@lenne.tech/nest-server 11.42.1 → 11.42.3

package/.claude/rules/configurable-features.md

@@ -320,7 +320,8 @@ This pattern is currently applied to:
 | Response Model Interceptor | `security.responseModelInterceptor` | Boolean Shorthand | `true` (enabled), `debug: false` |
 | Translate Response Interceptor | `security.translateResponseInterceptor` | Boolean Shorthand | `true` (enabled) |
 | Secret Fields Removal | `security.secretFields` | Array | `['password', 'verificationToken', ...]` |
-| Multi-Tenancy | `multiTenancy` | Presence Implies Enabled | **`excludeSchemas` is an OFF SWITCH for isolation, per model** — a listed schema gets no tenant filter at all; since 11.35.0 the plugin WARNS once per model when the excluded schema declares `tenantId` (i.e. was built for isolation). The framework's own docs recommended `['User', 'Session']` until then; that is withdrawn — it is only right for the global-user model. Since 11.35.0 GraphQL operations over the WEBSOCKET also run inside a `RequestContext` (`CoreModule` installs a context-aware `execute`/`subscribe` pair inside `subscriptions`, where `ApolloDriver` forwards it): the tenant comes from the handshake header validated against an active membership, else from the subscriber's memberships, and an unresolvable tenant leaves the safety net to refuse the read rather than returning everything. `headerName: 'x-tenant-id'`, `membershipModel: 'TenantMember'`, `adminBypass: true`, `excludeSchemas: []`, `roleHierarchy: { member: 1, manager: 2, owner: 3 }`, `cacheTtlMs: 30000` (0 disables, process-local). System roles (`S_EVERYONE`, `S_USER`, `S_VERIFIED`) are checked as OR alternatives before real roles; method-level system roles take precedence; membership validated for context when system role grants access + header present. Hierarchy roles use level comparison, normal roles use exact match. Use `DefaultHR` or `createHierarchyRoles()` for type-safe role constants. Bypass: `RequestContext.runWithBypassTenantGuard()`. Cache invalidation: `invalidateUser(userId)` / `invalidateAll()` are **instance** methods on the singleton `CoreTenantGuard` — inject it and call `this.tenantGuard?.invalidateUser(userId)`, never `CoreTenantGuard.invalidateUser(...)` (there is no static). With `redis` configured, both additionally BROADCAST the invalidation to every replica (`<keyPrefix>:tenant-cache:invalidate` pub/sub); without Redis they clear the local process only, so other replicas stay stale until `cacheTtlMs`. A received broadcast clears locally without re-publishing. **`isTenantActive` (11.42.0)**: optional hook `(tenantId, { connection }) => boolean \| Promise<boolean>`, absent = every tenant active (no change). Asked AFTER the membership check on every path that establishes a tenant: 403 on header paths and for tenant API tokens, no enrichment on `S_EVERYONE`, dropped from the header-less tenant list, no tenant for a NEW WebSocket subscription (an open one keeps its tenant until it reconnects — known limit, shared with removed memberships); an admin under `adminBypass` is exempt (someone must be able to switch it back on). Only `false` deactivates. Cached for `cacheTtlMs`; `invalidateTenant(tenantId)` clears and broadcasts (`{ scope: 'tenant' }`). A function, so `config.env.ts` only — not reachable through `NSC__*`. **`adminBypass: false` (11.42.0)** additionally withholds two things that went around it: `CoreUserService.update()` refuses changing another account's e-mail or password (`assertCredentialChangeAllowed()`, administrator targets included — promote-then-change — system work without a current user exempt), and the AI tool registry grants no ADMIN bypass |
+| Multi-Tenancy | `multiTenancy` | Presence Implies Enabled | **`excludeSchemas` is an OFF SWITCH for isolation, per model** — a listed schema gets no tenant filter at all; since 11.35.0 the plugin WARNS once per model when the excluded schema declares `tenantId` (i.e. was built for isolation). The framework's own docs recommended `['User', 'Session']` until then; that is withdrawn — it is only right for the global-user model. Since 11.35.0 GraphQL operations over the WEBSOCKET also run inside a `RequestContext` (`CoreModule` installs a context-aware `execute`/`subscribe` pair inside `subscriptions`, where `ApolloDriver` forwards it): the tenant comes from the handshake header validated against an active membership, else from the subscriber's memberships, and an unresolvable tenant leaves the safety net to refuse the read rather than returning everything. `headerName: 'x-tenant-id'`, `membershipModel: 'TenantMember'`, `adminBypass: true`, `excludeSchemas: []`, `roleHierarchy: { member: 1, manager: 2, owner: 3 }`, `cacheTtlMs: 30000` (0 disables, process-local). System roles (`S_EVERYONE`, `S_USER`, `S_VERIFIED`) are checked as OR alternatives before real roles; method-level system roles take precedence; membership validated for context when system role grants access + header present. Hierarchy roles use level comparison, normal roles use exact match. Use `DefaultHR` or `createHierarchyRoles()` for type-safe role constants. Bypass: `RequestContext.runWithBypassTenantGuard()`. Cache invalidation: `invalidateUser(userId)` / `invalidateAll()` are **instance** methods on the singleton `CoreTenantGuard` — inject it and call `this.tenantGuard?.invalidateUser(userId)`, never `CoreTenantGuard.invalidateUser(...)` (there is no static). With `redis` configured, both additionally BROADCAST the invalidation to every replica (`<keyPrefix>:tenant-cache:invalidate` pub/sub); without Redis they clear the local process only, so other replicas stay stale until `cacheTtlMs`. A received broadcast clears locally without re-publishing. **`isTenantActive` (11.42.0)**: optional hook `(tenantId, { connection }) => boolean \| Promise<boolean>`, absent = every tenant active (no change). Asked AFTER the membership check on every path that establishes a tenant: 403 on header paths and for tenant API tokens, no enrichment on `S_EVERYONE`, dropped from the header-less tenant list, no tenant for a NEW WebSocket subscription, and since 11.42.3 an OPEN one is closed with 4403 on `invalidateTenant()` (or at its next event once `graphQl.subscriptionRevalidationMs` has passed — see the GraphQL Subscription Re-check row); an admin under `adminBypass` is exempt (someone must be able to switch it back on). Only `false` deactivates. Cached for `cacheTtlMs`; `invalidateTenant(tenantId)` clears and broadcasts (`{ scope: 'tenant' }`). A function, so `config.env.ts` only — not reachable through `NSC__*`. **`adminBypass: false` (11.42.0)** additionally withholds two things that went around it: `CoreUserService.update()` refuses changing another account's e-mail or password (`assertCredentialChangeAllowed()`, administrator targets included — promote-then-change — system work without a current user exempt), and the AI tool registry grants no ADMIN bypass |
+| GraphQL Subscription Re-check | `graphQl.subscriptionRevalidationMs` | Numeric — `0` = STRICTEST, `false` = off, invalid → default (a fifth shape: Family C's "invalid never means unbounded", but `0` asks for MORE checking, not less) | **30000 since 11.42.3.** Before, a WebSocket was authorized once, at the handshake, and every event and operation on it ran on that snapshot until the client reconnected. Every connection a `CoreModule` `onConnect` accepts is now registered (`registerWsConnection()`) and re-checked — at once when an invalidation names it (`CoreTenantGuard.invalidateUser()` / `invalidateTenant()` / `invalidateAll()`, `CoreUserService.setRoles()` and role/verification `update()`s, the legacy password reset, and Better-Auth deleting a session through `wsSessionRevocationPlugin()`), and otherwise before the next event or operation once the last check is older than this value. The check re-runs the handshake's own authentication (session store, Better-Auth JWT signature/expiry, or for legacy tokens `CoreAuthService.verifyJwt()` — signature/expiry, verified on the WebSocket since 11.42.3 — plus the device binding) and the tenant resolution; any difference in user id, roles, verification state or tenant scope closes the socket with **4403**, which the graphql-ws client retries — the user continues with current rights or is refused at the handshake. `0` re-checks on every event and operation (one session lookup each); `false` switches only the TIME-based check off, invalidations still apply. Process-local registry: an invalidation reaches other replicas only where the tenant guard's Redis broadcast carries it; everything else is bounded by the interval. A project that replaces `onConnect` through `graphQl.driver.subscriptions` must call `registerWsConnection()` itself to keep this. Implementation: `common/helpers/graphql-ws-connection.helper.ts` |
 | API Tokens | `apiTokens` | Boolean Shorthand + Presence Implies Enabled — absent = off | `prefix: 'ltt'`, `scopes: []` (vocabulary; empty = no token creatable, boot warning), `manageRole`: highest hierarchy role, `maxAssertionLifetimeSeconds: 900` (invalid → default, never unbounded — Family C), `rateLimit: { max: 600, windowSeconds: 60 }` per token (**on by default**, `false` disables; Redis-shared when configured), `userTokens: true`, `tenantTokens: true` (effective only with `multiTenancy`), `encryptionKey` → `SECRETS_ENCRYPTION_KEY` → dev default (boot FAILS in production/staging). Top-level, NOT under `multiTenancy`: user tokens must work without it. **Deny by default**: every guard refuses a token on a route without `@ApiTokenScopes()`, public routes included, via ONE shared function (`enforceApiTokenRoute`) called BEFORE each guard's public-route shortcut. USER tokens act as their user with global roles REMOVED (no admin bypass); TENANT tokens act with the lowest hierarchy role in their own tenant, and a route guarded ONLY by `S_SELF` / `S_CREATOR` refuses them (a tenant token is nobody's self — skipping those roles would grant for any target). A tenant token depends on no member, so it outlives an off-boarded or deleted tenant until the project calls `deleteAllForTenant()`. The boot refuses a hierarchy in which that lowest role reaches `manageRole`. A prefixed credential that fails answers 401 on every route (not anonymous); `CoreBetterAuthMiddleware` skips prefixed credentials entirely, cookie fallback included. A password reset that ends the user's sessions ends their USER tokens too (legacy reset always; IAM reset while `betterAuth.emailAndPassword.revokeSessionsOnPasswordReset` is on), wired through `core-api-token.registry.ts` so neither reset path imports the optional module. Implementation: `src/core/modules/api-token/` |
 | BetterAuth Tenant Skip | `betterAuth.skipTenantCheck` | Explicit Boolean | `true` (default). When `true` and no `X-Tenant-Id` header is sent, IAM endpoints (controller + resolver) skip `CoreTenantGuard` tenant validation. When header IS present, normal membership validation runs regardless. Set `false` for tenant-aware auth scenarios (subdomain-based, invite links, SSO per tenant) |
 | Debug Process Input | `debugProcessInput` | Explicit Boolean | `false` (default). When `true`, logs a debug message when `prepareInput()` changes the input type during `process()`. Has performance cost due to `JSON.stringify` on every `process()` call — enable only for debugging |
@@ -329,7 +330,7 @@ This pattern is currently applied to:
 | CORS | `cors` | Boolean Shorthand | `enabled: true`, `allowAll: false`, `deriveAppUrl: true`. Origins come from `appUrl`/`baseUrl`, resolved by the shared `resolveServerUrls()` helper (`cookies.helper.ts`) that ALL three CORS layers use (GraphQL, REST, BetterAuth `trustedOrigins`) — they can no longer drift. `appUrl` resolution: explicit → derived from a **host-split** localhost `baseUrl` (its `api.` label strips to a sibling host: `https://api.crm.localhost` → `https://crm.localhost`, as served by `lt dev up`; the port is preserved) → localhost default (`http://localhost:3001`, only for `env: local`/`ci`/`e2e` with a **port-split** localhost `baseUrl` — one host, API `:3000`, app `:3001`; `https://api.localhost` strips to the bare `localhost` the API already answers on and is therefore a port split, not a host split) → derived from `baseUrl` by stripping a leading `api.` label (`https://api.example.com` → `https://example.com`). **Security:** the derived origin receives credentialed CORS; set `deriveAppUrl: false` when the apex domain is not trusted, then list the frontend origin via `appUrl`/`allowedOrigins` (a host-split localhost `baseUrl` then falls back to the localhost default). The derivation never yields a bare TLD (`https://api.dev` unchanged) and never emits the opaque `null` origin (non-http(s) `baseUrl` passes through verbatim). `allowAll: true` mirrors the request origin for REST/GraphQL, but BetterAuth's `trustedOrigins` still resolve to `[appUrl]` (+ passkey origins) — an origin check has no "allow everything" mode, so a separately hosted frontend must appear in `appUrl`/`allowedOrigins` (or set `betterAuth.trustedOrigins` explicitly). `enabled: false` disables CORS on all layers including BetterAuth (`trustedOrigins: []`, which still trusts BetterAuth's own `baseURL`). Explicit `betterAuth.trustedOrigins` always takes precedence |
 | Central Redis | `redis` | Boolean Shorthand + Presence Implies Enabled | `host: 'localhost'`, `port: 6379`, `db: 0`, `keyPrefix: <package.json name, slugified>` (per APPLICATION, not per framework — a constant default silently collides when two apps share one Redis; set it explicitly when sharing IS intended); `url` (takes precedence over host/port/db/credentials), `username`/`password`, `options` (passed to the ioredis constructor). `true` / `{}` enables with defaults; `{ enabled: false }` pre-configures without enabling; **absent = every consumer keeps its process-local fallback** (that fallback is the whole backward-compatibility story of 11.33.0). Requires the OPTIONAL peer `ioredis` — configured-but-missing **fails the boot** with a named error rather than crashing on first use. `keyPrefix` is applied by the framework per key, NOT as ioredis `keyPrefix` (that would collide with BullMQ's own prefix). One `CoreRedisService` serves all features: shared client (`getClient()`), one cached subscriber (`getSubscriber()` — a subscribing client cannot run commands), dedicated connections (`createClient(label)`); all are tracked and quit on shutdown. Switches on automatically: exact cross-replica rate limits via `RedisRateLimitStore` (see the Legacy Auth / BetterAuth / AI rate-limit rows), cron dedup (see Cron Job Deduplication row), `CoreRedisPubSub` as `PUB_SUB` for cluster-wide GraphQL subscriptions (**payloads must be JSON-serializable — `Date`, class instances, `Map`/`Set`, `undefined` do not survive**), tenant-cache invalidation broadcast, Hub collector mirroring, MCP session registry (turns a wrong-replica request from a misleading `404` into a `409` — `/ai/mcp` still REQUIRES sticky sessions, sessions are not portable) |
 | File Access Roles | `file.downloadRoles`, `file.uploadRoles`, `file.deleteRoles` | Config-Driven Role List | `[RoleEnum.ADMIN]` each. **These are the only breaking change a single-replica project gets in 11.33.0** — six members moved from `@Roles(S_EVERYONE)` to these knobs: `GET /files/id/:id`, `GET /files/:filename` and `getFileInfo` (`downloadRoles`), `uploadFile` / `uploadFiles` (`uploadRoles`), `deleteFile` (`deleteRoles`). Plain role STRINGS, not `RoleEnum` members, so project roles work (`['company-admin', 'editor']`). Applied at boot by `applyFileRoles()` via `Reflect.defineMetadata('roles', …)` on the base-class methods — the same runtime mechanism `CorePermissionsModule` uses, because the value is only known from config. **`[]`, a non-array, or an array holding a non-string is REJECTED with a warning and the default applies** — an all-empty role set reads to the guards as "no roles required" and would OPEN the route, the exact opposite of the intent. **ADMIN is always unioned in**: both `CoreFileController` and `CoreFileResolver` carry a class-level `@Roles(RoleEnum.ADMIN)` and the guards UNION class + handler metadata, so these knobs can grant but never exclude admins. Both classes also carry `@SkipTenantCheck()` — GridFS and the S3 metadata collection are reached outside Mongoose, so `mongooseTenantPlugin` never scopes them and a role name alone cannot express a per-tenant rule; roles resolve against `user.roles`, never `membership.role`. **A subclass that OVERRIDES a member opts out permanently** (decorator metadata lives on the function object, and an override is a different function) — inherit the member instead. **Since 11.35.1 that opt-out is REPORTED**: `CoreFileAccessAuditInitializer` reads the roles off the class the project actually registered at `onApplicationBootstrap` (the earliest point at which the route table exists, which is why it is a provider and not part of `applyFileRoles()`) and warns when a member is open beyond ADMIN for a reason the configuration cannot explain — the case the construction-time warning below is structurally blind to. It only REPORTS: overwriting an override's metadata, the way `TusModule.applyRoles()` does, would silently relax a route a project pinned on purpose. Roles are the coarse filter only; per-file rules belong in `CoreFileService.checkRights()`, which now receives `currentUser` and can read raw metadata via `getRawFileInfo()`. **Since 11.35.0 a reused FILENAME resolves to the most recent file** in all three stores (`uploadDate` desc, `_id` tie-break) and every by-name read path resolves a document and then reads by ID — under GridFS the by-name metadata lookup answered the oldest document while `openDownloadStreamByName()` served the newest, so a per-file rule approved one file and the bytes of another came back. Consequence: `duplicateById()` keeps the source's filename and the copy carries no metadata, so the copy now wins the name and an `ownerId` rule refuses it — give the copy its own metadata or its own name. **Since 11.35.0 `CoreFileService` WARNS at construction** when `multiTenancy` is active AND a knob names a role other than ADMIN AND `checkRights()` is not overridden — the file stores are reached outside Mongoose, so these role names resolve against `user.roles` (global) and every holder reaches every tenant's files; only `checkRights()` can narrow that. Silent on the admin-only default and silent when a per-file rule exists. Implementation: `src/core/modules/file/file-roles.config.ts` (`FILE_ROLE_DEFAULTS`, `FILE_ROLE_MEMBERS`, the three warnings, the shared `hasDeclaredFilePolicy()` silencer) + `file-roles.helper.ts` (`applyFileRoles`) + `core-file-access-audit.initializer.ts` (the registered-class audit) |
-| TUS Roles | `tus.roles` | Config-Driven Role List | `[RoleEnum.S_USER]` (was `S_EVERYONE` — breaking). A TUS upload writes into the SAME store the download routes guard, and the termination extension (on by default) can delete from it, so anonymous writes into a store only privileged callers may read is the wrong way round. Applied by `TusModule.applyRoles()` onto the registered controller class **and** onto `handleTus` / `handleTusWithId`. Same rejection rule as the file roles: `[]` / non-array / non-string → warning + `DEFAULT_TUS_CONFIG.roles`. **`OPTIONS` is deliberately exempt**: `handleTusOptions` / `handleTusOptionsWithId` keep their own handler-level `@Roles(RoleEnum.S_EVERYONE)`, because that is the CORS preflight — browsers send it WITHOUT credentials, and it returns server capabilities only. Gating it would make every browser upload fail before the first byte. `CoreTusController` also carries `@SkipTenantCheck()`. A custom controller is covered as long as it INHERITS the handlers; one that re-declares `@All()` / `@Roles()` carries its own metadata and thereby opts out — the documented way to hard-code a policy config must not be able to change. **Set `roles: [RoleEnum.S_EVERYONE]` explicitly if you accept attachments on a public form.** **Since 11.35.0 `tus.roles` is no longer the only gate**: `onUploadCreate` records the authenticated creator under `TUS_OWNER_METADATA_KEY` (`ltOwnerId`, always OVERWRITING any client-supplied value) and `onIncomingRequest` refuses HEAD/PATCH/DELETE naming an upload the caller does not own — with **404**, the file module's refusal policy. Before that, any authenticated caller who learned an upload id could APPEND BYTES to somebody else's upload, which are then migrated into the file store under the victim's filename. The finished file also gains `metadata.ownerId`, without which the documented per-file ownership rule could never authorize a tus-uploaded file (admin-only in practice). An OWNER-LESS upload stays reachable — uploads predating 11.35.0 have none, and neither does a deliberately public form. `readRequestUserId()` / `assertUploadOwnership()` are `protected`. **Since 11.41.9 the tenant is recorded too, but ONLY with `multiTenancy` configured** (not `enabled: false`) and a tenant guard registered: `onUploadCreate` validates the tenant header against the caller's active memberships through `core-tenant-context.registry.ts` (the routes carry `@SkipTenantCheck()`, so the guard did not), refuses a non-member with **403**, writes it under `TUS_TENANT_METADATA_KEY` (`ltTenantId`, always overwritten like the owner key) and the finished file gains `metadata.tenantId`. No header → tenant-less, as before; without `multiTenancy` nothing is read or written. A project hooks in through `TusModule.forRoot({ service })` (a `CoreTusService` subclass, constructed by the module as `(connection, options)` — project providers come from `options.moduleRef` at call time) and the `protected onUploadCreate(req, upload)`, the one point where `Upload-Length` is known and nothing is stored yet; an override must return `super.onUploadCreate()`. Note that `@tus/server` v2 hands its hooks a WHATWG `ServerRequest`, so a guard's `req.user` is reachable only via `runtime.node.req`. **CORS (11.42.1)**: the tus handler's `Access-Control-Allow-Origin` comes from `buildCorsConfig()` (or `tus.allowedOrigins`), plus `allowedCredentials` — without it `@tus/server` answered `*`, which browsers refuse on a credentialed request, so cookie-authenticated uploads across split app/API origins failed in every browser while the server answered 201; no credentialed CORS configured → the `*` default stays. Implementation: `src/core/modules/tus/tus.module.ts`, `src/core/modules/tus/core-tus.service.ts`, `src/core/modules/tus/tus.constants.ts` |
+| TUS Roles | `tus.roles` | Config-Driven Role List | `[RoleEnum.S_USER]` (was `S_EVERYONE` — breaking). A TUS upload writes into the SAME store the download routes guard, and the termination extension (on by default) can delete from it, so anonymous writes into a store only privileged callers may read is the wrong way round. Applied by `TusModule.applyRoles()` onto the registered controller class **and** onto `handleTus` / `handleTusWithId`. Same rejection rule as the file roles: `[]` / non-array / non-string → warning + `DEFAULT_TUS_CONFIG.roles`. **`OPTIONS` is deliberately exempt**: `handleTusOptions` / `handleTusOptionsWithId` keep their own handler-level `@Roles(RoleEnum.S_EVERYONE)`, because that is the CORS preflight — browsers send it WITHOUT credentials, and it returns server capabilities only. Gating it would make every browser upload fail before the first byte. `CoreTusController` also carries `@SkipTenantCheck()`. A custom controller is covered as long as it INHERITS the handlers; one that re-declares `@All()` / `@Roles()` carries its own metadata and thereby opts out — the documented way to hard-code a policy config must not be able to change. **Set `roles: [RoleEnum.S_EVERYONE]` explicitly if you accept attachments on a public form.** **Since 11.35.0 `tus.roles` is no longer the only gate**: `onUploadCreate` records the authenticated creator under `TUS_OWNER_METADATA_KEY` (`ltOwnerId`, always OVERWRITING any client-supplied value) and `onIncomingRequest` refuses HEAD/PATCH/DELETE naming an upload the caller does not own — with **404**, the file module's refusal policy. Before that, any authenticated caller who learned an upload id could APPEND BYTES to somebody else's upload, which are then migrated into the file store under the victim's filename. The finished file also gains `metadata.ownerId`, without which the documented per-file ownership rule could never authorize a tus-uploaded file (admin-only in practice). An OWNER-LESS upload stays reachable — uploads predating 11.35.0 have none, and neither does a deliberately public form. `readRequestUserId()` / `assertUploadOwnership()` are `protected`. **Since 11.41.9 the tenant is recorded too, but ONLY with `multiTenancy` configured** (not `enabled: false`) and a tenant guard registered: `onUploadCreate` validates the tenant header against the caller's active memberships through `core-tenant-context.registry.ts` (the routes carry `@SkipTenantCheck()`, so the guard did not), refuses a non-member with **403**, writes it under `TUS_TENANT_METADATA_KEY` (`ltTenantId`, always overwritten like the owner key) and the finished file gains `metadata.tenantId`. No header → tenant-less, as before; without `multiTenancy` nothing is read or written. A project hooks in through `TusModule.forRoot({ service })` (a `CoreTusService` subclass, constructed by the module as `(connection, options)` — project providers come from `options.moduleRef` at call time) and the `protected onUploadCreate(req, upload)`, the one point where `Upload-Length` is known and nothing is stored yet; an override must return `super.onUploadCreate()`. Note that `@tus/server` v2 hands its hooks a WHATWG `ServerRequest`, so a guard's `req.user` is reachable only via `runtime.node.req`. **CORS (11.42.1)**: the tus handler's `Access-Control-Allow-Origin` comes from `buildCorsConfig()` (or `tus.allowedOrigins`), plus `allowedCredentials` — without it `@tus/server` answered `*`, which browsers refuse on a credentialed request, so cookie-authenticated uploads across split app/API origins failed in every browser while the server answered 201; no credentialed CORS configured → the `*` default stays. **compression (11.42.2)**: `@tus/server` finishes responses with `res.end(callback)`, which `compression`'s two-argument `res.end(chunk, encoding)` patch reads as a chunk (`ERR_INVALID_ARG_TYPE … Received function`); with the starter's `filter: () => true, threshold: 0` every finished upload HUNG without an answer AFTER the file was stored (headers already sent, so no error response could follow). `CoreTusService` wraps `server.handle()` and normalises `res.end` per response (`normalizeEndCallback()`, callback on `finish`/`close`), so no `main.ts` change is needed. Implementation: `src/core/modules/tus/tus.module.ts`, `src/core/modules/tus/core-tus.service.ts`, `src/core/modules/tus/tus.constants.ts` |
 | File Storage | `file.storage` + `file.storageDir` + `s3` | Explicit Enum with DERIVED default | `'filesystem' \| 'gridfs' \| 's3'`. **Unset → derived**, most capable first: `'s3'` when `s3.bucket` is set, else `'gridfs'` when `mongoose.uri` is set, else `'filesystem'`. **Set → enforced**: an unavailable store FAILS THE BOOT (`assertFileStorageAvailable()`), it never falls back — a silent fallback puts files in a store the operator does not believe they are in, unrecoverably. A DERIVED driver is enforced too (`s3.bucket` set but `s3Service` not forwarded to `super()` → boot error). Metadata always lives in MongoDB whichever driver holds the bytes (`fs.files` / `s3-files` / `filesystem-files`) — it has to stay queryable for `findFileInfo()` and `checkRights()`. Reads consult ALL stores so switching drivers is forward-only with no migration; writes go to the active driver only. `'filesystem'` is pod-local: not shared between replicas, lost on restart unless `storageDir` is a mounted volume. `s3`: `bucket` (required — the one thing S3 cannot default, hence the eligibility test), `region: 'us-east-1'`, `forcePathStyle: false`, `autoCreateBucket: false` (off by design: production buckets come from infrastructure code, whose credentials usually cannot CreateBucket), `stagingBucket: bucket`, `presignedDownloads: false` (`true`/`{}` → `expiresInSeconds: 300`), `endpoint` (MinIO/RustFS), `accessKeyId`/`secretAccessKey` (omit → AWS default credential chain), `enabled: false` to pre-configure. Requires the OPTIONAL peer `@aws-sdk/client-s3`, plus `@aws-sdk/s3-request-presigner` for presigned downloads. **Uploads are never buffered on the S3 path** (11.41.7): a known length (`FileUploadSource.size`, TUS, a buffer) goes up as one streamed PutObject up to `CoreS3Service.MAX_SINGLE_PUT_BYTES` (5 GiB — AWS S3 refuses more in one request, `EntityTooLarge`) and as a multipart upload above it, an unknown one — every GraphQL and streamed REST upload — as a multipart upload via the OPTIONAL peer `@aws-sdk/lib-storage`. Missing peer → one boot warning and the old in-memory buffering, NOT a boot failure (multipart optimises a path that works without it). `size` must be the file's EXACT length — never a multipart request's `Content-Length`; anything but a positive integer counts as unknown (`isKnownUploadSize()`), and the recorded length of an unknown-length upload comes from a HEAD of the stored object. `presignedDownloads` makes `GET /files/id/:id` answer `302` to a time-limited S3 URL instead of streaming — the URL is a bearer capability, authorized once at issue time. The resolved driver is logged at boot (`[CoreFileStorage] File storage: …`) |
 | TUS S3 Staging | `tus.s3Staging` | Explicit Boolean (default ON when S3 configured) | `true` when `s3` is configured, otherwise inert. Stages in-progress uploads in `s3.stagingBucket` via `@tus/s3-store` instead of `tus.uploadDir` on local disk, so resumable uploads survive replica restarts and need no sticky sessions. Set `false` to force local disk. Missing OPTIONAL peer `@tus/s3-store` → warning + fall back to local disk (NOT a boot failure). **Give the staging bucket a lifecycle rule expiring incomplete multipart uploads** — the framework's own expiration cleanup is skipped in S3 mode (S3 is the right place for that policy), so aborted uploads otherwise accumulate parts nothing removes |
 | Cron Job Deduplication | per job: `distributed` in `CronJobConfig` | Explicit Boolean | **`true` when `redis` is configured, otherwise `false`** — a single-replica project that upgrades must not silently gain a `cron-locks` collection, a lease write per tick, and a new way for a tick to be skipped. A Redis-less multi-replica fleet opts in per job with `distributed: true` (MongoDB lease). Mechanism: BullMQ job scheduler when Redis + the OPTIONAL peer `bullmq` are present AND `cronTime` is a string without `utcOffset`; otherwise local timer + lease (Redis `SET NX`, else a TTL-indexed `cron-locks` document). Tick lease TTL 3600 s. **Leases fail open** — an unreachable lease store runs the tick everywhere rather than stopping all scheduled work fleet-wide. **`runOnInit` (default `true`) deduplicates over a FIXED per-job key with a 300 s TTL**, because replicas do not share a boot instant: replicas booting within 5 min run the startup tick once between them, and a replica restarting inside that window SKIPS its startup tick — set `distributed: false` on jobs whose `runOnInit` work is per-process (warming a process-local cache). No constructor change needed: `CoreModule` fills `core-cron-jobs.registry.ts` via `CoreCronJobsInitializer` and `CoreCronJobs` reads it lazily; explicit `{ connection, redisService }` in `CoreCronJobsOptions` wins. With neither source it warns once and every replica runs every tick |

package/.claude/rules/role-system.md

@@ -444,9 +444,37 @@ account over with an address change and a reset, which is precisely the access `
 withholds.
 
 **Deactivated tenants.** `multiTenancy.isTenantActive` is asked after the membership on every path that
-establishes a tenant (see `.claude/rules/configurable-features.md`, Multi-Tenancy row). A GraphQL
-subscription that is already open keeps its tenant until the client reconnects — a known limit it
-shares with a removed membership.
+establishes a tenant (see `.claude/rules/configurable-features.md`, Multi-Tenancy row).
+
+**Open WebSockets (11.42.3).** A WebSocket is authorized at the handshake, and until 11.42.3 that was
+the only check: a removed membership, a deactivated tenant, a withdrawn role or a revoked session took
+effect on every new request and on none of the sockets already open. Now every connection
+`CoreModule`'s `onConnect` accepts is registered (`registerWsConnection()`,
+`common/helpers/graphql-ws-connection.helper.ts`) with the rights it was authorized with, and is
+checked again
+
+| Trigger | When |
+|---------|------|
+| `CoreTenantGuard.invalidateUser()` / `invalidateTenant()` / `invalidateAll()` (also when received from another replica), `CoreUserService.setRoles()`, an `update()` touching `roles` / `verified` / `emailVerified`, the legacy password reset | at once |
+| Better-Auth deleting a session (sign-out, revoked session, reset with `revokeSessionsOnPasswordReset`) — through `wsSessionRevocationPlugin()`, a plugin so a project's own `options.databaseHooks` cannot displace it | at once |
+| anything nobody invalidated (a membership edited in the database, an expired session) | before the next event or operation once the last check is older than `graphQl.subscriptionRevalidationMs` (30 s) |
+
+A connection whose rights CHANGED — in either direction — is closed with **4403**, which the
+graphql-ws client retries: it reconnects and resubscribes with its current rights, or is refused at the
+handshake. It is closed rather than patched because a subscription may have picked its topic or filter
+from the tenant at subscribe time. An event is checked after graphql-js executed it and before it is
+sent, so a dropped event's reads happened but none of it reaches the client. Pinned by
+`tests/subscription-revalidation.e2e-spec.ts` (mechanism), `tests/subscription-session-iam.e2e-spec.ts`
+and `tests/subscription-session-legacy.e2e-spec.ts` (assembled stack).
+
+The check re-runs the HANDSHAKE'S authentication, which on the legacy builder means
+`CoreAuthService.verifyJwt()` — signature and expiry, in passport-jwt's key order — before
+`validateUser()`'s device binding. The handshake used `decodeJwt()` until 11.42.3, so an expired or
+re-signed legacy token opened sockets that HTTP refused (mutation `legacy-ws-jwt-unverified`). A legacy
+socket therefore ends with its token: at expiry or at the next token refresh.
+
+**A guard that asks "is this request allowed?" once is not enough for a connection that outlives the
+answer.** When you add a long-lived channel (SSE, a WebSocket of your own), register it the same way.
 
 ## Role Check Implementation
 

package/.claude/rules/testing.md

@@ -266,7 +266,7 @@ pnpm run check:mutations -- --id=<id>       # one mutation
 pnpm run check:mutations -- --list          # the registry, without running anything
 pnpm run check:mutations -- --allow-dirty   # when the fix and its evidence share a working tree
 pnpm run check:mutations -- --jobs=4        # N mutations at a time (default: 2, or 4 on >=12 cores)
-pnpm run check:mutations -- --no-infra      # only the 92 that need no MongoDB
+pnpm run check:mutations -- --no-infra      # only the 94 that need no MongoDB
 pnpm run check:mutations -- --since=<ref>   # only mutations touching files changed since <ref>
 ```
 
@@ -285,7 +285,7 @@ when the registry, a vitest config or a setup file changed, since those can move
 commit, and in CI alongside the publish without blocking it. The price of caching is a cache that
 has to model each spec's full dependency closure correctly, and getting that wrong produces a stale
 PASS for a test that has since gone vacuous — exactly what the gate is there to prevent. Bad trade
-at 146 mutations.
+at 156 mutations.
 
 **Decided 2026-10-03 (repo owner): keep the full run.** Measured at 128 mutations, the CI job for
 11.41.6 took **14 minutes**. The trigger to revisit is that wall time, not the mutation count —
@@ -330,9 +330,9 @@ exactly the environment where the answer matters.
 
 ### The cost is vitest's cold start, not the tests
 
-Worth knowing before optimising the wrong thing: the specs behind all 54 e2e mutations add up to
+Worth knowing before optimising the wrong thing: the specs behind all 62 e2e mutations add up to
 **~40 seconds**. The step takes ~740s. The remaining ~700s is paying vitest's startup — process
-spawn, transform, module graph, mongod connect, DB create and drop — once per mutation, 146 times.
+spawn, transform, module graph, mongod connect, DB create and drop — once per mutation, 156 times.
 That work is largely single-threaded I/O and barely scales with cores: the full registry measures
 **744s on a 12-core laptop and 777s on a 4-vCPU CI runner**.
 

package/CLAUDE.md

@@ -233,6 +233,11 @@ in services (MCP/AI tools call services directly), tenant-aware tool roles in th
 boundary under `adminBypass: false`. User-entered URLs (webhooks, export targets) go through
 `outboundFetch()` (SSRF guard) — configured targets do not.
 
+Since 11.42.3 an **open GraphQL WebSocket** is re-checked, not trusted for its lifetime: at once on an
+invalidation (tenant guard, role change, password reset, sign-out), otherwise every
+`graphQl.subscriptionRevalidationMs` (30 s); changed rights close it with 4403 and the client
+reconnects. A custom `onConnect` must call `registerWsConnection()` to keep that.
+
 See `.claude/rules/role-system.md` for complete documentation.
 
 ### Versioning

package/FRAMEWORK-API.md

@@ -1,6 +1,6 @@
 # @lenne.tech/nest-server — Framework API Reference
 
-> Auto-generated from source code as of 2026-10-04 (v11.42.1)
+> Auto-generated from source code as of 2026-10-04 (v11.42.3)
 > File: `FRAMEWORK-API.md` — compact, machine-readable API surface for Claude Code
 
 ## CoreModule.forRoot()

package/dist/core/common/helpers/graphql-ws-connection.helper.d.ts

@@ -0,0 +1,43 @@
+import { ResolvedTenantContext } from '../services/core-tenant-context.registry';
+export declare const WS_AUTHORIZATION_CHANGED_CLOSE_CODE = 4403;
+export declare const DEFAULT_SUBSCRIPTION_REVALIDATION_MS = 30000;
+export interface IWsConnectionSocket {
+    close(code: number, reason?: string): void;
+    once?(event: 'close', listener: (...args: any[]) => void): unknown;
+}
+export interface IWsConnectionRegistration {
+    carrier: object;
+    reauthenticate?: () => any;
+    socket?: IWsConnectionSocket;
+    user: any;
+}
+export interface IWsConnectionIdentity {
+    email?: string;
+    iamId?: string;
+    userId?: string;
+}
+export interface WsConnection {
+    readonly email?: string;
+    readonly iamId?: string;
+    readonly reauthenticate?: () => any;
+    readonly socket?: IWsConnectionSocket;
+    tenant?: ResolvedTenantContext;
+    readonly tenantHeader?: string;
+    terminated: boolean;
+    readonly user: any;
+    readonly userFingerprint: string;
+    readonly userId?: string;
+    inflight?: Promise<boolean>;
+    stale: boolean;
+    tenantFingerprint?: string;
+    validatedAt: number;
+}
+export declare function resolveSubscriptionRevalidationMs(value: unknown): false | number;
+export declare function readWsTenantHeader(contextValue: any): string | undefined;
+export declare function registerWsConnection(registration: IWsConnectionRegistration): void;
+export declare function getWsConnection(contextValue: any): undefined | WsConnection;
+export declare function ensureWsConnectionCurrent(connection: WsConnection): Promise<boolean>;
+export declare function noteWsConnectionTenant(connection: WsConnection, tenant: ResolvedTenantContext | undefined): boolean;
+export declare function revalidateWsConnectionsOf(identity: IWsConnectionIdentity): number;
+export declare function revalidateWsConnectionsForTenant(tenantId: string): number;
+export declare function revalidateAllWsConnections(): number;

package/dist/core/common/helpers/graphql-ws-connection.helper.js

@@ -0,0 +1,219 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DEFAULT_SUBSCRIPTION_REVALIDATION_MS = exports.WS_AUTHORIZATION_CHANGED_CLOSE_CODE = void 0;
+exports.resolveSubscriptionRevalidationMs = resolveSubscriptionRevalidationMs;
+exports.readWsTenantHeader = readWsTenantHeader;
+exports.registerWsConnection = registerWsConnection;
+exports.getWsConnection = getWsConnection;
+exports.ensureWsConnectionCurrent = ensureWsConnectionCurrent;
+exports.noteWsConnectionTenant = noteWsConnectionTenant;
+exports.revalidateWsConnectionsOf = revalidateWsConnectionsOf;
+exports.revalidateWsConnectionsForTenant = revalidateWsConnectionsForTenant;
+exports.revalidateAllWsConnections = revalidateAllWsConnections;
+const common_1 = require("@nestjs/common");
+const config_service_1 = require("../services/config.service");
+const core_tenant_context_registry_1 = require("../services/core-tenant-context.registry");
+exports.WS_AUTHORIZATION_CHANGED_CLOSE_CODE = 4403;
+exports.DEFAULT_SUBSCRIPTION_REVALIDATION_MS = 30_000;
+const WS_CONNECTION = Symbol('ltWsConnection');
+const liveConnections = new Set();
+const logger = new common_1.Logger('GraphQlWsConnection');
+function resolveSubscriptionRevalidationMs(value) {
+    if (value === false || value === 'false') {
+        return false;
+    }
+    const numeric = typeof value === 'string' && value.trim() !== '' ? Number(value) : value;
+    if (typeof numeric === 'number' && Number.isFinite(numeric) && numeric >= 0) {
+        return numeric;
+    }
+    return exports.DEFAULT_SUBSCRIPTION_REVALIDATION_MS;
+}
+function configuredRevalidationMs() {
+    const graphQl = config_service_1.ConfigService.configFastButReadOnly?.graphQl;
+    return resolveSubscriptionRevalidationMs(graphQl ? graphQl.subscriptionRevalidationMs : undefined);
+}
+function fingerprintUser(user) {
+    if (!user) {
+        return '';
+    }
+    const roles = Array.isArray(user.roles) ? user.roles.map((role) => String(role)).sort() : [];
+    const verified = !!(user.verified || user.verifiedAt || user.emailVerified);
+    return JSON.stringify([String(user.id ?? user._id ?? ''), roles, verified]);
+}
+function fingerprintTenant(tenant) {
+    const tenantIds = Array.isArray(tenant?.tenantIds) ? tenant.tenantIds.map((id) => String(id)).sort() : null;
+    return JSON.stringify([tenant?.tenantId ?? null, tenantIds, tenant?.tenantRole ?? null, !!tenant?.isAdminBypass]);
+}
+function readWsTenantHeader(contextValue) {
+    const headerName = (config_service_1.ConfigService.configFastButReadOnly?.multiTenancy?.headerName ?? 'x-tenant-id').toLowerCase();
+    const sources = [contextValue?.headers, contextValue?.connectionParams, contextValue?.request?.headers];
+    for (const source of sources) {
+        if (!source || typeof source !== 'object') {
+            continue;
+        }
+        for (const [key, value] of Object.entries(source)) {
+            if (key.toLowerCase() === headerName && typeof value === 'string' && value) {
+                return value;
+            }
+        }
+    }
+    return undefined;
+}
+function registerWsConnection(registration) {
+    const { carrier, reauthenticate, socket, user } = registration;
+    if (!carrier || typeof carrier !== 'object') {
+        return;
+    }
+    const userId = user?.id ?? user?._id;
+    const connection = {
+        email: typeof user?.email === 'string' ? user.email.toLowerCase() : undefined,
+        iamId: typeof user?.iamId === 'string' ? user.iamId : undefined,
+        reauthenticate,
+        socket,
+        stale: false,
+        tenantHeader: readWsTenantHeader(carrier),
+        terminated: false,
+        user,
+        userFingerprint: fingerprintUser(user),
+        userId: userId !== undefined && userId !== null ? String(userId) : undefined,
+        validatedAt: Date.now(),
+    };
+    Object.defineProperty(carrier, WS_CONNECTION, { configurable: true, enumerable: true, value: connection });
+    if (socket && typeof socket.once === 'function') {
+        liveConnections.add(connection);
+        socket.once('close', () => {
+            connection.terminated = true;
+            liveConnections.delete(connection);
+        });
+    }
+}
+function getWsConnection(contextValue) {
+    if (!contextValue || typeof contextValue !== 'object') {
+        return undefined;
+    }
+    const connection = contextValue[WS_CONNECTION];
+    return connection && typeof connection === 'object' ? connection : undefined;
+}
+function terminate(connection, reason) {
+    if (connection.terminated) {
+        return false;
+    }
+    connection.terminated = true;
+    liveConnections.delete(connection);
+    logger.log(`Closing GraphQL WebSocket of user ${connection.userId ?? '(unknown)'}: ${reason}`);
+    try {
+        connection.socket?.close(exports.WS_AUTHORIZATION_CHANGED_CLOSE_CODE, reason);
+    }
+    catch {
+    }
+    return false;
+}
+async function revalidate(connection) {
+    connection.stale = false;
+    try {
+        let user = connection.user;
+        if (connection.reauthenticate) {
+            user = await connection.reauthenticate();
+            if (!user) {
+                return terminate(connection, 'Session no longer valid');
+            }
+        }
+        if (fingerprintUser(user) !== connection.userFingerprint) {
+            return terminate(connection, 'User authorization changed');
+        }
+        if (connection.tenantFingerprint !== undefined) {
+            const resolver = (0, core_tenant_context_registry_1.getTenantContextResolver)();
+            const tenant = resolver ? await resolver.resolve(user, connection.tenantHeader) : {};
+            if (fingerprintTenant(tenant) !== connection.tenantFingerprint) {
+                return terminate(connection, 'Tenant access changed');
+            }
+        }
+        if (connection.terminated) {
+            return false;
+        }
+        connection.validatedAt = Date.now();
+        return true;
+    }
+    catch {
+        return terminate(connection, 'Authorization check failed');
+    }
+}
+function ensureWsConnectionCurrent(connection) {
+    if (connection.terminated) {
+        return Promise.resolve(false);
+    }
+    const interval = configuredRevalidationMs();
+    if (!connection.stale && (interval === false || Date.now() - connection.validatedAt < interval)) {
+        return Promise.resolve(true);
+    }
+    if (!connection.inflight) {
+        connection.inflight = revalidate(connection).finally(() => {
+            connection.inflight = undefined;
+            if (connection.stale && !connection.terminated) {
+                void ensureWsConnectionCurrent(connection);
+            }
+        });
+    }
+    return connection.inflight;
+}
+function noteWsConnectionTenant(connection, tenant) {
+    if (connection.terminated) {
+        return false;
+    }
+    const fingerprint = fingerprintTenant(tenant);
+    if (connection.tenantFingerprint === undefined) {
+        connection.tenant = tenant ? { ...tenant } : {};
+        connection.tenantFingerprint = fingerprint;
+        return true;
+    }
+    if (fingerprint !== connection.tenantFingerprint) {
+        return terminate(connection, 'Tenant access changed');
+    }
+    return true;
+}
+function markStale(connection) {
+    connection.stale = true;
+    void ensureWsConnectionCurrent(connection);
+}
+function revalidateWsConnectionsOf(identity) {
+    const userId = identity?.userId !== undefined && identity?.userId !== null ? String(identity.userId) : undefined;
+    const iamId = identity?.iamId || undefined;
+    const email = typeof identity?.email === 'string' ? identity.email.toLowerCase() : undefined;
+    if (!userId && !iamId && !email) {
+        return 0;
+    }
+    let count = 0;
+    for (const connection of liveConnections) {
+        if ((userId && connection.userId === userId) ||
+            (iamId && connection.iamId === iamId) ||
+            (email && connection.email === email)) {
+            markStale(connection);
+            count++;
+        }
+    }
+    return count;
+}
+function revalidateWsConnectionsForTenant(tenantId) {
+    if (!tenantId) {
+        return 0;
+    }
+    const id = String(tenantId);
+    let count = 0;
+    for (const connection of liveConnections) {
+        const tenant = connection.tenant;
+        if (tenant && (tenant.tenantId === id || (Array.isArray(tenant.tenantIds) && tenant.tenantIds.includes(id)))) {
+            markStale(connection);
+            count++;
+        }
+    }
+    return count;
+}
+function revalidateAllWsConnections() {
+    let count = 0;
+    for (const connection of liveConnections) {
+        markStale(connection);
+        count++;
+    }
+    return count;
+}
+//# sourceMappingURL=graphql-ws-connection.helper.js.map

package/dist/core/common/helpers/graphql-ws-connection.helper.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"graphql-ws-connection.helper.js","sourceRoot":"","sources":["../../../../src/core/common/helpers/graphql-ws-connection.helper.ts"],"names":[],"mappings":";;;AAkIA,8EASC;AAuBD,gDAcC;AAMD,oDA4BC;AAGD,0CAMC;AA6DD,8DAmBC;AASD,wDAcC;AAaD,8DAmBC;AAGD,4EAcC;AAGD,gEAOC;AA7XD,2CAAwC;AAExC,+DAA2D;AAC3D,2FAA2G;AAsC9F,QAAA,mCAAmC,GAAG,IAAI,CAAC;AAG3C,QAAA,oCAAoC,GAAG,MAAM,CAAC;AAmE3D,MAAM,aAAa,GAAG,MAAM,CAAC,gBAAgB,CAAC,CAAC;AAO/C,MAAM,eAAe,GAAG,IAAI,GAAG,EAAgB,CAAC;AAEhD,MAAM,MAAM,GAAG,IAAI,eAAM,CAAC,qBAAqB,CAAC,CAAC;AAUjD,SAAgB,iCAAiC,CAAC,KAAc;IAC9D,IAAI,KAAK,KAAK,KAAK,IAAI,KAAK,KAAK,OAAO,EAAE,CAAC;QACzC,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,OAAO,GAAG,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IACzF,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,OAAO,IAAI,CAAC,EAAE,CAAC;QAC5E,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,OAAO,4CAAoC,CAAC;AAC9C,CAAC;AAED,SAAS,wBAAwB;IAC/B,MAAM,OAAO,GAAG,8BAAa,CAAC,qBAAqB,EAAE,OAAO,CAAC;IAC7D,OAAO,iCAAiC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,0BAA0B,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;AACrG,CAAC;AAGD,SAAS,eAAe,CAAC,IAAS;IAChC,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAa,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACtG,MAAM,QAAQ,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,aAAa,CAAC,CAAC;IAC5E,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,IAAI,CAAC,GAAG,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC;AAC9E,CAAC;AAED,SAAS,iBAAiB,CAAC,MAAyC;IAClE,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IAC5G,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC,MAAM,EAAE,QAAQ,IAAI,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,IAAI,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC,CAAC;AACpH,CAAC;AAGD,SAAgB,kBAAkB,CAAC,YAAiB;IAClD,MAAM,UAAU,GAAG,CAAC,8BAAa,CAAC,qBAAqB,EAAE,YAAY,EAAE,UAAU,IAAI,aAAa,CAAC,CAAC,WAAW,EAAE,CAAC;IAClH,MAAM,OAAO,GAAG,CAAC,YAAY,EAAE,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAE,YAAY,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IACxG,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;YAC1C,SAAS;QACX,CAAC;QACD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAiC,CAAC,EAAE,CAAC;YAC7E,IAAI,GAAG,CAAC,WAAW,EAAE,KAAK,UAAU,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,EAAE,CAAC;gBAC3E,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAMD,SAAgB,oBAAoB,CAAC,YAAuC;IAC1E,MAAM,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,YAAY,CAAC;IAC/D,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;QAC5C,OAAO;IACT,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,EAAE,EAAE,IAAI,IAAI,EAAE,GAAG,CAAC;IACrC,MAAM,UAAU,GAAiB;QAC/B,KAAK,EAAE,OAAO,IAAI,EAAE,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,SAAS;QAC7E,KAAK,EAAE,OAAO,IAAI,EAAE,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS;QAC/D,cAAc;QACd,MAAM;QACN,KAAK,EAAE,KAAK;QACZ,YAAY,EAAE,kBAAkB,CAAC,OAAO,CAAC;QACzC,UAAU,EAAE,KAAK;QACjB,IAAI;QACJ,eAAe,EAAE,eAAe,CAAC,IAAI,CAAC;QACtC,MAAM,EAAE,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS;QAC5E,WAAW,EAAE,IAAI,CAAC,GAAG,EAAE;KACxB,CAAC;IACF,MAAM,CAAC,cAAc,CAAC,OAAO,EAAE,aAAa,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,CAAC;IAE3G,IAAI,MAAM,IAAI,OAAO,MAAM,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;QAChD,eAAe,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAChC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE;YACxB,UAAU,CAAC,UAAU,GAAG,IAAI,CAAC;YAC7B,eAAe,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QACrC,CAAC,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAGD,SAAgB,eAAe,CAAC,YAAiB;IAC/C,IAAI,CAAC,YAAY,IAAI,OAAO,YAAY,KAAK,QAAQ,EAAE,CAAC;QACtD,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,UAAU,GAAG,YAAY,CAAC,aAAa,CAAC,CAAC;IAC/C,OAAO,UAAU,IAAI,OAAO,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;AAC/E,CAAC;AAMD,SAAS,SAAS,CAAC,UAAwB,EAAE,MAAc;IACzD,IAAI,UAAU,CAAC,UAAU,EAAE,CAAC;QAC1B,OAAO,KAAK,CAAC;IACf,CAAC;IACD,UAAU,CAAC,UAAU,GAAG,IAAI,CAAC;IAC7B,eAAe,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IACnC,MAAM,CAAC,GAAG,CAAC,qCAAqC,UAAU,CAAC,MAAM,IAAI,WAAW,KAAK,MAAM,EAAE,CAAC,CAAC;IAC/F,IAAI,CAAC;QAEH,UAAU,CAAC,MAAM,EAAE,KAAK,CAAC,2CAAmC,EAAE,MAAM,CAAC,CAAC;IACxE,CAAC;IAAC,MAAM,CAAC;IAET,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,KAAK,UAAU,UAAU,CAAC,UAAwB;IAChD,UAAU,CAAC,KAAK,GAAG,KAAK,CAAC;IACzB,IAAI,CAAC;QACH,IAAI,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC;QAC3B,IAAI,UAAU,CAAC,cAAc,EAAE,CAAC;YAC9B,IAAI,GAAG,MAAM,UAAU,CAAC,cAAc,EAAE,CAAC;YACzC,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,OAAO,SAAS,CAAC,UAAU,EAAE,yBAAyB,CAAC,CAAC;YAC1D,CAAC;QACH,CAAC;QACD,IAAI,eAAe,CAAC,IAAI,CAAC,KAAK,UAAU,CAAC,eAAe,EAAE,CAAC;YACzD,OAAO,SAAS,CAAC,UAAU,EAAE,4BAA4B,CAAC,CAAC;QAC7D,CAAC;QACD,IAAI,UAAU,CAAC,iBAAiB,KAAK,SAAS,EAAE,CAAC;YAC/C,MAAM,QAAQ,GAAG,IAAA,uDAAwB,GAAE,CAAC;YAC5C,MAAM,MAAM,GAAG,QAAQ,CAAC,CAAC,CAAC,MAAM,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,UAAU,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACrF,IAAI,iBAAiB,CAAC,MAAM,CAAC,KAAK,UAAU,CAAC,iBAAiB,EAAE,CAAC;gBAC/D,OAAO,SAAS,CAAC,UAAU,EAAE,uBAAuB,CAAC,CAAC;YACxD,CAAC;QACH,CAAC;QACD,IAAI,UAAU,CAAC,UAAU,EAAE,CAAC;YAC1B,OAAO,KAAK,CAAC;QACf,CAAC;QACD,UAAU,CAAC,WAAW,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACpC,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QAGP,OAAO,SAAS,CAAC,UAAU,EAAE,4BAA4B,CAAC,CAAC;IAC7D,CAAC;AACH,CAAC;AASD,SAAgB,yBAAyB,CAAC,UAAwB;IAChE,IAAI,UAAU,CAAC,UAAU,EAAE,CAAC;QAC1B,OAAO,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAChC,CAAC;IACD,MAAM,QAAQ,GAAG,wBAAwB,EAAE,CAAC;IAC5C,IAAI,CAAC,UAAU,CAAC,KAAK,IAAI,CAAC,QAAQ,KAAK,KAAK,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,UAAU,CAAC,WAAW,GAAG,QAAQ,CAAC,EAAE,CAAC;QAChG,OAAO,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/B,CAAC;IACD,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QACzB,UAAU,CAAC,QAAQ,GAAG,UAAU,CAAC,UAAU,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE;YACxD,UAAU,CAAC,QAAQ,GAAG,SAAS,CAAC;YAGhC,IAAI,UAAU,CAAC,KAAK,IAAI,CAAC,UAAU,CAAC,UAAU,EAAE,CAAC;gBAC/C,KAAK,yBAAyB,CAAC,UAAU,CAAC,CAAC;YAC7C,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;IACD,OAAO,UAAU,CAAC,QAAQ,CAAC;AAC7B,CAAC;AASD,SAAgB,sBAAsB,CAAC,UAAwB,EAAE,MAAyC;IACxG,IAAI,UAAU,CAAC,UAAU,EAAE,CAAC;QAC1B,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,WAAW,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;IAC9C,IAAI,UAAU,CAAC,iBAAiB,KAAK,SAAS,EAAE,CAAC;QAC/C,UAAU,CAAC,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChD,UAAU,CAAC,iBAAiB,GAAG,WAAW,CAAC;QAC3C,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,WAAW,KAAK,UAAU,CAAC,iBAAiB,EAAE,CAAC;QACjD,OAAO,SAAS,CAAC,UAAU,EAAE,uBAAuB,CAAC,CAAC;IACxD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAGD,SAAS,SAAS,CAAC,UAAwB;IACzC,UAAU,CAAC,KAAK,GAAG,IAAI,CAAC;IACxB,KAAK,yBAAyB,CAAC,UAAU,CAAC,CAAC;AAC7C,CAAC;AAOD,SAAgB,yBAAyB,CAAC,QAA+B;IACvE,MAAM,MAAM,GAAG,QAAQ,EAAE,MAAM,KAAK,SAAS,IAAI,QAAQ,EAAE,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACjH,MAAM,KAAK,GAAG,QAAQ,EAAE,KAAK,IAAI,SAAS,CAAC;IAC3C,MAAM,KAAK,GAAG,OAAO,QAAQ,EAAE,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IAC7F,IAAI,CAAC,MAAM,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,EAAE,CAAC;QAChC,OAAO,CAAC,CAAC;IACX,CAAC;IACD,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,KAAK,MAAM,UAAU,IAAI,eAAe,EAAE,CAAC;QACzC,IACE,CAAC,MAAM,IAAI,UAAU,CAAC,MAAM,KAAK,MAAM,CAAC;YACxC,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK,KAAK,KAAK,CAAC;YACrC,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK,KAAK,KAAK,CAAC,EACrC,CAAC;YACD,SAAS,CAAC,UAAU,CAAC,CAAC;YACtB,KAAK,EAAE,CAAC;QACV,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAGD,SAAgB,gCAAgC,CAAC,QAAgB;IAC/D,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,CAAC,CAAC;IACX,CAAC;IACD,MAAM,EAAE,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC5B,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,KAAK,MAAM,UAAU,IAAI,eAAe,EAAE,CAAC;QACzC,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC;QACjC,IAAI,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7G,SAAS,CAAC,UAAU,CAAC,CAAC;YACtB,KAAK,EAAE,CAAC;QACV,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAGD,SAAgB,0BAA0B;IACxC,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,KAAK,MAAM,UAAU,IAAI,eAAe,EAAE,CAAC;QACzC,SAAS,CAAC,UAAU,CAAC,CAAC;QACtB,KAAK,EAAE,CAAC;IACV,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/core/common/helpers/graphql-ws-context.helper.d.ts

@@ -1,4 +1,5 @@
 import { IRequestContext } from '../services/request-context.service';
+import { WsConnection } from './graphql-ws-connection.helper';
 interface GraphQlArgs {
     contextValue?: any;
     [key: string]: any;
@@ -7,7 +8,7 @@ type ExecuteFn = (args: GraphQlArgs) => any;
 export declare function buildWsRequestContext(contextValue: any): Promise<IRequestContext | undefined>;
 export declare function withRequestContextAsyncIterator<T>(iterator: AsyncIterator<T> & {
     [Symbol.asyncIterator]?: () => AsyncIterator<T>;
-}, context: IRequestContext): AsyncIterableIterator<T>;
+}, context: IRequestContext, connection?: WsConnection): AsyncIterableIterator<T>;
 export declare function createRequestContextAwareExecute(execute: ExecuteFn): ExecuteFn;
 export declare function createRequestContextAwareSubscribe(subscribe: ExecuteFn): ExecuteFn;
 export declare function buildRequestContextAwareExecute(): (args: GraphQlArgs) => any;

package/dist/core/common/helpers/graphql-ws-context.helper.js

@@ -8,22 +8,10 @@ exports.buildRequestContextAwareExecute = buildRequestContextAwareExecute;
 exports.buildRequestContextAwareSubscribe = buildRequestContextAwareSubscribe;
 const graphql = require("graphql");
 const core_tenant_context_registry_1 = require("../services/core-tenant-context.registry");
-const config_service_1 = require("../services/config.service");
 const request_context_service_1 = require("../services/request-context.service");
+const graphql_ws_connection_helper_1 = require("./graphql-ws-connection.helper");
 function readTenantHeader(contextValue) {
-    const headerName = (config_service_1.ConfigService.configFastButReadOnly?.multiTenancy?.headerName ?? 'x-tenant-id').toLowerCase();
-    const sources = [contextValue?.headers, contextValue?.connectionParams, contextValue?.request?.headers];
-    for (const source of sources) {
-        if (!source || typeof source !== 'object') {
-            continue;
-        }
-        for (const [key, value] of Object.entries(source)) {
-            if (key.toLowerCase() === headerName && typeof value === 'string' && value) {
-                return value;
-            }
-        }
-    }
-    return undefined;
+    return (0, graphql_ws_connection_helper_1.readWsTenantHeader)(contextValue);
 }
 function readUser(contextValue) {
     return contextValue?.user ?? contextValue?.extra?.user ?? undefined;
@@ -42,17 +30,50 @@ async function buildWsRequestContext(contextValue) {
     }
     const resolver = (0, core_tenant_context_registry_1.getTenantContextResolver)();
     if (resolver) {
+        let resolved = {};
         try {
-            Object.assign(context, await resolver.resolve(user, readTenantHeader(contextValue)));
+            resolved = (await resolver.resolve(user, readTenantHeader(contextValue))) ?? {};
+            Object.assign(context, resolved);
         }
         catch {
         }
+        const connection = (0, graphql_ws_connection_helper_1.getWsConnection)(contextValue);
+        if (connection) {
+            (0, graphql_ws_connection_helper_1.noteWsConnectionTenant)(connection, resolved);
+        }
     }
     return context;
 }
-function withRequestContextAsyncIterator(iterator, context) {
+function refusedResult() {
+    return {
+        errors: [
+            new graphql.GraphQLError('The authorization of this connection changed — reconnect.', {
+                extensions: { code: 'FORBIDDEN' },
+            }),
+        ],
+    };
+}
+async function connectionStillAuthorized(contextValue) {
+    const connection = (0, graphql_ws_connection_helper_1.getWsConnection)(contextValue);
+    return connection ? (0, graphql_ws_connection_helper_1.ensureWsConnectionCurrent)(connection) : true;
+}
+function withRequestContextAsyncIterator(iterator, context, connection) {
+    const next = (...args) => request_context_service_1.RequestContext.run(context, () => iterator.next(...args));
     const wrapped = {
-        next: (...args) => request_context_service_1.RequestContext.run(context, () => iterator.next(...args)),
+        next: connection
+            ? async (...args) => {
+                const result = await next(...args);
+                if (result.done || (await (0, graphql_ws_connection_helper_1.ensureWsConnectionCurrent)(connection))) {
+                    return result;
+                }
+                try {
+                    await request_context_service_1.RequestContext.run(context, () => iterator.return?.());
+                }
+                catch {
+                }
+                return { done: true, value: undefined };
+            }
+            : next,
         [Symbol.asyncIterator]() {
             return wrapped;
         },
@@ -70,21 +91,36 @@ function isAsyncIterable(value) {
 }
 function createRequestContextAwareExecute(execute) {
     return async (args) => {
+        if (!(await connectionStillAuthorized(args?.contextValue))) {
+            return refusedResult();
+        }
         const context = await buildWsRequestContext(args?.contextValue);
         if (!context) {
             return execute(args);
         }
+        if ((0, graphql_ws_connection_helper_1.getWsConnection)(args?.contextValue)?.terminated) {
+            return refusedResult();
+        }
         return request_context_service_1.RequestContext.run(context, () => execute(args));
     };
 }
 function createRequestContextAwareSubscribe(subscribe) {
     return async (args) => {
+        if (!(await connectionStillAuthorized(args?.contextValue))) {
+            return refusedResult();
+        }
         const context = await buildWsRequestContext(args?.contextValue);
         if (!context) {
             return subscribe(args);
         }
+        const connection = (0, graphql_ws_connection_helper_1.getWsConnection)(args?.contextValue);
+        if (connection?.terminated) {
+            return refusedResult();
+        }
         const result = await request_context_service_1.RequestContext.run(context, () => subscribe(args));
-        return isAsyncIterable(result) ? withRequestContextAsyncIterator(result, context) : result;
+        return isAsyncIterable(result)
+            ? withRequestContextAsyncIterator(result, context, connection)
+            : result;
     };
 }
 function buildRequestContextAwareExecute() {

package/dist/core/common/helpers/graphql-ws-context.helper.js.map

@@ -1 +1 @@
-{"version":3,"file":"graphql-ws-context.helper.js","sourceRoot":"","sources":["../../../../src/core/common/helpers/graphql-ws-context.helper.ts"],"names":[],"mappings":";;AAyFA,sDA8BC;AAQD,0EAiBC;AAYD,4EAQC;AAGD,gFASC;AASD,0EAEC;AAED,8EAEC;AA1LD,mCAAoC;AAEpC,2FAAoF;AACpF,+DAA2D;AAC3D,iFAAsF;AAoDtF,SAAS,gBAAgB,CAAC,YAAiB;IACzC,MAAM,UAAU,GAAG,CAAC,8BAAa,CAAC,qBAAqB,EAAE,YAAY,EAAE,UAAU,IAAI,aAAa,CAAC,CAAC,WAAW,EAAE,CAAC;IAClH,MAAM,OAAO,GAAG,CAAC,YAAY,EAAE,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAE,YAAY,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IACxG,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;YAC1C,SAAS;QACX,CAAC;QACD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAiC,CAAC,EAAE,CAAC;YAC7E,IAAI,GAAG,CAAC,WAAW,EAAE,KAAK,UAAU,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,EAAE,CAAC;gBAC3E,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAGD,SAAS,QAAQ,CAAC,YAAiB;IACjC,OAAO,YAAY,EAAE,IAAI,IAAI,YAAY,EAAE,KAAK,EAAE,IAAI,IAAI,SAAS,CAAC;AACtE,CAAC;AASM,KAAK,UAAU,qBAAqB,CAAC,YAAiB;IAC3D,IAAI,CAAC,YAAY,IAAI,OAAO,YAAY,KAAK,QAAQ,IAAI,YAAY,CAAC,GAAG,EAAE,CAAC;QAC1E,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,IAAI,GAAG,QAAQ,CAAC,YAAY,CAAC,CAAC;IACpC,MAAM,OAAO,GAAoB,EAAE,WAAW,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;IAG1E,MAAM,cAAc,GAClB,YAAY,CAAC,OAAO,EAAE,CAAC,iBAAiB,CAAC;QACzC,YAAY,CAAC,gBAAgB,EAAE,CAAC,iBAAiB,CAAC;QAClD,YAAY,CAAC,OAAO,EAAE,OAAO,EAAE,CAAC,iBAAiB,CAAC,CAAC;IACrD,IAAI,OAAO,cAAc,KAAK,QAAQ,EAAE,CAAC;QACvC,OAAO,CAAC,QAAQ,GAAG,cAAc,CAAC;IACpC,CAAC;IAED,MAAM,QAAQ,GAAG,IAAA,uDAAwB,GAAE,CAAC;IAC5C,IAAI,QAAQ,EAAE,CAAC;QAIb,IAAI,CAAC;YACH,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,gBAAgB,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QACvF,CAAC;QAAC,MAAM,CAAC;QAET,CAAC;IACH,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAQD,SAAgB,+BAA+B,CAC7C,QAAgF,EAChF,OAAwB;IAExB,MAAM,OAAO,GAA6B;QACxC,IAAI,EAAE,CAAC,GAAG,IAAsB,EAAE,EAAE,CAAC,wCAAc,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAI,IAAW,CAAC,CAAC;QACtG,CAAC,MAAM,CAAC,aAAa,CAAC;YACpB,OAAO,OAAO,CAAC;QACjB,CAAC;KACF,CAAC;IACF,IAAI,QAAQ,CAAC,MAAM,EAAE,CAAC;QACpB,OAAO,CAAC,MAAM,GAAG,CAAC,KAAW,EAAE,EAAE,CAAC,wCAAc,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,MAAO,CAAC,KAAK,CAAC,CAAC,CAAC;IAC/F,CAAC;IACD,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC;QACnB,OAAO,CAAC,KAAK,GAAG,CAAC,KAAW,EAAE,EAAE,CAAC,wCAAc,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,KAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IAC7F,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAGD,SAAS,eAAe,CAAC,KAAU;IACjC,OAAO,CAAC,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,UAAU,CAAC;AACnG,CAAC;AAOD,SAAgB,gCAAgC,CAAC,OAAkB;IACjE,OAAO,KAAK,EAAE,IAAiB,EAAE,EAAE;QACjC,MAAM,OAAO,GAAG,MAAM,qBAAqB,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;QAChE,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC;QACvB,CAAC;QACD,OAAO,wCAAc,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IAC1D,CAAC,CAAC;AACJ,CAAC;AAGD,SAAgB,kCAAkC,CAAC,SAAoB;IACrE,OAAO,KAAK,EAAE,IAAiB,EAAE,EAAE;QACjC,MAAM,OAAO,GAAG,MAAM,qBAAqB,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;QAChE,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,SAAS,CAAC,IAAI,CAAC,CAAC;QACzB,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,wCAAc,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;QACxE,OAAO,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,+BAA+B,CAAC,MAA4B,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;IACnH,CAAC,CAAC;AACJ,CAAC;AASD,SAAgB,+BAA+B;IAC7C,OAAO,gCAAgC,CAAC,OAAO,CAAC,OAAc,CAAC,CAAC;AAClE,CAAC;AAED,SAAgB,iCAAiC;IAC/C,OAAO,kCAAkC,CAAC,OAAO,CAAC,SAAgB,CAAC,CAAC;AACtE,CAAC"}
+{"version":3,"file":"graphql-ws-context.helper.js","sourceRoot":"","sources":["../../../../src/core/common/helpers/graphql-ws-context.helper.ts"],"names":[],"mappings":";;AA4FA,sDAwCC;AAsCD,0EAgCC;AAYD,4EAcC;AAGD,gFAkBC;AASD,0EAEC;AAED,8EAEC;AAnQD,mCAAoC;AAEpC,2FAA2G;AAC3G,iFAAsF;AACtF,iFAMwC;AA6DxC,SAAS,gBAAgB,CAAC,YAAiB;IACzC,OAAO,IAAA,iDAAkB,EAAC,YAAY,CAAC,CAAC;AAC1C,CAAC;AAGD,SAAS,QAAQ,CAAC,YAAiB;IACjC,OAAO,YAAY,EAAE,IAAI,IAAI,YAAY,EAAE,KAAK,EAAE,IAAI,IAAI,SAAS,CAAC;AACtE,CAAC;AASM,KAAK,UAAU,qBAAqB,CAAC,YAAiB;IAC3D,IAAI,CAAC,YAAY,IAAI,OAAO,YAAY,KAAK,QAAQ,IAAI,YAAY,CAAC,GAAG,EAAE,CAAC;QAC1E,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,IAAI,GAAG,QAAQ,CAAC,YAAY,CAAC,CAAC;IACpC,MAAM,OAAO,GAAoB,EAAE,WAAW,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;IAG1E,MAAM,cAAc,GAClB,YAAY,CAAC,OAAO,EAAE,CAAC,iBAAiB,CAAC;QACzC,YAAY,CAAC,gBAAgB,EAAE,CAAC,iBAAiB,CAAC;QAClD,YAAY,CAAC,OAAO,EAAE,OAAO,EAAE,CAAC,iBAAiB,CAAC,CAAC;IACrD,IAAI,OAAO,cAAc,KAAK,QAAQ,EAAE,CAAC;QACvC,OAAO,CAAC,QAAQ,GAAG,cAAc,CAAC;IACpC,CAAC;IAED,MAAM,QAAQ,GAAG,IAAA,uDAAwB,GAAE,CAAC;IAC5C,IAAI,QAAQ,EAAE,CAAC;QAIb,IAAI,QAAQ,GAA0B,EAAE,CAAC;QACzC,IAAI,CAAC;YACH,QAAQ,GAAG,CAAC,MAAM,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,gBAAgB,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YAChF,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QACnC,CAAC;QAAC,MAAM,CAAC;QAET,CAAC;QAKD,MAAM,UAAU,GAAG,IAAA,8CAAe,EAAC,YAAY,CAAC,CAAC;QACjD,IAAI,UAAU,EAAE,CAAC;YACf,IAAA,qDAAsB,EAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;QAC/C,CAAC;IACH,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAOD,SAAS,aAAa;IACpB,OAAO;QACL,MAAM,EAAE;YACN,IAAI,OAAO,CAAC,YAAY,CAAC,2DAA2D,EAAE;gBACpF,UAAU,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE;aAClC,CAAC;SACH;KACF,CAAC;AACJ,CAAC;AAMD,KAAK,UAAU,yBAAyB,CAAC,YAAiB;IACxD,MAAM,UAAU,GAAG,IAAA,8CAAe,EAAC,YAAY,CAAC,CAAC;IACjD,OAAO,UAAU,CAAC,CAAC,CAAC,IAAA,wDAAyB,EAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACnE,CAAC;AAcD,SAAgB,+BAA+B,CAC7C,QAAgF,EAChF,OAAwB,EACxB,UAAyB;IAEzB,MAAM,IAAI,GAAG,CAAC,GAAG,IAAsB,EAAE,EAAE,CAAC,wCAAc,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAI,IAAW,CAAC,CAAC,CAAC;IAC9G,MAAM,OAAO,GAA6B;QACxC,IAAI,EAAE,UAAU;YACd,CAAC,CAAC,KAAK,EAAE,GAAG,IAAsB,EAAE,EAAE;gBAClC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC;gBACnC,IAAI,MAAM,CAAC,IAAI,IAAI,CAAC,MAAM,IAAA,wDAAyB,EAAC,UAAU,CAAC,CAAC,EAAE,CAAC;oBACjE,OAAO,MAAM,CAAC;gBAChB,CAAC;gBACD,IAAI,CAAC;oBACH,MAAM,wCAAc,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;gBAC/D,CAAC;gBAAC,MAAM,CAAC;gBAET,CAAC;gBACD,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAuB,CAAC;YAC/D,CAAC;YACH,CAAC,CAAC,IAAI;QACR,CAAC,MAAM,CAAC,aAAa,CAAC;YACpB,OAAO,OAAO,CAAC;QACjB,CAAC;KACF,CAAC;IACF,IAAI,QAAQ,CAAC,MAAM,EAAE,CAAC;QACpB,OAAO,CAAC,MAAM,GAAG,CAAC,KAAW,EAAE,EAAE,CAAC,wCAAc,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,MAAO,CAAC,KAAK,CAAC,CAAC,CAAC;IAC/F,CAAC;IACD,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC;QACnB,OAAO,CAAC,KAAK,GAAG,CAAC,KAAW,EAAE,EAAE,CAAC,wCAAc,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,KAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IAC7F,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAGD,SAAS,eAAe,CAAC,KAAU;IACjC,OAAO,CAAC,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,UAAU,CAAC;AACnG,CAAC;AAOD,SAAgB,gCAAgC,CAAC,OAAkB;IACjE,OAAO,KAAK,EAAE,IAAiB,EAAE,EAAE;QACjC,IAAI,CAAC,CAAC,MAAM,yBAAyB,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC,EAAE,CAAC;YAC3D,OAAO,aAAa,EAAE,CAAC;QACzB,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,qBAAqB,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;QAChE,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC;QACvB,CAAC;QACD,IAAI,IAAA,8CAAe,EAAC,IAAI,EAAE,YAAY,CAAC,EAAE,UAAU,EAAE,CAAC;YACpD,OAAO,aAAa,EAAE,CAAC;QACzB,CAAC;QACD,OAAO,wCAAc,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IAC1D,CAAC,CAAC;AACJ,CAAC;AAGD,SAAgB,kCAAkC,CAAC,SAAoB;IACrE,OAAO,KAAK,EAAE,IAAiB,EAAE,EAAE;QACjC,IAAI,CAAC,CAAC,MAAM,yBAAyB,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC,EAAE,CAAC;YAC3D,OAAO,aAAa,EAAE,CAAC;QACzB,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,qBAAqB,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;QAChE,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,SAAS,CAAC,IAAI,CAAC,CAAC;QACzB,CAAC;QACD,MAAM,UAAU,GAAG,IAAA,8CAAe,EAAC,IAAI,EAAE,YAAY,CAAC,CAAC;QACvD,IAAI,UAAU,EAAE,UAAU,EAAE,CAAC;YAC3B,OAAO,aAAa,EAAE,CAAC;QACzB,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,wCAAc,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;QACxE,OAAO,eAAe,CAAC,MAAM,CAAC;YAC5B,CAAC,CAAC,+BAA+B,CAAC,MAA4B,EAAE,OAAO,EAAE,UAAU,CAAC;YACpF,CAAC,CAAC,MAAM,CAAC;IACb,CAAC,CAAC;AACJ,CAAC;AASD,SAAgB,+BAA+B;IAC7C,OAAO,gCAAgC,CAAC,OAAO,CAAC,OAAc,CAAC,CAAC;AAClE,CAAC;AAED,SAAgB,iCAAiC;IAC/C,OAAO,kCAAkC,CAAC,OAAO,CAAC,SAAgB,CAAC,CAAC;AACtE,CAAC"}

package/dist/core/common/interfaces/server-options.interface.d.ts

@@ -305,6 +305,7 @@ export interface IServerOptions {
         enableSubscriptionAuth?: boolean;
         maxComplexity?: number;
         options?: GqlModuleAsyncOptions;
+        subscriptionRevalidationMs?: false | number;
     };
     healthCheck?: {
         configs?: {

package/dist/core/modules/auth/services/core-auth.service.d.ts

@@ -26,6 +26,7 @@ export declare class CoreAuthService {
     private readonly logger;
     constructor(userService: CoreAuthUserService, jwtService: JwtService, configService: ConfigService, betterAuthService?: CoreBetterAuthService, betterAuthUserMapper?: CoreBetterAuthUserMapper);
     decodeJwt(token: string): JwtPayload;
+    verifyJwt(token: string): Promise<JwtPayload | null>;
     logout(tokenOrRefreshToken: string, serviceOptions: ServiceOptions & {
         allDevices?: boolean;
     }): Promise<boolean>;