@lenne.tech/nest-server 11.43.3 → 11.43.5

package/docs/security-overrides.md

@@ -19,7 +19,7 @@ used to **exact-pin**, to a vulnerable version:
 | `ws` | [GHSA-96hv-2xvq-fx4p](https://github.com/advisories/GHSA-96hv-2xvq-fx4p) — high: memory-exhaustion DoS + uninitialized memory disclosure. Patched `>=8.21.0` | Older `@nestjs/graphql` releases declare `"ws": "8.20.1"` — an **exact pin**, not a caret. 13.4.5, the version this framework declares, pins `8.21.3` |
 | `js-yaml` | [GHSA-pm4m-ph32-ghv5](https://github.com/advisories/GHSA-pm4m-ph32-ghv5) — high: exponential parsing time in flow collections (DoS), patched `>=5.2.2`; [GHSA-r3ph-w7gj-g6xm](https://github.com/advisories/GHSA-r3ph-w7gj-g6xm) — moderate: `maxTotalMergeKeys` does not bound CPU use for empty merge sources, covers `<=5.4.0`, patched `>=5.4.1` (published 2026-09-29) | `@nestjs/swagger` declares js-yaml as an **exact pin**, the same shape as the `ws` case: older releases `5.2.1`, 11.4.7 — the version this framework declares, and the newest 11.x — `5.3.0`. No swagger update reaches the fix, so **this entry is load-bearing again** |
 | `@graphql-tools/utils` | [GHSA-7mx3-vvmw-hjmv](https://github.com/advisories/GHSA-7mx3-vvmw-hjmv) — high: prototype pollution in `mergeDeep`, which runs while the GraphQL schema is assembled. Covers `<=12.0.0`, patched `>=12.0.1` (added 2026-10-06) | `@nestjs/graphql` 13.4.5 — the version this framework declares, and the newest 13.x — declares `"@graphql-tools/utils": "12.0.0"`, an **exact pin**. Only `@nestjs/graphql` 14.x moves it, so **this entry is load-bearing**. `@apollo/server` reaches it too, through `@graphql-tools/schema` / `merge` — and in a lockfile that still holds schema 10.0.x (resolved before 2026-08-12), as **utils 11.x**: vulnerable too, with no 11.x fix, and outside the override key. Lift it with `pnpm update --depth Infinity @graphql-tools/schema @graphql-tools/merge`; the current releases request utils `^12.0.3`, which needs Node >=22.15 — the framework's own floor since 11.42.10, which is why the snippet below targets 12.0.3 |
-| `multer` | [GHSA-wc9g-mqfw-jrwm](https://github.com/advisories/GHSA-wc9g-mqfw-jrwm), [GHSA-535w-7cp7-47q4](https://github.com/advisories/GHSA-535w-7cp7-47q4), [GHSA-qfvm-cv95-jqjf](https://github.com/advisories/GHSA-qfvm-cv95-jqjf) — high: DoS via crafted multipart input; [GHSA-qvfw-j98x-7q72](https://github.com/advisories/GHSA-qvfw-j98x-7q72) — low: file size limit bypass. Patched `>=2.3.0` | `@nestjs/platform-express` up to 11.2.5 declares `"multer": "2.2.0"` — an **exact pin**. A direct `multer` dependency does not move it: you get both copies, and FileInterceptor uses the vulnerable one. 11.2.6, which this framework declared from 11.41.4, pins `2.4.0`, and so does 11.2.7, declared since 11.41.7 |
+| `multer` | [GHSA-wc9g-mqfw-jrwm](https://github.com/advisories/GHSA-wc9g-mqfw-jrwm), [GHSA-535w-7cp7-47q4](https://github.com/advisories/GHSA-535w-7cp7-47q4), [GHSA-qfvm-cv95-jqjf](https://github.com/advisories/GHSA-qfvm-cv95-jqjf) — high: DoS via crafted multipart input; [GHSA-qvfw-j98x-7q72](https://github.com/advisories/GHSA-qvfw-j98x-7q72) — low: file size limit bypass. Patched `>=2.3.0`. [GHSA-q7qp-rjg7-q26m](https://github.com/advisories/GHSA-q7qp-rjg7-q26m) — high: DoS via a pending asynchronous `fileFilter` after request teardown, covers 2.4.0, patched `>=2.5.0` (published 2026-10-23) | `@nestjs/platform-express` up to 11.2.5 declares `"multer": "2.2.0"` — an **exact pin**. A direct `multer` dependency does not move it: you get both copies, and FileInterceptor uses the vulnerable one. 11.2.6 to 11.2.8, the newest 11.x, pin `2.4.0`, which GHSA-q7qp-rjg7-q26m covers. No 11.x update reaches the fix, so **this entry is load-bearing again since 11.43.4** |
 
 **Status since 11.42.4:** `@graphql-tools/utils` joins `js-yaml` as load-bearing — no `@nestjs/graphql`
 13.x resolves past the exact pin. The 11.42.4 release also covers `proxy-addr` (GHSA-jqcg-44mw-7w3h,
@@ -58,10 +58,10 @@ overrides:
   # Remove once @nestjs/swagger pins >=5.4.1 itself.
   'js-yaml@>=5.0.0 <5.4.2': '5.4.2'
 
-  # @nestjs/platform-express <=11.2.5 exact-pins multer@2.2.0 (GHSA-wc9g-mqfw-jrwm and three more, patched >=2.3.0).
-  # Keep the target in LOCKSTEP with the multer version @lenne.tech/nest-server declares (2.4.0 since 11.41.4).
-  # Inert on @nestjs/platform-express 11.2.6+, which pins 2.4.0 itself.
-  'multer@>=2.0.0 <2.4.0': '2.4.0'
+  # @nestjs/platform-express 11.x exact-pins multer (<=11.2.5: 2.2.0, 11.2.6 to 11.2.8: 2.4.0).
+  # GHSA-q7qp-rjg7-q26m (high, DoS) covers 2.4.0, patched >=2.5.0. LOAD-BEARING again since 11.43.4.
+  # Keep the target in LOCKSTEP with the multer version @lenne.tech/nest-server declares (2.5.0 since 11.43.4).
+  'multer@>=2.0.0 <2.5.0': '2.5.0'
 
   # @nestjs/graphql 13.4.5 exact-pins @graphql-tools/utils@12.0.0 — GHSA-7mx3-vvmw-hjmv (high, patched >=12.0.1).
   # Target the newest 12.x, so the caret requesters (@graphql-tools/schema / merge) are not held back —
@@ -74,6 +74,21 @@ overrides:
   '@graphql-tools/utils@>=12.0.0 <12.1.0': '12.1.0'
 ```
 
+### Advisories no override can fix yet: `minimatch` and `glob` (11.43.5)
+
+[GHSA-g3hv-75wg-m249](https://github.com/advisories/GHSA-g3hv-75wg-m249) (minimatch `< 11.0.1`, moderate, DoS
+through globparts amplification) and [GHSA-3g3m-2fjr-6pw4](https://github.com/advisories/GHSA-3g3m-2fjr-6pw4)
+(glob `<= 14.0.1`, moderate) are fixed only in new majors that no consumer can take yet: `@nestjs/cli` 11.0.24, the
+newest 11.x, pins glob 13.0.6 and fork-ts-checker-webpack-plugin 9.1.0 (minimatch ^3) exactly, ts-morph 28
+(`@ts-morph/common` 0.29), nodemon, `@swc/cli` and glob 13 need the 9.x / 10.x lines, rimraf 6.1.3 needs glob 13 — all
+on their newest release. An override across the major is no way out (minimatch 11 removed `makeRe()` and
+`Minimatch#regexp`). nest-server suppresses both in its own repository with `auditConfig.unusableFixConsumers`, which
+`check:overrides` re-tests on every run. What it found for its own tree: the only production path is
+`@lenne.tech/nest-server > ts-morph > @ts-morph/common > minimatch`, used by the Permissions module's scanner with
+globs the developer writes; every other path is dev tooling. Your project's tree may have other paths, so check
+`pnpm why minimatch --prod` and `pnpm why glob --prod` before you suppress the same way, and remove the entries once
+your consumers move to minimatch 11 / glob 14.
+
 ### Retired: `@hono/node-server` (removed 2026-08-22, nest-server 11.36.1)
 
 This list used to carry a third entry. `@modelcontextprotocol/sdk` declared `@hono/node-server@^1.19.9`

package/migration-guides/11.43.3-to-11.43.4.md

@@ -0,0 +1,119 @@
+# Migration Guide: 11.43.3 → 11.43.4
+
+A security patch for projects that still run on 11.x. It is published under the npm dist-tag `latest-11`, not `latest`:
+12.x stays the version a plain install resolves to, and moving every project to 12.x remains the goal. This release
+carries only urgent security fixes; functional fixes from 12.x are not backported.
+
+## Overview
+
+| Category             | Details                                                                                                                                                                                                                       |
+| -------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| **Bugfixes**         | A legacy logout ends the device's refresh token; with `allDevices` it ends every device (§1). The legacy REST rate limit can no longer be bypassed with a query string (§1b)                                                   |
+| **New Features**     | None                                                                                                                                                                                                                          |
+| **Framework API**    | Unchanged                                                                                                                                                                                                                     |
+| **Dependencies**     | `nodemailer` 10.1.2 → 10.1.4 (§2), `multer` 2.4.0 → 2.5.0 (§3)                                                                                                                                                                |
+| **Breaking Changes** | None                                                                                                                                                                                                                          |
+| **Migration Effort** | Raise the version, add or raise the `multer` override (§3), refresh four transitive packages (§4)                                                                                                                             |
+
+## Quick Migration
+
+```bash
+# npm mode: the version is pinned exactly, and `latest` is 12.x, so name the version
+pnpm add @lenne.tech/nest-server@11.43.4
+```
+
+Then add the `multer` override from §3 to `pnpm-workspace.yaml` (or raise the one you already have), raise the
+`body-parser` and `fast-uri` entries from §4 if your project carries them, and refresh:
+
+```bash
+pnpm install
+pnpm update --depth Infinity body-parser zod fast-uri @hono/node-server
+pnpm audit --prod
+pnpm test
+```
+
+Vendor-mode projects update the core to the tag `11.43.4` with the core updater and apply §3 and §4 the same way.
+
+## 1. A legacy logout did not end the refresh token
+
+`CoreAuthService.logout()` removed the device from `refreshTokens` and wrote the map back through `update()`. `update()`
+merges its input into the stored record, so a key that is merely missing from the input survives: the logged-out
+device's refresh token kept working, and `logout(allDevices)`, which wrote an empty map, left every device signed in.
+A user who signed out, or signed out everywhere after losing a device, stayed reachable for whoever held the refresh
+token.
+
+The logout now writes `null` for every device it ends, in `refreshTokens` and `tempTokens`; `validateUser()` reads a
+`null` device as signed out. No action is needed. A project that overrides `logout()` and writes the token maps itself
+must do the same: write `null` for an ended device, never delete its key.
+
+This affects every project that keeps the legacy endpoints open (`auth.legacyEndpoints`, or the three-argument
+`CoreModule.forRoot()` from before 11.38.0). IAM (Better-Auth) sessions are not affected.
+
+## 1b. The legacy REST rate limit counted every spelling of a route separately
+
+`LegacyAuthRateLimitGuard` keyed the REST counter on the last segment of `request.url`, query string included. Express
+routes `/auth/signin?n=1`, `/auth/signin?n=2` and `/auth/SignIn/` to the same handler, but each got a fresh bucket, so
+`auth.rateLimit` never stopped password guessing against `/auth/signin` (or sign-up spam against `/auth/signup`). The
+counter is now keyed on the route handler. No action is needed; projects with `auth.rateLimit` configured and the legacy
+REST endpoints open are the ones that were exposed.
+
+## 2. nodemailer 10.1.4
+
+Three advisories in nodemailer's address parser, all moderate (CVSS 6.5), all patched in 10.1.4: a nested comment
+([GHSA-8c8m-p3m8-cjg8](https://github.com/advisories/GHSA-8c8m-p3m8-cjg8)), a `;` inside a quoted string
+([GHSA-m943-m63m-w62w](https://github.com/advisories/GHSA-m943-m63m-w62w)) and a `>` inside a quoted local part
+([GHSA-85x2-q946-cp5h](https://github.com/advisories/GHSA-85x2-q946-cp5h)) each turn text of an address into an
+additional recipient. nest-server pins nodemailer itself, so raising the framework is enough. A project that declares
+its own `nodemailer`, or carries an override for it, raises that to 10.1.4 as well.
+
+## 3. multer 2.5.0 — the override is needed again
+
+[GHSA-q7qp-rjg7-q26m](https://github.com/advisories/GHSA-q7qp-rjg7-q26m) (high, CVSS 7.5): a pending asynchronous
+`fileFilter` after the request was torn down leads to a denial of service. It covers 2.4.0, patched in 2.5.0.
+
+nest-server now declares 2.5.0, but every `@nestjs/platform-express` 11.x up to 11.2.8, the newest, pins multer
+**exactly** (2.4.0), and `FileInterceptor` uses that copy. No 11.x update reaches the fix, so the project needs an
+override:
+
+```yaml
+# pnpm-workspace.yaml of the project
+overrides:
+  # @nestjs/platform-express 11.x exact-pins multer 2.4.0 (GHSA-q7qp-rjg7-q26m, fixed 2.5.0)
+  'multer@>=2.0.0 <2.5.0': '2.5.0'
+```
+
+A project that already mirrors the older entry (`'multer@>=2.0.0 <2.4.0': '2.4.0'`) must raise both key and target:
+the old target is the vulnerable version.
+
+## 4. Transitive packages: refresh the lockfile
+
+Four advisories of the same week sit in packages nest-server does not pin; they are fixed by a lockfile refresh in the
+project (the command in Quick Migration):
+
+| Package | Advisory | Patched |
+| ------- | -------- | ------- |
+| `body-parser` (via `@apollo/server`, express) | [GHSA-27r3-jxmh-p828](https://github.com/advisories/GHSA-27r3-jxmh-p828), high | 2.4.0 |
+| `zod` (via `@modelcontextprotocol/sdk`) | [GHSA-mrhx-c7xc-m3w5](https://github.com/advisories/GHSA-mrhx-c7xc-m3w5), high | 4.6.6 |
+| `fast-uri` (via ajv) | four advisories up to moderate | 3.1.9 |
+| `@hono/node-server` (via `@modelcontextprotocol/sdk`) | [GHSA-rmxm-3fg6-px4f](https://github.com/advisories/GHSA-rmxm-3fg6-px4f), moderate | 2.1.3 |
+
+**A project that carries an override for `body-parser` or `fast-uri`** (starter-based projects do) must raise it, or
+the old target keeps the vulnerable version in place:
+
+```yaml
+  'body-parser@>=2.0.0 <2.4.0': '2.4.0'   # was '<2.3.0': '2.3.0'
+  'fast-uri@<3.1.9': '3.1.9'              # was '<3.1.8': '3.1.8'
+```
+
+`pnpm run check:overrides`, where a project has it, reports each of these as `TOO LOW`.
+
+## Not in this release
+
+Fixes from 12.x that are not urgent security fixes stay there, among them the configuration dump of a second
+`new ConfigService()` (12.0.0) and the fixes for `distinct()` over ObjectId fields and for names lost at an IAM sign-in
+(12.1.0). They arrive with the move to 12: `migration-guides/11.43.x-to-12.0.x.md`.
+
+## Module Documentation
+
+- [Auth (Legacy)](../src/core/modules/auth/)
+- [Security overrides](../docs/security-overrides.md)

package/migration-guides/11.43.4-to-11.43.5.md

@@ -0,0 +1,102 @@
+# Migration Guide: 11.43.4 → 11.43.5
+
+A security patch for projects that still run on 11.x. It is published under the npm dist-tag `latest-11`, not `latest`:
+12.x stays the version a plain install resolves to, and moving every project to 12.x remains the goal. This release
+carries only urgent security fixes; functional fixes from 12.x are not backported.
+
+## Overview
+
+| Category             | Details                                                                                                                                       |
+| -------------------- | --------------------------------------------------------------------------------------------------------------------------------------------- |
+| **Bugfixes**         | None in the framework code                                                                                                                    |
+| **New Features**     | None                                                                                                                                          |
+| **Framework API**    | Unchanged                                                                                                                                     |
+| **Dependencies**     | `follow-redirects` 1.16.1 → 1.16.2, transitive (§1)                                                                                          |
+| **Breaking Changes** | None                                                                                                                                          |
+| **Migration Effort** | Raise the version, refresh one transitive package (§1); decide on two advisories that have no usable fix yet (§2)                          |
+
+## Quick Migration
+
+```bash
+# npm mode: the version is pinned exactly, and `latest` is 12.x, so name the version
+pnpm add @lenne.tech/nest-server@11.43.5
+pnpm update --depth Infinity follow-redirects
+pnpm audit --prod
+pnpm test
+```
+
+Vendor-mode projects update the core to the tag `11.43.5` with the core updater and refresh `follow-redirects` the same
+way.
+
+## 1. follow-redirects 1.16.2
+
+[GHSA-mrwp-f3q8-3g9p](https://github.com/advisories/GHSA-mrwp-f3q8-3g9p) (high, CVSS 5.9): `sensitiveHeaders` arrays
+from another realm are discarded, so custom credentials can follow a redirect to another host. It covers 1.16.0 and
+1.16.1, patched in 1.16.2.
+
+nest-server reaches it through `node-mailjet > axios > follow-redirects`. axios requests a caret range, so no override is
+needed, but an existing lockfile keeps 1.16.1 until it is refreshed (the command in Quick Migration). Projects that
+reach axios on another path are covered by the same refresh.
+
+## 2. minimatch and glob: fixed only in a new major
+
+[GHSA-g3hv-75wg-m249](https://github.com/advisories/GHSA-g3hv-75wg-m249) (minimatch `< 11.0.1`, moderate, DoS through
+globparts amplification) and [GHSA-3g3m-2fjr-6pw4](https://github.com/advisories/GHSA-3g3m-2fjr-6pw4) (glob `9.0.0` to
+`14.0.1`, moderate, AbortSignal cancellation bypass) were published on 2026-10-30. Both fixes exist only in new majors
+(minimatch 11.0.1, glob 14.0.2), and none of their consumers in the 11.x tree can take them: `@nestjs/cli` 11.0.24, the
+newest 11.x, pins glob 13.0.6 and fork-ts-checker-webpack-plugin 9.1.0 (minimatch ^3) exactly; ts-morph, nodemon,
+`@swc/cli`, glob 13 and rimraf 6 are on their newest releases and request the older majors. An override across the
+major is no way out: minimatch 11 removed `makeRe()` and `Minimatch#regexp`.
+
+`pnpm audit --prod` in a project reports minimatch: ts-morph is a dependency of nest-server (the Permissions module's
+scanner), so the path `@lenne.tech/nest-server > ts-morph > @ts-morph/common > minimatch` reaches every production
+tree. That scanner matches globs the developer writes, never request input. glob is dev tooling in nest-server's own
+tree.
+
+What a project does depends on its audit gate:
+
+- **No blocking `pnpm audit` gate:** nothing to do. Re-check when the consumers move to minimatch 11 / glob 14.
+- **A blocking gate:** check `pnpm why minimatch --prod` and `pnpm why glob --prod` first. Your tree may reach either
+  package on a path that does take request input; then that path is a finding of its own. If every path matches
+  patterns the developer writes, suppress both advisories with the reason next to them. A project that carries
+  `scripts/check-overrides.mjs` (starter-based projects do) declares them in `unusableFixConsumers`, so the guard
+  reports the day a consumer moves:
+
+```yaml
+# pnpm-workspace.yaml of the project — list the consumers YOUR lockfile shows, at their versions
+auditConfig:
+  ignoreGhsas:
+    - GHSA-g3hv-75wg-m249
+    - GHSA-3g3m-2fjr-6pw4
+  unusableFixConsumers:
+    GHSA-g3hv-75wg-m249: '@swc/cli@0.8.1 + @ts-morph/common@0.29.0 + fork-ts-checker-webpack-plugin@9.1.0 + glob@13.0.6 + nodemon@3.1.14 cannot use 11.0.1'
+    GHSA-3g3m-2fjr-6pw4: '@nestjs/cli@11.0.24 + rimraf@6.1.3 cannot use 14.0.2'
+```
+
+nest-server's own repository carries exactly these entries, with the reasoning in `pnpm-workspace.yaml` and a scope
+guard (`tests/unit/audit-suppression-scope.spec.ts`) that fails if glob reaches the production tree or minimatch reaches
+it through any parent other than `@ts-morph/common`.
+
+## 3. `check:overrides`: the guard of 12.x (projects that copied it)
+
+Only relevant for a project that carries a copy of `scripts/check-overrides.mjs`. The guard on `release/11.x` is now the
+one 12.x runs, which the declarations in §2 need:
+
+- `unusableFixConsumers` takes several consumers, joined with ` + `, each at its assessed version. A listed consumer
+  that no longer pulls an affected version fails the run.
+- Only edges to an AFFECTED version count as consumers; a parent that already pulls the fixed release does not. An edge
+  is matched by the package it pulls, not by its key (npm aliases).
+- An advisory that names no patched version is looked up in the registry: a release outside every vulnerable range
+  makes the suppression `FIX AVAILABLE`, a release younger than `minimumReleaseAge` is reported as `pending`.
+
+Copy the file from the tag `11.43.5` to take these over. Nothing changes for a project without the guard.
+
+## Not in this release
+
+Fixes from 12.x that are not urgent security fixes stay there. They arrive with the move to 12:
+`migration-guides/11.43.x-to-12.0.x.md`.
+
+## Module Documentation
+
+- [Security overrides](../docs/security-overrides.md)
+- [Package management rules](../.claude/rules/package-management.md)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lenne.tech/nest-server",
-  "version": "11.43.3",
+  "version": "11.43.5",
   "description": "Modern, fast, powerful Node.js web framework in TypeScript based on Nest with a GraphQL API and a connection to MongoDB (or other databases).",
   "keywords": [
     "node",
@@ -127,9 +127,9 @@
     "lodash": "4.18.1",
     "mongodb": "7.7.0",
     "mongoose": "9.11.2",
-    "multer": "2.4.0",
+    "multer": "2.5.0",
     "node-mailjet": "6.0.11",
-    "nodemailer": "10.1.2",
+    "nodemailer": "10.1.4",
     "passport": "0.7.0",
     "passport-jwt": "4.0.1",
     "reflect-metadata": "0.2.2",
@@ -213,7 +213,7 @@
     "oxfmt": "0.73.0",
     "oxlint": "1.88.0",
     "rimraf": "6.1.3",
-    "smtp-server": "3.19.23",
+    "smtp-server": "3.21.1",
     "ts-node": "10.9.2",
     "tsconfig-paths": "4.2.0",
     "tsx": "4.23.15",

package/src/core/modules/auth/guards/legacy-auth-rate-limit.guard.ts

@@ -76,9 +76,10 @@ export class LegacyAuthRateLimitGuard implements CanActivate {
     const request = context.switchToHttp().getRequest();
     const ip = this.getClientIp(request);
 
-    // Get endpoint from URL path
-    const url = request.url || request.path || '';
-    const endpoint = url.split('/').pop() || 'unknown';
+    // The handler, never the URL: the URL carries the query string and the client's spelling of the path
+    // (Express routes case-insensitively and ignores a trailing slash), so every variant was a fresh bucket and
+    // `/auth/signin?n=1`, `?n=2`, … guessed passwords without ever reaching the limit.
+    const endpoint = context.getHandler()?.name || 'unknown';
 
     return { endpoint, ip };
   }

package/src/core/modules/auth/services/core-auth.service.ts

@@ -130,16 +130,30 @@ export class CoreAuthService {
       throw new UnauthorizedException(ErrorCode.INVALID_TOKEN);
     }
 
+    // A device is ended by writing `null` for it, not by deleting its key: update() MERGES the input into the stored
+    // record, so a key that is merely missing from the input survives — and with it the refresh token this logout
+    // must end. `validateUser()` reads a `null` device as "not signed in".
+    const ended = (deviceIds: string[]) => Object.fromEntries(deviceIds.map((id) => [id, null]));
+
     // Logout from all devices
     if (serviceOptions.allDevices) {
+      const deviceIds = Object.keys(user.refreshTokens);
       user.refreshTokens = {};
-      await this.userService.update(user.id, { refreshTokens: {} }, serviceOptions);
+      await this.userService.update(
+        user.id,
+        { refreshTokens: ended(deviceIds), tempTokens: ended(Object.keys(user.tempTokens ?? {})) },
+        serviceOptions,
+      );
       return true;
     }
 
     // Logout from specific devices
     delete user.refreshTokens[deviceId];
-    await this.userService.update(user.id, { refreshTokens: user.refreshTokens }, serviceOptions);
+    await this.userService.update(
+      user.id,
+      { refreshTokens: ended([deviceId]), tempTokens: ended([deviceId]) },
+      serviceOptions,
+    );
     return true;
   }