@lenne.tech/nest-server 11.43.3 → 12.1.0

package/src/core/common/persistence/data-source.config.ts

@@ -0,0 +1,271 @@
+import type {
+  DatabaseSqlEngine,
+  IDatabaseConfig,
+  IDatabaseSourceConfig,
+} from '../interfaces/server-options.interface.js';
+
+/**
+ * Resolution of the `database` configuration into named data sources, and of a model to its source.
+ *
+ * Pure functions: no connection is opened here. `CoreModule.forRoot()` resolves once at boot and refuses,
+ * before anything connects, what the running version cannot wire (`assertDataSourcesSupported`).
+ */
+
+export type DatabaseDriver = 'mariadb' | 'mongodb' | 'mysql' | 'postgres';
+
+export interface ResolvedDataSource {
+  driver: DatabaseDriver;
+  name: string;
+  /** Present on SQL sources that configure the owner connection */
+  ownerUrl?: string;
+  /** Present on SQL sources only */
+  sqlEngine?: DatabaseSqlEngine;
+  url: string;
+}
+
+export interface ResolvedDataSources {
+  /** Name of the default source; `undefined` when no database is configured */
+  defaultSource: string | undefined;
+  /** `database: false` — the project runs without any database */
+  disabled: boolean;
+  /** Configured exceptions: model name → source name */
+  modelSources: Record<string, string>;
+  sources: Record<string, ResolvedDataSource>;
+}
+
+export interface ResolveDataSourcesInput {
+  database?: false | IDatabaseConfig | string;
+  /** Whether the PROJECT configured `mongoose` — the framework's own fallback URI does not count */
+  explicitMongoose?: boolean;
+  /** The effective mongoose URI (project value or framework fallback) */
+  mongooseUri?: string;
+}
+
+/** A configuration this version cannot resolve or cannot wire. Thrown at boot, never at request time. */
+export class DataSourceConfigError extends Error {
+  constructor(message: string) {
+    super(`[database] ${message}`);
+    this.name = 'DataSourceConfigError';
+  }
+}
+
+export const DEFAULT_SOURCE = 'default';
+/** Source name an explicitly configured `mongoose` gets when `database` sets the default */
+export const MONGOOSE_SOURCE = 'mongoose';
+export const DEFAULT_SQL_ENGINE: DatabaseSqlEngine = 'typeorm';
+
+const SQL_ENGINES: readonly DatabaseSqlEngine[] = ['drizzle', 'kysely', 'typeorm'];
+const SOURCE_NAME = /^[A-Za-z][\w-]*$/;
+const DRIVERS: Record<string, DatabaseDriver> = {
+  'mariadb:': 'mariadb',
+  'mongodb+srv:': 'mongodb',
+  'mongodb:': 'mongodb',
+  'mysql:': 'mysql',
+  'postgres:': 'postgres',
+  'postgresql:': 'postgres',
+};
+
+/**
+ * The database a URL points at, taken from its scheme.
+ */
+export function driverFromUrl(url: string): DatabaseDriver {
+  const scheme = /^[a-z][a-z0-9+.-]*:/i.exec(url)?.[0]?.toLowerCase();
+  const driver = scheme ? DRIVERS[scheme] : undefined;
+  if (!driver) {
+    throw new DataSourceConfigError(
+      `Unsupported connection URL ${redactUrl(url)} — use mongodb://, mongodb+srv://, postgres://, postgresql://, mysql:// or mariadb://`,
+    );
+  }
+  return driver;
+}
+
+/**
+ * A connection URL reduced to scheme and host, so an error message or a log line never carries
+ * credentials, a path or query options (which may hold a password too).
+ */
+export function redactUrl(url: unknown): string {
+  if (typeof url !== 'string') {
+    return `<${typeof url}>`;
+  }
+  const scheme = /^([a-z][a-z0-9+.-]*:)\/\//i.exec(url);
+  if (!scheme) {
+    return '<unparsable URL>';
+  }
+  // The authority ends at the first `/`, `?` or `#`, and the credentials at the LAST `@` inside it — the WHATWG
+  // rule node-postgres parses by, so a password with an unencoded `@` (which it accepts) never reaches the result
+  const authority = url.slice(scheme[0].length).split(/[/?#]/, 1)[0];
+  return `${scheme[1]}//${authority.slice(authority.lastIndexOf('@') + 1)}`;
+}
+
+/**
+ * Resolve the `database` configuration (plus the mongoose configuration it extends) into named sources.
+ */
+export function resolveDataSources(input: ResolveDataSourcesInput): ResolvedDataSources {
+  const { database, explicitMongoose, mongooseUri } = input;
+
+  if (database === false) {
+    return { defaultSource: undefined, disabled: true, modelSources: {}, sources: {} };
+  }
+
+  const config: IDatabaseConfig = typeof database === 'string' ? { url: database } : (database ?? {});
+  if (typeof config !== 'object' || Array.isArray(config)) {
+    throw new DataSourceConfigError('`database` must be a URL, an object or false');
+  }
+  if (config.ownerUrl !== undefined && config.url === undefined) {
+    // The usual cause: `database` was a URL string and an NSC__DATABASE__* variable (e.g. NSC__DATABASE__OWNER_URL)
+    // was merged over it — the environment merge REPLACES a string with an object, so the URL is gone and every
+    // model would fall back to MongoDB without a word
+    throw new DataSourceConfigError(
+      'database.ownerUrl is set but database.url is not. A NSC__DATABASE__* variable replaces a `database` given as a ' +
+        'URL string; write `database: { url: … }` in the configuration (or set NSC__DATABASE__URL as well)',
+    );
+  }
+  const topEngine = config.sqlEngine === undefined ? undefined : checkEngine(config.sqlEngine, 'database.sqlEngine');
+
+  const sources: Record<string, ResolvedDataSource> = {};
+  if (config.url !== undefined) {
+    sources[DEFAULT_SOURCE] = buildSource(
+      DEFAULT_SOURCE,
+      { ownerUrl: config.ownerUrl, url: config.url },
+      topEngine,
+      'database.url',
+    );
+    // A project that keeps its MongoDB next to a new default reaches it as a named source
+    if (explicitMongoose && mongooseUri) {
+      sources[MONGOOSE_SOURCE] = buildSource(MONGOOSE_SOURCE, { url: mongooseUri }, undefined, 'mongoose.uri');
+    }
+  } else if (mongooseUri) {
+    sources[DEFAULT_SOURCE] = buildSource(DEFAULT_SOURCE, { url: mongooseUri }, undefined, 'mongoose.uri');
+  }
+
+  for (const [name, value] of Object.entries(config.sources ?? {})) {
+    if (name === DEFAULT_SOURCE || name === MONGOOSE_SOURCE) {
+      throw new DataSourceConfigError(`database.sources: the source name "${name}" is reserved`);
+    }
+    if (!SOURCE_NAME.test(name)) {
+      throw new DataSourceConfigError(
+        `database.sources: invalid source name "${name}" — use letters, digits, "_" and "-", starting with a letter`,
+      );
+    }
+    const source: IDatabaseSourceConfig = typeof value === 'string' ? { url: value } : value;
+    sources[name] = buildSource(name, source, topEngine, `database.sources.${name}`);
+  }
+
+  const modelSources: Record<string, string> = {};
+  for (const [model, source] of Object.entries(config.models ?? {})) {
+    if (typeof source !== 'string' || !sources[source]) {
+      throw new DataSourceConfigError(
+        `database.models.${model} names the source "${String(source)}", which is not configured (known: ${knownSources(sources)})`,
+      );
+    }
+    modelSources[model] = source;
+  }
+
+  return {
+    defaultSource: sources[DEFAULT_SOURCE] ? DEFAULT_SOURCE : undefined,
+    disabled: false,
+    modelSources,
+    sources,
+  };
+}
+
+/**
+ * The source a model is stored in: the configuration first, then the class's `@PersistedModel`
+ * declaration, then the default source. `undefined` when the project runs without a database.
+ */
+export function resolveModelSource(
+  resolved: ResolvedDataSources,
+  modelName: string,
+  declaredSource?: string,
+): string | undefined {
+  if (resolved.disabled) {
+    return undefined;
+  }
+  const configured = resolved.modelSources[modelName];
+  if (configured) {
+    return configured;
+  }
+  if (declaredSource !== undefined) {
+    if (!resolved.sources[declaredSource]) {
+      throw new DataSourceConfigError(
+        `@PersistedModel on ${modelName} names the source "${declaredSource}", which is not configured (known: ${knownSources(resolved.sources)})`,
+      );
+    }
+    return declaredSource;
+  }
+  return resolved.defaultSource;
+}
+
+/**
+ * Refuse what the running version cannot wire, with a message naming the setting.
+ *
+ * PostgreSQL, MySQL and MariaDB sources (default or additional) are wired next to the MongoDB connection, and since
+ * 12.1.0 a project runs without any database (`database: false`); a second MongoDB connection is refused. Refusing at
+ * boot is the point: a configuration that is accepted and then silently served by the wrong database is the outcome to
+ * avoid.
+ */
+export function assertDataSourcesSupported(resolved: ResolvedDataSources): void {
+  for (const source of Object.values(resolved.sources)) {
+    if (source.driver === 'mongodb' && source.name !== DEFAULT_SOURCE && source.name !== MONGOOSE_SOURCE) {
+      throw new DataSourceConfigError(
+        `The additional MongoDB source "${source.name}" (${redactUrl(source.url)}) is not supported by this version yet — one MongoDB connection only`,
+      );
+    }
+  }
+}
+
+/** Whether any configured source is a MongoDB — the connection CoreModule opens, and the libraries it needs */
+export function usesMongoDb(resolved: ResolvedDataSources): boolean {
+  return Object.values(resolved.sources).some((source) => source.driver === 'mongodb');
+}
+
+/** Whether any configured source is a SQL database */
+export function hasSqlSource(resolved: ResolvedDataSources): boolean {
+  return Object.values(resolved.sources).some((source) => source.driver !== 'mongodb');
+}
+
+function buildSource(
+  name: string,
+  source: IDatabaseSourceConfig,
+  fallbackEngine: DatabaseSqlEngine | undefined,
+  path: string,
+): ResolvedDataSource {
+  if (!source || typeof source !== 'object' || typeof source.url !== 'string' || !source.url) {
+    throw new DataSourceConfigError(`${path}: the url must be a non-empty string`);
+  }
+  const driver = driverFromUrl(source.url);
+  if (driver === 'mongodb') {
+    if (source.ownerUrl !== undefined) {
+      throw new DataSourceConfigError(`${path}: ownerUrl applies to SQL sources only, not to ${redactUrl(source.url)}`);
+    }
+    if (source.sqlEngine !== undefined) {
+      throw new DataSourceConfigError(
+        `${path}: sqlEngine applies to SQL sources only, not to ${redactUrl(source.url)}`,
+      );
+    }
+    return { driver, name, url: source.url };
+  }
+  const engine =
+    source.sqlEngine === undefined
+      ? (fallbackEngine ?? DEFAULT_SQL_ENGINE)
+      : checkEngine(source.sqlEngine, `${path}.sqlEngine`);
+  if (source.ownerUrl !== undefined) {
+    if (typeof source.ownerUrl !== 'string' || !source.ownerUrl || driverFromUrl(source.ownerUrl) !== driver) {
+      throw new DataSourceConfigError(`${path}: ownerUrl must be a ${driver} URL of the same database`);
+    }
+    return { driver, name, ownerUrl: source.ownerUrl, sqlEngine: engine, url: source.url };
+  }
+  return { driver, name, sqlEngine: engine, url: source.url };
+}
+
+function checkEngine(value: unknown, path: string): DatabaseSqlEngine {
+  if (!SQL_ENGINES.includes(value as DatabaseSqlEngine)) {
+    throw new DataSourceConfigError(`${path}: "${String(value)}" is not a known sqlEngine (${SQL_ENGINES.join(', ')})`);
+  }
+  return value as DatabaseSqlEngine;
+}
+
+function knownSources(sources: Record<string, ResolvedDataSource>): string {
+  const names = Object.keys(sources);
+  return names.length ? names.join(', ') : 'none';
+}

package/src/core/common/persistence/data-source.runtime.ts

@@ -0,0 +1,351 @@
+import { Logger } from '@nestjs/common';
+
+import { ConfigService } from '../services/config.service.js';
+import { RequestContext } from '../services/request-context.service.js';
+import type { DataStore } from './data-store.interface.js';
+import { expiredRecordsFilter } from './expiry-sweep.js';
+import type { LockStore } from './lock-store.interface.js';
+import {
+  redactUrl,
+  type ResolvedDataSource,
+  type ResolvedDataSources,
+  resolveModelSource,
+} from './data-source.config.js';
+import type { ModelDescriptor } from './model-descriptor.interface.js';
+import { getModelDescriptor } from './model-metadata.registry.js';
+import { MongooseDataStore } from './mongoose-data-store.js';
+import {
+  getPersistedModels,
+  type IamSqlStorage,
+  type PersistenceOverview,
+  type PersistenceRuntime,
+} from './persistence-runtime.registry.js';
+import { grantStatement } from './sql/postgres/postgres-schema.compiler.js';
+import { assertSafeApplicationRole, SCHEMA_LOCK_SQL } from './sql/postgres/postgres-schema.migrator.js';
+import { type SqlDialect, sqlDialect } from './sql/sql-dialect.js';
+import { createSqlExecutor } from './sql/sql-executor.factory.js';
+import type { SqlExecutor } from './sql/sql-executor.interface.js';
+import { LOCK_MODEL, type SchemaChange, tableName } from './sql/sql-schema.shared.js';
+
+/**
+ * Routes every model registered with `CorePersistenceModule.forFeature()` to its data source (plan §3.9: the
+ * configuration, then `@PersistedModel`, then the default). A SQL source is connected once, as the application role;
+ * each model's table is brought up to date when its store is created — as the owner, or only verified without
+ * `ownerUrl` — and the application role is checked against it: a role row-level security cannot bind stops the boot.
+ * Per model, not per registry: the registry is process-wide, the stores Nest creates belong to THIS application.
+ * What differs between PostgreSQL and MySQL / MariaDB is the source's `SqlDialect`.
+ * Installed by `CoreModule.forRoot()` only when a SQL source is configured.
+ */
+export class DataSourceRuntime implements PersistenceRuntime {
+  protected readonly logger = new Logger('DataSources');
+  private bootReleased = false;
+  private readonly dialects = new Map<string, SqlDialect>();
+  private readonly executors = new Map<string, Promise<SqlExecutor>>();
+  /** Sources whose application-only tenant isolation was reported */
+  private readonly isolationReported = new Set<string>();
+  private lockStore?: Promise<LockStore | undefined>;
+  private readonly owners = new Map<string, Promise<SqlExecutor>>();
+  private readonly stores = new Map<string, Promise<DataStore<any>>>();
+
+  constructor(protected readonly resolved: ResolvedDataSources) {}
+
+  async close(): Promise<void> {
+    const executors = [...this.executors.values()];
+    this.executors.clear();
+    this.lockStore = undefined;
+    this.stores.clear();
+    await Promise.all([this.releaseBootConnections(), ...executors.map(closeExecutor)]);
+  }
+
+  /**
+   * The framework's own leases (system-setup claim, cron, migrations) live in the default source. Opened once — as the
+   * owner it brings the lease table up to date, which a model of the default source would otherwise have done
+   */
+  defaultLockStore(): Promise<LockStore | undefined> {
+    this.lockStore ??= this.openLockStore();
+    return this.lockStore;
+  }
+
+  async releaseBootConnections(): Promise<void> {
+    this.bootReleased = true;
+    const owners = [...this.owners.values()];
+    this.owners.clear();
+    await Promise.all(owners.map(closeExecutor));
+  }
+
+  async resolveStore(name: string, mongoModel: unknown): Promise<DataStore<any>> {
+    const source = this.sourceOf(name);
+    if (!source || source.driver === 'mongodb') {
+      return new MongooseDataStore(mongoModel as any);
+    }
+    let store = this.stores.get(name);
+    if (!store) {
+      store = this.openStore(source, name);
+      this.stores.set(name, store);
+    }
+    return store;
+  }
+
+  defaultSqlSource(): undefined | { engine?: string; ownerUrl?: string; url: string } {
+    const name = this.resolved.defaultSource;
+    const source = name ? this.resolved.sources[name] : undefined;
+    return source && source.driver !== 'mongodb'
+      ? { engine: source.sqlEngine, ownerUrl: source.ownerUrl, url: source.url }
+      : undefined;
+  }
+
+  describe(): PersistenceOverview {
+    return {
+      defaultSource: this.resolved.defaultSource,
+      models: getPersistedModels().map((model) => ({
+        name: model.name,
+        source: resolveModelSource(this.resolved, model.name, model.declaredSource),
+      })),
+      sources: Object.values(this.resolved.sources).map((source) => ({
+        driver: source.driver,
+        engine: source.sqlEngine,
+        host: redactUrl(source.url),
+        name: source.name,
+        ownerConfigured: !!source.ownerUrl,
+      })),
+    };
+  }
+
+  async iamStorage(): Promise<IamSqlStorage | undefined> {
+    const registration = getPersistedModels().find((model) => {
+      const descriptor = getModelDescriptor(model.name);
+      return !!descriptor && tableName(descriptor) === USERS_TABLE;
+    });
+    const source = registration ? this.sourceOf(registration.name) : undefined;
+    if (!registration || !source || source.driver === 'mongodb') {
+      return undefined;
+    }
+    if (source.driver !== 'postgres') {
+      throw new Error(
+        `Better-Auth cannot run on ${this.dialect(source).label} yet: the user model (table ${USERS_TABLE}) is routed to ` +
+          `the source "${source.name}". Keep the user model on PostgreSQL or MongoDB (database.models), or switch Better-Auth off.`,
+      );
+    }
+    // Opening the store brings `users` up to date first: Better-Auth only adds its columns to the table the user model
+    // defines, never the other way round
+    const users = await this.resolveStore(registration.name, undefined);
+    const app = await this.executor(source);
+    return {
+      applySchema: (migrate, tables) => this.applyForeignSchema(source, app, migrate, tables),
+      pool: app.driverPool,
+      source: source.name,
+      users,
+    };
+  }
+
+  async sweepExpired(now = new Date()): Promise<{ deleted: number; model: string }[]> {
+    const swept: { deleted: number; model: string }[] = [];
+    const failed: string[] = [];
+    for (const [name, pending] of this.stores) {
+      const descriptor = getModelDescriptor(name);
+      const expired = descriptor ? expiredRecordsFilter(descriptor, now) : undefined;
+      if (!expired) {
+        continue;
+      }
+      try {
+        const store = await pending;
+        // System work across every tenant, as the TTL monitor is: row-level security admits the system scope
+        const deleted = await RequestContext.runWithBypassTenantGuard(() => store.deleteMany(expired as any));
+        swept.push({ deleted, model: name });
+      } catch (error) {
+        // One table that cannot be swept must not keep the others full
+        failed.push(`${name}: ${(error as Error)?.message ?? error}`);
+      }
+    }
+    if (failed.length) {
+      throw new Error(failed.join('; '));
+    }
+    return swept;
+  }
+
+  sqlSources(): { name: string; ping: () => Promise<void> }[] {
+    return Object.values(this.resolved.sources)
+      .filter((source) => source.driver !== 'mongodb')
+      .map((source) => ({
+        name: source.name,
+        ping: async () => {
+          await (await this.executor(source)).run({ params: [], text: 'SELECT 1' }, { kind: 'system' });
+        },
+      }));
+  }
+
+  /**
+   * Whether a model's rows are tenant-isolated: tenant-scoped, multi-tenancy on, not excluded. On PostgreSQL the table
+   * carries row-level security; MySQL / MariaDB have none, and the store alone isolates
+   */
+  isTenantIsolated(model: ModelDescriptor): boolean {
+    const multiTenancy = ConfigService.configFastButReadOnly?.multiTenancy;
+    return (
+      !!multiTenancy &&
+      multiTenancy.enabled !== false &&
+      model.tenantScoped &&
+      !multiTenancy.excludeSchemas?.includes(model.name)
+    );
+  }
+
+  protected sourceOf(name: string): ResolvedDataSource | undefined {
+    const registration = getPersistedModels().find((model) => model.name === name);
+    const source = resolveModelSource(this.resolved, name, registration?.declaredSource);
+    return source ? this.resolved.sources[source] : undefined;
+  }
+
+  private async openStore(source: ResolvedDataSource, name: string): Promise<DataStore<any>> {
+    const model = getModelDescriptor(name);
+    if (!model) {
+      throw new Error(`No descriptor for model "${name}" — register it with CorePersistenceModule.forFeature()`);
+    }
+    const app = await this.executor(source);
+    const dialect = this.dialect(source);
+    let changes: SchemaChange[];
+    if (source.ownerUrl) {
+      changes = await dialect.applySchema(await this.owner(source), app, [model]);
+    } else {
+      changes = await dialect.verifySchema(app, [model]);
+    }
+    for (const change of changes) {
+      if (change.kind === 'automatic') {
+        this.logger.log(`[${source.name}] ${change.description}`);
+      } else if (change.kind === 'notice') {
+        this.logger.warn(`[${source.name}] ${change.description}`);
+      }
+    }
+    await dialect.assertSafeApplication(app, [tableName(model), tableName(LOCK_MODEL)]);
+    const isolated = this.isTenantIsolated(model);
+    if (isolated && source.driver !== 'postgres' && !this.isolationReported.has(source.name)) {
+      this.isolationReported.add(source.name);
+      this.logger.warn(
+        `[${source.name}] ${dialect.label} has no row-level security: tenant isolation of ${source.name} is enforced by ` +
+          'the application only. A query on a tenant table through store.native(), store.raw() or a connection of your ' +
+          'own must filter by tenantId itself — nothing in the database stops it.',
+      );
+    }
+    this.logger.log(
+      `${name} → ${source.name} → ${source.driver} ${redactUrl(source.url)} → ${source.sqlEngine}${dialect.isolation(isolated)}`,
+    );
+    const registration = getPersistedModels().find((entry) => entry.name === name);
+    return dialect.createStore(app, model, { schema: registration?.schema as any });
+  }
+
+  private async openLockStore(): Promise<LockStore | undefined> {
+    const name = this.resolved.defaultSource;
+    const source = name ? this.resolved.sources[name] : undefined;
+    if (!source || source.driver === 'mongodb') {
+      return undefined;
+    }
+    const app = await this.executor(source);
+    const dialect = this.dialect(source);
+    if (!source.ownerUrl) {
+      await dialect.verifySchema(app, []);
+    } else if (this.bootReleased) {
+      // First asked after the boot released its owner connections: a connection of its own, closed at once
+      const owner = await createSqlExecutor({
+        applicationName: 'nest-server-schema',
+        engine: source.sqlEngine,
+        maxConnections: 1,
+        url: source.ownerUrl,
+      });
+      try {
+        await dialect.applySchema(owner, app, []);
+      } finally {
+        await owner.close();
+      }
+    } else {
+      await dialect.applySchema(await this.owner(source), app, []);
+    }
+    await dialect.assertSafeApplication(app, [tableName(LOCK_MODEL)]);
+    return dialect.createLockStore(app);
+  }
+
+  /**
+   * Tables another library creates in a SQL source (Better-Auth's): its migration runs as the owner under the schema lock
+   * the framework's own evolution takes, so replicas booting together apply it once; the application role is granted
+   * and checked as on the framework's tables. Two owner connections: one holds the lock, the library migrates on the
+   * other — it brings its own client and cannot run inside the locking transaction.
+   */
+  private async applyForeignSchema(
+    source: ResolvedDataSource,
+    app: SqlExecutor,
+    migrate: (pool: unknown, asOwner: boolean) => Promise<void>,
+    tables: string[],
+  ): Promise<void> {
+    if (!source.ownerUrl) {
+      await migrate(app.driverPool, false);
+    } else {
+      const connect = (maxConnections: number) =>
+        createSqlExecutor({
+          applicationName: 'nest-server-schema',
+          engine: source.sqlEngine,
+          maxConnections,
+          url: source.ownerUrl,
+        });
+      const [lock, migrator] = await Promise.all([connect(1), connect(2)]);
+      const appRole = decodeURIComponent(new URL(source.url).username);
+      try {
+        await lock.transaction(async (tx) => {
+          await tx.run({ params: [], text: SCHEMA_LOCK_SQL }, SYSTEM);
+          await migrate(migrator.driverPool, true);
+          for (const table of tables) {
+            await tx.run({ params: [], text: grantStatement(table, appRole) }, SYSTEM);
+          }
+        });
+      } finally {
+        await Promise.all([lock.close(), migrator.close()]);
+      }
+    }
+    await assertSafeApplicationRole(app, tables);
+  }
+
+  private dialect(source: ResolvedDataSource): SqlDialect {
+    let dialect = this.dialects.get(source.name);
+    if (!dialect) {
+      dialect = sqlDialect({
+        appRole: decodeURIComponent(new URL(source.url).username),
+        driver: source.driver as 'mariadb' | 'mysql' | 'postgres',
+        isTenantIsolated: (candidate) => this.isTenantIsolated(candidate),
+      });
+      this.dialects.set(source.name, dialect);
+    }
+    return dialect;
+  }
+
+  /**
+   * One owner connection per source for the whole boot, released once every store exists: one per model opened and
+   * closed a privileged connection for every table, and the stores are created concurrently
+   */
+  private owner(source: ResolvedDataSource): Promise<SqlExecutor> {
+    let pending = this.owners.get(source.name);
+    if (!pending) {
+      pending = createSqlExecutor({
+        applicationName: 'nest-server-schema',
+        engine: source.sqlEngine,
+        maxConnections: 1,
+        url: source.ownerUrl,
+      });
+      this.owners.set(source.name, pending);
+    }
+    return pending;
+  }
+
+  private executor(source: ResolvedDataSource): Promise<SqlExecutor> {
+    let pending = this.executors.get(source.name);
+    if (!pending) {
+      pending = createSqlExecutor({ applicationName: 'nest-server', engine: source.sqlEngine, url: source.url });
+      this.executors.set(source.name, pending);
+    }
+    return pending;
+  }
+}
+
+/** The table the user model and Better-Auth share */
+const USERS_TABLE = 'users';
+
+const SYSTEM = { kind: 'system' } as const;
+
+async function closeExecutor(pending: Promise<SqlExecutor>): Promise<void> {
+  await (await pending.catch(() => undefined))?.close();
+}