@lenne.tech/nest-server 11.37.0 → 11.38.0

package/src/core/modules/user/core-user.service.ts

@@ -5,6 +5,7 @@ import { sha256 } from 'js-sha256';
 import { Document, Model } from 'mongoose';
 
 import { looksLikeSystemRole, SYSTEM_ROLE_PREFIX } from '../../common/enums/role.enum';
+import { maskEmail } from '../../common/helpers/logging.helper';
 import { assignPlain, prepareServiceOptionsForCreate } from '../../common/helpers/input.helper';
 import { ServiceOptions } from '../../common/interfaces/service-options.interface';
 import { ConfigService } from '../../common/services/config.service';
@@ -185,12 +186,41 @@ export abstract class CoreUserService<
     // Get user
     const dbObject = await this.mainDbModel.findOne({ passwordResetToken: token }).exec();
     if (!dbObject) {
-      throw new NotFoundException(`No user found with password reset token: ${token}`);
+      // The token is NOT echoed. It is attacker-supplied so nothing secret leaks, but it lands
+      // in the response body and in every log line that records the exception — and this logger
+      // feeds the ADMIN-readable Hub log buffer. An unbounded caller-controlled string there is
+      // free log-stuffing, and the message is no more useful for it.
+      throw new NotFoundException('Invalid or expired password reset token');
     }
 
-    // Store the original plain password for IAM sync before any hashing
-    // We need the plain password because IAM uses scrypt, not bcrypt+sha256
-    const plainPasswordForIamSync = /^[a-f0-9]{64}$/i.test(newPassword) ? undefined : newPassword;
+    // Capture the submitted password for the IAM sync before the closure below
+    // reassigns `newPassword` to its sha256 form.
+    //
+    // It is passed on exactly as received, INCLUDING an already-sha256-hashed
+    // one. This used to skip the sync for a 64-hex value, on the reasoning that
+    // "IAM uses scrypt, not bcrypt+sha256" — but the sync does not need a plain
+    // password: `hashPasswordForBetterAuth` runs its input through
+    // `normalizePasswordForIam`, which passes a 64-hex string through unchanged
+    // by design, and `migrateAccountToIam` is fed the very same pre-hashed value
+    // when an account is created.
+    //
+    // The guard therefore disabled the sync for exactly the clients this stack
+    // ships. The lt frontends hash in the browser before sending — seven call
+    // sites in `nuxt-extensions/src/runtime/lib/auth-client.ts` (`signIn.email`,
+    // `resetPassword`, `changePassword` and the rest) run `ltSha256` on the
+    // password first. That is independent of the `sha256` config option, which
+    // only governs what the SERVER does with a plaintext password it happens to
+    // receive. So the value arriving here is 64-hex whatever that option says,
+    // and every such reset took the skipped branch.
+    //
+    // The legacy password was updated, the IAM credential was not, and sign-in —
+    // which goes through IAM — kept accepting the OLD password and refusing the
+    // new one. The endpoint reported success throughout, so the failure surfaced
+    // only at the next sign-in.
+    //
+    // A client that posts a plaintext password was never affected: the old guard
+    // let that one through, and the sync normalized it the same way IAM does.
+    const passwordForIamSync = newPassword;
 
     return this.process(
       async () => {
@@ -204,17 +234,38 @@ export abstract class CoreUserService<
         const updatedUser = await assignPlain(dbObject, {
           password: await bcrypt.hash(newPassword, 10),
           passwordResetToken: null,
+          // A reset is what somebody reaches for after a suspected takeover, so it must not
+          // leave the attacker's session live. Clearing the refresh tokens ends every legacy
+          // session; the IAM half is `betterAuth.emailAndPassword.revokeSessionsOnPasswordReset`,
+          // which is off by default because it is a behaviour change for existing deployments —
+          // the migration guide recommends turning it on.
+          //
+          // Without this, "the reset now lands in both stores" would still leave the account
+          // reachable with the credential the reset was meant to retire.
+          refreshTokens: {},
         }).save();
 
         // Sync password to Better-Auth (IAM) if mapper is available
         // This ensures users can sign in via IAM after password reset
-        if (this.options?.betterAuthUserMapper && plainPasswordForIamSync && dbObject.email) {
+        if (this.options?.betterAuthUserMapper && passwordForIamSync && dbObject.email) {
           try {
-            await this.options.betterAuthUserMapper.syncPasswordChangeToIam(dbObject.email, plainPasswordForIamSync);
+            // Same reasoning as in update(): a `false` return means the reset landed in the
+            // legacy store only, which is the shape of failure this whole path exists to
+            // prevent. It must not be indistinguishable from success.
+            const synced = await this.options.betterAuthUserMapper.syncPasswordChangeToIam(
+              dbObject.email,
+              passwordForIamSync,
+            );
+            if (!synced) {
+              this.userServiceLogger.warn(
+                `Password reset for ${maskEmail(dbObject.email)} was NOT synced to IAM (no credential account) — ` +
+                  'the legacy password now differs from the IAM credential.',
+              );
+            }
           } catch (error) {
             // Log but don't fail - Legacy Auth password was updated successfully
             this.userServiceLogger.warn(
-              `Failed to sync password reset to IAM for ${dbObject.email}: ${error instanceof Error ? error.message : 'Unknown error'}`,
+              `Failed to sync password reset to IAM for ${maskEmail(dbObject.email)}: ${error instanceof Error ? error.message : 'Unknown error'}`,
             );
           }
         }
@@ -226,13 +277,48 @@ export abstract class CoreUserService<
   }
 
   /**
-   * Set password rest token for email
+   * Set a password-reset token for an email address
+   *
+   * Returns `null` for an unknown address when `auth.passwordReset.preventUserEnumeration` is on
+   * (the default since 11.38.0) — the caller must then answer exactly as it would for a known one.
+   * With the option off it throws `NotFoundException`, the pre-11.38.0 behaviour.
+   *
+   * WHY THE DEFAULT CHANGED
+   *
+   * Throwing made the endpoint an account oracle: HTTP 404 for an unknown address, 201 for a known
+   * one, so anyone could test who has an account. In a multi-tenant product that also answers who
+   * works at which customer. The framework already answers this correctly on the IAM path —
+   * Better-Auth's `/request-password-reset` returns the same body either way — so the two halves
+   * of one framework disagreed about the same question.
+   *
+   * THE STATUS CODE IS THE SMALLER HALF
+   *
+   * Response TIME distinguishes the cases too, and by far more: the known path writes a token and
+   * (in the caller) sends mail, the unknown path returns immediately. This method equalises what it
+   * can — the token generation still happens, so the CPU cost matches — but the mail send lives in
+   * the caller. A `sendPasswordResetMail()` that AWAITS the send leaks the difference as latency,
+   * whatever this method does. `src/server/modules/user/user.service.ts` shows the shape that does
+   * not; the IAM path uses the same trick, with the reasoning recorded in `better-auth.config.ts`.
+   *
+   * Anything measuring this honestly should say so rather than claim the channel is closed.
    */
-  async setPasswordResetTokenForEmail(email: string, serviceOptions?: ServiceOptions): Promise<TUser> {
+  async setPasswordResetTokenForEmail(email: string, serviceOptions?: ServiceOptions): Promise<null | TUser> {
     // Get user
     const dbObject = await this.mainDbModel.findOne({ email }).exec();
     if (!dbObject) {
-      throw new NotFoundException(`No user found with email: ${email}`);
+      const preventEnumeration =
+        this.configService.getFastButReadOnly('auth')?.passwordReset?.preventUserEnumeration !== false;
+
+      if (!preventEnumeration) {
+        throw new NotFoundException(`No user found with email: ${email}`);
+      }
+
+      // Do the work the known path does, so the two do not differ in CPU cost. It is cheap next to
+      // a mail send, which is why this alone does not close the timing channel — see the note above.
+      crypto.randomBytes(32).toString('hex');
+
+      this.userServiceLogger.debug(`Password reset requested for an unknown address (${maskEmail(email)})`);
+      return null;
     }
 
     return this.process(
@@ -311,10 +397,14 @@ export abstract class CoreUserService<
     const oldUser = (await this.mainDbModel.findById(id).lean().exec()) as null | TUser;
     const oldEmail = oldUser?.email;
 
-    // Store plain password for IAM sync before any hashing occurs
-    // We need to capture this before super.update() which may hash it
-    const inputPassword = (input as any).password;
-    const plainPasswordForIamSync = inputPassword && !/^[a-f0-9]{64}$/i.test(inputPassword) ? inputPassword : undefined;
+    // Capture the submitted password for the IAM sync before super.update()
+    // hashes it in place.
+    //
+    // Passed on exactly as received, including an already-sha256-hashed one —
+    // see the note in `resetPassword`: the sync normalizes a 64-hex value
+    // through unchanged, so skipping it there disabled the sync for the
+    // standard setup, where the frontend hashes before sending.
+    const passwordForIamSync = (input as any).password;
 
     // Perform the update
     const updatedUser = await super.update(id, input, serviceOptions);
@@ -333,13 +423,28 @@ export abstract class CoreUserService<
     }
 
     // Sync password change to IAM if password was changed and mapper is available
-    if (this.options?.betterAuthUserMapper && plainPasswordForIamSync && oldUser?.email) {
+    if (this.options?.betterAuthUserMapper && passwordForIamSync && oldUser?.email) {
       try {
-        await this.options.betterAuthUserMapper.syncPasswordChangeToIam(oldUser.email, plainPasswordForIamSync);
-        this.userServiceLogger.debug(`Synced password change to IAM for user ${oldUser.email}`);
+        // Report what actually happened, not that the call was made. `syncPasswordChangeToIam`
+        // answers `false` — never throws — when there is no IAM credential to update, and
+        // logging success regardless is how a half-applied password change stays invisible:
+        // the endpoint reports success, the user is left with two different passwords, and
+        // nothing in the log says so.
+        const synced = await this.options.betterAuthUserMapper.syncPasswordChangeToIam(
+          oldUser.email,
+          passwordForIamSync,
+        );
+        if (synced) {
+          this.userServiceLogger.debug(`Synced password change to IAM for user ${maskEmail(oldUser.email)}`);
+        } else {
+          this.userServiceLogger.warn(
+            `Password change for ${maskEmail(oldUser.email)} was NOT synced to IAM (no credential account) — ` +
+              'the legacy password now differs from the IAM credential.',
+          );
+        }
       } catch (error) {
         this.userServiceLogger.warn(
-          `Failed to sync password change to IAM for ${oldUser.email}: ${error instanceof Error ? error.message : 'Unknown error'}`,
+          `Failed to sync password change to IAM for ${maskEmail(oldUser.email)}: ${error instanceof Error ? error.message : 'Unknown error'}`,
         );
         // Don't throw - password sync failure shouldn't block the update
       }

package/src/core/modules/user/inputs/core-user.input.ts

@@ -97,11 +97,26 @@ export abstract class CoreUserInput extends CoreInput {
 
   /**
    * Password of the user
+   *
+   * Restricted to ADMIN and the account owner since 11.38.0. It used to be `S_EVERYONE`, i.e.
+   * settable by whoever was allowed to update the record at all — and `updateUser` grants that to
+   * `S_CREATOR`, which in an invite or admin-provisioning flow is the INVITING ADMIN, permanently
+   * (see `.claude/rules/role-system.md`).
+   *
+   * That was largely inert before: the lt frontends hash client-side, and the 64-hex guard then
+   * routed such a write away from the IAM sync, so it only ever landed in the legacy store — which
+   * this release also turns off by default. Removing the guard makes the same write reach the LIVE
+   * IAM credential. A dormant privilege issue would have become an account-takeover path in the
+   * very release that closes the legacy door, so the field is narrowed in the same step.
+   *
+   * A user changing their own password is unaffected (`S_SELF`). A project that genuinely needs a
+   * third party to set a password should go through an invitation or reset flow, both of which
+   * prove possession of the mailbox.
    */
   @UnifiedField({
     description: 'Password of the user',
     isOptional: true,
-    roles: RoleEnum.S_EVERYONE,
+    roles: [RoleEnum.ADMIN, RoleEnum.S_SELF],
   })
   password?: string = undefined;
 }

package/src/core.module.ts

@@ -29,6 +29,7 @@ import {
   IServerOptions,
 } from './core/common/interfaces/server-options.interface';
 import { RequestContextMiddleware } from './core/common/middleware/request-context.middleware';
+import { SecurityHeadersMiddleware } from './core/common/middlewares/security-headers.middleware';
 import { MapAndValidatePipe } from './core/common/pipes/map-and-validate.pipe';
 import { ComplexityPlugin } from './core/common/plugins/complexity.plugin';
 import { mongooseIdPlugin } from './core/common/plugins/mongoose-id.plugin';
@@ -84,6 +85,13 @@ export class CoreModule implements NestModule {
   configure(consumer: MiddlewareConsumer) {
     // RequestContext middleware must run for all routes to provide AsyncLocalStorage context
     consumer.apply(RequestContextMiddleware).forRoutes('*');
+
+    // Security headers on EVERY response, guards' rejections included. Middleware rather than an
+    // interceptor for exactly that reason: an interceptor never runs for a request a guard turns
+    // away, and those are the ones an attacker generates most of. The middleware itself decides
+    // whether it is enabled — keeping the policy in one file rather than splitting it between a
+    // config read here and the values there.
+    consumer.apply(SecurityHeadersMiddleware).forRoutes('*');
     if (CoreModule.graphQlEnabled) {
       consumer.apply(graphqlUploadExpress()).forRoutes('graphql');
     }

package/src/index.ts

@@ -73,6 +73,7 @@ export * from './core/common/interfaces/server-options.interface';
 export * from './core/common/interfaces/service-options.interface';
 export * from './core/common/middleware/request-context.middleware';
 export * from './core/common/middlewares/to-lower-case.middleware';
+export * from './core/common/middlewares/security-headers.middleware';
 export * from './core/common/models/core-model.model';
 export * from './core/common/models/core-persistence.model';
 export * from './core/common/models/pagination-info.model';
@@ -133,11 +134,13 @@ export * from './core/modules/auth/core-auth.controller';
 export * from './core/modules/auth/core-auth.model';
 export * from './core/modules/auth/core-auth.module';
 export * from './core/modules/auth/core-auth.resolver';
+export * from './core/modules/auth/core-legacy-auth-deprecation.initializer';
 export * from './core/modules/auth/exceptions/expired-refresh-token.exception';
 export * from './core/modules/auth/exceptions/expired-token.exception';
 export * from './core/modules/auth/exceptions/invalid-token.exception';
 export * from './core/modules/auth/exceptions/legacy-auth-disabled.exception';
 export * from './core/modules/auth/guards/auth.guard';
+export * from './core/modules/auth/helpers/legacy-endpoints.helper';
 export * from './core/modules/auth/guards/legacy-auth-rate-limit.guard';
 export * from './core/modules/auth/guards/roles-guard-registry';
 export * from './core/modules/auth/guards/roles.guard';

package/src/server/modules/user/user.controller.ts

@@ -144,7 +144,13 @@ export class UserController {
   @Post('password/reset-request')
   @Roles(RoleEnum.S_EVERYONE)
   async requestPasswordResetMail(@Body('email') email: string): Promise<boolean> {
-    return !!(await this.userService.sendPasswordResetMail(email));
+    // Always `true`, whether or not the address exists. `sendPasswordResetMail` returns `null` for
+    // an unknown one (see CoreUserService.setPasswordResetTokenForEmail), and forwarding that as
+    // `false` would rebuild the account oracle one layer up: the status code is equal, the body
+    // is not. The caller is told the same thing either way — "if this address is known, mail is on
+    // its way" — which is the only honest answer that reveals nothing.
+    await this.userService.sendPasswordResetMail(email);
+    return true;
   }
 
   /**

package/src/server/modules/user/user.resolver.ts

@@ -125,7 +125,13 @@ export class UserResolver {
   @Mutation(() => Boolean, { description: 'Request new password for user with email' })
   @Roles(RoleEnum.S_EVERYONE)
   async requestPasswordResetMail(@Args('email') email: string): Promise<boolean> {
-    return !!(await this.userService.sendPasswordResetMail(email));
+    // Always `true`, whether or not the address exists. `sendPasswordResetMail` returns `null` for
+    // an unknown one (see CoreUserService.setPasswordResetTokenForEmail), and forwarding that as
+    // `false` would rebuild the account oracle one layer up: the status code is equal, the body
+    // is not. The caller is told the same thing either way — "if this address is known, mail is on
+    // its way" — which is the only honest answer that reveals nothing.
+    await this.userService.sendPasswordResetMail(email);
+    return true;
   }
 
   /**

package/src/server/modules/user/user.service.ts

@@ -74,19 +74,45 @@ export class UserService extends CoreUserService<User, UserInput, UserCreateInpu
 
   /**
    * Request password reset mail
+   *
+   * REFERENCE IMPLEMENTATION — the two details below are the ones that matter, and a project
+   * copying this method needs both. Either one alone leaves the endpoint an account oracle.
+   *
+   * 1. An unknown address yields `null` (since 11.38.0, unless
+   *    `auth.passwordReset.preventUserEnumeration` is off) and this method returns quietly, so the
+   *    caller answers the same way it would for a known one.
+   * 2. The mail send is NOT awaited. This is the half that actually closes the channel: the send
+   *    is a network round trip to SMTP or Brevo, orders of magnitude above everything else in the
+   *    request. Awaiting it would make the known path visibly slower whatever the status code says
+   *    — you would have given up the "unknown address" hint in the UI and kept the oracle.
+   *
+   * A failed send must still be reported rather than crash the process, which is why it carries
+   * its own `catch`. The user is told the mail is on its way either way; that is the same trade
+   * Better-Auth makes on the IAM path.
    */
-  async sendPasswordResetMail(email: string, serviceOptions?: ServiceOptions): Promise<User> {
+  async sendPasswordResetMail(email: string, serviceOptions?: ServiceOptions): Promise<null | User> {
     // Set password reset token
     const user = await super.setPasswordResetTokenForEmail(email, serviceOptions);
 
-    // Send email
-    await this.emailService.sendMail(user.email, 'Password reset', {
-      htmlTemplate: 'password-reset',
-      templateData: {
-        link: `${this.configService.configFastButReadOnly.email.passwordResetLink}/${user.passwordResetToken}`,
-        name: user.username,
-      },
-    });
+    if (!user) {
+      // Unknown address, enumeration protection on. Answer exactly as for a known one.
+      return null;
+    }
+
+    // Deliberately NOT awaited — see the note above.
+    void this.emailService
+      .sendMail(user.email, 'Password reset', {
+        htmlTemplate: 'password-reset',
+        templateData: {
+          link: `${this.configService.configFastButReadOnly.email.passwordResetLink}/${user.passwordResetToken}`,
+          name: user.username,
+        },
+      })
+      .catch((error: unknown) => {
+        this.userServiceLogger.error(
+          `Failed to send the password-reset mail: ${error instanceof Error ? error.message : String(error)}`,
+        );
+      });
 
     // Return user
     return user;