@lenne.tech/nest-server 11.41.9 → 11.42.1

package/src/core/modules/tenant/core-tenant.guard.ts

@@ -61,7 +61,8 @@ interface CachedTenantIds {
  * Cache invalidation message broadcast between replicas via Redis pub/sub
  */
 interface TenantCacheInvalidation {
-  scope: 'all' | 'user';
+  scope: 'all' | 'tenant' | 'user';
+  tenantId?: string;
   userId?: string;
 }
 
@@ -148,6 +149,9 @@ export class CoreTenantGuard implements CanActivate, OnApplicationBootstrap, OnM
    */
   private readonly tenantIdsCache = new Map<string, CachedTenantIds>();
 
+  /** Answers of `multiTenancy.isTenantActive`, keyed by tenant id (same TTL as the other caches). */
+  private readonly tenantActiveCache = new Map<string, { active: boolean; expiresAt: number }>();
+
   /** Cache TTL in milliseconds. Configurable via multiTenancy.cacheTtlMs (default: 30s, 0 = disabled) */
   private cacheTtlMs: number = 30_000;
   /** Maximum cache entries before eviction */
@@ -223,7 +227,7 @@ export class CoreTenantGuard implements CanActivate, OnApplicationBootstrap, OnM
 
     if (trimmed) {
       const membership = await this.findMembershipCached(user.id, trimmed);
-      if (!membership) {
+      if (!membership || !(await this.isTenantActive(trimmed))) {
         return {};
       }
       return { tenantId: trimmed, tenantRole: membership.role as string };
@@ -288,6 +292,17 @@ export class CoreTenantGuard implements CanActivate, OnApplicationBootstrap, OnM
     }
     this.membershipCache.clear();
     this.tenantIdsCache.clear();
+    this.tenantActiveCache.clear();
+  }
+
+  /**
+   * Forget the cached `multiTenancy.isTenantActive` answer for a tenant.
+   * Call this right after switching a tenant on or off — otherwise the previous answer holds for up to
+   * `cacheTtlMs`. Broadcast to every replica when Redis is enabled.
+   */
+  invalidateTenant(tenantId: string): void {
+    this.tenantActiveCache.delete(tenantId);
+    this.publishInvalidation({ scope: 'tenant', tenantId });
   }
 
   /**
@@ -349,6 +364,10 @@ export class CoreTenantGuard implements CanActivate, OnApplicationBootstrap, OnM
       request,
     });
     if (apiTokenKind === ApiTokenKind.TENANT) {
+      // The token is bound to its tenant (set on the request by the helper); a deactivated one ends it.
+      if (request.tenantId) {
+        await this.assertTenantActive(request.tenantId);
+      }
       return true;
     }
     // A user token restricted to one tenant is bound to it like a header naming it — the helper has
@@ -397,7 +416,7 @@ export class CoreTenantGuard implements CanActivate, OnApplicationBootstrap, OnM
       // Never block access — S_EVERYONE endpoints are always public.
       if (headerTenantId && request.user?.id) {
         const membership = await this.findMembershipCached(request.user.id, headerTenantId);
-        if (membership) {
+        if (membership && (await this.isTenantActive(headerTenantId))) {
           request.tenantId = headerTenantId;
           request.tenantRole = capApiTokenTenantRole(request.user, membership.role as string) ?? undefined;
         }
@@ -520,6 +539,7 @@ export class CoreTenantGuard implements CanActivate, OnApplicationBootstrap, OnM
       if (!membership) {
         throw new ForbiddenException('Not a member of this tenant');
       }
+      await this.assertTenantActive(headerTenantId);
 
       // A user token with maxTenantRole acts with the lower of its cap and the membership role; `null`
       // (a role the hierarchy cannot compare with the cap) satisfies no tenant role at all.
@@ -620,7 +640,7 @@ export class CoreTenantGuard implements CanActivate, OnApplicationBootstrap, OnM
       const now = Date.now();
       const cached = this.tenantIdsCache.get(cacheKey);
       if (cached && now < cached.expiresAt) {
-        request.tenantIds = cached.ids;
+        request.tenantIds = await this.filterActiveTenants(cached.ids);
         return;
       }
     }
@@ -648,7 +668,8 @@ export class CoreTenantGuard implements CanActivate, OnApplicationBootstrap, OnM
       ids = memberships.map((m) => m.tenant as string);
     }
 
-    request.tenantIds = ids;
+    // The cache keeps the membership answer; activity is filtered per request through its own cache.
+    request.tenantIds = await this.filterActiveTenants(ids);
 
     // Store in process-level cache when enabled
     if (ttl > 0) {
@@ -689,6 +710,8 @@ export class CoreTenantGuard implements CanActivate, OnApplicationBootstrap, OnM
       this.clearAll();
     } else if (parsed?.scope === 'user' && parsed.userId) {
       this.clearUser(parsed.userId);
+    } else if (parsed?.scope === 'tenant' && parsed.tenantId) {
+      this.tenantActiveCache.delete(parsed.tenantId);
     }
   }
 
@@ -698,6 +721,7 @@ export class CoreTenantGuard implements CanActivate, OnApplicationBootstrap, OnM
   protected clearAll(): void {
     this.membershipCache.clear();
     this.tenantIdsCache.clear();
+    this.tenantActiveCache.clear();
   }
 
   /**
@@ -814,6 +838,54 @@ export class CoreTenantGuard implements CanActivate, OnApplicationBootstrap, OnM
         this.tenantIdsCache.delete(key);
       }
     }
+    for (const [key, entry] of this.tenantActiveCache.entries()) {
+      if (now >= entry.expiresAt) {
+        this.tenantActiveCache.delete(key);
+      }
+    }
+  }
+
+  /**
+   * Whether a tenant may be used at all — `multiTenancy.isTenantActive`, cached for `cacheTtlMs`.
+   *
+   * Always true without the hook. Asked only AFTER the membership check, so a non-member learns
+   * nothing about a tenant's state. Protected so a custom guard can answer it differently.
+   */
+  protected async isTenantActive(tenantId: string): Promise<boolean> {
+    const hook = ConfigService.configFastButReadOnly?.multiTenancy?.isTenantActive;
+    if (typeof hook !== 'function') {
+      return true;
+    }
+    const ttl = this.cacheTtlMs;
+    const now = Date.now();
+    if (ttl > 0) {
+      const cached = this.tenantActiveCache.get(tenantId);
+      if (cached && now < cached.expiresAt) {
+        return cached.active;
+      }
+    }
+    const active = (await hook(tenantId, { connection: this.memberModel.db })) !== false;
+    if (ttl > 0) {
+      this.evictIfOverCapacity(this.tenantActiveCache);
+      this.tenantActiveCache.set(tenantId, { active, expiresAt: now + ttl });
+    }
+    return active;
+  }
+
+  /** 403 for a deactivated tenant. */
+  private async assertTenantActive(tenantId: string): Promise<void> {
+    if (!(await this.isTenantActive(tenantId))) {
+      throw new ForbiddenException('Tenant is inactive');
+    }
+  }
+
+  /** The tenant list without deactivated tenants — unchanged (and free) without the hook. */
+  private async filterActiveTenants(ids: string[]): Promise<string[]> {
+    if (typeof ConfigService.configFastButReadOnly?.multiTenancy?.isTenantActive !== 'function') {
+      return ids;
+    }
+    const active = await Promise.all(ids.map((id) => this.isTenantActive(id)));
+    return ids.filter((_id, index) => active[index]);
   }
 
   /**
@@ -847,6 +919,7 @@ export class CoreTenantGuard implements CanActivate, OnApplicationBootstrap, OnM
     if (!membership) {
       throw new ForbiddenException('Not a member of this tenant');
     }
+    await this.assertTenantActive(headerTenantId);
     request.tenantId = headerTenantId;
     request.tenantRole = capApiTokenTenantRole(user, membership.role as string) ?? undefined;
     return true;

package/src/core/modules/tus/INTEGRATION-CHECKLIST.md

@@ -174,7 +174,9 @@ every caller allowed to use TUS — and accepts every file type.
 
 **Multi-tenancy:** with `multiTenancy` configured, the core validates the tenant header against the
 caller's memberships and stores `metadata.tenantId` on the finished file; a non-member gets 403.
-Without `multiTenancy` nothing changes. Nothing to do in the project either way.
+Without `multiTenancy` nothing changes. On the server nothing to do. On the client, send the tenant header with the TUS upload itself
+(`useLtTusUpload({ headers })`): a header added by the project's API-client interceptor does not reach
+`tus-js-client`, and without it the upload silently stays tenant-less.
 
 ---
 

package/src/core/modules/tus/README.md

@@ -107,6 +107,17 @@ The TUS server automatically handles CORS headers for browser-based clients:
 - `Upload-Offset`
 - `Upload-Metadata`
 
+**`Access-Control-Allow-Origin` follows the API's CORS configuration (11.42.1+).** The tus handler
+writes its responses itself, and without `allowedOrigins` `@tus/server` answers `*`. With cookie
+authentication and separate app and API origins the request is credentialed, and every browser
+refuses `*` there — uploads failed in the browser although the server answered 201. The origins now
+come from `buildCorsConfig()` (`appUrl`, `baseUrl`, `cors.allowedOrigins`, `cors.allowAll`), the same
+decision REST, GraphQL and Better-Auth make; `tus.allowedOrigins` overrides. Without credentialed CORS
+(cookies off, or no origin resolvable) the tus default `*` stays.
+
+The preflight (`OPTIONS`) is answered by Nest's CORS layer and was never affected — test an
+**authenticated** request with an `Origin` header when checking this.
+
 ---
 
 ## Configuration
@@ -392,6 +403,15 @@ for them.
 | Header naming a tenant the caller belongs to         | the finished file gets `metadata.tenantId` |
 | Header naming a tenant the caller does NOT belong to | **403**, nothing is stored                 |
 
+**The header has to come from the TUS client itself.** Projects usually add `X-Tenant-Id` in an
+interceptor of their generated API client, and `tus-js-client` does not go through that client. Without
+an explicit header the upload is accepted, stays tenant-less and bypasses tenant filtering and any
+per-tenant quota, with no error anywhere. Pass it to the upload, e.g. with nuxt-extensions:
+
+```typescript
+const { addFiles } = useLtTusUpload({ headers: { 'X-Tenant-Id': currentTenantId } });
+```
+
 The tenant is recorded under `TUS_TENANT_METADATA_KEY` (`ltTenantId`), next to the owner under
 `TUS_OWNER_METADATA_KEY`. Both keys are framework-owned and always overwritten, so a client cannot
 put either of them into its own `Upload-Metadata`. `metadata.tenantId` on the finished file is what

package/src/core/modules/tus/core-tus.service.ts

@@ -9,6 +9,7 @@ import { Readable } from 'stream';
 
 import { GridFSHelper } from '../../common/helpers/gridfs.helper';
 import { ITusConfig } from '../../common/interfaces/server-options.interface';
+import { buildCorsConfig } from '../../common/helpers/cookies.helper';
 import { ConfigService } from '../../common/services/config.service';
 import { CoreRedisService } from '../../common/services/core-redis.service';
 import { CoreS3Service } from '../../common/services/core-s3.service';
@@ -638,6 +639,46 @@ export class CoreTusService implements OnModuleDestroy, OnModuleInit {
     return { metadata };
   }
 
+  /**
+   * The origins the tus handler may answer a cross-origin request with — or `undefined` to keep the
+   * tus server's own default (`*`).
+   *
+   * The tus handler writes its responses itself, past the API's CORS layer, and without
+   * `allowedOrigins` @tus/server sets `Access-Control-Allow-Origin: *`. On a credentialed request —
+   * cookie authentication with separate app and API origins — every browser refuses that, so no
+   * browser upload could succeed although the server answered 201. Preflights and 401s were fine
+   * (Nest answers those), which is why nothing noticed: only an AUTHENTICATED request reaches it.
+   *
+   * Taken from `tus.allowedOrigins` when set, else from `buildCorsConfig()` — the same decision REST,
+   * GraphQL and Better-Auth make. Without credentialed CORS configured the previous default stays.
+   */
+  protected resolveCorsOrigins(): ((origin: string) => boolean) | undefined {
+    const toOrigin = (value: string): string => {
+      try {
+        return new URL(value).origin;
+      } catch {
+        return value;
+      }
+    };
+    const fromList = (list: string[]) => {
+      const allowed = new Set(list.filter((entry) => typeof entry === 'string').map(toOrigin));
+      return (origin: string) => allowed.has(toOrigin(origin));
+    };
+
+    if (Array.isArray(this.config.allowedOrigins) && this.config.allowedOrigins.length) {
+      return fromList(this.config.allowedOrigins);
+    }
+    const options = this.options?.configService?.configFastButReadOnly ?? ConfigService.configFastButReadOnly ?? {};
+    const cors = buildCorsConfig(options);
+    if (cors.credentials !== true) {
+      return undefined;
+    }
+    if (cors.origin === true) {
+      return () => true;
+    }
+    return Array.isArray(cors.origin) ? fromList(cors.origin as string[]) : undefined;
+  }
+
   /**
    * The VALIDATED tenant a new upload belongs to, or `undefined`.
    *
@@ -716,8 +757,12 @@ export class CoreTusService implements OnModuleDestroy, OnModuleInit {
     // correct for the single-replica deployment that configuration describes.
     const locker = this.createLocker();
 
+    const cors = this.resolveCorsOrigins();
     const server = new Server({
       allowedHeaders: this.config.allowedHeaders || DEFAULT_TUS_ALLOWED_HEADERS,
+      // Without these, @tus/server answers every request with `Access-Control-Allow-Origin: *`,
+      // which a browser refuses on a credentialed (cookie) request — see resolveCorsOrigins().
+      ...(cors ? { allowedCredentials: true, allowedOrigins: cors } : {}),
       datastore,
       ...(locker ? { locker } : {}),
       maxSize: this.config.maxSize,

package/src/core/modules/tus/interfaces/tus-config.interface.ts

@@ -31,13 +31,16 @@ export const DEFAULT_TUS_ALLOWED_HEADERS: string[] = [];
  * Default TUS configuration
  */
 export const DEFAULT_TUS_CONFIG: Required<
-  Omit<ITusConfig, 'allowedTypes' | 'creation' | 'expiration'> & {
+  Omit<ITusConfig, 'allowedOrigins' | 'allowedTypes' | 'creation' | 'expiration'> & {
+    allowedOrigins: undefined;
     allowedTypes: undefined;
     creation: boolean;
     expiration: ITusExpirationConfig;
   }
 > = {
   allowedHeaders: DEFAULT_TUS_ALLOWED_HEADERS,
+  // Derived from the API CORS configuration (CoreTusService.resolveCorsOrigins())
+  allowedOrigins: undefined,
   allowedTypes: undefined,
   checksum: true,
   concatenation: true,

package/src/core/modules/user/core-user.service.ts

@@ -5,6 +5,7 @@ import { sha256 } from 'js-sha256';
 import { Document, Model } from 'mongoose';
 
 import { looksLikeSystemRole, SYSTEM_ROLE_PREFIX } from '../../common/enums/role.enum';
+import { accessDeniedException } from '../../common/exceptions/access-denied.exception';
 import { resolveAppUrlFromConfig } from '../../common/helpers/cookies.helper';
 import { maskEmail } from '../../common/helpers/logging.helper';
 import { assignPlain, isQueryableString, prepareServiceOptionsForCreate } from '../../common/helpers/input.helper';
@@ -673,6 +674,8 @@ export abstract class CoreUserService<
     const oldUser = (await this.mainDbModel.findById(id).lean().exec()) as null | TUser;
     const oldEmail = oldUser?.email;
 
+    this.assertCredentialChangeAllowed(oldUser, input, serviceOptions);
+
     // Capture the submitted password for the IAM sync before super.update()
     // hashes it in place.
     //
@@ -738,6 +741,56 @@ export abstract class CoreUserService<
     return updatedUser;
   }
 
+  /**
+   * Refuses a change of another account's e-mail address or password where the configuration promises
+   * tenant isolation from platform administrators.
+   *
+   * With multi-tenancy active and `adminBypass: false`, a platform administrator deliberately has no
+   * way into a tenant's data. Setting a tenant user's address or password is a way around that: change
+   * the address, request a reset, sign in as that person. The same holds for whoever created the
+   * account, because `S_CREATOR` may update it and the e-mail field is open to everyone who may.
+   *
+   * Untouched by design:
+   * - the account changing its own credentials,
+   * - profile fields, and an e-mail address sent along unchanged,
+   * - work without a signed-in user (invitation, password reset), which is the system's own,
+   * - every configuration other than multi-tenancy with `adminBypass: false`.
+   *
+   * `force` does not lift it: the rule is about WHO acts, and system work is defined by the absence of
+   * a current user. Protected so a project can widen or narrow it.
+   */
+  protected assertCredentialChangeAllowed(
+    target: null | TUser,
+    input: TUserInput,
+    serviceOptions?: ServiceOptions,
+  ): void {
+    const multiTenancy = ConfigService.configFastButReadOnly?.multiTenancy;
+    if (!multiTenancy || multiTenancy.enabled === false || multiTenancy.adminBypass !== false) {
+      return;
+    }
+    const currentUser = serviceOptions?.currentUser;
+    if (!currentUser?.id || !target) {
+      return;
+    }
+    // No exemption for administrator TARGETS: an administrator may write `roles`, so "promote the
+    // tenant account to ADMIN, then change its address" would open every account in two requests.
+    const targetId = String((target as any)._id ?? (target as any).id);
+    if (String(currentUser.id) === targetId) {
+      return;
+    }
+
+    const submitted = input as { email?: unknown; password?: unknown };
+    const normalize = (value: unknown) => (typeof value === 'string' ? value.trim().toLowerCase() : value);
+    const changesEmail = submitted?.email !== undefined && normalize(submitted.email) !== normalize(target.email);
+    const changesPassword = submitted?.password !== undefined;
+    if (changesEmail || changesPassword) {
+      throw accessDeniedException(
+        currentUser,
+        'The e-mail address and password of a tenant account can only be changed by the account itself',
+      );
+    }
+  }
+
   /**
    * Delete user with automatic cleanup of IAM auth data
    *

package/src/index.ts

@@ -47,6 +47,7 @@ export * from './core/common/helpers/input.helper';
 export * from './core/common/helpers/logging.helper';
 export * from './core/common/helpers/meta.helper';
 export * from './core/common/helpers/model.helper';
+export * from './core/common/helpers/outbound-url.helper';
 export * from './core/common/helpers/process-diagnostics.helper';
 export * from './core/common/helpers/register-enum.helper';
 export * from './core/common/helpers/scim.helper';
@@ -258,6 +259,7 @@ export * from './core/modules/tenant/core-tenant.decorators';
 export * from './core/modules/tenant/core-tenant.enums';
 export * from './core/modules/tenant/core-tenant.guard';
 export * from './core/modules/tenant/core-role-scope.registry';
+export * from './core/modules/tenant/core-tenant-role.helper';
 export * from './core/modules/tenant/core-tenant.helpers';
 export * from './core/modules/tenant/core-tenant.module';
 export * from './core/modules/tenant/core-tenant.service';