateLimitStoreHit>;
+    protected runHit(key: string, windowSeconds: number): Promise<[number, number, number]>;
+    resetByPrefix(prefix: string): Promise<void>;
+    size(): number;
+    destroy(): void;
+    protected guard<T>(operation: () => Promise<T>, onFailure: (() => Promise<T> | T) | undefined): Promise<T>;
+    protected redisKey(key: string): string;
+    protected redisKeyPattern(prefix: string): string;
+    protected cardinalityKey(): string;
+    protected overflowKey(key: string): string;
+    protected deleteByPattern(pattern: string): Promise<void>;
+}