@lenne.tech/nest-server 11.41.8 → 11.42.0

package/src/core/modules/tus/core-tus.service.ts

@@ -1,4 +1,5 @@
 import { Injectable, Logger, OnModuleDestroy, OnModuleInit } from '@nestjs/common';
+import { ModuleRef } from '@nestjs/core';
 import { FileStore } from '@tus/file-store';
 import { Server, Upload } from '@tus/server';
 import * as fs from 'fs';
@@ -11,6 +12,7 @@ import { ITusConfig } from '../../common/interfaces/server-options.interface';
 import { ConfigService } from '../../common/services/config.service';
 import { CoreRedisService } from '../../common/services/core-redis.service';
 import { CoreS3Service } from '../../common/services/core-s3.service';
+import { getTenantContextResolver } from '../../common/services/core-tenant-context.registry';
 import { resolveFileStorage } from '../file/file-storage.helper';
 import {
   DEFAULT_FILESYSTEM_DIR,
@@ -18,7 +20,7 @@ import {
   FilesystemFileHelper,
 } from '../file/filesystem-file.helper';
 import { S3_FILES_COLLECTION, S3FileHelper } from '../file/s3-file.helper';
-import { TUS_OWNER_METADATA_KEY } from './tus.constants';
+import { TUS_OWNER_METADATA_KEY, TUS_TENANT_METADATA_KEY } from './tus.constants';
 import { TusRedisLocker } from './tus-redis-locker';
 import {
   DEFAULT_TUS_ALLOWED_HEADERS,
@@ -37,6 +39,14 @@ import {
 export interface CoreTusServiceOptions {
   configService?: ConfigService;
 
+  /**
+   * How a subclass reaches project providers. `TusModule` constructs the service itself, with
+   * exactly `(connection, options)`, so a subclass cannot declare constructor dependencies of its
+   * own — resolve them at call time instead:
+   * `this.options?.moduleRef?.get(QuotaService, { strict: false })`.
+   */
+  moduleRef?: ModuleRef;
+
   /** Central Redis; when present, upload locks are shared across replicas */
   redisService?: CoreRedisService;
 
@@ -187,6 +197,10 @@ export class CoreTusService implements OnModuleDestroy, OnModuleInit {
         // ADMIN, so a project following the documented pattern ended up with undownloadable files.
         // Written from the SERVER-recorded owner, never from the client's own metadata.
         ...(metadata[TUS_OWNER_METADATA_KEY] ? { ownerId: metadata[TUS_OWNER_METADATA_KEY] } : {}),
+        // The tenant the upload was created in — validated against an active membership in
+        // onUploadCreate(), never taken from the client. Present only with multi-tenancy active; it
+        // is what the file module's `'tenant'` access preset decides on.
+        ...(metadata[TUS_TENANT_METADATA_KEY] ? { tenantId: metadata[TUS_TENANT_METADATA_KEY] } : {}),
         tusUploadId: upload.id,
         uploadedAt: new Date(),
       };
@@ -579,6 +593,115 @@ export class CoreTusService implements OnModuleDestroy, OnModuleInit {
     return false;
   }
 
+  /**
+   * Runs when a client CREATES an upload — the one point where the declared `Upload-Length` is known
+   * and no byte has been written yet. Returning `{ metadata }` is what PERSISTS it: the tus server
+   * writes the returned value onto the upload (returning `{}` would keep the client's metadata
+   * verbatim). Throw an error carrying `status_code` to refuse the upload.
+   *
+   * Records two framework-owned keys, both OVERWRITTEN rather than merged, because the client's
+   * `Upload-Metadata` header must never be able to set them:
+   * - {@link TUS_OWNER_METADATA_KEY} — the authenticated creator (see `assertUploadOwnership()`).
+   * - {@link TUS_TENANT_METADATA_KEY} — the validated tenant, only while multi-tenancy is active
+   *   (see `resolveUploadTenantId()`); `null` otherwise.
+   *
+   * Override to add project rules — a quota, a per-tenant type policy — and call `super` to keep the
+   * owner, the tenant and `allowedTypes`. Register the subclass via `TusModule.forRoot({ service })`.
+   */
+  protected async onUploadCreate(req: any, upload: Upload): Promise<{ metadata: Record<string, null | string> }> {
+    // Record the creator and the tenant FIRST, so the checks below and later requests have something
+    // to compare against.
+    const metadata: Record<string, null | string> = {
+      ...upload.metadata,
+      [TUS_OWNER_METADATA_KEY]: this.readRequestUserId(req) ?? null,
+      [TUS_TENANT_METADATA_KEY]: (await this.resolveUploadTenantId(req)) ?? null,
+    };
+
+    // Validate file type if allowedTypes is configured
+    if (this.config.allowedTypes && this.config.allowedTypes.length > 0) {
+      const filetype = this.parseMetadata(upload.metadata).filetype;
+
+      if (!this.validateFileType(filetype)) {
+        const allowedList = this.config.allowedTypes.join(', ');
+        this.logger.warn(
+          `Upload rejected: file type '${filetype || 'unknown'}' not allowed. Allowed types: ${allowedList}`,
+        );
+
+        // Throw error to reject the upload
+        // @tus/server v2 expects throwing an error with status_code
+        const error = new Error(`File type '${filetype || 'unknown'}' is not allowed. Allowed types: ${allowedList}`);
+        (error as any).status_code = 415; // Unsupported Media Type
+        throw error;
+      }
+    }
+
+    return { metadata };
+  }
+
+  /**
+   * The VALIDATED tenant a new upload belongs to, or `undefined`.
+   *
+   * Only while multi-tenancy is active AND the tenant guard is registered — without it nothing can
+   * validate a tenant, and a project without multi-tenancy sees no change at all. The tus routes
+   * carry `@SkipTenantCheck()`, so the guard did NOT validate the request's tenant header; this asks
+   * the same membership logic directly (`core-tenant-context.registry.ts`, the path GraphQL
+   * subscriptions use).
+   *
+   * - No tenant header: `undefined` — the upload stays tenant-less, as before.
+   * - A header naming a tenant the caller is an active member of (or any tenant, for an admin under
+   *   `adminBypass`): that tenant.
+   * - A header naming a tenant the caller is NOT a member of: the upload is REFUSED with 403. Taking
+   *   the header verbatim would let anybody place a file in somebody else's tenant, and silently
+   *   dropping it would store the file somewhere the caller did not ask for.
+   *
+   * Override to derive the tenant from somewhere else (a subdomain, an API key).
+   */
+  protected async resolveUploadTenantId(req: any): Promise<string | undefined> {
+    const multiTenancy = ConfigService.configFastButReadOnly?.multiTenancy;
+    const resolver = getTenantContextResolver();
+    if (!multiTenancy || multiTenancy.enabled === false || !resolver) {
+      return undefined;
+    }
+
+    const headerName = (multiTenancy.headerName ?? 'x-tenant-id').toLowerCase();
+    const header = this.readRequestHeader(req, headerName)?.trim();
+    if (!header) {
+      return undefined;
+    }
+
+    const resolved = await resolver.resolve(this.readRequestUser(req), header);
+    if (!resolved?.tenantId) {
+      const error = new Error('Not a member of the requested tenant');
+      (error as any).status_code = 403;
+      throw error;
+    }
+    return resolved.tenantId;
+  }
+
+  /**
+   * The authenticated caller with roles, read the same way as {@link readRequestUserId} — the roles
+   * decide the admin bypass of the tenant resolution.
+   */
+  protected readRequestUser(req: any): undefined | { id: string; roles?: string[] } {
+    const id = this.readRequestUserId(req);
+    if (!id) {
+      return undefined;
+    }
+    const user = req?.user ?? req?.runtime?.node?.req?.user ?? req?.context?.user;
+    return { id, roles: Array.isArray(user?.roles) ? user.roles : undefined };
+  }
+
+  /**
+   * A request header, from either request shape `@tus/server` v2 hands its hooks: the WHATWG
+   * `ServerRequest` (a `Headers` object) or the original Node request behind `runtime.node.req`.
+   */
+  protected readRequestHeader(req: any, name: string): string | undefined {
+    const fromHeaders = typeof req?.headers?.get === 'function' ? req.headers.get(name) : req?.headers?.[name];
+    const value = fromHeaders ?? req?.runtime?.node?.req?.headers?.[name];
+    const single = Array.isArray(value) ? value[0] : value;
+    return typeof single === 'string' && single.length > 0 ? single : undefined;
+  }
+
   /**
    * Create the TUS server instance with configured extensions
    */
@@ -604,35 +727,7 @@ export class CoreTusService implements OnModuleDestroy, OnModuleInit {
       // protocol is built around a per-upload URL. Appending is the sharp end — bytes PATCHed into
       // somebody else's upload are migrated into the file store under THEIR filename.
       onIncomingRequest: async (req, uploadId) => this.assertUploadOwnership(req, uploadId),
-      onUploadCreate: async (req, upload) => {
-        // Record the creator FIRST, so the ownership check below has something to compare against.
-        // Overwrites rather than merges: see TUS_OWNER_METADATA_KEY.
-        const metadata = { ...upload.metadata, [TUS_OWNER_METADATA_KEY]: this.readRequestUserId(req) ?? null };
-
-        // Validate file type if allowedTypes is configured
-        if (this.config.allowedTypes && this.config.allowedTypes.length > 0) {
-          const filetype = this.parseMetadata(upload.metadata).filetype;
-
-          if (!this.validateFileType(filetype)) {
-            const allowedList = this.config.allowedTypes.join(', ');
-            this.logger.warn(
-              `Upload rejected: file type '${filetype || 'unknown'}' not allowed. Allowed types: ${allowedList}`,
-            );
-
-            // Throw error to reject the upload
-            // @tus/server v2 expects throwing an error with status_code
-            const error = new Error(
-              `File type '${filetype || 'unknown'}' is not allowed. Allowed types: ${allowedList}`,
-            );
-            (error as any).status_code = 415; // Unsupported Media Type
-            throw error;
-          }
-        }
-
-        // Returning the metadata is what PERSISTS the owner — the tus server writes the returned
-        // value onto the upload. Returning `{}` here would keep the client's own metadata verbatim.
-        return { metadata };
-      },
+      onUploadCreate: async (req, upload) => this.onUploadCreate(req, upload),
       onUploadFinish: async (_req, upload) => {
         try {
           await this.onUploadComplete(upload);

package/src/core/modules/tus/tus.constants.ts

@@ -39,3 +39,15 @@ export const TUS_CONFIG = 'TUS_CONFIG';
  * `tests/unit/import-cycle-invariants.spec.ts` enforces exactly that placement.
  */
 export const TUS_OWNER_METADATA_KEY = 'ltOwnerId';
+
+/**
+ * Metadata key recording the VALIDATED tenant a tus upload was created in, in the upload's own
+ * (staged) metadata. On completion it becomes the finished file's `metadata.tenantId` — the field the
+ * file module's `'tenant'` access preset decides on.
+ *
+ * Framework-owned and ALWAYS overwritten in `onUploadCreate`, exactly like
+ * {@link TUS_OWNER_METADATA_KEY}: the client's `Upload-Metadata` header must never be able to place
+ * a file in a tenant. It is set only while multi-tenancy is active and the caller's tenant header
+ * resolves to a tenant they are an active member of; otherwise it is `null`.
+ */
+export const TUS_TENANT_METADATA_KEY = 'ltTenantId';

package/src/core/modules/tus/tus.module.ts

@@ -1,4 +1,5 @@
 import { DynamicModule, Global, Logger, Module, OnModuleInit, Type } from '@nestjs/common';
+import { ModuleRef } from '@nestjs/core';
 import { getConnectionToken } from '@nestjs/mongoose';
 import { Connection } from 'mongoose';
 
@@ -54,6 +55,32 @@ export interface TusModuleOptions {
    * ```
    */
   controller?: Type<CoreTusController>;
+
+  /**
+   * Custom service class to use instead of CoreTusService.
+   * The class must extend CoreTusService and keep its constructor signature
+   * `(connection, options?)`: the module constructs it with exactly those arguments, so it cannot
+   * declare constructor dependencies of its own. Project providers are reached at call time through
+   * `this.options?.moduleRef`.
+   *
+   * The seam for project-specific upload rules — e.g. override `onUploadCreate()` to enforce a quota
+   * from the declared `Upload-Length` before a single byte is written, or `onUploadComplete()` to
+   * post-process the finished file.
+   *
+   * @example
+   * ```typescript
+   * export class TusService extends CoreTusService {
+   *   protected override async onUploadCreate(req: any, upload: Upload) {
+   *     const quota = this.options?.moduleRef?.get(QuotaService, { strict: false });
+   *     await quota?.assertRoomFor(req, upload.size); // throw an Error with status_code 413 to refuse
+   *     return super.onUploadCreate(req, upload);
+   *   }
+   * }
+   *
+   * TusModule.forRoot({ service: TusService })
+   * ```
+   */
+  service?: Type<CoreTusService>;
 }
 
 /**
@@ -98,6 +125,7 @@ export class TusModule implements OnModuleInit {
   private static tusEnabled = false;
   private static currentConfig: ITusConfig | null = null;
   private static customController: null | Type<CoreTusController> = null;
+  private static customService: null | Type<CoreTusService> = null;
 
   constructor(private readonly tusService?: CoreTusService) {}
 
@@ -157,15 +185,17 @@ export class TusModule implements OnModuleInit {
    * @returns Dynamic module configuration
    */
   static forRoot(options: TusModuleOptions = {}): DynamicModule {
-    const { config: rawConfig, controller } = options;
+    const { config: rawConfig, controller, service } = options;
 
     // Normalize config: undefined/true → enabled with defaults, false → disabled
     const config = normalizeTusConfig(rawConfig);
 
     // Store config for service configuration
     this.currentConfig = config;
-    // Store custom controller if provided
+    // Store custom controller and service if provided
     this.customController = controller || null;
+    this.customService = service || null;
+    const ServiceClass = this.customService || CoreTusService;
 
     // If TUS is disabled, return minimal module
     if (config === null) {
@@ -183,9 +213,9 @@ export class TusModule implements OnModuleInit {
             inject: [getConnectionToken()],
             provide: CoreTusService,
             useFactory: (connection: Connection) => {
-              const service = new CoreTusService(connection);
-              service.configure(false);
-              return service;
+              const tusService = new ServiceClass(connection);
+              tusService.configure(false);
+              return tusService;
             },
           },
         ],
@@ -230,6 +260,7 @@ export class TusModule implements OnModuleInit {
             ConfigService,
             { optional: true, token: CoreS3Service },
             { optional: true, token: CoreRedisService },
+            ModuleRef,
           ],
           provide: CoreTusService,
           useFactory: async (
@@ -238,14 +269,15 @@ export class TusModule implements OnModuleInit {
             configService: ConfigService,
             s3Service?: CoreS3Service,
             redisService?: CoreRedisService,
+            moduleRef?: ModuleRef,
           ) => {
-            const service = new CoreTusService(connection, { configService, redisService, s3Service });
-            service.configure(tusConfig);
+            const tusService = new ServiceClass(connection, { configService, moduleRef, redisService, s3Service });
+            tusService.configure(tusConfig);
             // NestJS DOES call onModuleInit on a factory-provided instance — its hook iterates
             // every non-alias provider, however it was constructed. Calling it here as well ran
             // init TWICE per boot: two TUS servers, two S3 stores, and two hourly expiration
             // intervals of which onModuleDestroy clears only the second.
-            return service;
+            return tusService;
           },
         },
       ],
@@ -260,5 +292,6 @@ export class TusModule implements OnModuleInit {
     this.tusEnabled = false;
     this.currentConfig = null;
     this.customController = null;
+    this.customService = null;
   }
 }

package/src/core/modules/user/core-user.service.ts

@@ -5,6 +5,7 @@ import { sha256 } from 'js-sha256';
 import { Document, Model } from 'mongoose';
 
 import { looksLikeSystemRole, SYSTEM_ROLE_PREFIX } from '../../common/enums/role.enum';
+import { accessDeniedException } from '../../common/exceptions/access-denied.exception';
 import { resolveAppUrlFromConfig } from '../../common/helpers/cookies.helper';
 import { maskEmail } from '../../common/helpers/logging.helper';
 import { assignPlain, isQueryableString, prepareServiceOptionsForCreate } from '../../common/helpers/input.helper';
@@ -673,6 +674,8 @@ export abstract class CoreUserService<
     const oldUser = (await this.mainDbModel.findById(id).lean().exec()) as null | TUser;
     const oldEmail = oldUser?.email;
 
+    this.assertCredentialChangeAllowed(oldUser, input, serviceOptions);
+
     // Capture the submitted password for the IAM sync before super.update()
     // hashes it in place.
     //
@@ -738,6 +741,56 @@ export abstract class CoreUserService<
     return updatedUser;
   }
 
+  /**
+   * Refuses a change of another account's e-mail address or password where the configuration promises
+   * tenant isolation from platform administrators.
+   *
+   * With multi-tenancy active and `adminBypass: false`, a platform administrator deliberately has no
+   * way into a tenant's data. Setting a tenant user's address or password is a way around that: change
+   * the address, request a reset, sign in as that person. The same holds for whoever created the
+   * account, because `S_CREATOR` may update it and the e-mail field is open to everyone who may.
+   *
+   * Untouched by design:
+   * - the account changing its own credentials,
+   * - profile fields, and an e-mail address sent along unchanged,
+   * - work without a signed-in user (invitation, password reset), which is the system's own,
+   * - every configuration other than multi-tenancy with `adminBypass: false`.
+   *
+   * `force` does not lift it: the rule is about WHO acts, and system work is defined by the absence of
+   * a current user. Protected so a project can widen or narrow it.
+   */
+  protected assertCredentialChangeAllowed(
+    target: null | TUser,
+    input: TUserInput,
+    serviceOptions?: ServiceOptions,
+  ): void {
+    const multiTenancy = ConfigService.configFastButReadOnly?.multiTenancy;
+    if (!multiTenancy || multiTenancy.enabled === false || multiTenancy.adminBypass !== false) {
+      return;
+    }
+    const currentUser = serviceOptions?.currentUser;
+    if (!currentUser?.id || !target) {
+      return;
+    }
+    // No exemption for administrator TARGETS: an administrator may write `roles`, so "promote the
+    // tenant account to ADMIN, then change its address" would open every account in two requests.
+    const targetId = String((target as any)._id ?? (target as any).id);
+    if (String(currentUser.id) === targetId) {
+      return;
+    }
+
+    const submitted = input as { email?: unknown; password?: unknown };
+    const normalize = (value: unknown) => (typeof value === 'string' ? value.trim().toLowerCase() : value);
+    const changesEmail = submitted?.email !== undefined && normalize(submitted.email) !== normalize(target.email);
+    const changesPassword = submitted?.password !== undefined;
+    if (changesEmail || changesPassword) {
+      throw accessDeniedException(
+        currentUser,
+        'The e-mail address and password of a tenant account can only be changed by the account itself',
+      );
+    }
+  }
+
   /**
    * Delete user with automatic cleanup of IAM auth data
    *

package/src/index.ts

@@ -47,6 +47,7 @@ export * from './core/common/helpers/input.helper';
 export * from './core/common/helpers/logging.helper';
 export * from './core/common/helpers/meta.helper';
 export * from './core/common/helpers/model.helper';
+export * from './core/common/helpers/outbound-url.helper';
 export * from './core/common/helpers/process-diagnostics.helper';
 export * from './core/common/helpers/register-enum.helper';
 export * from './core/common/helpers/scim.helper';
@@ -258,6 +259,7 @@ export * from './core/modules/tenant/core-tenant.decorators';
 export * from './core/modules/tenant/core-tenant.enums';
 export * from './core/modules/tenant/core-tenant.guard';
 export * from './core/modules/tenant/core-role-scope.registry';
+export * from './core/modules/tenant/core-tenant-role.helper';
 export * from './core/modules/tenant/core-tenant.helpers';
 export * from './core/modules/tenant/core-tenant.module';
 export * from './core/modules/tenant/core-tenant.service';