@lenne.tech/nest-server 11.42.2 → 11.42.4

package/src/core/common/interfaces/server-options.interface.ts

@@ -1051,6 +1051,53 @@ export interface IBetterAuthUserField {
   type: BetterAuthFieldType;
 }
 
+/**
+ * Size limits for the two body parsers NestJS registers globally (`application/json` and
+ * `application/x-www-form-urlencoded`).
+ *
+ * @see IServerOptions.bodyParser
+ * @since 11.42.4
+ */
+export interface IBodyParserConfig {
+  /**
+   * Limit for `application/json` bodies — REST and GraphQL alike, since Apollo reads the body the
+   * global parser produced.
+   *
+   * A number is bytes; a string is a size such as `'500kb'` or `'2mb'` (1024-based, units
+   * `b` / `kb` / `mb` / `gb`, case-insensitive).
+   *
+   * @default '100kb' (body-parser's own default — unset leaves the parser untouched)
+   */
+  json?: IBodyParserTypeConfig;
+
+  /**
+   * Limit for `application/x-www-form-urlencoded` bodies. Same value format as `json`.
+   *
+   * Configured separately on purpose: form posts rarely need more, and raising one limit should not
+   * silently raise the other.
+   *
+   * @default '100kb' (body-parser's own default — unset leaves the parser untouched)
+   */
+  urlencoded?: IBodyParserTypeConfig;
+}
+
+/**
+ * Settings for one body parser.
+ *
+ * @see IBodyParserConfig
+ * @since 11.42.4
+ */
+export interface IBodyParserTypeConfig {
+  /**
+   * Maximum body size: bytes as a number, or a size string such as `'2mb'`.
+   *
+   * A value that is not a positive size (`0`, negative, `NaN`, `'lots'`) is REJECTED with an error
+   * log and the parser keeps its default — it never becomes "no limit". The parser runs before
+   * authentication, so an unbounded limit would be an unbounded pre-auth allocation.
+   */
+  limit?: number | string;
+}
+
 /**
  * Interface for Error Code module configuration
  *
@@ -1490,8 +1537,9 @@ export interface IMultiTenancy {
    * - tenant API tokens: **403**
    * - public (`S_EVERYONE`) routes: not blocked, but no tenant context is set
    * - no header: the tenant is dropped from the user's tenant list, so its data stays out of reach
-   * - GraphQL over WebSocket: no tenant is resolved for a NEW subscription; one already open keeps
-   *   its tenant until the client reconnects (as it does after a removed membership)
+   * - GraphQL over WebSocket: no tenant is resolved for a NEW subscription; one already open is
+   *   closed (4403) once `invalidateTenant()` is called, or at its next event after
+   *   `graphQl.subscriptionRevalidationMs` without it (since 11.42.3)
    *
    * A platform administrator under `adminBypass` still reaches the tenant — somebody has to be able to
    * look into it and switch it back on.
@@ -2263,6 +2311,48 @@ export interface IServerOptions {
    */
   betterAuth?: boolean | IBetterAuth;
 
+  /**
+   * Size limits for request bodies.
+   *
+   * NestJS registers a JSON and a URL-encoded body parser on every application, and neither has a
+   * limit anybody chose: body-parser's default of **100 kB** applies. A request over it is answered
+   * with 413 in middleware — before authentication, before routing — so the whole request fails,
+   * every retry fails identically, and a document that grew past the limit can no longer be saved.
+   *
+   * Unset, both parsers stay exactly as NestJS registered them. Set a limit only where the data
+   * model needs it, and keep it as small as that need allows: the parser runs before
+   * authentication, and `JSON.parse` blocks the event loop for the whole body — measured on a
+   * realistic document shape, about 0.5 ms for 100 kB, 16 ms for 1 MB and 55 ms for 2 MB per
+   * request. That is why the default is not raised for everybody.
+   *
+   * Applied by `CoreModule` during module init, which replaces the global parsers NestJS registered
+   * IN PLACE — same position in the middleware chain, same options otherwise (`extended: true` for
+   * URL-encoded bodies, `req.rawBody` when the app was created with `NestFactory.create(…, {
+   * rawBody: true })`). Because this happens in `app.init()`, it holds under
+   * `Test.createTestingModule(...).createNestApplication()` too, which never runs `main.ts` — a
+   * `useBodyParser()` call in `main.ts` does not reach the e2e suite, this does. A configured value
+   * also replaces a global parser registered in `main.ts`; a path-scoped one
+   * (`server.use('/upload', json({ limit }))`) is left alone, and stays the way to give ONE path a
+   * different limit, since the parser runs before routing and GraphQL shares a single path anyway.
+   *
+   * One caveat: under the testing module the options passed to `createNestApplication()` are not
+   * visible to providers, so a test app created with `{ rawBody: true }` gets no `req.rawBody` from
+   * a CONFIGURED parser. Applications created with `NestFactory.create()` are not affected.
+   *
+   * Independent of this setting, a 413 from either parser is answered with
+   * `#LTNS_0304: Request body too large [<size>, limit <limit>]` instead of a bare
+   * "request entity too large", and logged as a warning naming the route and the config key.
+   *
+   * @since 11.42.4
+   *
+   * @example
+   * ```typescript
+   * // Documents carry HTML: allow 2 MB of JSON, keep form posts at the default
+   * bodyParser: { json: { limit: '2mb' } },
+   * ```
+   */
+  bodyParser?: IBodyParserConfig;
+
   /**
    * Configuration for Brevo
    * See: https://developers.brevo.com/
@@ -2567,6 +2657,35 @@ export interface IServerOptions {
          * Module options (forRootAsync)
          */
         options?: GqlModuleAsyncOptions;
+
+        /**
+         * How long an open GraphQL WebSocket connection may go without re-checking its authorization,
+         * in milliseconds.
+         *
+         * A WebSocket is authorized at the handshake. Before 11.42.3 that was also the last check: a
+         * removed membership, a deactivated tenant, a withdrawn role or a revoked session took effect
+         * on every new request and on none of the sockets already open. Now a connection is re-checked
+         * at once when an invalidation names it (`CoreTenantGuard.invalidateUser()` /
+         * `invalidateTenant()` / `invalidateAll()`, a role change through `CoreUserService`, a
+         * password reset), and before an event is delivered or an operation runs once its last check
+         * is older than this value — the bound for a change nobody invalidated, such as a sign-out or a
+         * membership edited directly in the database. A connection whose rights changed is closed with
+         * 4403, which the graphql-ws client retries: it reconnects and continues with the current
+         * rights, or is refused at the handshake.
+         *
+         * - `undefined` → 30000
+         * - `0` → re-check on every operation and every event (one session lookup each)
+         * - `false` → no time-based re-check; invalidations still apply
+         * - anything else that is not a non-negative number → 30000, never "off"
+         *
+         * Applies to connections registered by `CoreModule`'s own `onConnect`. A project that replaces
+         * `onConnect` through `graphQl.driver.subscriptions` registers its connections with
+         * `registerWsConnection()` to keep this.
+         *
+         * @default 30000
+         * @since 11.42.3
+         */
+        subscriptionRevalidationMs?: false | number;
       };
 
   /**

package/src/core/common/services/core-body-parser.initializer.ts

@@ -0,0 +1,232 @@
+import { Injectable, Logger, OnModuleInit, Optional, PayloadTooLargeException } from '@nestjs/common';
+import { HttpAdapterHost, ModuleRef } from '@nestjs/core';
+import { json, urlencoded } from 'express';
+
+import { ErrorCode } from '../../modules/error-code/error-codes';
+import { IBodyParserConfig } from '../interfaces/server-options.interface';
+import { ConfigService } from './config.service';
+
+import type { NextFunction, Request, RequestHandler, Response } from 'express';
+
+/** The two parsers NestJS registers on every Express application */
+export type CoreBodyParserType = 'json' | 'urlencoded';
+
+/**
+ * The function names body-parser gives its middleware. NestJS identifies its own parser layers by
+ * exactly these names (`ExpressAdapter.isMiddlewareApplied()`), which is why a wrapper must keep them.
+ */
+const PARSER_NAMES: Record<CoreBodyParserType, string> = { json: 'jsonParser', urlencoded: 'urlencodedParser' };
+
+/** 1024-based, like the `bytes` package body-parser itself parses limits with */
+const UNIT_FACTORS: Record<string, number> = { b: 1, gb: 1024 ** 3, kb: 1024, mb: 1024 ** 2 };
+
+/** The router layer fields this initializer reads and writes (Express 5 / `router` 2.x) */
+interface ExpressLayer {
+  handle: RequestHandler;
+  slash?: boolean;
+}
+
+/**
+ * Convert a configured body limit into bytes.
+ *
+ * Returns `undefined` for anything that is not a positive size, so the caller can refuse it. The
+ * value is turned into a number HERE rather than handed to body-parser as a string, so the limit that
+ * is logged and the limit that is enforced cannot differ.
+ *
+ * @example parseBodyLimit('2mb') // 2097152
+ * @example parseBodyLimit(500000) // 500000
+ * @example parseBodyLimit('lots') // undefined
+ */
+export function parseBodyLimit(value: unknown): number | undefined {
+  if (typeof value === 'number') {
+    return Number.isFinite(value) && value >= 1 ? Math.floor(value) : undefined;
+  }
+  if (typeof value !== 'string') {
+    return undefined;
+  }
+  const match = /^(\d+(?:\.\d+)?)\s*(b|kb|mb|gb)?$/i.exec(value.trim());
+  if (!match) {
+    return undefined;
+  }
+  const bytes = Math.floor(Number(match[1]) * UNIT_FACTORS[(match[2] || 'b').toLowerCase()]);
+  return bytes >= 1 ? bytes : undefined;
+}
+
+/**
+ * Applies `ServerOptions.bodyParser` to the body parsers NestJS registered, and turns their 413 into
+ * an answer a caller can act on.
+ *
+ * WHY it swaps layers instead of calling `useBodyParser()`: NestJS registers its parsers inside
+ * `app.init()`, BEFORE any `onModuleInit` runs, and a parser appended afterwards would sit behind
+ * the routes. So the layers NestJS created are replaced in place — same position in the middleware
+ * chain, same options otherwise. Doing it during module init (rather than in `main.ts`) is what
+ * makes the limit hold under `Test.createTestingModule()`, which never runs `main.ts`.
+ *
+ * Unconfigured, the parsers are not replaced, only wrapped: their own limit and options stay, and a
+ * 413 they raise is answered with `ErrorCode.REQUEST_BODY_TOO_LARGE` plus size and limit instead of
+ * a bare "request entity too large", and logged as a warning that names the route and the config
+ * key. Without that line the first symptom of a too-small limit is a user whose save keeps failing.
+ *
+ * Registered as a CoreModule provider; consumers never interact with it.
+ */
+@Injectable()
+export class CoreBodyParserInitializer implements OnModuleInit {
+  protected readonly logger = new Logger(CoreBodyParserInitializer.name);
+
+  constructor(
+    @Optional() protected readonly httpAdapterHost?: HttpAdapterHost,
+    @Optional() protected readonly moduleRef?: ModuleRef,
+  ) {}
+
+  onModuleInit(): void {
+    const stack = this.getRouterStack();
+    if (!stack) {
+      // Fastify and non-HTTP contexts have no body-parser layers; there is nothing to adjust.
+      return;
+    }
+
+    const config = this.getConfig();
+    for (const type of ['json', 'urlencoded'] as const) {
+      const limit = this.resolveLimit(type, config?.[type]?.limit);
+      const layers = stack.filter((layer) => this.isGlobalParserLayer(layer, type));
+
+      if (limit !== undefined && !layers.length) {
+        this.logger.warn(
+          `bodyParser.${type}.limit is configured, but no global ${type} body parser is registered ` +
+            '(was the app created with `bodyParser: false`?) — the limit has no effect.',
+        );
+        continue;
+      }
+
+      for (const layer of layers) {
+        const parser = limit === undefined ? layer.handle : this.createParser(type, limit);
+        layer.handle = this.wrapParser(type, parser);
+      }
+
+      if (limit !== undefined) {
+        this.logger.log(`Body parser: ${type} limit set to ${limit} bytes`);
+      }
+    }
+  }
+
+  /**
+   * A parser equivalent to the one NestJS registers, with the configured limit.
+   *
+   * `extended: true` mirrors NestJS's URL-encoded default (nested objects via `qs`). `req.rawBody`
+   * is kept when the app was created with `rawBody: true`, because webhook signature checks read it
+   * and would otherwise fail on every request once a limit is configured.
+   */
+  protected createParser(type: CoreBodyParserType, limit: number): RequestHandler {
+    const verify = this.isRawBodyEnabled() ? captureRawBody : undefined;
+    return type === 'json' ? json({ limit, verify }) : urlencoded({ extended: true, limit, verify });
+  }
+
+  /** The configured `bodyParser` block, or `undefined` when the project did not set one */
+  protected getConfig(): IBodyParserConfig | undefined {
+    return ConfigService.getFastButReadOnly<IBodyParserConfig>('bodyParser');
+  }
+
+  /** The Express router stack, or `undefined` for a non-Express adapter */
+  protected getRouterStack(): ExpressLayer[] | undefined {
+    const app = this.httpAdapterHost?.httpAdapter?.getInstance?.();
+    if (typeof app?.use !== 'function' || typeof app?.set !== 'function') {
+      return undefined;
+    }
+    const stack = app.router?.stack;
+    return Array.isArray(stack) ? stack : undefined;
+  }
+
+  /**
+   * Whether a layer is a GLOBAL parser of this type.
+   *
+   * `slash` is how the Express 5 router marks `app.use(fn)` — mounted on `/` without an end. A
+   * path-scoped `app.use('/upload', json({ limit }))` is a project's deliberate exception for one
+   * path and is left alone, including its 413.
+   */
+  protected isGlobalParserLayer(layer: ExpressLayer | undefined, type: CoreBodyParserType): boolean {
+    return layer?.slash === true && typeof layer.handle === 'function' && layer.handle.name === PARSER_NAMES[type];
+  }
+
+  /**
+   * Whether the application was created with `rawBody: true`.
+   *
+   * `NestFactory.create()` hands its options to the container and nothing public exposes them, so
+   * they are read from the container `ModuleRef` carries. Under `Test.createTestingModule()` the
+   * options passed to `createNestApplication()` never reach the container — that is the caveat
+   * documented on `IServerOptions.bodyParser`.
+   */
+  protected isRawBodyEnabled(): boolean {
+    const container = (this.moduleRef as unknown as { container?: { contextOptions?: { rawBody?: boolean } } })
+      ?.container;
+    return container?.contextOptions?.rawBody === true;
+  }
+
+  /**
+   * The configured limit in bytes, or `undefined` when unset or invalid.
+   *
+   * An invalid value is refused rather than passed on: body-parser would throw at boot for some
+   * inputs and apply nonsense (a negative limit rejects every body) for others. The parser keeps the
+   * limit it has — never "no limit", since it runs before authentication.
+   */
+  protected resolveLimit(type: CoreBodyParserType, value: unknown): number | undefined {
+    if (value === undefined || value === null) {
+      return undefined;
+    }
+    const limit = parseBodyLimit(value);
+    if (limit === undefined) {
+      this.logger.error(
+        `bodyParser.${type}.limit ${JSON.stringify(value)} is not a positive size (bytes, or e.g. '500kb' / '2mb') ` +
+          `— ignored, the ${type} body parser keeps the limit it has (100 kB unless set elsewhere).`,
+      );
+    }
+    return limit;
+  }
+
+  /**
+   * Answer a body-parser 413 with an error code, the size and the limit, and log it.
+   *
+   * Every other error (malformed JSON, unsupported charset, too many parameters) passes through
+   * unchanged, so NestJS answers it exactly as before.
+   */
+  protected translateError(type: CoreBodyParserType, error: unknown, req: Request): unknown {
+    const details = error as undefined | { length?: unknown; limit?: unknown; type?: unknown };
+    if (details?.type !== 'entity.too.large') {
+      return error;
+    }
+
+    // `length` is the declared Content-Length; a chunked body has none, and the byte count at which
+    // body-parser stopped reading says nothing about how large the body really was.
+    const length = typeof details.length === 'number' ? details.length : undefined;
+    const sizeText = length === undefined ? '' : `${length} bytes, `;
+    const path = String(req.originalUrl ?? req.url ?? '').split('?')[0];
+
+    this.logger.warn(
+      `413 ${req.method} ${path}: ${type} body ${length === undefined ? '' : `of ${length} bytes `}` +
+        `exceeds the limit of ${details.limit} bytes. If payloads of this size are legitimate here, ` +
+        `raise \`bodyParser.${type}.limit\` in the server options.`,
+    );
+    return new PayloadTooLargeException(
+      `${ErrorCode.REQUEST_BODY_TOO_LARGE} [${sizeText}limit ${details.limit} bytes]`,
+    );
+  }
+
+  /**
+   * Wrap a parser so its 413 is translated, keeping the name NestJS identifies the layer by.
+   *
+   * Wrapping an already wrapped parser is harmless: the outer wrapper receives the translated
+   * `PayloadTooLargeException`, which carries no body-parser `type`, and passes it on unchanged.
+   */
+  protected wrapParser(type: CoreBodyParserType, parser: RequestHandler): RequestHandler {
+    const wrapped = (req: Request, res: Response, next: NextFunction) =>
+      parser(req, res, (error?: unknown) => (error ? next(this.translateError(type, error, req)) : next()));
+    Object.defineProperty(wrapped, 'name', { value: PARSER_NAMES[type] });
+    return wrapped;
+  }
+}
+
+/** Same behaviour as the `verify` NestJS installs for `rawBody: true` */
+function captureRawBody(req: Request & { rawBody?: Buffer }, _res: Response, buffer: Buffer): void {
+  if (Buffer.isBuffer(buffer)) {
+    req.rawBody = buffer;
+  }
+}

package/src/core/modules/auth/services/core-auth.service.ts

@@ -69,11 +69,48 @@ export class CoreAuthService {
 
   /**
    * Decode JWT
+   *
+   * Reads the payload WITHOUT checking signature or expiry — never decide access on its result.
+   * Use `verifyJwt()` for that.
    */
   decodeJwt(token: string): JwtPayload {
     return this.jwtService.decode(token) as JwtPayload;
   }
 
+  /**
+   * Verify an access token's signature and expiry and answer its payload, or `null` when it does not
+   * verify.
+   *
+   * The same check passport-jwt applies on the HTTP path (`JwtStrategy`), for transports that have no
+   * passport in front of them — today the GraphQL WebSocket. The key is resolved in passport's order:
+   * `jwt.secretOrKeyProvider` when configured, else `jwt.secretOrPrivateKey || jwt.secret`. Until
+   * 11.42.3 the WebSocket handshake used `decodeJwt()`, so an expired token, or a copy re-signed with
+   * any key, was accepted there as long as its `tokenId` still matched the device.
+   *
+   * @since 11.42.3
+   */
+  async verifyJwt(token: string): Promise<JwtPayload | null> {
+    if (!token || typeof token !== 'string') {
+      return null;
+    }
+    try {
+      const provider = this.configService.getFastButReadOnly('jwt.secretOrKeyProvider');
+      const secret =
+        typeof provider === 'function'
+          ? await new Promise<string>((resolve, reject) =>
+              provider({}, token, (error: unknown, key: string) => (error ? reject(error) : resolve(key))),
+            )
+          : this.configService.getFastButReadOnly('jwt.secretOrPrivateKey') ||
+            this.configService.getFastButReadOnly('jwt.secret');
+      if (!secret) {
+        return null;
+      }
+      return (await this.jwtService.verifyAsync(token, { secret })) as JwtPayload;
+    } catch {
+      return null;
+    }
+  }
+
   /**
    * Logout user (from device)
    */

package/src/core/modules/better-auth/better-auth.config.ts

@@ -8,6 +8,7 @@ import * as fs from 'fs';
 import * as path from 'path';
 
 import { resolveServerUrls, strippedApiHostname } from '../../common/helpers/cookies.helper';
+import { revalidateWsConnectionsOf } from '../../common/helpers/graphql-ws-connection.helper';
 import { IBetterAuth, ICorsConfig } from '../../common/interfaces/server-options.interface';
 import { detectCookiePrefixDrift, resolveBetterAuthCookiePrefix } from './better-auth-cookie-prefix.helper';
 
@@ -753,6 +754,48 @@ export function createBetterAuthInstance(options: CreateBetterAuthOptions): Crea
   };
 }
 
+/**
+ * Ends the GraphQL WebSocket connections that rode on a session the moment the session is deleted —
+ * a sign-out, a revoked session, a password reset with `revokeSessionsOnPasswordReset`, a deleted user.
+ *
+ * Without it such a connection stays open until `graphQl.subscriptionRevalidationMs` (30 s by
+ * default) catches it on its next event. Better-Auth's `onPasswordReset` cannot do this job: all
+ * three reset routes call it BEFORE they delete the sessions, so a re-check from there would still
+ * find them valid.
+ *
+ * A plugin rather than `databaseHooks` in the options, because Better-Auth collects a plugin's
+ * `init().options.databaseHooks` as a SEPARATE source: a project's own `options.databaseHooks`
+ * neither replaces this one nor is replaced by it — unlike everything spread from `options`.
+ *
+ * It only asks for a re-check of the user's connections. The re-check resolves each connection's
+ * own token again, so a connection on a DIFFERENT, still-valid session of the same user stays open.
+ * It never throws: a failure here must not fail the sign-out.
+ */
+export function wsSessionRevocationPlugin(): BetterAuthPlugin {
+  return {
+    id: 'lt-ws-session-revocation',
+    init: () => ({
+      options: {
+        databaseHooks: {
+          session: {
+            delete: {
+              after: async (session: { userId?: unknown }) => {
+                try {
+                  if (session?.userId) {
+                    revalidateWsConnectionsOf({ iamId: String(session.userId) });
+                  }
+                } catch {
+                  // Never fail the deletion over a re-check; the revalidation interval still applies.
+                }
+              },
+            },
+          },
+        },
+      },
+    }),
+  } as BetterAuthPlugin;
+}
+
 /**
  * Formats a package name to a human-readable display name.
  * Converts kebab-case and snake_case to Title Case.
@@ -873,7 +916,9 @@ function buildPlugins(
   options: { passkeyNormalization: PasskeyNormalizationResult; serverEnv?: string },
 ): BetterAuthPlugin[] {
   const { passkeyNormalization, serverEnv } = options;
-  const plugins: BetterAuthPlugin[] = [];
+  // Always first and always on: it changes nothing about authentication itself, it only ends the
+  // WebSocket connections that rode on a session once the session is gone.
+  const plugins: BetterAuthPlugin[] = [wsSessionRevocationPlugin()];
 
   // JWT Plugin for API client compatibility
   // JWT is enabled by default unless explicitly disabled (jwt: false or jwt: { enabled: false })

package/src/core/modules/better-auth/core-better-auth.module.ts

@@ -226,6 +226,27 @@ function normalizeBetterAuthConfig(config: boolean | IBetterAuth | undefined): I
   return config;
 }
 
+/**
+ * The secret Better-Auth actually signs with, for the NestJS layer (controller cookie helper,
+ * API middleware, CoreBetterAuthService) to sign its cookies with the same value.
+ *
+ * `createBetterAuthInstance` resolves it as `betterAuth.secret` → first fallback of at least 32
+ * characters → auto-generated. Only the instance knows the generated one; without it the cookie
+ * went out unsigned and every native Better-Auth endpoint (`/iam/token`, MCP authorize, passkey,
+ * 2FA) rejected the session with 401.
+ */
+function resolveSigningSecret(
+  authInstance: BetterAuthInstance | null,
+  config: IBetterAuth,
+  fallbackSecrets?: (string | undefined)[],
+): string | undefined {
+  return (
+    (authInstance as null | { options?: { secret?: string } })?.options?.secret ||
+    config.secret ||
+    fallbackSecrets?.find((s) => s && s.length >= 32)
+  );
+}
+
 /**
  * CoreBetterAuthModule provides integration with the better-auth authentication framework.
  *
@@ -698,8 +719,8 @@ export class CoreBetterAuthModule implements NestModule, OnModuleInit {
             // Store a config copy with the resolved secret so that consumers
             // (CoreBetterAuthService, CoreBetterAuthController) can sign cookies.
             // The original config object may be frozen (from ConfigService), so we
-            // create a shallow copy with the resolved fallback secret applied.
-            const resolvedSecret = config.secret || fallbackSecrets?.find((s) => s && s.length >= 32);
+            // create a shallow copy with the resolved (fallback or generated) secret applied.
+            const resolvedSecret = resolveSigningSecret(this.authInstance, config, fallbackSecrets);
             this.currentConfig =
               resolvedSecret && resolvedSecret !== config.secret ? { ...config, secret: resolvedSecret } : config;
 
@@ -1068,8 +1089,7 @@ export class CoreBetterAuthModule implements NestModule, OnModuleInit {
             this.resolvedCookieDomain = result?.cookieDomain;
 
             // Store a config copy with the resolved secret (same as first forRoot variant)
-            const fallbacks = options?.fallbackSecrets;
-            const resolvedSecret2 = config.secret || fallbacks?.find((s) => s && s.length >= 32);
+            const resolvedSecret2 = resolveSigningSecret(this.authInstance, config, options?.fallbackSecrets);
             this.currentConfig =
               resolvedSecret2 && resolvedSecret2 !== config.secret ? { ...config, secret: resolvedSecret2 } : config;
 

package/src/core/modules/better-auth/core-better-auth.service.ts

@@ -804,9 +804,17 @@ export class CoreBetterAuthService implements OnModuleInit {
     }
 
     try {
-      // Create headers with the session token
+      // Better-Auth's signOut finds the session through its SIGNED session cookie. An `Authorization`
+      // header is read only by its `bearer` plugin, which the framework does not install — so until
+      // 11.42.3 this call deleted nothing: the caller got `true`, the controller cleared the cookies,
+      // and the session stayed valid server-side, authenticating the same token until it expired.
+      // The header stays for projects that added the bearer plugin themselves.
       const headers = new Headers();
       headers.set('Authorization', `Bearer ${sessionToken}`);
+      const secret = this.config?.secret;
+      if (secret) {
+        headers.set('cookie', `${this.getSessionCookieName()}=${signCookieValueIfNeeded(sessionToken, secret, true)}`);
+      }
 
       // Call Better-Auth's signOut endpoint
       await api.signOut({ headers });

package/src/core/modules/error-code/error-codes.ts

@@ -435,6 +435,15 @@ export const LtnsErrors = {
     },
   },
 
+  REQUEST_BODY_TOO_LARGE: {
+    code: 'LTNS_0304',
+    message: 'Request body too large',
+    translations: {
+      de: 'Die gesendeten Daten sind zu groß und wurden nicht verarbeitet.',
+      en: 'The submitted data is too large and was not processed.',
+    },
+  },
+
   // =====================================================
   // Resource Errors (LTNS_0400-LTNS_0499)
   // =====================================================

package/src/core/modules/tenant/README.md

@@ -236,14 +236,14 @@ multiTenancy: {
 }
 ```
 
-| Path                                                           | Deactivated tenant                                                                                                           |
-| -------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------- |
-| Header + tenant role, or `S_USER` / `S_VERIFIED` with a header | **403** `Tenant is inactive`                                                                                                 |
-| Tenant API token                                               | **403**                                                                                                                      |
-| `S_EVERYONE` with a header                                     | not blocked, but no tenant context is set                                                                                    |
-| No header                                                      | dropped from the user's tenant list — its data stays out of reach                                                            |
-| GraphQL over WebSocket                                         | no tenant resolved for a new subscription — an open one keeps its tenant until it reconnects (as after a removed membership) |
-| Admin under `adminBypass`                                      | still allowed — somebody has to be able to switch it back on                                                                 |
+| Path                                                           | Deactivated tenant                                                                                                                                                                         |
+| -------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
+| Header + tenant role, or `S_USER` / `S_VERIFIED` with a header | **403** `Tenant is inactive`                                                                                                                                                               |
+| Tenant API token                                               | **403**                                                                                                                                                                                    |
+| `S_EVERYONE` with a header                                     | not blocked, but no tenant context is set                                                                                                                                                  |
+| No header                                                      | dropped from the user's tenant list — its data stays out of reach                                                                                                                          |
+| GraphQL over WebSocket                                         | no tenant resolved for a new subscription; an open one is closed (4403) on `invalidateTenant()`, or at its next event once `graphQl.subscriptionRevalidationMs` has passed (since 11.42.3) |
+| Admin under `adminBypass`                                      | still allowed — somebody has to be able to switch it back on                                                                                                                               |
 
 The hook is asked **after** the membership check, so a non-member learns nothing about a tenant's
 state. Return `false` for inactive; anything else counts as active. Answers are cached for