@lenne.tech/nest-server 11.43.3 → 12.1.0

package/src/core/common/plugins/mongoose-audit-fields.plugin.ts

@@ -1,4 +1,10 @@
-import { RequestContext } from '../services/request-context.service';
+import {
+  type AuditFieldPresence,
+  resolveAuditActorId,
+  stampAuditOnReplace,
+  stampAuditOnUpdate,
+  stampAuditOnWrite,
+} from '../persistence/policies/audit.policy.js';
 
 /**
  * Mongoose plugin that automatically sets createdBy/updatedBy fields.
@@ -16,36 +22,35 @@ import { RequestContext } from '../services/request-context.service';
  * - Bulk operations: sets createdBy/updatedBy per document/operation
  *
  * Only activates on schemas that have createdBy and/or updatedBy fields defined.
+ *
+ * The stamping decisions live in the audit policy (`persistence/policies/audit.policy.ts`), which every
+ * data store shares; this plugin only applies them to Mongoose's hook shapes.
  */
 export function mongooseAuditFieldsPlugin(schema) {
-  const hasCreatedBy = !!schema.path('createdBy');
-  const hasUpdatedBy = !!schema.path('updatedBy');
+  const fields: AuditFieldPresence = {
+    createdBy: !!schema.path('createdBy'),
+    updatedBy: !!schema.path('updatedBy'),
+  };
 
   // Skip schemas without audit fields (e.g. BetterAuth sessions, third-party schemas)
-  if (!hasCreatedBy && !hasUpdatedBy) {
+  if (!fields.createdBy && !fields.updatedBy) {
     return;
   }
 
   // Pre-save hook
   schema.pre('save', function () {
-    const currentUser = RequestContext.getCurrentUser();
-    if (!currentUser?.id) {
+    const actorId = resolveAuditActorId();
+    if (!actorId) {
       return;
     }
-
-    if (hasCreatedBy && this.isNew && !this['createdBy']) {
-      this['createdBy'] = currentUser.id;
-    }
-    if (hasUpdatedBy) {
-      this['updatedBy'] = currentUser.id;
-    }
+    stampAuditOnWrite(this, actorId, fields, this.isNew);
   });
 
   // Pre-update hooks (only needed for updatedBy)
-  if (hasUpdatedBy) {
+  if (fields.updatedBy) {
     const updateHook = function () {
-      const currentUser = RequestContext.getCurrentUser();
-      if (!currentUser?.id) {
+      const actorId = resolveAuditActorId();
+      if (!actorId) {
         return;
       }
 
@@ -54,22 +59,7 @@ export function mongooseAuditFieldsPlugin(schema) {
         return;
       }
 
-      // Handle both flat updates and $set operator
-      update['updatedBy'] = currentUser.id;
-      if (update.$set) {
-        update.$set['updatedBy'] = currentUser.id;
-      }
-
-      // Handle upsert: set createdBy on insert via $setOnInsert
-      // Only add if createdBy is not already in the update (avoids MongoDB path conflict)
-      if (hasCreatedBy && !update['createdBy'] && !update.$set?.['createdBy']) {
-        if (!update.$setOnInsert) {
-          update.$setOnInsert = {};
-        }
-        if (!update.$setOnInsert['createdBy']) {
-          update.$setOnInsert['createdBy'] = currentUser.id;
-        }
-      }
+      stampAuditOnUpdate(update, actorId, fields);
     };
 
     schema.pre('findOneAndUpdate', updateHook);
@@ -78,8 +68,8 @@ export function mongooseAuditFieldsPlugin(schema) {
 
     // Replace hooks: flat replacement doc (no $set/$setOnInsert)
     const replaceHook = function () {
-      const currentUser = RequestContext.getCurrentUser();
-      if (!currentUser?.id) {
+      const actorId = resolveAuditActorId();
+      if (!actorId) {
         return;
       }
 
@@ -88,12 +78,7 @@ export function mongooseAuditFieldsPlugin(schema) {
         return;
       }
 
-      replacement['updatedBy'] = currentUser.id;
-
-      // For upsert replacements: set createdBy if not already present
-      if (hasCreatedBy && !replacement['createdBy']) {
-        replacement['createdBy'] = currentUser.id;
-      }
+      stampAuditOnReplace(replacement, actorId, fields);
     };
 
     schema.pre('replaceOne', replaceHook);
@@ -103,55 +88,29 @@ export function mongooseAuditFieldsPlugin(schema) {
   // Bulk operation hooks (needed when either createdBy or updatedBy is present)
   // Pre-insertMany hook (Mongoose 9: first arg is docs array)
   schema.pre('insertMany', function (docs) {
-    const currentUser = RequestContext.getCurrentUser();
-    if (!currentUser?.id) return;
+    const actorId = resolveAuditActorId();
+    if (!actorId) return;
     if (!Array.isArray(docs)) return;
 
     for (const doc of docs) {
-      if (hasCreatedBy && !doc.createdBy) {
-        doc.createdBy = currentUser.id;
-      }
-      if (hasUpdatedBy) {
-        doc.updatedBy = currentUser.id;
-      }
+      stampAuditOnWrite(doc, actorId, fields, true);
     }
   });
 
   // Pre-bulkWrite hook
   schema.pre('bulkWrite', function (ops) {
-    const currentUser = RequestContext.getCurrentUser();
-    if (!currentUser?.id) return;
+    const actorId = resolveAuditActorId();
+    if (!actorId) return;
 
     for (const op of ops) {
       if ('insertOne' in op) {
-        if (hasCreatedBy && !op.insertOne.document.createdBy) {
-          op.insertOne.document.createdBy = currentUser.id;
-        }
-        if (hasUpdatedBy) {
-          op.insertOne.document.updatedBy = currentUser.id;
-        }
+        stampAuditOnWrite(op.insertOne.document, actorId, fields, true);
       } else if ('updateOne' in op || 'updateMany' in op) {
         const update = 'updateOne' in op ? op.updateOne.update : op.updateMany.update;
         if (!update) continue;
-        if (hasUpdatedBy) {
-          update['updatedBy'] = currentUser.id;
-          if (update.$set) {
-            update.$set['updatedBy'] = currentUser.id;
-          }
-        }
-        if (hasCreatedBy && !update['createdBy'] && !update.$set?.['createdBy']) {
-          if (!update.$setOnInsert) update.$setOnInsert = {};
-          if (!update.$setOnInsert['createdBy']) {
-            update.$setOnInsert['createdBy'] = currentUser.id;
-          }
-        }
+        stampAuditOnUpdate(update, actorId, fields);
       } else if ('replaceOne' in op) {
-        if (hasUpdatedBy) {
-          op.replaceOne.replacement['updatedBy'] = currentUser.id;
-        }
-        if (hasCreatedBy && !op.replaceOne.replacement['createdBy']) {
-          op.replaceOne.replacement['createdBy'] = currentUser.id;
-        }
+        stampAuditOnReplace(op.replaceOne.replacement, actorId, fields);
       }
     }
   });

package/src/core/common/plugins/mongoose-id.plugin.ts

@@ -6,6 +6,15 @@ export function mongooseIdPlugin(schema) {
   schema.post(/.*/, (docs) => {
     const docsArray = Array.isArray(docs) ? docs : [docs];
     for (const doc of docsArray) {
+      // A bare ObjectId is a VALUE, not a document — `distinct()` on an ObjectId field returns an
+      // array of them. Mongoose gives `ObjectId.prototype` an `_id` getter returning itself, so the
+      // check below matched, and the assignment then hit bson's own `id` SETTER (the 12-byte
+      // buffer). bson < 7.3 silently accepted the hex string; bson >= 7.3 (mongodb >= 7.7) throws
+      // `BSONError: Cannot create Buffer from the passed potentialBuffer`, turning every
+      // `distinct()` over an ObjectId field into a 500.
+      if (doc?._bsontype === 'ObjectId') {
+        continue;
+      }
       if (doc?._id && typeof doc._id.toHexString === 'function') {
         doc.id = doc._id.toHexString();
       }

package/src/core/common/plugins/mongoose-password.plugin.ts

@@ -1,7 +1,7 @@
-import bcrypt = require('bcrypt');
-import { sha256 } from 'js-sha256';
+import { hashPassword, hashUpdatePassword } from '../persistence/policies/password.policy.js';
 
-import { ConfigService } from '../services/config.service';
+// Public API since before the policy extraction — keep every import path working
+export { hashPassword, hashUpdatePassword, resetSkipPatternsCache } from '../persistence/policies/password.policy.js';
 
 /**
  * Mongoose plugin that automatically hashes passwords before saving to the database.
@@ -15,6 +15,9 @@ import { ConfigService } from '../services/config.service';
  *
  * For sentinel/lock values (e.g. '!LOCKED:REQUIRES_PASSWORD_RESET'), configure
  * skipPatterns in security.mongoosePasswordPlugin to preserve them as-is.
+ *
+ * The hashing decisions live in the password policy (`persistence/policies/password.policy.ts`), which
+ * every data store shares; this plugin only applies them to Mongoose's hook shapes.
  */
 export function mongoosePasswordPlugin(schema) {
   // Pre-save hook
@@ -79,62 +82,3 @@ export function mongoosePasswordPlugin(schema) {
     }
   });
 }
-
-export async function hashUpdatePassword(update: any) {
-  if (!update) {
-    return;
-  }
-  if (update.password) {
-    update.password = await hashPassword(update.password);
-  }
-  if (update.$set?.password) {
-    update.$set.password = await hashPassword(update.$set.password);
-  }
-}
-
-// Compiled RegExp cache (built once on first call)
-let compiledSkipPatterns: RegExp[] | null = null;
-
-/**
- * Reset the compiled skip patterns cache.
- * Use in test environments where ConfigService is reset between test suites.
- */
-export function resetSkipPatternsCache(): void {
-  compiledSkipPatterns = null;
-}
-
-function getSkipPatterns(): RegExp[] {
-  if (compiledSkipPatterns !== null) {
-    return compiledSkipPatterns;
-  }
-  const pluginConfig = ConfigService.configFastButReadOnly?.security?.mongoosePasswordPlugin;
-  if (pluginConfig && typeof pluginConfig === 'object' && 'skipPatterns' in pluginConfig && pluginConfig.skipPatterns) {
-    compiledSkipPatterns = (pluginConfig.skipPatterns as (string | RegExp)[]).map((p) =>
-      p instanceof RegExp ? p : new RegExp(p),
-    );
-  } else {
-    compiledSkipPatterns = [];
-  }
-  return compiledSkipPatterns;
-}
-
-export async function hashPassword(password: string): Promise<string> {
-  // Already BCrypt-hashed → skip
-  if (/^\$2[aby]\$\d+\$/.test(password)) {
-    return password;
-  }
-
-  // Check configured skip patterns (e.g. sentinel/lock values)
-  const skipPatterns = getSkipPatterns();
-  if (skipPatterns.some((pattern) => pattern.test(password))) {
-    return password;
-  }
-
-  // SHA256 pre-hash if configured and password is not already SHA256
-  const sha256Enabled = ConfigService.configFastButReadOnly?.sha256;
-  if (sha256Enabled && !/^[a-f0-9]{64}$/i.test(password)) {
-    password = sha256(password);
-  }
-
-  return bcrypt.hash(password, 10);
-}

package/src/core/common/plugins/mongoose-role-guard.plugin.ts

@@ -1,8 +1,11 @@
 import { Logger } from '@nestjs/common';
 
-import { RoleEnum } from '../enums/role.enum';
-import { ConfigService } from '../services/config.service';
-import { RequestContext } from '../services/request-context.service';
+import {
+  isRoleChangeAllowed,
+  stripRoleChanges,
+  updateChangesRoles,
+} from '../persistence/policies/role-guard.policy.js';
+import { RequestContext } from '../services/request-context.service.js';
 
 const logger = new Logger('mongooseRoleGuardPlugin');
 
@@ -117,8 +120,8 @@ export function mongooseRoleGuardPlugin(schema) {
   schema.pre('bulkWrite', function (ops) {
     const hasAnyRoleChange = ops.some((op) => {
       if ('insertOne' in op) return !!op.insertOne.document?.roles?.length;
-      if ('updateOne' in op) return hasRolesInUpdate(op.updateOne.update);
-      if ('updateMany' in op) return hasRolesInUpdate(op.updateMany.update);
+      if ('updateOne' in op) return updateChangesRoles(op.updateOne.update);
+      if ('updateMany' in op) return updateChangesRoles(op.updateMany.update);
       if ('replaceOne' in op) return !!op.replaceOne.replacement?.roles?.length;
       return false;
     });
@@ -146,58 +149,15 @@ export function mongooseRoleGuardPlugin(schema) {
 }
 
 /**
- * Check if the current user is allowed to modify roles.
- * Returns true if:
- * - No user context (system operation)
- * - bypassRoleGuard is active (via RequestContext.runWithBypassRoleGuard())
- * - User has ADMIN role
- * - User has one of the configured allowedRoles
+ * Strip an unauthorized role change from an update object. The decisions live in the role-guard policy
+ * (`persistence/policies/role-guard.policy.ts`), which every data store shares.
  */
-function isRoleChangeAllowed(): boolean {
-  const currentUser = RequestContext.getCurrentUser();
-  // No user context (system operation) → allow
-  if (!currentUser) {
-    return true;
-  }
-  // Explicit bypass (e.g. signUp with default roles, authorized service operations)
-  if (RequestContext.isBypassRoleGuard()) {
-    return true;
-  }
-  // Admin → always allow
-  if (currentUser.hasRole?.([RoleEnum.ADMIN]) || currentUser.roles?.includes(RoleEnum.ADMIN)) {
-    return true;
-  }
-
-  // Check configured allowedRoles
-  const pluginConfig = ConfigService.configFastButReadOnly?.security?.mongooseRoleGuardPlugin;
-  if (pluginConfig && typeof pluginConfig === 'object' && 'allowedRoles' in pluginConfig && pluginConfig.allowedRoles) {
-    const allowedRoles: string[] = pluginConfig.allowedRoles as string[];
-    if (currentUser.roles?.some((role: string) => allowedRoles.includes(role))) {
-      return true;
-    }
-  }
-
-  return false;
-}
-
-function hasRolesInUpdate(update: any): boolean {
-  return !!(
-    update?.roles ||
-    update?.$set?.roles ||
-    update?.$push?.roles ||
-    update?.$addToSet?.roles ||
-    update?.$pull?.roles
-  );
-}
-
 function handleUpdateRoleGuard(update: any) {
   if (!update) {
     return;
   }
 
-  const hasRolesUpdate =
-    update.roles || update.$set?.roles || update?.$push?.roles || update.$addToSet?.roles || update.$pull?.roles;
-  if (!hasRolesUpdate) {
+  if (!updateChangesRoles(update)) {
     return;
   }
 
@@ -208,17 +168,5 @@ function handleUpdateRoleGuard(update: any) {
   // Unauthorized: remove roles changes with debug log
   const currentUser = RequestContext.getCurrentUser();
   logger.debug(`Stripped unauthorized roles change from user ${currentUser?.id || 'unknown'}`);
-  delete update.roles;
-  if (update.$set?.roles) {
-    delete update.$set.roles;
-  }
-  if (update.$push?.roles) {
-    delete update.$push.roles;
-  }
-  if (update.$addToSet?.roles) {
-    delete update.$addToSet.roles;
-  }
-  if (update.$pull?.roles) {
-    delete update.$pull.roles;
-  }
+  stripRoleChanges(update);
 }

package/src/core/common/plugins/mongoose-system-role.plugin.ts

@@ -1,6 +1,9 @@
-import { BadRequestException } from '@nestjs/common';
-
-import { looksLikeSystemRole, SYSTEM_ROLE_PREFIX } from '../enums/role.enum';
+import {
+  assertNoSystemRoles,
+  assertUpdateHasNoSystemRoles,
+  toRoleArray,
+  updateMayIntroduceSystemRoles,
+} from '../persistence/policies/system-role.policy.js';
 
 /**
  * Mongoose plugin that refuses to STORE system roles (`s_*`) in a `roles` array.
@@ -93,38 +96,6 @@ export function mongooseSystemRolePlugin(schema) {
   });
 }
 
-/** Normalize an unknown value to a string array; anything else becomes an empty baseline. */
-function toRoleArray(value: unknown): string[] {
-  return Array.isArray(value) ? value.filter((entry): entry is string => typeof entry === 'string') : [];
-}
-
-/**
- * Throw if the write INTRODUCES a system role.
- *
- * `alreadyStored` is the document's current value. A system role that is already in there is NOT
- * refused, and this is load-bearing rather than lenient: `CrudService.update()` writes the whole
- * object back, so a login (`updateRefreshToken` → `update`) re-sends the stored `roles` verbatim.
- * Refusing that would lock every already-contaminated account out of the system on upgrade — and
- * would do the same, fleet-wide, to any project whose own role name happens to start with `s_`.
- * An upgrade must not cause a login outage; cleaning up stored values is what the migration guide's
- * audit query is for.
- *
- * Accepts anything: a non-array (nothing to check) and non-string elements (cannot be a system
- * role) pass through untouched — type validation is not this plugin's job.
- */
-function assertNoSystemRoles(roles: unknown, alreadyStored: string[] = []): void {
-  if (!Array.isArray(roles)) {
-    return;
-  }
-
-  const introduced = roles.filter((role) => looksLikeSystemRole(role) && !alreadyStored.includes(role));
-  if (introduced.length) {
-    throw new BadRequestException(
-      `System roles (${SYSTEM_ROLE_PREFIX}*) must never be stored in user.roles: ${introduced.join(', ')}`,
-    );
-  }
-}
-
 /**
  * Query-level variant: resolves the affected document's stored roles before deciding.
  *
@@ -133,7 +104,7 @@ function assertNoSystemRoles(roles: unknown, alreadyStored: string[] = []): void
  */
 async function assertUpdateIntroducesNoSystemRoles(query: any): Promise<void> {
   const update = query.getUpdate();
-  if (!update || !collectRoleValues(update).some((role) => looksLikeSystemRole(role))) {
+  if (!update || !updateMayIntroduceSystemRoles(update)) {
     return;
   }
 
@@ -149,45 +120,3 @@ async function assertUpdateIntroducesNoSystemRoles(query: any): Promise<void> {
 
   assertUpdateHasNoSystemRoles(update, stored);
 }
-
-/** Every roles value the update could write, flattened across the operators that can carry one. */
-function collectRoleValues(update: any): unknown[] {
-  const values: unknown[] = [
-    ...toRoleArray(update.roles),
-    ...toRoleArray(update.$set?.roles),
-    ...toRoleArray(update.$setOnInsert?.roles),
-  ];
-
-  for (const operator of [update.$push?.roles, update.$addToSet?.roles]) {
-    if (operator === undefined || operator === null) {
-      continue;
-    }
-    values.push(...(Array.isArray(operator?.$each) ? operator.$each : [operator]));
-  }
-
-  return values;
-}
-
-/**
- * Check every operator through which a roles value can reach the document.
- *
- * `$pull` is deliberately NOT checked — removing an `s_*` value from a document that already has
- * one is exactly the cleanup this release asks projects to perform, so it must stay possible.
- */
-function assertUpdateHasNoSystemRoles(update: any, alreadyStored: string[] = []): void {
-  if (!update) {
-    return;
-  }
-
-  assertNoSystemRoles(update.roles, alreadyStored);
-  assertNoSystemRoles(update.$set?.roles, alreadyStored);
-  assertNoSystemRoles(update.$setOnInsert?.roles, alreadyStored);
-
-  // $push / $addToSet take either a bare value or a { $each: [...] } modifier
-  for (const operator of [update.$push?.roles, update.$addToSet?.roles]) {
-    if (operator === undefined || operator === null) {
-      continue;
-    }
-    assertNoSystemRoles(Array.isArray(operator?.$each) ? operator.$each : [operator], alreadyStored);
-  }
-}

package/src/core/common/plugins/mongoose-tenant.plugin.ts

@@ -1,47 +1,12 @@
-import { ForbiddenException, Logger } from '@nestjs/common';
+import { ForbiddenException } from '@nestjs/common';
 
-import { ConfigService } from '../services/config.service';
-import { RequestContext } from '../services/request-context.service';
-
-/** Models already warned about, so the message appears once per process rather than per query. */
-const isolationDisabledWarned = new Set<string>();
-
-/**
- * Say out loud that isolation is off for a schema that was built for it.
- *
- * `excludeSchemas` is a legitimate feature — a genuinely global lookup table has no tenant. But this
- * plugin only ever attaches to schemas that DECLARE a `tenantId` field, so reaching here means the
- * author of that schema intended per-tenant rows and the configuration silently overrides them.
- * Nothing said so, and the shape is easy to arrive at by accident: the framework's own documentation
- * carried `excludeSchemas: ['User', 'Session']` in a copyable `@example` from 11.20.0 onwards, which
- * on a project with per-tenant users switches filtering off for the user collection.
- *
- * A warning, not a boot failure. An ambiguous ROLE vocabulary fails the boot because its access
- * decisions cannot be resolved coherently; this configuration is perfectly coherent — it is simply
- * one nobody may make without noticing.
- *
- * The membership model is skipped: `CoreModule` adds it to `excludeSchemas` itself because
- * membership is tenant-spanning by design, so warning about it would be the framework complaining
- * about its own correct default.
- */
-function warnIsolationDisabled(modelName: string): void {
-  if (isolationDisabledWarned.has(modelName)) {
-    return;
-  }
-  isolationDisabledWarned.add(modelName);
-
-  const membershipModel = ConfigService.configFastButReadOnly?.multiTenancy?.membershipModel ?? 'TenantMember';
-  if (modelName === membershipModel) {
-    return;
-  }
-
-  new Logger('mongooseTenantPlugin').warn(
-    `Tenant isolation is DISABLED for "${modelName}": the schema declares a tenantId field, but ` +
-      `"${modelName}" is listed in multiTenancy.excludeSchemas — so no tenant filter is applied and ` +
-      `every query on it sees every tenant's rows. Remove it from excludeSchemas unless this ` +
-      `collection is genuinely global.`,
-  );
-}
+import {
+  assertOwnTenant,
+  assertRowsInTenantScope,
+  assertUnfilterableCountAllowed,
+  resolveSingleTenantId,
+  resolveTenantFilter,
+} from '../persistence/policies/tenant.policy.js';
 
 /**
  * Mongoose plugin that provides automatic tenant-based data isolation.
@@ -71,7 +36,7 @@ export function mongooseTenantPlugin(schema) {
   // Only activate on schemas with a tenantId path.
   // CoreTenantMemberModel uses 'tenant' (not 'tenantId') intentionally, so this check
   // excludes it at registration time. Additionally, 'TenantMember' is auto-added to
-  // excludeSchemas in CoreModule as defense-in-depth (see shouldBypass()).
+  // excludeSchemas in CoreModule as defense-in-depth (see isTenantPolicyBypassed() in the tenant policy).
   if (!schema.path('tenantId')) {
     return;
   }
@@ -119,6 +84,19 @@ export function mongooseTenantPlugin(schema) {
     });
   }
 
+  // === After-layer: every returned row must belong to the caller's scope ===
+  // The pre hooks above decide WHICH rows a query may touch; this checks what actually came back, with
+  // the same policy a SQL store applies after its reads. Populated references are checked by their own
+  // model's hooks. Aggregations are not checked here: their output is reshaped and need not carry tenantId.
+  const rowCheckHooks = ['find', 'findOne', 'findOneAndUpdate', 'findOneAndDelete', 'findOneAndReplace'];
+  for (const hookName of rowCheckHooks) {
+    schema.post(hookName, function (result: any) {
+      // includeResultMetadata: findOneAnd* resolves to { value, lastErrorObject, ok }
+      const rows = result && typeof result === 'object' && 'lastErrorObject' in result ? result.value : result;
+      assertRowsInTenantScope(this.model?.modelName, rows);
+    });
+  }
+
   // === Save: set tenantId automatically on new documents ===
   // Intentional asymmetry: writes only set tenantId when truthy (not null).
   // Only uses single tenantId from header — tenantIds array is for reads only.
@@ -194,18 +172,7 @@ export function mongooseTenantPlugin(schema) {
   // collection, i.e. every other tenant's volume. Throwing is the only honest option; callers that
   // want a tenant's own count use countDocuments(), which IS filtered.
   schema.pre('estimatedDocumentCount', function () {
-    const modelName = (this as any).model?.modelName;
-    if (shouldBypass(modelName)) {
-      return;
-    }
-    const context = RequestContext.get();
-    if (context?.isAdminBypass && !context?.tenantId) {
-      return; // platform admin without a tenant header legitimately sees everything
-    }
-    throw new ForbiddenException(
-      "estimatedDocumentCount() cannot be tenant-filtered and would expose other tenants' row counts — " +
-        'use countDocuments() instead',
-    );
+    assertUnfilterableCountAllowed((this as any).model?.modelName);
   });
 
   // === Aggregate: prepend $match stage, and secure every cross-collection stage ===
@@ -340,91 +307,3 @@ function filterForCollection(collectionName: unknown, sourceModel: any): Record<
 
   return undefined;
 }
-
-/**
- * Refuse a tenantId that is not the caller's own.
- *
- * Covers both directions of the same boundary:
- * - creating a row with a FOREIGN tenantId → planting data in someone else's tenant;
- * - changing an existing row's tenantId → moving data out of this one.
- *
- * Throwing rather than overwriting is deliberate. Silently rewriting the value would make a request
- * that asked for something impossible look like it succeeded, and for tenant-scoped medical data
- * "the write went somewhere other than you asked" is not a recoverable ambiguity.
- */
-function assertOwnTenant(value: unknown, ownTenantId: string, isNew: boolean): void {
-  if (value === undefined || value === null || value === ownTenantId) {
-    return;
-  }
-  throw new ForbiddenException(
-    isNew
-      ? `Cannot create a document in a foreign tenant (got "${String(value)}", own tenant is "${ownTenantId}")`
-      : `Cannot move a document to a foreign tenant (got "${String(value)}", own tenant is "${ownTenantId}")`,
-  );
-}
-
-/**
- * Check common bypass conditions.
- *
- * @returns `true` if filtering should be skipped, `false` otherwise
- */
-function shouldBypass(modelName?: string): boolean {
-  const mtConfig = ConfigService.configFastButReadOnly?.multiTenancy;
-  if (!mtConfig || mtConfig.enabled === false) return true;
-
-  const context = RequestContext.get();
-  if (!context) return true;
-  if (context.bypassTenantGuard) return true;
-  if (modelName && mtConfig.excludeSchemas?.includes(modelName)) {
-    warnIsolationDisabled(modelName);
-    return true;
-  }
-
-  return false;
-}
-
-/**
- * Resolve tenant filter from RequestContext for read operations (queries, aggregates).
- *
- * Defense-in-depth: If a schema has tenantId but there is no valid tenant context,
- * throws ForbiddenException instead of returning unfiltered data (Safety Net).
- *
- * @returns
- * - `undefined` → no filter should be applied (bypass active or plugin disabled)
- * - `{}` → empty filter (admin bypass without header — sees all data)
- * - `{ tenantId: string }` → filter by single validated tenant
- * - `{ tenantId: { $in: string[] } }` → filter by user's tenant memberships
- * @throws ForbiddenException when tenantId-schema is accessed without valid tenant context
- */
-function resolveTenantFilter(modelName?: string): Record<string, any> | undefined {
-  if (shouldBypass(modelName)) return undefined;
-
-  const context = RequestContext.get();
-
-  // Validated tenant ID (set by CoreTenantGuard) → filter by it
-  const tenantId = context?.tenantId;
-  if (tenantId) return { tenantId };
-
-  // User has resolved memberships → filter by their tenants
-  const tenantIds = context?.tenantIds;
-  if (tenantIds) return { tenantId: { $in: tenantIds } };
-
-  // Admin bypass without header → no filter, sees all data
-  if (context?.isAdminBypass) return {};
-
-  // SAFETY NET: Schema has tenantId but no valid tenant context.
-  // Throw instead of returning unfiltered data to prevent data leaks.
-  throw new ForbiddenException(
-    'Tenant context required: this data is tenant-scoped but no valid tenant context was provided',
-  );
-}
-
-/**
- * Resolve single tenant ID for write operations (save, insertMany).
- * Only returns a value when a specific tenant header is set.
- */
-function resolveSingleTenantId(modelName?: string): string | undefined {
-  if (shouldBypass(modelName)) return undefined;
-
-  return RequestContext.get()?.tenantId || undefined;
-}