@lenne.tech/nest-server 11.42.2 → 11.42.4

package/.claude/rules/configurable-features.md

@@ -320,7 +320,8 @@ This pattern is currently applied to:
 | Response Model Interceptor | `security.responseModelInterceptor` | Boolean Shorthand | `true` (enabled), `debug: false` |
 | Translate Response Interceptor | `security.translateResponseInterceptor` | Boolean Shorthand | `true` (enabled) |
 | Secret Fields Removal | `security.secretFields` | Array | `['password', 'verificationToken', ...]` |
-| Multi-Tenancy | `multiTenancy` | Presence Implies Enabled | **`excludeSchemas` is an OFF SWITCH for isolation, per model** — a listed schema gets no tenant filter at all; since 11.35.0 the plugin WARNS once per model when the excluded schema declares `tenantId` (i.e. was built for isolation). The framework's own docs recommended `['User', 'Session']` until then; that is withdrawn — it is only right for the global-user model. Since 11.35.0 GraphQL operations over the WEBSOCKET also run inside a `RequestContext` (`CoreModule` installs a context-aware `execute`/`subscribe` pair inside `subscriptions`, where `ApolloDriver` forwards it): the tenant comes from the handshake header validated against an active membership, else from the subscriber's memberships, and an unresolvable tenant leaves the safety net to refuse the read rather than returning everything. `headerName: 'x-tenant-id'`, `membershipModel: 'TenantMember'`, `adminBypass: true`, `excludeSchemas: []`, `roleHierarchy: { member: 1, manager: 2, owner: 3 }`, `cacheTtlMs: 30000` (0 disables, process-local). System roles (`S_EVERYONE`, `S_USER`, `S_VERIFIED`) are checked as OR alternatives before real roles; method-level system roles take precedence; membership validated for context when system role grants access + header present. Hierarchy roles use level comparison, normal roles use exact match. Use `DefaultHR` or `createHierarchyRoles()` for type-safe role constants. Bypass: `RequestContext.runWithBypassTenantGuard()`. Cache invalidation: `invalidateUser(userId)` / `invalidateAll()` are **instance** methods on the singleton `CoreTenantGuard` — inject it and call `this.tenantGuard?.invalidateUser(userId)`, never `CoreTenantGuard.invalidateUser(...)` (there is no static). With `redis` configured, both additionally BROADCAST the invalidation to every replica (`<keyPrefix>:tenant-cache:invalidate` pub/sub); without Redis they clear the local process only, so other replicas stay stale until `cacheTtlMs`. A received broadcast clears locally without re-publishing. **`isTenantActive` (11.42.0)**: optional hook `(tenantId, { connection }) => boolean \| Promise<boolean>`, absent = every tenant active (no change). Asked AFTER the membership check on every path that establishes a tenant: 403 on header paths and for tenant API tokens, no enrichment on `S_EVERYONE`, dropped from the header-less tenant list, no tenant for a NEW WebSocket subscription (an open one keeps its tenant until it reconnects — known limit, shared with removed memberships); an admin under `adminBypass` is exempt (someone must be able to switch it back on). Only `false` deactivates. Cached for `cacheTtlMs`; `invalidateTenant(tenantId)` clears and broadcasts (`{ scope: 'tenant' }`). A function, so `config.env.ts` only — not reachable through `NSC__*`. **`adminBypass: false` (11.42.0)** additionally withholds two things that went around it: `CoreUserService.update()` refuses changing another account's e-mail or password (`assertCredentialChangeAllowed()`, administrator targets included — promote-then-change — system work without a current user exempt), and the AI tool registry grants no ADMIN bypass |
+| Multi-Tenancy | `multiTenancy` | Presence Implies Enabled | **`excludeSchemas` is an OFF SWITCH for isolation, per model** — a listed schema gets no tenant filter at all; since 11.35.0 the plugin WARNS once per model when the excluded schema declares `tenantId` (i.e. was built for isolation). The framework's own docs recommended `['User', 'Session']` until then; that is withdrawn — it is only right for the global-user model. Since 11.35.0 GraphQL operations over the WEBSOCKET also run inside a `RequestContext` (`CoreModule` installs a context-aware `execute`/`subscribe` pair inside `subscriptions`, where `ApolloDriver` forwards it): the tenant comes from the handshake header validated against an active membership, else from the subscriber's memberships, and an unresolvable tenant leaves the safety net to refuse the read rather than returning everything. `headerName: 'x-tenant-id'`, `membershipModel: 'TenantMember'`, `adminBypass: true`, `excludeSchemas: []`, `roleHierarchy: { member: 1, manager: 2, owner: 3 }`, `cacheTtlMs: 30000` (0 disables, process-local). System roles (`S_EVERYONE`, `S_USER`, `S_VERIFIED`) are checked as OR alternatives before real roles; method-level system roles take precedence; membership validated for context when system role grants access + header present. Hierarchy roles use level comparison, normal roles use exact match. Use `DefaultHR` or `createHierarchyRoles()` for type-safe role constants. Bypass: `RequestContext.runWithBypassTenantGuard()`. Cache invalidation: `invalidateUser(userId)` / `invalidateAll()` are **instance** methods on the singleton `CoreTenantGuard` — inject it and call `this.tenantGuard?.invalidateUser(userId)`, never `CoreTenantGuard.invalidateUser(...)` (there is no static). With `redis` configured, both additionally BROADCAST the invalidation to every replica (`<keyPrefix>:tenant-cache:invalidate` pub/sub); without Redis they clear the local process only, so other replicas stay stale until `cacheTtlMs`. A received broadcast clears locally without re-publishing. **`isTenantActive` (11.42.0)**: optional hook `(tenantId, { connection }) => boolean \| Promise<boolean>`, absent = every tenant active (no change). Asked AFTER the membership check on every path that establishes a tenant: 403 on header paths and for tenant API tokens, no enrichment on `S_EVERYONE`, dropped from the header-less tenant list, no tenant for a NEW WebSocket subscription, and since 11.42.3 an OPEN one is closed with 4403 on `invalidateTenant()` (or at its next event once `graphQl.subscriptionRevalidationMs` has passed — see the GraphQL Subscription Re-check row); an admin under `adminBypass` is exempt (someone must be able to switch it back on). Only `false` deactivates. Cached for `cacheTtlMs`; `invalidateTenant(tenantId)` clears and broadcasts (`{ scope: 'tenant' }`). A function, so `config.env.ts` only — not reachable through `NSC__*`. **`adminBypass: false` (11.42.0)** additionally withholds two things that went around it: `CoreUserService.update()` refuses changing another account's e-mail or password (`assertCredentialChangeAllowed()`, administrator targets included — promote-then-change — system work without a current user exempt), and the AI tool registry grants no ADMIN bypass |
+| GraphQL Subscription Re-check | `graphQl.subscriptionRevalidationMs` | Numeric — `0` = STRICTEST, `false` = off, invalid → default (a fifth shape: Family C's "invalid never means unbounded", but `0` asks for MORE checking, not less) | **30000 since 11.42.3.** Before, a WebSocket was authorized once, at the handshake, and every event and operation on it ran on that snapshot until the client reconnected. Every connection a `CoreModule` `onConnect` accepts is now registered (`registerWsConnection()`) and re-checked — at once when an invalidation names it (`CoreTenantGuard.invalidateUser()` / `invalidateTenant()` / `invalidateAll()`, `CoreUserService.setRoles()` and role/verification `update()`s, the legacy password reset, and Better-Auth deleting a session through `wsSessionRevocationPlugin()`), and otherwise before the next event or operation once the last check is older than this value. The check re-runs the handshake's own authentication (session store, Better-Auth JWT signature/expiry, or for legacy tokens `CoreAuthService.verifyJwt()` — signature/expiry, verified on the WebSocket since 11.42.3 — plus the device binding) and the tenant resolution; any difference in user id, roles, verification state or tenant scope closes the socket with **4403**, which the graphql-ws client retries — the user continues with current rights or is refused at the handshake. `0` re-checks on every event and operation (one session lookup each); `false` switches only the TIME-based check off, invalidations still apply. Process-local registry: an invalidation reaches other replicas only where the tenant guard's Redis broadcast carries it; everything else is bounded by the interval. A project that replaces `onConnect` through `graphQl.driver.subscriptions` must call `registerWsConnection()` itself to keep this. Implementation: `common/helpers/graphql-ws-connection.helper.ts` |
 | API Tokens | `apiTokens` | Boolean Shorthand + Presence Implies Enabled — absent = off | `prefix: 'ltt'`, `scopes: []` (vocabulary; empty = no token creatable, boot warning), `manageRole`: highest hierarchy role, `maxAssertionLifetimeSeconds: 900` (invalid → default, never unbounded — Family C), `rateLimit: { max: 600, windowSeconds: 60 }` per token (**on by default**, `false` disables; Redis-shared when configured), `userTokens: true`, `tenantTokens: true` (effective only with `multiTenancy`), `encryptionKey` → `SECRETS_ENCRYPTION_KEY` → dev default (boot FAILS in production/staging). Top-level, NOT under `multiTenancy`: user tokens must work without it. **Deny by default**: every guard refuses a token on a route without `@ApiTokenScopes()`, public routes included, via ONE shared function (`enforceApiTokenRoute`) called BEFORE each guard's public-route shortcut. USER tokens act as their user with global roles REMOVED (no admin bypass); TENANT tokens act with the lowest hierarchy role in their own tenant, and a route guarded ONLY by `S_SELF` / `S_CREATOR` refuses them (a tenant token is nobody's self — skipping those roles would grant for any target). A tenant token depends on no member, so it outlives an off-boarded or deleted tenant until the project calls `deleteAllForTenant()`. The boot refuses a hierarchy in which that lowest role reaches `manageRole`. A prefixed credential that fails answers 401 on every route (not anonymous); `CoreBetterAuthMiddleware` skips prefixed credentials entirely, cookie fallback included. A password reset that ends the user's sessions ends their USER tokens too (legacy reset always; IAM reset while `betterAuth.emailAndPassword.revokeSessionsOnPasswordReset` is on), wired through `core-api-token.registry.ts` so neither reset path imports the optional module. Implementation: `src/core/modules/api-token/` |
 | BetterAuth Tenant Skip | `betterAuth.skipTenantCheck` | Explicit Boolean | `true` (default). When `true` and no `X-Tenant-Id` header is sent, IAM endpoints (controller + resolver) skip `CoreTenantGuard` tenant validation. When header IS present, normal membership validation runs regardless. Set `false` for tenant-aware auth scenarios (subdomain-based, invite links, SSO per tenant) |
 | Debug Process Input | `debugProcessInput` | Explicit Boolean | `false` (default). When `true`, logs a debug message when `prepareInput()` changes the input type during `process()`. Has performance cost due to `JSON.stringify` on every `process()` call — enable only for debugging |
@@ -334,6 +335,7 @@ This pattern is currently applied to:
 | TUS S3 Staging | `tus.s3Staging` | Explicit Boolean (default ON when S3 configured) | `true` when `s3` is configured, otherwise inert. Stages in-progress uploads in `s3.stagingBucket` via `@tus/s3-store` instead of `tus.uploadDir` on local disk, so resumable uploads survive replica restarts and need no sticky sessions. Set `false` to force local disk. Missing OPTIONAL peer `@tus/s3-store` → warning + fall back to local disk (NOT a boot failure). **Give the staging bucket a lifecycle rule expiring incomplete multipart uploads** — the framework's own expiration cleanup is skipped in S3 mode (S3 is the right place for that policy), so aborted uploads otherwise accumulate parts nothing removes |
 | Cron Job Deduplication | per job: `distributed` in `CronJobConfig` | Explicit Boolean | **`true` when `redis` is configured, otherwise `false`** — a single-replica project that upgrades must not silently gain a `cron-locks` collection, a lease write per tick, and a new way for a tick to be skipped. A Redis-less multi-replica fleet opts in per job with `distributed: true` (MongoDB lease). Mechanism: BullMQ job scheduler when Redis + the OPTIONAL peer `bullmq` are present AND `cronTime` is a string without `utcOffset`; otherwise local timer + lease (Redis `SET NX`, else a TTL-indexed `cron-locks` document). Tick lease TTL 3600 s. **Leases fail open** — an unreachable lease store runs the tick everywhere rather than stopping all scheduled work fleet-wide. **`runOnInit` (default `true`) deduplicates over a FIXED per-job key with a 300 s TTL**, because replicas do not share a boot instant: replicas booting within 5 min run the startup tick once between them, and a replica restarting inside that window SKIPS its startup tick — set `distributed: false` on jobs whose `runOnInit` work is per-process (warming a process-local cache). No constructor change needed: `CoreModule` fills `core-cron-jobs.registry.ts` via `CoreCronJobsInitializer` and `CoreCronJobs` reads it lazily; explicit `{ connection, redisService }` in `CoreCronJobsOptions` wins. With neither source it warns once and every replica runs every tick |
 | Shutdown Delay | `shutdownDelayMs` | Numeric Sentinel — Family B (`0` = off) | `0` (default, no delay, no log). Waits N ms **in the SIGTERM/SIGINT handler, before `close()` is entered**, so a load balancer can finish deregistering while the instance is still fully healthy. NOT a lifecycle hook: `close()` runs `onModuleDestroy` → `beforeApplicationShutdown` → dispose → `onApplicationShutdown`, so a delay in `beforeApplicationShutdown` would wait with every module already torn down while the socket still accepts — worse than no delay. **Requires `installGracefulShutdown(app)` in main.ts, which REPLACES `server.enableShutdownHooks()`** — keeping both makes Nest close the app in parallel with the wait, so the delay silently never happens. At delay `0` the helper IS `enableShutdownHooks()`. **Keep the value well below the orchestrator grace period AND leave room for the drain that follows**: Compose `stop_grace_period` 10s, Kubernetes `terminationGracePeriodSeconds` 30s, and `installProcessDiagnostics()` force-exits after 30s — exceed any and the process is SIGKILLed mid-wait with no hook running. Warns above `10000`, capped at `60000`. Non-numeric / negative values behave like `0` |
+| Body Parser Limits | `bodyParser.json.limit`, `bodyParser.urlencoded.limit` | Explicit Value (Express/body-parser default) — invalid → default, never unbounded | **Unset = 100 kB each, exactly as NestJS registers the parsers** (body-parser's own default — a limit nobody chose, and before 11.42.4 the only one in force: over it a request got a bare `request entity too large`, before auth and routing, GraphQL included). A number is bytes, a string a 1024-based size (`'500kb'`, `'2mb'`, units `b`/`kb`/`mb`/`gb`). The two limits are separate on purpose — raising JSON must not raise form posts. **Not raised by default because the parser runs before authentication** and `JSON.parse` blocks the event loop for the whole body: ~0.5 ms for 100 kB, ~16 ms for 1 MB, ~55 ms for 2 MB per request on a realistic document shape. Applied by `CoreBodyParserInitializer` (CoreModule provider) in `onModuleInit` by **swapping the handle of the global `jsonParser`/`urlencodedParser` layers NestJS registered, in place** — NestJS registers them inside `app.init()` before any init hook, and a parser appended later would sit behind the routes. Same position, `extended: true` for URL-encoded, `req.rawBody` kept when the app came from `NestFactory.create(…, { rawBody: true })` (read from the container's context options; under `Test.createTestingModule()` those options never reach the container, so a test app with `rawBody: true` gets no `req.rawBody` from a CONFIGURED parser). Because it runs during module init it **holds under `Test.createTestingModule()`**, which never runs `main.ts` — the reason a `useBodyParser()` in `main.ts` was not enough. A configured value also replaces a global parser registered in `main.ts`; a **path-scoped** one (`server.use('/upload', json({ limit }))`) is left alone and stays the way to give one path its own limit (the parser runs before routing; GraphQL shares one path). An invalid value (`0`, negative, `NaN`, a word) is refused with an error log and the parser keeps its limit. **Independent of configuration**, every 413 from a global parser is answered as `PayloadTooLargeException` with `#LTNS_0304: Request body too large [<n> bytes, limit <m> bytes]` (size only when a `Content-Length` was sent) and logged as a WARN naming method, path without query string, and the config key — no boot warning, because the framework cannot know which routes expect large bodies; the first oversized request is the earliest point anything can be said. Other parser errors pass through unchanged. Pinned by `tests/unit/body-parser.spec.ts` and `tests/body-parser.e2e-spec.ts` (mutations `body-parser-*`). Implementation: `common/services/core-body-parser.initializer.ts` |
 | Trust Proxy | `trustProxy` | Explicit Value (pass-through, Express default) | `false` (Express's own default — the forwarded chain is not trusted). Passed verbatim to `app.set('trust proxy', …)` by `CoreTrustProxyInitializer`, a `CoreModule` provider, so a consumer inherits it by upgrading and needs no `main.ts` edit. Accepts `false` / a hop count (`1`, `2`) / `'loopback'` / a subnet list — **not** Express's predicate function: the value must survive `NEST_SERVER_CONFIG` / `NSC__*` (JSON) and the ConfigService deep clone. **This is what makes `request.ip` correct, and every IP-keyed rate limit depends on it**: unset behind Caddy/nginx/an ingress, `req.ip` is the PROXY address for every request, so all clients share ONE bucket and `auth.rateLimit.max` throttles everybody at once — exactly fleet-wide once `redis` is configured. Trusting MORE hops than exist is the opposite failure: a client prepends its own header entry and picks a fresh bucket per request. Applied at module init (inside `app.init()`/`listen()`, i.e. AFTER `main.ts`), so a configured value wins over a hand-written `app.set()`; an UNSET value is never applied, which keeps `app.set('trust proxy', fn)` in `main.ts` available as the escape hatch for the predicate form. **Unset + an IP-keyed limiter enabled (`auth.rateLimit` / `betterAuth.rateLimit`) logs a boot warning naming the shared-bucket consequence**; `trustProxy: false` is the explicit "nothing proxies me" answer that silences it. The AI limiter keys on the user id and is unaffected |
 | Outbound URL Guard (SSRF) | `security.allowPrivateOutboundTargets` | Explicit Boolean with DERIVED default | **Opt-in helper for URLs a USER entered** (webhooks, export targets, ERP addresses) — `outboundFetch()`, `assertOutboundUrlAllowed()`, `createOutboundDispatcher()` in `common/helpers/outbound-url.helper.ts` (11.42.0). Nothing is applied globally: configured targets (AI providers, SMTP, S3, Redis, Brevo) never go through it. Refuses loopback, RFC 1918, link-local incl. `169.254.169.254`, CGNAT, `0/8`, benchmarking, multicast/reserved, IPv6 unspecified/loopback/IPv4-compatible (`::/96`), NAT64, ULA, link-local and multicast, and IPv4-mapped IPv6 in every notation (canonicalised through the URL parser). Checked TWICE: on the URL before sending (readable `OutboundUrlBlockedError`) and on every connection through an undici `Agent` with a guarded connector — the only place that sees a redirect's next hop and a DNS answer at connect time (rebinding). **Unset → derived from the environment**: allowed in `local`, `e2e`, `ci`, refused everywhere else — deliberately including `test`, a DEPLOYED stage in starter-based projects; `true`/`false` (also the strings, from `NSC__SECURITY__ALLOW_PRIVATE_OUTBOUND_TARGETS`) decide explicitly. Per call, `allowedHosts` frees single internal hosts (`'erp.local:8443'` = that port, `'erp.local'` = any port) without opening the rest — re-checked per connection, so a redirect does not inherit it. `outboundFetch()` uses undici's OWN `fetch` (runtime dependency `undici` since 11.42.0), because Node 22's built-in fetch bundles a different undici major than the agent |
 | AI Egress Allowlist (SSRF) | `ai.allowedBaseUrlHosts` | Explicit Value — **unset = permissive**, malformed = INTERPRETED or reported, never silently off | `undefined` → no restriction, so a local provider (Ollama on `localhost:11434`) works out of the box. Set → only those hosts are reachable, matched against `URL.host` (incl. port) and `URL.hostname`. **Accepts an array OR a comma-separated string, and the string form is not a convenience** — it is what the framework's own env mapping produces: `NSC__AI__ALLOWED_BASE_URL_HOSTS` becomes `{ ai: { allowedBaseUrlHosts: '<string>' } }` and lodash `merge` assigns that scalar straight over a configured array. Until 11.39.x a bare `!Array.isArray(...) -> return` read that as "not configured" and skipped the check entirely, so the canonical `NSC__` spelling silently disabled SSRF egress control with no log line at all. Entries are trimmed, lowercased and stripped of a fully-qualifying trailing dot, and the SAME normalisation is applied to the URL, so neither side wins by spelling one DNS name differently; a bare hostname entry matches any port, and an entry naming the scheme's default port (`example.com:443` on https) also matches the portless URL. A value that is neither array nor string carries no hostnames — the allowlist is then inactive and that is LOGGED as an error, because from the outside it looks exactly like "correctly unset". Enforced on **all three** outbound paths (`chat()`, the capability `probe()`, and `probeContextWindow()` — the last was unguarded before 11.39.x and is reachable from an ordinary user prompt via `detectAndPersistCapabilities()`, before the rate limit). Implementation: `openai-compatible.provider.ts` → `assertBaseUrlAllowed()` / `resolveAllowedBaseUrlHosts()` |

package/.claude/rules/package-management.md

@@ -169,7 +169,7 @@ Two ordering rules, both enforced by the contract test:
 Package overrides live in the `overrides:` section of **`pnpm-workspace.yaml`** (they moved out of `package.json`'s `pnpm.overrides` in the pnpm 11 upgrade). They force transitive dependencies to a security-patched version.
 
 **Keep the set minimal.** On the pnpm 11 upgrade the list was pruned from 36 to the 9 then still
-load-bearing (it has since grown back to 18 as new advisories landed) — an override is only necessary if removing it lets the package resolve back INTO its vulnerable range (verify with a with/without lockfile diff; `pnpm audit` is the arbiter). Each surviving entry carries its CVE rationale as a comment. Remove an entry once its parent dependency ships a fixed version.
+load-bearing (it has since grown back to 19 as new advisories landed) — an override is only necessary if removing it lets the package resolve back INTO its vulnerable range (verify with a with/without lockfile diff; `pnpm audit` is the arbiter). Each surviving entry carries its CVE rationale as a comment. Remove an entry once its parent dependency ships a fixed version.
 
 ### Rule: Override Targets MUST Be Fixed Versions
 

package/.claude/rules/role-system.md

@@ -444,9 +444,37 @@ account over with an address change and a reset, which is precisely the access `
 withholds.
 
 **Deactivated tenants.** `multiTenancy.isTenantActive` is asked after the membership on every path that
-establishes a tenant (see `.claude/rules/configurable-features.md`, Multi-Tenancy row). A GraphQL
-subscription that is already open keeps its tenant until the client reconnects — a known limit it
-shares with a removed membership.
+establishes a tenant (see `.claude/rules/configurable-features.md`, Multi-Tenancy row).
+
+**Open WebSockets (11.42.3).** A WebSocket is authorized at the handshake, and until 11.42.3 that was
+the only check: a removed membership, a deactivated tenant, a withdrawn role or a revoked session took
+effect on every new request and on none of the sockets already open. Now every connection
+`CoreModule`'s `onConnect` accepts is registered (`registerWsConnection()`,
+`common/helpers/graphql-ws-connection.helper.ts`) with the rights it was authorized with, and is
+checked again
+
+| Trigger | When |
+|---------|------|
+| `CoreTenantGuard.invalidateUser()` / `invalidateTenant()` / `invalidateAll()` (also when received from another replica), `CoreUserService.setRoles()`, an `update()` touching `roles` / `verified` / `emailVerified`, the legacy password reset | at once |
+| Better-Auth deleting a session (sign-out, revoked session, reset with `revokeSessionsOnPasswordReset`) — through `wsSessionRevocationPlugin()`, a plugin so a project's own `options.databaseHooks` cannot displace it | at once |
+| anything nobody invalidated (a membership edited in the database, an expired session) | before the next event or operation once the last check is older than `graphQl.subscriptionRevalidationMs` (30 s) |
+
+A connection whose rights CHANGED — in either direction — is closed with **4403**, which the
+graphql-ws client retries: it reconnects and resubscribes with its current rights, or is refused at the
+handshake. It is closed rather than patched because a subscription may have picked its topic or filter
+from the tenant at subscribe time. An event is checked after graphql-js executed it and before it is
+sent, so a dropped event's reads happened but none of it reaches the client. Pinned by
+`tests/subscription-revalidation.e2e-spec.ts` (mechanism), `tests/subscription-session-iam.e2e-spec.ts`
+and `tests/subscription-session-legacy.e2e-spec.ts` (assembled stack).
+
+The check re-runs the HANDSHAKE'S authentication, which on the legacy builder means
+`CoreAuthService.verifyJwt()` — signature and expiry, in passport-jwt's key order — before
+`validateUser()`'s device binding. The handshake used `decodeJwt()` until 11.42.3, so an expired or
+re-signed legacy token opened sockets that HTTP refused (mutation `legacy-ws-jwt-unverified`). A legacy
+socket therefore ends with its token: at expiry or at the next token refresh.
+
+**A guard that asks "is this request allowed?" once is not enough for a connection that outlives the
+answer.** When you add a long-lived channel (SSE, a WebSocket of your own), register it the same way.
 
 ## Role Check Implementation
 

package/.claude/rules/testing.md

@@ -266,7 +266,7 @@ pnpm run check:mutations -- --id=<id>       # one mutation
 pnpm run check:mutations -- --list          # the registry, without running anything
 pnpm run check:mutations -- --allow-dirty   # when the fix and its evidence share a working tree
 pnpm run check:mutations -- --jobs=4        # N mutations at a time (default: 2, or 4 on >=12 cores)
-pnpm run check:mutations -- --no-infra      # only the 92 that need no MongoDB
+pnpm run check:mutations -- --no-infra      # only the 97 that need no MongoDB
 pnpm run check:mutations -- --since=<ref>   # only mutations touching files changed since <ref>
 ```
 
@@ -285,7 +285,7 @@ when the registry, a vitest config or a setup file changed, since those can move
 commit, and in CI alongside the publish without blocking it. The price of caching is a cache that
 has to model each spec's full dependency closure correctly, and getting that wrong produces a stale
 PASS for a test that has since gone vacuous — exactly what the gate is there to prevent. Bad trade
-at 147 mutations.
+at 160 mutations.
 
 **Decided 2026-10-03 (repo owner): keep the full run.** Measured at 128 mutations, the CI job for
 11.41.6 took **14 minutes**. The trigger to revisit is that wall time, not the mutation count —
@@ -330,9 +330,9 @@ exactly the environment where the answer matters.
 
 ### The cost is vitest's cold start, not the tests
 
-Worth knowing before optimising the wrong thing: the specs behind all 55 e2e mutations add up to
+Worth knowing before optimising the wrong thing: the specs behind all 63 e2e mutations add up to
 **~40 seconds**. The step takes ~740s. The remaining ~700s is paying vitest's startup — process
-spawn, transform, module graph, mongod connect, DB create and drop — once per mutation, 147 times.
+spawn, transform, module graph, mongod connect, DB create and drop — once per mutation, 160 times.
 That work is largely single-threaded I/O and barely scales with cores: the full registry measures
 **744s on a 12-core laptop and 777s on a 4-vCPU CI runner**.
 

package/CLAUDE.md

@@ -233,6 +233,11 @@ in services (MCP/AI tools call services directly), tenant-aware tool roles in th
 boundary under `adminBypass: false`. User-entered URLs (webhooks, export targets) go through
 `outboundFetch()` (SSRF guard) — configured targets do not.
 
+Since 11.42.3 an **open GraphQL WebSocket** is re-checked, not trusted for its lifetime: at once on an
+invalidation (tenant guard, role change, password reset, sign-out), otherwise every
+`graphQl.subscriptionRevalidationMs` (30 s); changed rights close it with 4403 and the client
+reconnects. A custom `onConnect` must call `registerWsConnection()` to keep that.
+
 See `.claude/rules/role-system.md` for complete documentation.
 
 ### Versioning
@@ -500,8 +505,9 @@ lt dev doctor    # Diagnose Caddy/CA/DNS/port issues
 **Active URLs for THIS project:**
 
 - API: `https://api.nest-server.localhost`
+- The `*.localhost` names are resolved by BROWSERS. Node, `curl` and other tools may not resolve them (they do not on Windows), so a script uses the loopback address: `LT_DEV_API_INTERNAL_URL` (set in the processes and in `.lt-dev/.env`), or the `→ 127.0.0.1:<port>` that `lt dev status` prints. The port differs per machine, which is why it is not written here.
 - DB: `mongodb://127.0.0.1/nest-server-local`
 
-Env vars set automatically by `lt dev up`: `BASE_URL`, `APP_URL`, `NUXT_API_URL`, `NUXT_PUBLIC_API_URL`, `NUXT_PUBLIC_SITE_URL`, `NUXT_PUBLIC_STORAGE_PREFIX`, `NSC__MONGOOSE__URI`, `DATABASE_URL`. **Never assume `localhost:3000` / `localhost:3001` for this project** — those are the framework defaults, not the active URLs.
+Env vars set automatically by `lt dev up`: `BASE_URL`, `APP_URL`, `NUXT_API_URL`, `NUXT_PUBLIC_API_URL`, `NUXT_PUBLIC_SITE_URL`, `NUXT_PUBLIC_STORAGE_PREFIX`, `NUXT_SESSION_PASSWORD`, `NSC__MONGOOSE__URI`, `DATABASE_URL`. **Never assume `localhost:3000` / `localhost:3001` for this project** — those are the framework defaults, not the active URLs.
 
 <!-- lt-dev:url-block:end -->

package/FRAMEWORK-API.md

@@ -1,6 +1,6 @@
 # @lenne.tech/nest-server — Framework API Reference
 
-> Auto-generated from source code as of 2026-10-04 (v11.42.2)
+> Auto-generated from source code as of 2026-10-06 (v11.42.4)
 > File: `FRAMEWORK-API.md` — compact, machine-readable API surface for Claude Code
 
 ## CoreModule.forRoot()
@@ -19,6 +19,7 @@
   - `automaticObjectIdFiltering?`: `boolean | undefined` — Automatically detect ObjectIds in string values in FilterQueries
   - `baseUrl?`: `string | undefined` — Base URL of the API server.
   - `betterAuth?`: `boolean | IBetterAuth | undefined` (default: `undefined (enabled with defaults)`) — Configuration for better-auth authentication framework.
+  - `bodyParser?`: `IBodyParserConfig | undefined` — Size limits for request bodies.
   - `brevo?`: `{ apiKey: string; exclude?: RegExp; maxRetries?: number; sender: { email: str...` — Configuration for Brevo
   - `compression?`: `boolean | compression.CompressionOptions | undefined` — Whether to use the compression middleware package to enable gzip compression.
   - `cookies?`: `boolean | ICookiesConfig | undefined` (default: `true`) — Cookie configuration for authentication handling.

package/dist/core/common/helpers/graphql-ws-connection.helper.d.ts

@@ -0,0 +1,43 @@
+import { ResolvedTenantContext } from '../services/core-tenant-context.registry';
+export declare const WS_AUTHORIZATION_CHANGED_CLOSE_CODE = 4403;
+export declare const DEFAULT_SUBSCRIPTION_REVALIDATION_MS = 30000;
+export interface IWsConnectionSocket {
+    close(code: number, reason?: string): void;
+    once?(event: 'close', listener: (...args: any[]) => void): unknown;
+}
+export interface IWsConnectionRegistration {
+    carrier: object;
+    reauthenticate?: () => any;
+    socket?: IWsConnectionSocket;
+    user: any;
+}
+export interface IWsConnectionIdentity {
+    email?: string;
+    iamId?: string;
+    userId?: string;
+}
+export interface WsConnection {
+    readonly email?: string;
+    readonly iamId?: string;
+    readonly reauthenticate?: () => any;
+    readonly socket?: IWsConnectionSocket;
+    tenant?: ResolvedTenantContext;
+    readonly tenantHeader?: string;
+    terminated: boolean;
+    readonly user: any;
+    readonly userFingerprint: string;
+    readonly userId?: string;
+    inflight?: Promise<boolean>;
+    stale: boolean;
+    tenantFingerprint?: string;
+    validatedAt: number;
+}
+export declare function resolveSubscriptionRevalidationMs(value: unknown): false | number;
+export declare function readWsTenantHeader(contextValue: any): string | undefined;
+export declare function registerWsConnection(registration: IWsConnectionRegistration): void;
+export declare function getWsConnection(contextValue: any): undefined | WsConnection;
+export declare function ensureWsConnectionCurrent(connection: WsConnection): Promise<boolean>;
+export declare function noteWsConnectionTenant(connection: WsConnection, tenant: ResolvedTenantContext | undefined): boolean;
+export declare function revalidateWsConnectionsOf(identity: IWsConnectionIdentity): number;
+export declare function revalidateWsConnectionsForTenant(tenantId: string): number;
+export declare function revalidateAllWsConnections(): number;

package/dist/core/common/helpers/graphql-ws-connection.helper.js

@@ -0,0 +1,219 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DEFAULT_SUBSCRIPTION_REVALIDATION_MS = exports.WS_AUTHORIZATION_CHANGED_CLOSE_CODE = void 0;
+exports.resolveSubscriptionRevalidationMs = resolveSubscriptionRevalidationMs;
+exports.readWsTenantHeader = readWsTenantHeader;
+exports.registerWsConnection = registerWsConnection;
+exports.getWsConnection = getWsConnection;
+exports.ensureWsConnectionCurrent = ensureWsConnectionCurrent;
+exports.noteWsConnectionTenant = noteWsConnectionTenant;
+exports.revalidateWsConnectionsOf = revalidateWsConnectionsOf;
+exports.revalidateWsConnectionsForTenant = revalidateWsConnectionsForTenant;
+exports.revalidateAllWsConnections = revalidateAllWsConnections;
+const common_1 = require("@nestjs/common");
+const config_service_1 = require("../services/config.service");
+const core_tenant_context_registry_1 = require("../services/core-tenant-context.registry");
+exports.WS_AUTHORIZATION_CHANGED_CLOSE_CODE = 4403;
+exports.DEFAULT_SUBSCRIPTION_REVALIDATION_MS = 30_000;
+const WS_CONNECTION = Symbol('ltWsConnection');
+const liveConnections = new Set();
+const logger = new common_1.Logger('GraphQlWsConnection');
+function resolveSubscriptionRevalidationMs(value) {
+    if (value === false || value === 'false') {
+        return false;
+    }
+    const numeric = typeof value === 'string' && value.trim() !== '' ? Number(value) : value;
+    if (typeof numeric === 'number' && Number.isFinite(numeric) && numeric >= 0) {
+        return numeric;
+    }
+    return exports.DEFAULT_SUBSCRIPTION_REVALIDATION_MS;
+}
+function configuredRevalidationMs() {
+    const graphQl = config_service_1.ConfigService.configFastButReadOnly?.graphQl;
+    return resolveSubscriptionRevalidationMs(graphQl ? graphQl.subscriptionRevalidationMs : undefined);
+}
+function fingerprintUser(user) {
+    if (!user) {
+        return '';
+    }
+    const roles = Array.isArray(user.roles) ? user.roles.map((role) => String(role)).sort() : [];
+    const verified = !!(user.verified || user.verifiedAt || user.emailVerified);
+    return JSON.stringify([String(user.id ?? user._id ?? ''), roles, verified]);
+}
+function fingerprintTenant(tenant) {
+    const tenantIds = Array.isArray(tenant?.tenantIds) ? tenant.tenantIds.map((id) => String(id)).sort() : null;
+    return JSON.stringify([tenant?.tenantId ?? null, tenantIds, tenant?.tenantRole ?? null, !!tenant?.isAdminBypass]);
+}
+function readWsTenantHeader(contextValue) {
+    const headerName = (config_service_1.ConfigService.configFastButReadOnly?.multiTenancy?.headerName ?? 'x-tenant-id').toLowerCase();
+    const sources = [contextValue?.headers, contextValue?.connectionParams, contextValue?.request?.headers];
+    for (const source of sources) {
+        if (!source || typeof source !== 'object') {
+            continue;
+        }
+        for (const [key, value] of Object.entries(source)) {
+            if (key.toLowerCase() === headerName && typeof value === 'string' && value) {
+                return value;
+            }
+        }
+    }
+    return undefined;
+}
+function registerWsConnection(registration) {
+    const { carrier, reauthenticate, socket, user } = registration;
+    if (!carrier || typeof carrier !== 'object') {
+        return;
+    }
+    const userId = user?.id ?? user?._id;
+    const connection = {
+        email: typeof user?.email === 'string' ? user.email.toLowerCase() : undefined,
+        iamId: typeof user?.iamId === 'string' ? user.iamId : undefined,
+        reauthenticate,
+        socket,
+        stale: false,
+        tenantHeader: readWsTenantHeader(carrier),
+        terminated: false,
+        user,
+        userFingerprint: fingerprintUser(user),
+        userId: userId !== undefined && userId !== null ? String(userId) : undefined,
+        validatedAt: Date.now(),
+    };
+    Object.defineProperty(carrier, WS_CONNECTION, { configurable: true, enumerable: true, value: connection });
+    if (socket && typeof socket.once === 'function') {
+        liveConnections.add(connection);
+        socket.once('close', () => {
+            connection.terminated = true;
+            liveConnections.delete(connection);
+        });
+    }
+}
+function getWsConnection(contextValue) {
+    if (!contextValue || typeof contextValue !== 'object') {
+        return undefined;
+    }
+    const connection = contextValue[WS_CONNECTION];
+    return connection && typeof connection === 'object' ? connection : undefined;
+}
+function terminate(connection, reason) {
+    if (connection.terminated) {
+        return false;
+    }
+    connection.terminated = true;
+    liveConnections.delete(connection);
+    logger.log(`Closing GraphQL WebSocket of user ${connection.userId ?? '(unknown)'}: ${reason}`);
+    try {
+        connection.socket?.close(exports.WS_AUTHORIZATION_CHANGED_CLOSE_CODE, reason);
+    }
+    catch {
+    }
+    return false;
+}
+async function revalidate(connection) {
+    connection.stale = false;
+    try {
+        let user = connection.user;
+        if (connection.reauthenticate) {
+            user = await connection.reauthenticate();
+            if (!user) {
+                return terminate(connection, 'Session no longer valid');
+            }
+        }
+        if (fingerprintUser(user) !== connection.userFingerprint) {
+            return terminate(connection, 'User authorization changed');
+        }
+        if (connection.tenantFingerprint !== undefined) {
+            const resolver = (0, core_tenant_context_registry_1.getTenantContextResolver)();
+            const tenant = resolver ? await resolver.resolve(user, connection.tenantHeader) : {};
+            if (fingerprintTenant(tenant) !== connection.tenantFingerprint) {
+                return terminate(connection, 'Tenant access changed');
+            }
+        }
+        if (connection.terminated) {
+            return false;
+        }
+        connection.validatedAt = Date.now();
+        return true;
+    }
+    catch {
+        return terminate(connection, 'Authorization check failed');
+    }
+}
+function ensureWsConnectionCurrent(connection) {
+    if (connection.terminated) {
+        return Promise.resolve(false);
+    }
+    const interval = configuredRevalidationMs();
+    if (!connection.stale && (interval === false || Date.now() - connection.validatedAt < interval)) {
+        return Promise.resolve(true);
+    }
+    if (!connection.inflight) {
+        connection.inflight = revalidate(connection).finally(() => {
+            connection.inflight = undefined;
+            if (connection.stale && !connection.terminated) {
+                void ensureWsConnectionCurrent(connection);
+            }
+        });
+    }
+    return connection.inflight;
+}
+function noteWsConnectionTenant(connection, tenant) {
+    if (connection.terminated) {
+        return false;
+    }
+    const fingerprint = fingerprintTenant(tenant);
+    if (connection.tenantFingerprint === undefined) {
+        connection.tenant = tenant ? { ...tenant } : {};
+        connection.tenantFingerprint = fingerprint;
+        return true;
+    }
+    if (fingerprint !== connection.tenantFingerprint) {
+        return terminate(connection, 'Tenant access changed');
+    }
+    return true;
+}
+function markStale(connection) {
+    connection.stale = true;
+    void ensureWsConnectionCurrent(connection);
+}
+function revalidateWsConnectionsOf(identity) {
+    const userId = identity?.userId !== undefined && identity?.userId !== null ? String(identity.userId) : undefined;
+    const iamId = identity?.iamId || undefined;
+    const email = typeof identity?.email === 'string' ? identity.email.toLowerCase() : undefined;
+    if (!userId && !iamId && !email) {
+        return 0;
+    }
+    let count = 0;
+    for (const connection of liveConnections) {
+        if ((userId && connection.userId === userId) ||
+            (iamId && connection.iamId === iamId) ||
+            (email && connection.email === email)) {
+            markStale(connection);
+            count++;
+        }
+    }
+    return count;
+}
+function revalidateWsConnectionsForTenant(tenantId) {
+    if (!tenantId) {
+        return 0;
+    }
+    const id = String(tenantId);
+    let count = 0;
+    for (const connection of liveConnections) {
+        const tenant = connection.tenant;
+        if (tenant && (tenant.tenantId === id || (Array.isArray(tenant.tenantIds) && tenant.tenantIds.includes(id)))) {
+            markStale(connection);
+            count++;
+        }
+    }
+    return count;
+}
+function revalidateAllWsConnections() {
+    let count = 0;
+    for (const connection of liveConnections) {
+        markStale(connection);
+        count++;
+    }
+    return count;
+}
+//# sourceMappingURL=graphql-ws-connection.helper.js.map

package/dist/core/common/helpers/graphql-ws-connection.helper.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"graphql-ws-connection.helper.js","sourceRoot":"","sources":["../../../../src/core/common/helpers/graphql-ws-connection.helper.ts"],"names":[],"mappings":";;;AAkIA,8EASC;AAuBD,gDAcC;AAMD,oDA4BC;AAGD,0CAMC;AA6DD,8DAmBC;AASD,wDAcC;AAaD,8DAmBC;AAGD,4EAcC;AAGD,gEAOC;AA7XD,2CAAwC;AAExC,+DAA2D;AAC3D,2FAA2G;AAsC9F,QAAA,mCAAmC,GAAG,IAAI,CAAC;AAG3C,QAAA,oCAAoC,GAAG,MAAM,CAAC;AAmE3D,MAAM,aAAa,GAAG,MAAM,CAAC,gBAAgB,CAAC,CAAC;AAO/C,MAAM,eAAe,GAAG,IAAI,GAAG,EAAgB,CAAC;AAEhD,MAAM,MAAM,GAAG,IAAI,eAAM,CAAC,qBAAqB,CAAC,CAAC;AAUjD,SAAgB,iCAAiC,CAAC,KAAc;IAC9D,IAAI,KAAK,KAAK,KAAK,IAAI,KAAK,KAAK,OAAO,EAAE,CAAC;QACzC,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,OAAO,GAAG,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IACzF,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,OAAO,IAAI,CAAC,EAAE,CAAC;QAC5E,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,OAAO,4CAAoC,CAAC;AAC9C,CAAC;AAED,SAAS,wBAAwB;IAC/B,MAAM,OAAO,GAAG,8BAAa,CAAC,qBAAqB,EAAE,OAAO,CAAC;IAC7D,OAAO,iCAAiC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,0BAA0B,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;AACrG,CAAC;AAGD,SAAS,eAAe,CAAC,IAAS;IAChC,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAa,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACtG,MAAM,QAAQ,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,aAAa,CAAC,CAAC;IAC5E,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,IAAI,CAAC,GAAG,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC;AAC9E,CAAC;AAED,SAAS,iBAAiB,CAAC,MAAyC;IAClE,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IAC5G,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC,MAAM,EAAE,QAAQ,IAAI,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,IAAI,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC,CAAC;AACpH,CAAC;AAGD,SAAgB,kBAAkB,CAAC,YAAiB;IAClD,MAAM,UAAU,GAAG,CAAC,8BAAa,CAAC,qBAAqB,EAAE,YAAY,EAAE,UAAU,IAAI,aAAa,CAAC,CAAC,WAAW,EAAE,CAAC;IAClH,MAAM,OAAO,GAAG,CAAC,YAAY,EAAE,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAE,YAAY,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IACxG,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;YAC1C,SAAS;QACX,CAAC;QACD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAiC,CAAC,EAAE,CAAC;YAC7E,IAAI,GAAG,CAAC,WAAW,EAAE,KAAK,UAAU,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,EAAE,CAAC;gBAC3E,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAMD,SAAgB,oBAAoB,CAAC,YAAuC;IAC1E,MAAM,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,YAAY,CAAC;IAC/D,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;QAC5C,OAAO;IACT,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,EAAE,EAAE,IAAI,IAAI,EAAE,GAAG,CAAC;IACrC,MAAM,UAAU,GAAiB;QAC/B,KAAK,EAAE,OAAO,IAAI,EAAE,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,SAAS;QAC7E,KAAK,EAAE,OAAO,IAAI,EAAE,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS;QAC/D,cAAc;QACd,MAAM;QACN,KAAK,EAAE,KAAK;QACZ,YAAY,EAAE,kBAAkB,CAAC,OAAO,CAAC;QACzC,UAAU,EAAE,KAAK;QACjB,IAAI;QACJ,eAAe,EAAE,eAAe,CAAC,IAAI,CAAC;QACtC,MAAM,EAAE,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS;QAC5E,WAAW,EAAE,IAAI,CAAC,GAAG,EAAE;KACxB,CAAC;IACF,MAAM,CAAC,cAAc,CAAC,OAAO,EAAE,aAAa,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,CAAC;IAE3G,IAAI,MAAM,IAAI,OAAO,MAAM,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;QAChD,eAAe,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAChC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE;YACxB,UAAU,CAAC,UAAU,GAAG,IAAI,CAAC;YAC7B,eAAe,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QACrC,CAAC,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAGD,SAAgB,eAAe,CAAC,YAAiB;IAC/C,IAAI,CAAC,YAAY,IAAI,OAAO,YAAY,KAAK,QAAQ,EAAE,CAAC;QACtD,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,UAAU,GAAG,YAAY,CAAC,aAAa,CAAC,CAAC;IAC/C,OAAO,UAAU,IAAI,OAAO,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;AAC/E,CAAC;AAMD,SAAS,SAAS,CAAC,UAAwB,EAAE,MAAc;IACzD,IAAI,UAAU,CAAC,UAAU,EAAE,CAAC;QAC1B,OAAO,KAAK,CAAC;IACf,CAAC;IACD,UAAU,CAAC,UAAU,GAAG,IAAI,CAAC;IAC7B,eAAe,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IACnC,MAAM,CAAC,GAAG,CAAC,qCAAqC,UAAU,CAAC,MAAM,IAAI,WAAW,KAAK,MAAM,EAAE,CAAC,CAAC;IAC/F,IAAI,CAAC;QAEH,UAAU,CAAC,MAAM,EAAE,KAAK,CAAC,2CAAmC,EAAE,MAAM,CAAC,CAAC;IACxE,CAAC;IAAC,MAAM,CAAC;IAET,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,KAAK,UAAU,UAAU,CAAC,UAAwB;IAChD,UAAU,CAAC,KAAK,GAAG,KAAK,CAAC;IACzB,IAAI,CAAC;QACH,IAAI,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC;QAC3B,IAAI,UAAU,CAAC,cAAc,EAAE,CAAC;YAC9B,IAAI,GAAG,MAAM,UAAU,CAAC,cAAc,EAAE,CAAC;YACzC,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,OAAO,SAAS,CAAC,UAAU,EAAE,yBAAyB,CAAC,CAAC;YAC1D,CAAC;QACH,CAAC;QACD,IAAI,eAAe,CAAC,IAAI,CAAC,KAAK,UAAU,CAAC,eAAe,EAAE,CAAC;YACzD,OAAO,SAAS,CAAC,UAAU,EAAE,4BAA4B,CAAC,CAAC;QAC7D,CAAC;QACD,IAAI,UAAU,CAAC,iBAAiB,KAAK,SAAS,EAAE,CAAC;YAC/C,MAAM,QAAQ,GAAG,IAAA,uDAAwB,GAAE,CAAC;YAC5C,MAAM,MAAM,GAAG,QAAQ,CAAC,CAAC,CAAC,MAAM,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,UAAU,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACrF,IAAI,iBAAiB,CAAC,MAAM,CAAC,KAAK,UAAU,CAAC,iBAAiB,EAAE,CAAC;gBAC/D,OAAO,SAAS,CAAC,UAAU,EAAE,uBAAuB,CAAC,CAAC;YACxD,CAAC;QACH,CAAC;QACD,IAAI,UAAU,CAAC,UAAU,EAAE,CAAC;YAC1B,OAAO,KAAK,CAAC;QACf,CAAC;QACD,UAAU,CAAC,WAAW,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACpC,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QAGP,OAAO,SAAS,CAAC,UAAU,EAAE,4BAA4B,CAAC,CAAC;IAC7D,CAAC;AACH,CAAC;AASD,SAAgB,yBAAyB,CAAC,UAAwB;IAChE,IAAI,UAAU,CAAC,UAAU,EAAE,CAAC;QAC1B,OAAO,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAChC,CAAC;IACD,MAAM,QAAQ,GAAG,wBAAwB,EAAE,CAAC;IAC5C,IAAI,CAAC,UAAU,CAAC,KAAK,IAAI,CAAC,QAAQ,KAAK,KAAK,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,UAAU,CAAC,WAAW,GAAG,QAAQ,CAAC,EAAE,CAAC;QAChG,OAAO,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/B,CAAC;IACD,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QACzB,UAAU,CAAC,QAAQ,GAAG,UAAU,CAAC,UAAU,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE;YACxD,UAAU,CAAC,QAAQ,GAAG,SAAS,CAAC;YAGhC,IAAI,UAAU,CAAC,KAAK,IAAI,CAAC,UAAU,CAAC,UAAU,EAAE,CAAC;gBAC/C,KAAK,yBAAyB,CAAC,UAAU,CAAC,CAAC;YAC7C,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;IACD,OAAO,UAAU,CAAC,QAAQ,CAAC;AAC7B,CAAC;AASD,SAAgB,sBAAsB,CAAC,UAAwB,EAAE,MAAyC;IACxG,IAAI,UAAU,CAAC,UAAU,EAAE,CAAC;QAC1B,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,WAAW,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;IAC9C,IAAI,UAAU,CAAC,iBAAiB,KAAK,SAAS,EAAE,CAAC;QAC/C,UAAU,CAAC,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChD,UAAU,CAAC,iBAAiB,GAAG,WAAW,CAAC;QAC3C,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,WAAW,KAAK,UAAU,CAAC,iBAAiB,EAAE,CAAC;QACjD,OAAO,SAAS,CAAC,UAAU,EAAE,uBAAuB,CAAC,CAAC;IACxD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAGD,SAAS,SAAS,CAAC,UAAwB;IACzC,UAAU,CAAC,KAAK,GAAG,IAAI,CAAC;IACxB,KAAK,yBAAyB,CAAC,UAAU,CAAC,CAAC;AAC7C,CAAC;AAOD,SAAgB,yBAAyB,CAAC,QAA+B;IACvE,MAAM,MAAM,GAAG,QAAQ,EAAE,MAAM,KAAK,SAAS,IAAI,QAAQ,EAAE,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACjH,MAAM,KAAK,GAAG,QAAQ,EAAE,KAAK,IAAI,SAAS,CAAC;IAC3C,MAAM,KAAK,GAAG,OAAO,QAAQ,EAAE,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IAC7F,IAAI,CAAC,MAAM,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,EAAE,CAAC;QAChC,OAAO,CAAC,CAAC;IACX,CAAC;IACD,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,KAAK,MAAM,UAAU,IAAI,eAAe,EAAE,CAAC;QACzC,IACE,CAAC,MAAM,IAAI,UAAU,CAAC,MAAM,KAAK,MAAM,CAAC;YACxC,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK,KAAK,KAAK,CAAC;YACrC,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK,KAAK,KAAK,CAAC,EACrC,CAAC;YACD,SAAS,CAAC,UAAU,CAAC,CAAC;YACtB,KAAK,EAAE,CAAC;QACV,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAGD,SAAgB,gCAAgC,CAAC,QAAgB;IAC/D,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,CAAC,CAAC;IACX,CAAC;IACD,MAAM,EAAE,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC5B,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,KAAK,MAAM,UAAU,IAAI,eAAe,EAAE,CAAC;QACzC,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC;QACjC,IAAI,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7G,SAAS,CAAC,UAAU,CAAC,CAAC;YACtB,KAAK,EAAE,CAAC;QACV,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAGD,SAAgB,0BAA0B;IACxC,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,KAAK,MAAM,UAAU,IAAI,eAAe,EAAE,CAAC;QACzC,SAAS,CAAC,UAAU,CAAC,CAAC;QACtB,KAAK,EAAE,CAAC;IACV,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/core/common/helpers/graphql-ws-context.helper.d.ts

@@ -1,4 +1,5 @@
 import { IRequestContext } from '../services/request-context.service';
+import { WsConnection } from './graphql-ws-connection.helper';
 interface GraphQlArgs {
     contextValue?: any;
     [key: string]: any;
@@ -7,7 +8,7 @@ type ExecuteFn = (args: GraphQlArgs) => any;
 export declare function buildWsRequestContext(contextValue: any): Promise<IRequestContext | undefined>;
 export declare function withRequestContextAsyncIterator<T>(iterator: AsyncIterator<T> & {
     [Symbol.asyncIterator]?: () => AsyncIterator<T>;
-}, context: IRequestContext): AsyncIterableIterator<T>;
+}, context: IRequestContext, connection?: WsConnection): AsyncIterableIterator<T>;
 export declare function createRequestContextAwareExecute(execute: ExecuteFn): ExecuteFn;
 export declare function createRequestContextAwareSubscribe(subscribe: ExecuteFn): ExecuteFn;
 export declare function buildRequestContextAwareExecute(): (args: GraphQlArgs) => any;

package/dist/core/common/helpers/graphql-ws-context.helper.js

@@ -8,22 +8,10 @@ exports.buildRequestContextAwareExecute = buildRequestContextAwareExecute;
 exports.buildRequestContextAwareSubscribe = buildRequestContextAwareSubscribe;
 const graphql = require("graphql");
 const core_tenant_context_registry_1 = require("../services/core-tenant-context.registry");
-const config_service_1 = require("../services/config.service");
 const request_context_service_1 = require("../services/request-context.service");
+const graphql_ws_connection_helper_1 = require("./graphql-ws-connection.helper");
 function readTenantHeader(contextValue) {
-    const headerName = (config_service_1.ConfigService.configFastButReadOnly?.multiTenancy?.headerName ?? 'x-tenant-id').toLowerCase();
-    const sources = [contextValue?.headers, contextValue?.connectionParams, contextValue?.request?.headers];
-    for (const source of sources) {
-        if (!source || typeof source !== 'object') {
-            continue;
-        }
-        for (const [key, value] of Object.entries(source)) {
-            if (key.toLowerCase() === headerName && typeof value === 'string' && value) {
-                return value;
-            }
-        }
-    }
-    return undefined;
+    return (0, graphql_ws_connection_helper_1.readWsTenantHeader)(contextValue);
 }
 function readUser(contextValue) {
     return contextValue?.user ?? contextValue?.extra?.user ?? undefined;
@@ -42,17 +30,50 @@ async function buildWsRequestContext(contextValue) {
     }
     const resolver = (0, core_tenant_context_registry_1.getTenantContextResolver)();
     if (resolver) {
+        let resolved = {};
         try {
-            Object.assign(context, await resolver.resolve(user, readTenantHeader(contextValue)));
+            resolved = (await resolver.resolve(user, readTenantHeader(contextValue))) ?? {};
+            Object.assign(context, resolved);
         }
         catch {
         }
+        const connection = (0, graphql_ws_connection_helper_1.getWsConnection)(contextValue);
+        if (connection) {
+            (0, graphql_ws_connection_helper_1.noteWsConnectionTenant)(connection, resolved);
+        }
     }
     return context;
 }
-function withRequestContextAsyncIterator(iterator, context) {
+function refusedResult() {
+    return {
+        errors: [
+            new graphql.GraphQLError('The authorization of this connection changed — reconnect.', {
+                extensions: { code: 'FORBIDDEN' },
+            }),
+        ],
+    };
+}
+async function connectionStillAuthorized(contextValue) {
+    const connection = (0, graphql_ws_connection_helper_1.getWsConnection)(contextValue);
+    return connection ? (0, graphql_ws_connection_helper_1.ensureWsConnectionCurrent)(connection) : true;
+}
+function withRequestContextAsyncIterator(iterator, context, connection) {
+    const next = (...args) => request_context_service_1.RequestContext.run(context, () => iterator.next(...args));
     const wrapped = {
-        next: (...args) => request_context_service_1.RequestContext.run(context, () => iterator.next(...args)),
+        next: connection
+            ? async (...args) => {
+                const result = await next(...args);
+                if (result.done || (await (0, graphql_ws_connection_helper_1.ensureWsConnectionCurrent)(connection))) {
+                    return result;
+                }
+                try {
+                    await request_context_service_1.RequestContext.run(context, () => iterator.return?.());
+                }
+                catch {
+                }
+                return { done: true, value: undefined };
+            }
+            : next,
         [Symbol.asyncIterator]() {
             return wrapped;
         },
@@ -70,21 +91,36 @@ function isAsyncIterable(value) {
 }
 function createRequestContextAwareExecute(execute) {
     return async (args) => {
+        if (!(await connectionStillAuthorized(args?.contextValue))) {
+            return refusedResult();
+        }
         const context = await buildWsRequestContext(args?.contextValue);
         if (!context) {
             return execute(args);
         }
+        if ((0, graphql_ws_connection_helper_1.getWsConnection)(args?.contextValue)?.terminated) {
+            return refusedResult();
+        }
         return request_context_service_1.RequestContext.run(context, () => execute(args));
     };
 }
 function createRequestContextAwareSubscribe(subscribe) {
     return async (args) => {
+        if (!(await connectionStillAuthorized(args?.contextValue))) {
+            return refusedResult();
+        }
         const context = await buildWsRequestContext(args?.contextValue);
         if (!context) {
             return subscribe(args);
         }
+        const connection = (0, graphql_ws_connection_helper_1.getWsConnection)(args?.contextValue);
+        if (connection?.terminated) {
+            return refusedResult();
+        }
         const result = await request_context_service_1.RequestContext.run(context, () => subscribe(args));
-        return isAsyncIterable(result) ? withRequestContextAsyncIterator(result, context) : result;
+        return isAsyncIterable(result)
+            ? withRequestContextAsyncIterator(result, context, connection)
+            : result;
     };
 }
 function buildRequestContextAwareExecute() {

package/dist/core/common/helpers/graphql-ws-context.helper.js.map

@@ -1 +1 @@
-{"version":3,"file":"graphql-ws-context.helper.js","sourceRoot":"","sources":["../../../../src/core/common/helpers/graphql-ws-context.helper.ts"],"names":[],"mappings":";;AAyFA,sDA8BC;AAQD,0EAiBC;AAYD,4EAQC;AAGD,gFASC;AASD,0EAEC;AAED,8EAEC;AA1LD,mCAAoC;AAEpC,2FAAoF;AACpF,+DAA2D;AAC3D,iFAAsF;AAoDtF,SAAS,gBAAgB,CAAC,YAAiB;IACzC,MAAM,UAAU,GAAG,CAAC,8BAAa,CAAC,qBAAqB,EAAE,YAAY,EAAE,UAAU,IAAI,aAAa,CAAC,CAAC,WAAW,EAAE,CAAC;IAClH,MAAM,OAAO,GAAG,CAAC,YAAY,EAAE,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAE,YAAY,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IACxG,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;YAC1C,SAAS;QACX,CAAC;QACD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAiC,CAAC,EAAE,CAAC;YAC7E,IAAI,GAAG,CAAC,WAAW,EAAE,KAAK,UAAU,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,EAAE,CAAC;gBAC3E,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAGD,SAAS,QAAQ,CAAC,YAAiB;IACjC,OAAO,YAAY,EAAE,IAAI,IAAI,YAAY,EAAE,KAAK,EAAE,IAAI,IAAI,SAAS,CAAC;AACtE,CAAC;AASM,KAAK,UAAU,qBAAqB,CAAC,YAAiB;IAC3D,IAAI,CAAC,YAAY,IAAI,OAAO,YAAY,KAAK,QAAQ,IAAI,YAAY,CAAC,GAAG,EAAE,CAAC;QAC1E,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,IAAI,GAAG,QAAQ,CAAC,YAAY,CAAC,CAAC;IACpC,MAAM,OAAO,GAAoB,EAAE,WAAW,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;IAG1E,MAAM,cAAc,GAClB,YAAY,CAAC,OAAO,EAAE,CAAC,iBAAiB,CAAC;QACzC,YAAY,CAAC,gBAAgB,EAAE,CAAC,iBAAiB,CAAC;QAClD,YAAY,CAAC,OAAO,EAAE,OAAO,EAAE,CAAC,iBAAiB,CAAC,CAAC;IACrD,IAAI,OAAO,cAAc,KAAK,QAAQ,EAAE,CAAC;QACvC,OAAO,CAAC,QAAQ,GAAG,cAAc,CAAC;IACpC,CAAC;IAED,MAAM,QAAQ,GAAG,IAAA,uDAAwB,GAAE,CAAC;IAC5C,IAAI,QAAQ,EAAE,CAAC;QAIb,IAAI,CAAC;YACH,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,gBAAgB,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QACvF,CAAC;QAAC,MAAM,CAAC;QAET,CAAC;IACH,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAQD,SAAgB,+BAA+B,CAC7C,QAAgF,EAChF,OAAwB;IAExB,MAAM,OAAO,GAA6B;QACxC,IAAI,EAAE,CAAC,GAAG,IAAsB,EAAE,EAAE,CAAC,wCAAc,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAI,IAAW,CAAC,CAAC;QACtG,CAAC,MAAM,CAAC,aAAa,CAAC;YACpB,OAAO,OAAO,CAAC;QACjB,CAAC;KACF,CAAC;IACF,IAAI,QAAQ,CAAC,MAAM,EAAE,CAAC;QACpB,OAAO,CAAC,MAAM,GAAG,CAAC,KAAW,EAAE,EAAE,CAAC,wCAAc,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,MAAO,CAAC,KAAK,CAAC,CAAC,CAAC;IAC/F,CAAC;IACD,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC;QACnB,OAAO,CAAC,KAAK,GAAG,CAAC,KAAW,EAAE,EAAE,CAAC,wCAAc,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,KAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IAC7F,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAGD,SAAS,eAAe,CAAC,KAAU;IACjC,OAAO,CAAC,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,UAAU,CAAC;AACnG,CAAC;AAOD,SAAgB,gCAAgC,CAAC,OAAkB;IACjE,OAAO,KAAK,EAAE,IAAiB,EAAE,EAAE;QACjC,MAAM,OAAO,GAAG,MAAM,qBAAqB,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;QAChE,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC;QACvB,CAAC;QACD,OAAO,wCAAc,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IAC1D,CAAC,CAAC;AACJ,CAAC;AAGD,SAAgB,kCAAkC,CAAC,SAAoB;IACrE,OAAO,KAAK,EAAE,IAAiB,EAAE,EAAE;QACjC,MAAM,OAAO,GAAG,MAAM,qBAAqB,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;QAChE,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,SAAS,CAAC,IAAI,CAAC,CAAC;QACzB,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,wCAAc,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;QACxE,OAAO,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,+BAA+B,CAAC,MAA4B,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;IACnH,CAAC,CAAC;AACJ,CAAC;AASD,SAAgB,+BAA+B;IAC7C,OAAO,gCAAgC,CAAC,OAAO,CAAC,OAAc,CAAC,CAAC;AAClE,CAAC;AAED,SAAgB,iCAAiC;IAC/C,OAAO,kCAAkC,CAAC,OAAO,CAAC,SAAgB,CAAC,CAAC;AACtE,CAAC"}
+{"version":3,"file":"graphql-ws-context.helper.js","sourceRoot":"","sources":["../../../../src/core/common/helpers/graphql-ws-context.helper.ts"],"names":[],"mappings":";;AA4FA,sDAwCC;AAsCD,0EAgCC;AAYD,4EAcC;AAGD,gFAkBC;AASD,0EAEC;AAED,8EAEC;AAnQD,mCAAoC;AAEpC,2FAA2G;AAC3G,iFAAsF;AACtF,iFAMwC;AA6DxC,SAAS,gBAAgB,CAAC,YAAiB;IACzC,OAAO,IAAA,iDAAkB,EAAC,YAAY,CAAC,CAAC;AAC1C,CAAC;AAGD,SAAS,QAAQ,CAAC,YAAiB;IACjC,OAAO,YAAY,EAAE,IAAI,IAAI,YAAY,EAAE,KAAK,EAAE,IAAI,IAAI,SAAS,CAAC;AACtE,CAAC;AASM,KAAK,UAAU,qBAAqB,CAAC,YAAiB;IAC3D,IAAI,CAAC,YAAY,IAAI,OAAO,YAAY,KAAK,QAAQ,IAAI,YAAY,CAAC,GAAG,EAAE,CAAC;QAC1E,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,IAAI,GAAG,QAAQ,CAAC,YAAY,CAAC,CAAC;IACpC,MAAM,OAAO,GAAoB,EAAE,WAAW,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;IAG1E,MAAM,cAAc,GAClB,YAAY,CAAC,OAAO,EAAE,CAAC,iBAAiB,CAAC;QACzC,YAAY,CAAC,gBAAgB,EAAE,CAAC,iBAAiB,CAAC;QAClD,YAAY,CAAC,OAAO,EAAE,OAAO,EAAE,CAAC,iBAAiB,CAAC,CAAC;IACrD,IAAI,OAAO,cAAc,KAAK,QAAQ,EAAE,CAAC;QACvC,OAAO,CAAC,QAAQ,GAAG,cAAc,CAAC;IACpC,CAAC;IAED,MAAM,QAAQ,GAAG,IAAA,uDAAwB,GAAE,CAAC;IAC5C,IAAI,QAAQ,EAAE,CAAC;QAIb,IAAI,QAAQ,GAA0B,EAAE,CAAC;QACzC,IAAI,CAAC;YACH,QAAQ,GAAG,CAAC,MAAM,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,gBAAgB,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YAChF,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QACnC,CAAC;QAAC,MAAM,CAAC;QAET,CAAC;QAKD,MAAM,UAAU,GAAG,IAAA,8CAAe,EAAC,YAAY,CAAC,CAAC;QACjD,IAAI,UAAU,EAAE,CAAC;YACf,IAAA,qDAAsB,EAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;QAC/C,CAAC;IACH,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAOD,SAAS,aAAa;IACpB,OAAO;QACL,MAAM,EAAE;YACN,IAAI,OAAO,CAAC,YAAY,CAAC,2DAA2D,EAAE;gBACpF,UAAU,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE;aAClC,CAAC;SACH;KACF,CAAC;AACJ,CAAC;AAMD,KAAK,UAAU,yBAAyB,CAAC,YAAiB;IACxD,MAAM,UAAU,GAAG,IAAA,8CAAe,EAAC,YAAY,CAAC,CAAC;IACjD,OAAO,UAAU,CAAC,CAAC,CAAC,IAAA,wDAAyB,EAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACnE,CAAC;AAcD,SAAgB,+BAA+B,CAC7C,QAAgF,EAChF,OAAwB,EACxB,UAAyB;IAEzB,MAAM,IAAI,GAAG,CAAC,GAAG,IAAsB,EAAE,EAAE,CAAC,wCAAc,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAI,IAAW,CAAC,CAAC,CAAC;IAC9G,MAAM,OAAO,GAA6B;QACxC,IAAI,EAAE,UAAU;YACd,CAAC,CAAC,KAAK,EAAE,GAAG,IAAsB,EAAE,EAAE;gBAClC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC;gBACnC,IAAI,MAAM,CAAC,IAAI,IAAI,CAAC,MAAM,IAAA,wDAAyB,EAAC,UAAU,CAAC,CAAC,EAAE,CAAC;oBACjE,OAAO,MAAM,CAAC;gBAChB,CAAC;gBACD,IAAI,CAAC;oBACH,MAAM,wCAAc,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;gBAC/D,CAAC;gBAAC,MAAM,CAAC;gBAET,CAAC;gBACD,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAuB,CAAC;YAC/D,CAAC;YACH,CAAC,CAAC,IAAI;QACR,CAAC,MAAM,CAAC,aAAa,CAAC;YACpB,OAAO,OAAO,CAAC;QACjB,CAAC;KACF,CAAC;IACF,IAAI,QAAQ,CAAC,MAAM,EAAE,CAAC;QACpB,OAAO,CAAC,MAAM,GAAG,CAAC,KAAW,EAAE,EAAE,CAAC,wCAAc,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,MAAO,CAAC,KAAK,CAAC,CAAC,CAAC;IAC/F,CAAC;IACD,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC;QACnB,OAAO,CAAC,KAAK,GAAG,CAAC,KAAW,EAAE,EAAE,CAAC,wCAAc,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,KAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IAC7F,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAGD,SAAS,eAAe,CAAC,KAAU;IACjC,OAAO,CAAC,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,UAAU,CAAC;AACnG,CAAC;AAOD,SAAgB,gCAAgC,CAAC,OAAkB;IACjE,OAAO,KAAK,EAAE,IAAiB,EAAE,EAAE;QACjC,IAAI,CAAC,CAAC,MAAM,yBAAyB,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC,EAAE,CAAC;YAC3D,OAAO,aAAa,EAAE,CAAC;QACzB,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,qBAAqB,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;QAChE,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC;QACvB,CAAC;QACD,IAAI,IAAA,8CAAe,EAAC,IAAI,EAAE,YAAY,CAAC,EAAE,UAAU,EAAE,CAAC;YACpD,OAAO,aAAa,EAAE,CAAC;QACzB,CAAC;QACD,OAAO,wCAAc,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IAC1D,CAAC,CAAC;AACJ,CAAC;AAGD,SAAgB,kCAAkC,CAAC,SAAoB;IACrE,OAAO,KAAK,EAAE,IAAiB,EAAE,EAAE;QACjC,IAAI,CAAC,CAAC,MAAM,yBAAyB,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC,EAAE,CAAC;YAC3D,OAAO,aAAa,EAAE,CAAC;QACzB,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,qBAAqB,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;QAChE,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,SAAS,CAAC,IAAI,CAAC,CAAC;QACzB,CAAC;QACD,MAAM,UAAU,GAAG,IAAA,8CAAe,EAAC,IAAI,EAAE,YAAY,CAAC,CAAC;QACvD,IAAI,UAAU,EAAE,UAAU,EAAE,CAAC;YAC3B,OAAO,aAAa,EAAE,CAAC;QACzB,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,wCAAc,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;QACxE,OAAO,eAAe,CAAC,MAAM,CAAC;YAC5B,CAAC,CAAC,+BAA+B,CAAC,MAA4B,EAAE,OAAO,EAAE,UAAU,CAAC;YACpF,CAAC,CAAC,MAAM,CAAC;IACb,CAAC,CAAC;AACJ,CAAC;AASD,SAAgB,+BAA+B;IAC7C,OAAO,gCAAgC,CAAC,OAAO,CAAC,OAAc,CAAC,CAAC;AAClE,CAAC;AAED,SAAgB,iCAAiC;IAC/C,OAAO,kCAAkC,CAAC,OAAO,CAAC,SAAgB,CAAC,CAAC;AACtE,CAAC"}