@lenne.tech/nest-server 11.36.2 → 11.36.4

package/src/core/modules/better-auth/core-better-auth.resolver.ts

@@ -13,6 +13,7 @@ import {
   hasSession,
   hasUser,
   requires2FA,
+  sessionTokenFromResponse,
 } from './better-auth.types';
 import { CoreBetterAuthAuthModel } from './core-better-auth-auth.model';
 import { CoreBetterAuthEmailVerificationService } from './core-better-auth-email-verification.service';
@@ -490,7 +491,11 @@ export class CoreBetterAuthResolver {
         // If email verification is enabled, revoke the session and don't return session data
         // The user must verify their email before they can use any session
         if (this.emailVerificationService?.isEnabled()) {
-          const sessionToken = hasSession(response) ? response.session.token : undefined;
+          // Shared chain, NOT `hasSession(response) ? response.session.token : undefined`: `token` is
+          // optional on the guard, so that expression returns `undefined` for a response shape that
+          // still carries a revocable token — and the endpoint would then report a revoked session
+          // while a live one remained in the database.
+          const sessionToken = sessionTokenFromResponse(response);
           if (sessionToken) {
             await this.betterAuthService.revokeSession(sessionToken);
           }

package/src/core/modules/better-auth/core-better-auth.service.ts

@@ -11,6 +11,7 @@ import { ConfigService } from '../../common/services/config.service';
 import { ErrorCode } from '../error-code/error-codes';
 import { resolveBetterAuthCookiePrefix } from './better-auth-cookie-prefix.helper';
 import { BetterAuthInstance } from './better-auth.config';
+import { isJwtShaped } from './core-better-auth-token.helper';
 import { BetterAuthSessionUser } from './core-better-auth-user.mapper';
 import { convertExpressHeaders, parseCookieHeader, signCookieValueIfNeeded } from './core-better-auth-web.helper';
 import { BETTER_AUTH_CONFIG, BETTER_AUTH_COOKIE_DOMAIN, BETTER_AUTH_INSTANCE } from './core-better-auth.constants';
@@ -359,8 +360,10 @@ export class CoreBetterAuthService implements OnModuleInit {
       return token;
     }
 
-    // Already a JWT (three base64url segments separated by dots)
-    if (token.startsWith('eyJ') && token.split('.').length === 3) {
+    // Already a JWT (three base64url segments separated by dots). Shares ONE definition with the
+    // session-cookie guard — two copies of this predicate would let the conversion path and the
+    // cookie path disagree about the same token, silently.
+    if (isJwtShaped(token)) {
       return token;
     }