@lenne.tech/nest-server 11.35.0 → 11.35.1

package/src/core/modules/file/file-roles.helper.ts

@@ -3,7 +3,7 @@ import { Logger } from '@nestjs/common';
 import { IFileConfig } from '../../common/interfaces/server-options.interface';
 import { CoreFileController } from './core-file.controller';
 import { CoreFileResolver } from './core-file.resolver';
-import { FileRoleKey, resolveRoles } from './file-roles.config';
+import { FILE_ROLE_MEMBERS, FileEndpointClassName, FileRoleKey, resolveRoles } from './file-roles.config';
 
 const logger = new Logger('CoreFileRoles');
 
@@ -12,32 +12,25 @@ const logger = new Logger('CoreFileRoles');
 // imports the endpoint classes, which inject CoreFileService — see file-roles.config.ts.
 export {
   FILE_ROLE_DEFAULTS,
+  FILE_ROLE_MEMBERS,
   resolveRoles,
   warnOnPresignedDownloadsWithRestrictedRoles,
+  warnOnUndecidedEffectiveFileAccess,
   warnOnUndecidedFileAccess,
 } from './file-roles.config';
-export type { FileRoleKey } from './file-roles.config';
+export type { FileEndpointClassName, FileRoleKey, ObservedFileHandler } from './file-roles.config';
 
 /**
- * Which member is governed by which knob.
+ * The prototypes the member names in {@link FILE_ROLE_MEMBERS} resolve against.
  *
- * `getFileInfo` rides with `downloadRoles` rather than getting its own knob:
- * it answers filename, size and content type for a blob, which is the metadata
- * half of a download. Splitting it would let a project accidentally publish the
- * bucket's contents list while believing downloads were still closed.
+ * The NAMES live in `file-roles.config.ts` so the boot audit can share them without importing these
+ * classes (that import is what makes this file a non-leaf — see the header of `file-roles.config.ts`
+ * for the temporal-dead-zone crash it caused). Only the class lookup lives here.
  */
-const ROLE_TARGETS: { key: FileRoleKey; member: string; owner: () => unknown }[] = [
-  {
-    key: 'downloadRoles',
-    member: 'CoreFileController.getFileById',
-    owner: () => CoreFileController.prototype.getFileById,
-  },
-  { key: 'downloadRoles', member: 'CoreFileController.getFile', owner: () => CoreFileController.prototype.getFile },
-  { key: 'downloadRoles', member: 'CoreFileResolver.getFileInfo', owner: () => CoreFileResolver.prototype.getFileInfo },
-  { key: 'uploadRoles', member: 'CoreFileResolver.uploadFile', owner: () => CoreFileResolver.prototype.uploadFile },
-  { key: 'uploadRoles', member: 'CoreFileResolver.uploadFiles', owner: () => CoreFileResolver.prototype.uploadFiles },
-  { key: 'deleteRoles', member: 'CoreFileResolver.deleteFile', owner: () => CoreFileResolver.prototype.deleteFile },
-];
+const ENDPOINT_PROTOTYPES: Record<FileEndpointClassName, unknown> = {
+  CoreFileController: CoreFileController.prototype,
+  CoreFileResolver: CoreFileResolver.prototype,
+};
 
 /**
  * Apply the configured file roles to the core file endpoints.
@@ -65,14 +58,14 @@ const ROLE_TARGETS: { key: FileRoleKey; member: string; owner: () => unknown }[]
 export function applyFileRoles(config?: IFileConfig): void {
   const resolved = new Map<FileRoleKey, string[]>();
 
-  for (const { key, member, owner } of ROLE_TARGETS) {
+  for (const { className, key, method } of FILE_ROLE_MEMBERS) {
     if (!resolved.has(key)) {
       resolved.set(key, resolveRoles(key, config));
     }
 
-    const target = owner();
+    const target = (ENDPOINT_PROTOTYPES[className] as Record<string, unknown>)[method];
     if (typeof target !== 'function') {
-      logger.warn(`Cannot apply file.${key}: ${member} is not a function — skipping.`);
+      logger.warn(`Cannot apply file.${key}: ${className}.${method} is not a function — skipping.`);
       continue;
     }
 

package/src/core.module.ts

@@ -1,6 +1,6 @@
 import { ApolloDriver, ApolloDriverConfig } from '@nestjs/apollo';
 import { DynamicModule, Global, MiddlewareConsumer, Module, NestModule, UnauthorizedException } from '@nestjs/common';
-import { APP_INTERCEPTOR, APP_PIPE } from '@nestjs/core';
+import { APP_INTERCEPTOR, APP_PIPE, DiscoveryModule } from '@nestjs/core';
 import { GraphQLModule } from '@nestjs/graphql';
 import { MongooseModule } from '@nestjs/mongoose';
 import type { Context } from 'graphql-ws';
@@ -51,6 +51,7 @@ import { CoreBetterAuthUserMapper } from './core/modules/better-auth/core-better
 import { CoreBetterAuthModule } from './core/modules/better-auth/core-better-auth.module';
 import { CoreBetterAuthService } from './core/modules/better-auth/core-better-auth.service';
 import { ErrorCodeModule } from './core/modules/error-code/error-code.module';
+import { CoreFileAccessAuditInitializer } from './core/modules/file/core-file-access-audit.initializer';
 import { applyFileRoles, warnOnPresignedDownloadsWithRestrictedRoles } from './core/modules/file/file-roles.helper';
 import { CoreHealthCheckModule } from './core/modules/health-check/core-health-check.module';
 import { CoreHubModule } from './core/modules/hub/core-hub.module';
@@ -305,6 +306,11 @@ export class CoreModule implements NestModule {
 
       // Core Services
       CoreCronJobsInitializer,
+      // Audits the file endpoints the project actually REGISTERED. applyFileRoles() above can only
+      // reach the base-class members; a subclass that re-declares one keeps its own @Roles() and the
+      // configuration never reaches that route. Only a bootstrap-time look at the registered class
+      // can tell those apart — see the initializer.
+      CoreFileAccessAuditInitializer,
       CoreRedisService,
       CoreS3Service,
       CoreTrustProxyInitializer,
@@ -381,7 +387,9 @@ export class CoreModule implements NestModule {
       }
     }
 
-    const imports: any[] = [MongooseModule.forRoot(config.mongoose.uri, config.mongoose.options)];
+    // DiscoveryModule: CoreFileAccessAuditInitializer needs the registered controller/resolver
+    // classes, which only exist once Nest has built its route table.
+    const imports: any[] = [DiscoveryModule, MongooseModule.forRoot(config.mongoose.uri, config.mongoose.options)];
 
     if (isGraphQlEnabled && config.graphQl) {
       imports.push(

package/src/index.ts

@@ -36,9 +36,11 @@ export * from './core/common/helpers/cookies.helper';
 export * from './core/common/helpers/graceful-shutdown.helper';
 export * from './core/common/helpers/db.helper';
 export * from './core/common/helpers/decorator.helper';
+export * from './core/common/helpers/execution-context-request.helper';
 export * from './core/common/helpers/file.helper';
 export * from './core/common/helpers/filter.helper';
 export * from './core/common/helpers/graphql.helper';
+export * from './core/common/helpers/graphql-ws-context.helper';
 export * from './core/common/helpers/interceptor.helper';
 export * from './core/common/helpers/gridfs.helper';
 export * from './core/common/helpers/input.helper';
@@ -94,6 +96,7 @@ export * from './core/common/services/core-cron-jobs.service';
 export * from './core/common/services/core-redis.service';
 export * from './core/common/services/core-redis-pubsub';
 export * from './core/common/services/core-s3.service';
+export * from './core/common/services/core-tenant-context.registry';
 export * from './core/common/services/rate-limit-store';
 export * from './core/common/services/crud.service';
 export * from './core/common/services/email.service';
@@ -173,6 +176,7 @@ export * from './core/modules/error-code';
 // Core - Modules - File
 // =====================================================================================================================
 
+export * from './core/modules/file/core-file-access-audit.initializer';
 export * from './core/modules/file/core-file-info.model';
 export * from './core/modules/file/core-file.controller';
 export * from './core/modules/file/core-file.resolver';