@lenne.tech/nest-server 11.42.2 → 11.42.4

package/src/core/modules/tenant/core-tenant.guard.ts

@@ -16,6 +16,11 @@ import { Model } from 'mongoose';
 
 import { RoleEnum } from '../../common/enums/role.enum';
 import { resolveGuardRequest } from '../../common/helpers/execution-context-request.helper';
+import {
+  revalidateAllWsConnections,
+  revalidateWsConnectionsForTenant,
+  revalidateWsConnectionsOf,
+} from '../../common/helpers/graphql-ws-connection.helper';
 import { ConfigService } from '../../common/services/config.service';
 import { ResolvedTenantContext, setTenantContextResolver } from '../../common/services/core-tenant-context.registry';
 import { CoreRedisService } from '../../common/services/core-redis.service';
@@ -208,6 +213,9 @@ export class CoreTenantGuard implements CanActivate, OnApplicationBootstrap, OnM
     if (!config || config.enabled === false) {
       return {};
     }
+    // The WebSocket path reaches this without passing canActivate(), so it has to pick up a changed
+    // `cacheTtlMs` itself — otherwise an API whose traffic is all WebSocket keeps the 30 s default.
+    this.syncConfig(config);
 
     const trimmed =
       headerTenantId && typeof headerTenantId === 'string' && headerTenantId.length <= 128
@@ -301,7 +309,7 @@ export class CoreTenantGuard implements CanActivate, OnApplicationBootstrap, OnM
    * `cacheTtlMs`. Broadcast to every replica when Redis is enabled.
    */
   invalidateTenant(tenantId: string): void {
-    this.tenantActiveCache.delete(tenantId);
+    this.clearTenant(tenantId);
     this.publishInvalidation({ scope: 'tenant', tenantId });
   }
 
@@ -339,16 +347,7 @@ export class CoreTenantGuard implements CanActivate, OnApplicationBootstrap, OnM
       return true;
     }
 
-    // Detect config changes (e.g., roleHierarchy modified in tests) and flush caches
-    if (this.lastSeenConfig !== config) {
-      this.lastSeenConfig = config;
-      // Default 30s in production, 0 (disabled) in test environments to avoid stale data between test cases
-      const isTestEnv =
-        process.env.VITEST === 'true' || process.env.NODE_ENV === 'test' || process.env.NODE_ENV === 'e2e';
-      this.cacheTtlMs = config.cacheTtlMs ?? (isTestEnv ? 0 : 30_000);
-      // Local-only flush: every replica detects the config change itself, no broadcast needed
-      this.clearAll();
-    }
+    this.syncConfig(config);
 
     const request = this.getRequest(context);
     if (!request) {
@@ -711,7 +710,7 @@ export class CoreTenantGuard implements CanActivate, OnApplicationBootstrap, OnM
     } else if (parsed?.scope === 'user' && parsed.userId) {
       this.clearUser(parsed.userId);
     } else if (parsed?.scope === 'tenant' && parsed.tenantId) {
-      this.tenantActiveCache.delete(parsed.tenantId);
+      this.clearTenant(parsed.tenantId);
     }
   }
 
@@ -722,6 +721,17 @@ export class CoreTenantGuard implements CanActivate, OnApplicationBootstrap, OnM
     this.membershipCache.clear();
     this.tenantIdsCache.clear();
     this.tenantActiveCache.clear();
+    // Open WebSocket connections were authorized against what was just thrown away.
+    revalidateAllWsConnections();
+  }
+
+  /**
+   * Forget a tenant's cached `isTenantActive` answer locally (no broadcast), and re-check the open
+   * WebSocket connections scoped to it.
+   */
+  protected clearTenant(tenantId: string): void {
+    this.tenantActiveCache.delete(tenantId);
+    revalidateWsConnectionsForTenant(tenantId);
   }
 
   /**
@@ -738,6 +748,25 @@ export class CoreTenantGuard implements CanActivate, OnApplicationBootstrap, OnM
         this.tenantIdsCache.delete(key);
       }
     }
+    // A membership change reaches the user's OPEN WebSocket connections too, not just new requests.
+    // After the caches above, so the re-check reads the membership as it is now.
+    revalidateWsConnectionsOf({ userId });
+  }
+
+  /**
+   * Pick up a changed `multiTenancy` config: the cache TTL, and a flush of everything cached under
+   * the old one. Local-only — every replica detects the change itself, no broadcast needed.
+   */
+  private syncConfig(config: object & { cacheTtlMs?: number }): void {
+    if (this.lastSeenConfig === config) {
+      return;
+    }
+    this.lastSeenConfig = config;
+    // Default 30s in production, 0 (disabled) in test environments to avoid stale data between test cases
+    const isTestEnv =
+      process.env.VITEST === 'true' || process.env.NODE_ENV === 'test' || process.env.NODE_ENV === 'e2e';
+    this.cacheTtlMs = config.cacheTtlMs ?? (isTestEnv ? 0 : 30_000);
+    this.clearAll();
   }
 
   /**

package/src/core/modules/user/core-user.service.ts

@@ -7,6 +7,7 @@ import { Document, Model } from 'mongoose';
 import { looksLikeSystemRole, SYSTEM_ROLE_PREFIX } from '../../common/enums/role.enum';
 import { accessDeniedException } from '../../common/exceptions/access-denied.exception';
 import { resolveAppUrlFromConfig } from '../../common/helpers/cookies.helper';
+import { revalidateWsConnectionsOf } from '../../common/helpers/graphql-ws-connection.helper';
 import { maskEmail } from '../../common/helpers/logging.helper';
 import { assignPlain, isQueryableString, prepareServiceOptionsForCreate } from '../../common/helpers/input.helper';
 import { ServiceOptions } from '../../common/interfaces/service-options.interface';
@@ -377,6 +378,10 @@ export abstract class CoreUserService<
           );
         }
 
+        // The same holds for the user's open GraphQL WebSockets: their re-check finds the device's
+        // refresh token gone and closes them, instead of letting them run until the next interval.
+        revalidateWsConnectionsOf({ email: dbObject.email, userId: dbObject.id });
+
         return updatedUser;
       },
       { dbObject, serviceOptions },
@@ -648,6 +653,10 @@ export abstract class CoreUserService<
           this.options.betterAuthUserMapper.invalidateUserCache((user as any).iamId);
         }
 
+        // ... including on the user's OPEN GraphQL WebSockets, which were authorized with the old
+        // roles. After the cache above, so the re-check reads the new ones.
+        revalidateWsConnectionsOf({ userId: String(userId) });
+
         return user;
       },
       { serviceOptions },
@@ -730,12 +739,16 @@ export abstract class CoreUserService<
     }
 
     // Invalidate BetterAuth user cache when roles or verified status may have changed
-    if (this.options?.betterAuthUserMapper && (oldUser as any)?.iamId) {
-      const rolesChanged = 'roles' in (input as any);
-      const verifiedChanged = 'verified' in (input as any) || 'emailVerified' in (input as any);
-      if (rolesChanged || verifiedChanged) {
-        this.options.betterAuthUserMapper.invalidateUserCache((oldUser as any).iamId);
-      }
+    const rightsMayHaveChanged =
+      !!input &&
+      typeof input === 'object' &&
+      ('roles' in (input as any) || 'verified' in (input as any) || 'emailVerified' in (input as any));
+    if (rightsMayHaveChanged && this.options?.betterAuthUserMapper && (oldUser as any)?.iamId) {
+      this.options.betterAuthUserMapper.invalidateUserCache((oldUser as any).iamId);
+    }
+    // ... and re-check the user's OPEN GraphQL WebSockets, which were authorized with the old values.
+    if (rightsMayHaveChanged) {
+      revalidateWsConnectionsOf({ userId: String(id) });
     }
 
     return updatedUser;

package/src/core.module.ts

@@ -1,5 +1,13 @@
 import { ApolloDriver, ApolloDriverConfig } from '@nestjs/apollo';
-import { DynamicModule, Global, MiddlewareConsumer, Module, NestModule, UnauthorizedException } from '@nestjs/common';
+import {
+  DynamicModule,
+  Global,
+  Logger,
+  MiddlewareConsumer,
+  Module,
+  NestModule,
+  UnauthorizedException,
+} from '@nestjs/common';
 import { APP_INTERCEPTOR, APP_PIPE, DiscoveryModule } from '@nestjs/core';
 import { GraphQLModule } from '@nestjs/graphql';
 import { MongooseModule } from '@nestjs/mongoose';
@@ -8,6 +16,7 @@ import graphqlUploadExpress = require('graphql-upload/graphqlUploadExpress.js');
 import mongoose from 'mongoose';
 
 import { merge } from './core/common/helpers/config.helper';
+import { registerWsConnection } from './core/common/helpers/graphql-ws-connection.helper';
 import {
   buildRequestContextAwareExecute,
   buildRequestContextAwareSubscribe,
@@ -39,6 +48,7 @@ import { mongooseRoleGuardPlugin } from './core/common/plugins/mongoose-role-gua
 import { mongooseSystemRolePlugin } from './core/common/plugins/mongoose-system-role.plugin';
 import { mongooseTenantPlugin } from './core/common/plugins/mongoose-tenant.plugin';
 import { ConfigService } from './core/common/services/config.service';
+import { CoreBodyParserInitializer } from './core/common/services/core-body-parser.initializer';
 import { CoreCronJobsInitializer } from './core/common/services/core-cron-jobs.initializer';
 import { CoreRedisService } from './core/common/services/core-redis.service';
 import { CoreS3Service } from './core/common/services/core-s3.service';
@@ -48,6 +58,7 @@ import { MailjetService } from './core/common/services/mailjet.service';
 import { ModelDocService } from './core/common/services/model-doc.service';
 import { TemplateService } from './core/common/services/template.service';
 import { CoreAiModule } from './core/modules/ai/core-ai.module';
+import { isLegacyJwt } from './core/modules/better-auth/core-better-auth-token.helper';
 import { CoreBetterAuthUserMapper } from './core/modules/better-auth/core-better-auth-user.mapper';
 import { CoreBetterAuthModule } from './core/modules/better-auth/core-better-auth.module';
 import { CoreBetterAuthService } from './core/modules/better-auth/core-better-auth.service';
@@ -314,6 +325,9 @@ export class CoreModule implements NestModule {
       },
 
       // Core Services
+      // Applies `bodyParser` limits and answers a body-parser 413 with an error code. Swaps the
+      // parser layers NestJS registered in place, during module init — see the initializer.
+      CoreBodyParserInitializer,
       CoreCronJobsInitializer,
       // Audits the file endpoints the project actually REGISTERED. applyFileRoles() above can only
       // reach the base-class members; a subclass that re-declares one keeps its own @Roles() and the
@@ -665,23 +679,22 @@ export class CoreModule implements NestModule {
                       connectionParams?.Authorization?.split(' ')[1] ?? headers.Authorization?.split(' ')[1];
 
                     if (authToken) {
-                      // Validate via BetterAuth session
-                      const { session, user: sessionUser } = await betterAuthService.getSession({
-                        headers: { authorization: `Bearer ${authToken}` },
-                      });
-
-                      if (!session || !sessionUser) {
-                        throw new UnauthorizedException('Invalid or expired session');
-                      }
-
-                      // Map to full user with roles
-                      const user = await userMapper.mapSessionUser(sessionUser);
+                      // Resolved like an HTTP request with the same header — see authenticateIamWsToken().
+                      const user = await CoreModule.authenticateIamWsToken(betterAuthService, userMapper, authToken);
                       if (!user) {
-                        throw new UnauthorizedException('User not found');
+                        throw new UnauthorizedException('Invalid or expired session');
                       }
 
                       extra.user = user;
                       extra.headers = connectionParams ?? headers;
+                      // Re-checked for the life of the socket — see graphql-ws-connection.helper.ts.
+                      registerWsConnection({
+                        carrier: extra,
+                        reauthenticate: () =>
+                          CoreModule.authenticateIamWsToken(betterAuthService, userMapper, authToken),
+                        socket: extra.socket,
+                        user,
+                      });
                       return extra;
                     }
 
@@ -690,29 +703,30 @@ export class CoreModule implements NestModule {
                 },
               },
               'subscriptions-transport-ws': {
-                onConnect: async (connectionParams) => {
+                onConnect: async (connectionParams, webSocket) => {
                   const enableAuth = graphQlOpts?.enableSubscriptionAuth ?? true;
 
                   if (enableAuth) {
                     const authToken: string = connectionParams?.Authorization?.split(' ')[1];
 
                     if (authToken) {
-                      // Validate via BetterAuth session
-                      const { session, user: sessionUser } = await betterAuthService.getSession({
-                        headers: { authorization: `Bearer ${authToken}` },
-                      });
-
-                      if (!session || !sessionUser) {
-                        throw new UnauthorizedException('Invalid or expired session');
-                      }
-
-                      // Map to full user with roles
-                      const user = await userMapper.mapSessionUser(sessionUser);
+                      // Resolved like an HTTP request with the same header — see authenticateIamWsToken().
+                      const user = await CoreModule.authenticateIamWsToken(betterAuthService, userMapper, authToken);
                       if (!user) {
-                        throw new UnauthorizedException('User not found');
+                        throw new UnauthorizedException('Invalid or expired session');
                       }
 
-                      return { headers: connectionParams, user };
+                      // subscriptions-transport-ws hands each operation a copy of this object; the
+                      // registration survives that copy — see graphql-ws-connection.helper.ts.
+                      const connectionContext = { headers: connectionParams, user };
+                      registerWsConnection({
+                        carrier: connectionContext,
+                        reauthenticate: () =>
+                          CoreModule.authenticateIamWsToken(betterAuthService, userMapper, authToken),
+                        socket: webSocket,
+                        user,
+                      });
+                      return connectionContext;
                     }
 
                     throw new UnauthorizedException('Missing authentication token');
@@ -781,21 +795,22 @@ export class CoreModule implements NestModule {
                       connectionParams?.Authorization?.split(' ')[1] ?? headers.Authorization?.split(' ')[1];
 
                     if (authToken) {
-                      const { session, user: sessionUser } = await betterAuthService.getSession({
-                        headers: { authorization: `Bearer ${authToken}` },
-                      });
-
-                      if (!session || !sessionUser) {
-                        throw new UnauthorizedException('Invalid or expired session');
-                      }
-
-                      const user = await userMapper.mapSessionUser(sessionUser);
+                      // Resolved like an HTTP request with the same header — see authenticateIamWsToken().
+                      const user = await CoreModule.authenticateIamWsToken(betterAuthService, userMapper, authToken);
                       if (!user) {
-                        throw new UnauthorizedException('User not found');
+                        throw new UnauthorizedException('Invalid or expired session');
                       }
 
                       extra.user = user;
                       extra.headers = connectionParams ?? headers;
+                      // Re-checked for the life of the socket — see graphql-ws-connection.helper.ts.
+                      registerWsConnection({
+                        carrier: extra,
+                        reauthenticate: () =>
+                          CoreModule.authenticateIamWsToken(betterAuthService, userMapper, authToken),
+                        socket: extra.socket,
+                        user,
+                      });
                       return extra;
                     }
 
@@ -804,7 +819,7 @@ export class CoreModule implements NestModule {
                 },
               },
               'subscriptions-transport-ws': {
-                onConnect: async (connectionParams) => {
+                onConnect: async (connectionParams, webSocket) => {
                   const enableAuth = graphQlOpts?.enableSubscriptionAuth ?? true;
 
                   if (enableAuth) {
@@ -818,20 +833,23 @@ export class CoreModule implements NestModule {
                     const authToken: string = connectionParams?.Authorization?.split(' ')[1];
 
                     if (authToken) {
-                      const { session, user: sessionUser } = await betterAuthService.getSession({
-                        headers: { authorization: `Bearer ${authToken}` },
-                      });
-
-                      if (!session || !sessionUser) {
-                        throw new UnauthorizedException('Invalid or expired session');
-                      }
-
-                      const user = await userMapper.mapSessionUser(sessionUser);
+                      // Resolved like an HTTP request with the same header — see authenticateIamWsToken().
+                      const user = await CoreModule.authenticateIamWsToken(betterAuthService, userMapper, authToken);
                       if (!user) {
-                        throw new UnauthorizedException('User not found');
+                        throw new UnauthorizedException('Invalid or expired session');
                       }
 
-                      return { headers: connectionParams, user };
+                      // subscriptions-transport-ws hands each operation a copy of this object; the
+                      // registration survives that copy — see graphql-ws-connection.helper.ts.
+                      const connectionContext = { headers: connectionParams, user };
+                      registerWsConnection({
+                        carrier: connectionContext,
+                        reauthenticate: () =>
+                          CoreModule.authenticateIamWsToken(betterAuthService, userMapper, authToken),
+                        socket: webSocket,
+                        user,
+                      });
+                      return connectionContext;
                     }
 
                     throw new UnauthorizedException('Missing authentication token');
@@ -900,14 +918,20 @@ export class CoreModule implements NestModule {
                       connectionParams?.Authorization?.split(' ')[1] ?? headers.Authorization?.split(' ')[1];
                     if (authToken) {
                       // verify authToken/getJwtPayLoad
-                      const payload = authService.decodeJwt(authToken);
-                      const user = await authService.validateUser(payload);
+                      const user = await CoreModule.authenticateLegacyWsToken(authService, authToken);
                       if (!user) {
                         throw new UnauthorizedException('No user found for token');
                       }
                       // the user/jwtPayload object found will be available as context.currentUser/jwtPayload in your GraphQL resolvers
                       extra.user = user;
                       extra.headers = connectionParams ?? headers;
+                      // Re-checked for the life of the socket — see graphql-ws-connection.helper.ts.
+                      registerWsConnection({
+                        carrier: extra,
+                        reauthenticate: () => CoreModule.authenticateLegacyWsToken(authService, authToken),
+                        socket: extra.socket,
+                        user,
+                      });
                       return extra;
                     }
 
@@ -916,20 +940,28 @@ export class CoreModule implements NestModule {
                 },
               },
               'subscriptions-transport-ws': {
-                onConnect: async (connectionParams) => {
+                onConnect: async (connectionParams, webSocket) => {
                   if (enableSubscriptionAuth) {
                     // get authToken from authorization header
                     const authToken: string = connectionParams?.Authorization?.split(' ')[1];
 
                     if (authToken) {
                       // verify authToken/getJwtPayLoad
-                      const payload = authService.decodeJwt(authToken);
-                      const user = await authService.validateUser(payload);
+                      const user = await CoreModule.authenticateLegacyWsToken(authService, authToken);
                       if (!user) {
                         throw new UnauthorizedException('No user found for token');
                       }
                       // the user/jwtPayload object found will be available as context.currentUser/jwtPayload in your GraphQL resolvers
-                      return { headers: connectionParams, user };
+                      // subscriptions-transport-ws hands each operation a copy of this object; the
+                      // registration survives that copy — see graphql-ws-connection.helper.ts.
+                      const connectionContext = { headers: connectionParams, user };
+                      registerWsConnection({
+                        carrier: connectionContext,
+                        reauthenticate: () => CoreModule.authenticateLegacyWsToken(authService, authToken),
+                        socket: webSocket,
+                        user,
+                      });
+                      return connectionContext;
                     }
 
                     throw new UnauthorizedException('Missing authentication token');
@@ -943,6 +975,89 @@ export class CoreModule implements NestModule {
     };
   }
 
+  /**
+   * Resolve the bearer token of an IAM WebSocket handshake to a user — and re-resolve it for a
+   * connection that is already open (the `reauthenticate` of `registerWsConnection()`). Answers
+   * `null` when the token does not authenticate (any more).
+   *
+   * Mirrors Strategy 1 of `CoreBetterAuthMiddleware` — a Better-Auth JWT first, then the session
+   * store — because that is what an HTTP request carrying the same header gets. Until 11.42.3 the
+   * handshake asked `getSession()` with an `authorization` header, which Better-Auth reads only
+   * with its `bearer` plugin, and the framework does not install that plugin: every IAM handshake
+   * with a bearer token was refused as "Invalid or expired session". `getSession()` stays as the
+   * last resort, so a project that added the bearer plugin itself resolves exactly as before.
+   *
+   * A JWT is checked statelessly (signature, expiry), as on HTTP: signing out ends the session
+   * behind it, not the JWT, which lapses on its own (`betterAuth.jwt.expiresIn`, 15 min by default).
+   */
+  private static async authenticateIamWsToken(
+    betterAuthService: Pick<
+      CoreBetterAuthService,
+      'getSession' | 'getSessionByToken' | 'isJwtEnabled' | 'verifyJwtToken'
+    >,
+    userMapper: Pick<CoreBetterAuthUserMapper, 'mapSessionUser'>,
+    authToken: string,
+  ): Promise<any> {
+    if (!authToken) {
+      return null;
+    }
+    if (authToken.split('.').length === 3 && !isLegacyJwt(authToken) && betterAuthService.isJwtEnabled()) {
+      const payload = await betterAuthService.verifyJwtToken(authToken);
+      if (payload?.sub) {
+        return userMapper.mapSessionUser({
+          email: payload.email || '',
+          emailVerified: payload.emailVerified,
+          id: payload.sub,
+          name: payload.name,
+        });
+      }
+    }
+    const stored = await betterAuthService.getSessionByToken(authToken);
+    if (stored?.session && stored?.user) {
+      return userMapper.mapSessionUser(stored.user);
+    }
+    const { session, user: sessionUser } = await betterAuthService.getSession({
+      headers: { authorization: `Bearer ${authToken}` },
+    });
+    return session && sessionUser ? userMapper.mapSessionUser(sessionUser) : null;
+  }
+
+  /**
+   * The legacy counterpart of `authenticateIamWsToken()`: the token's signature and expiry are verified
+   * exactly as passport-jwt does on HTTP (`CoreAuthService.verifyJwt()`), then `validateUser()` ties it
+   * to its device's live refresh token, so a logout, a password reset or a token refresh ends it.
+   *
+   * Until 11.42.3 this read the token with `decodeJwt()`, which checks neither signature nor expiry:
+   * an expired token — or a copy re-signed with any key — opened sockets for as long as its `tokenId`
+   * matched the device. A token that is not a JWT at all decoded to `null`, which `validateUser()` then
+   * dereferenced: the handshake closed with 4500 and the TypeError as its reason.
+   *
+   * An AuthService that does not extend `CoreAuthService` may lack `verifyJwt()`. It keeps the
+   * unverified read rather than losing its WebSockets on upgrade, and is warned about once.
+   */
+  private static async authenticateLegacyWsToken(authService: any, authToken: string): Promise<any> {
+    if (!authToken) {
+      return null;
+    }
+    let payload: any;
+    if (typeof authService?.verifyJwt === 'function') {
+      payload = await authService.verifyJwt(authToken);
+    } else {
+      if (!CoreModule.unverifiedLegacyWsTokenWarned) {
+        CoreModule.unverifiedLegacyWsTokenWarned = true;
+        new Logger('CoreModule').warn(
+          'The AuthService passed to CoreModule.forRoot() has no verifyJwt(): legacy WebSocket tokens are ' +
+            'read WITHOUT checking signature or expiry. Extend CoreAuthService to close that.',
+        );
+      }
+      payload = authService.decodeJwt(authToken);
+    }
+    return payload ? authService.validateUser(payload) : null;
+  }
+
+  /** Whether the "no verifyJwt()" warning was already logged in this process. */
+  private static unverifiedLegacyWsTokenWarned = false;
+
   /**
    * @deprecated Use `isCookiesEnabled` from `core/common/helpers/cookies.helper` instead.
    */

package/src/index.ts

@@ -40,6 +40,7 @@ export * from './core/common/helpers/execution-context-request.helper';
 export * from './core/common/helpers/file.helper';
 export * from './core/common/helpers/filter.helper';
 export * from './core/common/helpers/graphql.helper';
+export * from './core/common/helpers/graphql-ws-connection.helper';
 export * from './core/common/helpers/graphql-ws-context.helper';
 export * from './core/common/helpers/interceptor.helper';
 export * from './core/common/helpers/gridfs.helper';