@lenne.tech/nest-server 11.42.0 → 11.42.1

package/migration-guides/11.42.0-to-11.42.1.md

@@ -0,0 +1,66 @@
+# Migration Guide: 11.42.0 → 11.42.1
+
+## Overview
+
+| Category             | Details                                                                                       |
+| -------------------- | --------------------------------------------------------------------------------------------- |
+| **Bugfix**           | Browser uploads through TUS work with cookie authentication and separate app/API origins (§1) |
+| **New option**       | `tus.allowedOrigins` overrides the derived origins (§1)                                       |
+| **Migration Effort** | None — `pnpm update`                                                                          |
+
+## Quick Migration
+
+```bash
+pnpm update @lenne.tech/nest-server
+```
+
+Vendor-mode projects pick up the core update; nothing else to change.
+
+## 1. TUS answered a credentialed request with `Access-Control-Allow-Origin: *`
+
+The tus handler writes its responses itself, past the API's CORS layer, and `@tus/server` answers
+`Access-Control-Allow-Origin: *` unless it is given `allowedOrigins`. The core gave it none. With cookie
+authentication and separate app and API origins (`lt dev up`, or `app.example.com` /
+`api.example.com`), the request is credentialed and the API adds
+`Access-Control-Allow-Credentials: true` — a combination every browser refuses:
+
+> The value of the 'Access-Control-Allow-Origin' header in the response must not be the wildcard '*'
+> when the request's credentials mode is 'include'.
+
+So every browser upload failed, while the server answered `201`. Preflights and unauthenticated
+requests were fine, which is why no test noticed — only an **authenticated** request with an `Origin`
+reaches the header.
+
+Since 11.42.1 the tus server takes its origins from `buildCorsConfig()`, the decision REST, GraphQL and
+Better-Auth already share (`appUrl`, `baseUrl`, `cors.allowedOrigins`, `cors.allowAll`), and mirrors an
+allowed `Origin`. A foreign origin gets no `Access-Control-Allow-Origin` at all. To use different
+origins for uploads:
+
+```typescript
+tus: {
+  allowedOrigins: ['https://uploads.example.com'];
+}
+```
+
+Without credentialed CORS configured — cookies off, or no origin resolvable — nothing changes; the tus
+default `*` stays.
+
+## 2. Dependencies
+
+Updated within their majors: `@modelcontextprotocol/sdk` 1.32.0, `mongoose` 9.10.4, `supertest` 7.3.1, and
+the `@aws-sdk/*` S3 packages 3.1146.0 (dev). NestJS stays on 11.
+
+`@modelcontextprotocol/sdk` 1.32.0 lets its CLIENT transports follow redirects only within the same
+origin. The framework uses the server side only, so this matters only to a project that builds its own MCP
+client transport and relied on a cross-origin redirect.
+
+## Troubleshooting
+
+| Symptom                                                                                            | Cause                                          | Fix                                                          |
+| -------------------------------------------------------------------------------------------------- | ---------------------------------------------- | ------------------------------------------------------------ |
+| Browser: "must not be the wildcard '*' when the request's credentials mode is 'include'" on `/tus` | 11.42.0 or older                               | Update to 11.42.1                                            |
+| Upload from an origin that is not the app refused by CORS                                          | Origin not in `appUrl` / `cors.allowedOrigins` | Add it to `cors.allowedOrigins`, or set `tus.allowedOrigins` |
+
+## Module Documentation
+
+- [TUS README](../src/core/modules/tus/README.md) — CORS Headers

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lenne.tech/nest-server",
-  "version": "11.42.0",
+  "version": "11.42.1",
   "description": "Modern, fast, powerful Node.js web framework in TypeScript based on Nest with a GraphQL API and a connection to MongoDB (or other databases).",
   "keywords": [
     "node",
@@ -92,7 +92,7 @@
     "@apollo/server": "5.5.1",
     "@as-integrations/express5": "1.1.2",
     "@getbrevo/brevo": "6.0.3",
-    "@modelcontextprotocol/sdk": "1.31.0",
+    "@modelcontextprotocol/sdk": "1.32.0",
     "@nestjs/apollo": "13.4.5",
     "@nestjs/common": "11.2.7",
     "@nestjs/core": "11.2.7",
@@ -126,7 +126,7 @@
     "json-to-graphql-query": "2.3.0",
     "lodash": "4.18.1",
     "mongodb": "7.6.0",
-    "mongoose": "9.10.3",
+    "mongoose": "9.10.4",
     "multer": "2.4.0",
     "node-mailjet": "6.0.11",
     "nodemailer": "10.0.13",
@@ -135,7 +135,7 @@
     "reflect-metadata": "0.2.2",
     "rfdc": "1.4.1",
     "rxjs": "7.8.2",
-    "supertest": "7.3.0",
+    "supertest": "7.3.1",
     "ts-morph": "28.0.0",
     "undici": "7.30.0",
     "ws": "8.21.3",
@@ -182,9 +182,9 @@
     }
   },
   "devDependencies": {
-    "@aws-sdk/client-s3": "3.1145.0",
-    "@aws-sdk/lib-storage": "3.1145.0",
-    "@aws-sdk/s3-request-presigner": "3.1145.0",
+    "@aws-sdk/client-s3": "3.1146.0",
+    "@aws-sdk/lib-storage": "3.1146.0",
+    "@aws-sdk/s3-request-presigner": "3.1146.0",
     "@better-auth/core": "1.7.7",
     "@better-auth/passkey": "1.7.7",
     "@compodoc/compodoc": "2.0.0",

package/src/core/common/interfaces/server-options.interface.ts

@@ -3606,6 +3606,23 @@ export interface ITusConfig {
    */
   allowedHeaders?: string[];
 
+  /**
+   * Origins the tus handler may answer a cross-origin request with (`Access-Control-Allow-Origin`).
+   *
+   * Unset, they come from the API's own CORS configuration — `buildCorsConfig()`, the function REST,
+   * GraphQL and Better-Auth share (`appUrl`, `baseUrl`, `cors.allowedOrigins`, `cors.allowAll`).
+   * Without credentialed CORS configured (cookies off, or no origin resolvable) the tus server keeps
+   * its own default, `*`.
+   *
+   * The wildcard is what broke browser uploads with cookie authentication and separate app/API
+   * origins before 11.42.1: a credentialed response with `Access-Control-Allow-Origin: *` is refused
+   * by every browser, although the server answered 201.
+   *
+   * @default undefined (derived from the API CORS configuration)
+   * @since 11.42.1
+   */
+  allowedOrigins?: string[];
+
   /**
    * Allowed MIME types for uploads.
    * If undefined, all types are allowed.

package/src/core/modules/tus/README.md

@@ -107,6 +107,17 @@ The TUS server automatically handles CORS headers for browser-based clients:
 - `Upload-Offset`
 - `Upload-Metadata`
 
+**`Access-Control-Allow-Origin` follows the API's CORS configuration (11.42.1+).** The tus handler
+writes its responses itself, and without `allowedOrigins` `@tus/server` answers `*`. With cookie
+authentication and separate app and API origins the request is credentialed, and every browser
+refuses `*` there — uploads failed in the browser although the server answered 201. The origins now
+come from `buildCorsConfig()` (`appUrl`, `baseUrl`, `cors.allowedOrigins`, `cors.allowAll`), the same
+decision REST, GraphQL and Better-Auth make; `tus.allowedOrigins` overrides. Without credentialed CORS
+(cookies off, or no origin resolvable) the tus default `*` stays.
+
+The preflight (`OPTIONS`) is answered by Nest's CORS layer and was never affected — test an
+**authenticated** request with an `Origin` header when checking this.
+
 ---
 
 ## Configuration

package/src/core/modules/tus/core-tus.service.ts

@@ -9,6 +9,7 @@ import { Readable } from 'stream';
 
 import { GridFSHelper } from '../../common/helpers/gridfs.helper';
 import { ITusConfig } from '../../common/interfaces/server-options.interface';
+import { buildCorsConfig } from '../../common/helpers/cookies.helper';
 import { ConfigService } from '../../common/services/config.service';
 import { CoreRedisService } from '../../common/services/core-redis.service';
 import { CoreS3Service } from '../../common/services/core-s3.service';
@@ -638,6 +639,46 @@ export class CoreTusService implements OnModuleDestroy, OnModuleInit {
     return { metadata };
   }
 
+  /**
+   * The origins the tus handler may answer a cross-origin request with — or `undefined` to keep the
+   * tus server's own default (`*`).
+   *
+   * The tus handler writes its responses itself, past the API's CORS layer, and without
+   * `allowedOrigins` @tus/server sets `Access-Control-Allow-Origin: *`. On a credentialed request —
+   * cookie authentication with separate app and API origins — every browser refuses that, so no
+   * browser upload could succeed although the server answered 201. Preflights and 401s were fine
+   * (Nest answers those), which is why nothing noticed: only an AUTHENTICATED request reaches it.
+   *
+   * Taken from `tus.allowedOrigins` when set, else from `buildCorsConfig()` — the same decision REST,
+   * GraphQL and Better-Auth make. Without credentialed CORS configured the previous default stays.
+   */
+  protected resolveCorsOrigins(): ((origin: string) => boolean) | undefined {
+    const toOrigin = (value: string): string => {
+      try {
+        return new URL(value).origin;
+      } catch {
+        return value;
+      }
+    };
+    const fromList = (list: string[]) => {
+      const allowed = new Set(list.filter((entry) => typeof entry === 'string').map(toOrigin));
+      return (origin: string) => allowed.has(toOrigin(origin));
+    };
+
+    if (Array.isArray(this.config.allowedOrigins) && this.config.allowedOrigins.length) {
+      return fromList(this.config.allowedOrigins);
+    }
+    const options = this.options?.configService?.configFastButReadOnly ?? ConfigService.configFastButReadOnly ?? {};
+    const cors = buildCorsConfig(options);
+    if (cors.credentials !== true) {
+      return undefined;
+    }
+    if (cors.origin === true) {
+      return () => true;
+    }
+    return Array.isArray(cors.origin) ? fromList(cors.origin as string[]) : undefined;
+  }
+
   /**
    * The VALIDATED tenant a new upload belongs to, or `undefined`.
    *
@@ -716,8 +757,12 @@ export class CoreTusService implements OnModuleDestroy, OnModuleInit {
     // correct for the single-replica deployment that configuration describes.
     const locker = this.createLocker();
 
+    const cors = this.resolveCorsOrigins();
     const server = new Server({
       allowedHeaders: this.config.allowedHeaders || DEFAULT_TUS_ALLOWED_HEADERS,
+      // Without these, @tus/server answers every request with `Access-Control-Allow-Origin: *`,
+      // which a browser refuses on a credentialed (cookie) request — see resolveCorsOrigins().
+      ...(cors ? { allowedCredentials: true, allowedOrigins: cors } : {}),
       datastore,
       ...(locker ? { locker } : {}),
       maxSize: this.config.maxSize,

package/src/core/modules/tus/interfaces/tus-config.interface.ts

@@ -31,13 +31,16 @@ export const DEFAULT_TUS_ALLOWED_HEADERS: string[] = [];
  * Default TUS configuration
  */
 export const DEFAULT_TUS_CONFIG: Required<
-  Omit<ITusConfig, 'allowedTypes' | 'creation' | 'expiration'> & {
+  Omit<ITusConfig, 'allowedOrigins' | 'allowedTypes' | 'creation' | 'expiration'> & {
+    allowedOrigins: undefined;
     allowedTypes: undefined;
     creation: boolean;
     expiration: ITusExpirationConfig;
   }
 > = {
   allowedHeaders: DEFAULT_TUS_ALLOWED_HEADERS,
+  // Derived from the API CORS configuration (CoreTusService.resolveCorsOrigins())
+  allowedOrigins: undefined,
   allowedTypes: undefined,
   checksum: true,
   concatenation: true,