@lenne.tech/nest-server 11.43.3 → 12.1.0

package/src/core/modules/api-token/core-api-token.decorators.ts

@@ -1,6 +1,6 @@
 import { SetMetadata } from '@nestjs/common';
 
-import { API_TOKEN_SCOPES_KEY } from './core-api-token.constants';
+import { API_TOKEN_SCOPES_KEY } from './core-api-token.constants.js';
 
 /**
  * Method/class decorator that opens an endpoint to API tokens (`apiTokens` config).

package/src/core/modules/api-token/core-api-token.helpers.ts

@@ -2,19 +2,19 @@ import { createHash, createHmac, randomBytes, timingSafeEqual } from 'node:crypt
 
 import { ForbiddenException, UnauthorizedException } from '@nestjs/common';
 
-import { isForbiddenMembershipRole, RoleEnum } from '../../common/enums/role.enum';
-import { isProductionLikeEnv } from '../../common/helpers/cookies.helper';
-import type { IApiTokens, IMultiTenancy } from '../../common/interfaces/server-options.interface';
-import { ConfigService } from '../../common/services/config.service';
-import { ErrorCode } from '../error-code/error-codes';
-import { DEFAULT_ROLE_HIERARCHY } from '../tenant/core-tenant.enums';
+import { isForbiddenMembershipRole, RoleEnum } from '../../common/enums/role.enum.js';
+import { isProductionLikeEnv } from '../../common/helpers/cookies.helper.js';
+import type { IApiTokens, IMultiTenancy } from '../../common/interfaces/server-options.interface.js';
+import { ConfigService } from '../../common/services/config.service.js';
+import { ErrorCode } from '../error-code/error-codes.js';
+import { DEFAULT_ROLE_HIERARCHY } from '../tenant/core-tenant.enums.js';
 import {
   checkRoleAccess,
   isSystemRole,
   mergeRolesMetadata,
   tenantSatisfiableRoles,
-} from '../tenant/core-tenant.helpers';
-import { API_TOKEN_SCOPES_KEY, ApiTokenKind } from './core-api-token.constants';
+} from '../tenant/core-tenant.helpers.js';
+import { API_TOKEN_SCOPES_KEY, ApiTokenKind } from './core-api-token.constants.js';
 
 // =====================================================================================================================
 // Configuration

package/src/core/modules/api-token/core-api-token.middleware.ts

@@ -1,9 +1,9 @@
 import { HttpException, HttpStatus, Injectable, NestMiddleware, Optional, UnauthorizedException } from '@nestjs/common';
 import { NextFunction, Request, Response } from 'express';
 
-import { ErrorCode } from '../error-code/error-codes';
-import { getApiTokenConfig, getApiTokenContext, readApiTokenCredentialFromHeaders } from './core-api-token.helpers';
-import { CoreApiTokenService } from './core-api-token.service';
+import { ErrorCode } from '../error-code/error-codes.js';
+import { getApiTokenConfig, getApiTokenContext, readApiTokenCredentialFromHeaders } from './core-api-token.helpers.js';
+import { CoreApiTokenService } from './core-api-token.service.js';
 
 /**
  * Authenticates requests that carry an API token or a signed assertion — `Authorization: Bearer …` or

package/src/core/modules/api-token/core-api-token.model.ts

@@ -1,16 +1,16 @@
 import { ObjectType } from '@nestjs/graphql';
-import { Schema } from '@nestjs/mongoose';
-
-import { Restricted } from '../../common/decorators/restricted.decorator';
-import { UnifiedField } from '../../common/decorators/unified-field.decorator';
-import { RoleEnum } from '../../common/enums/role.enum';
-import { accessDeniedException } from '../../common/exceptions/access-denied.exception';
-import { CorePersistenceModel } from '../../common/models/core-persistence.model';
-import { ConfigService } from '../../common/services/config.service';
-import { RequestContext } from '../../common/services/request-context.service';
-import { checkRoleAccess } from '../tenant/core-tenant.helpers';
-import { ApiTokenKind } from './core-api-token.constants';
-import { getApiTokenContext, getApiTokenManageRole } from './core-api-token.helpers';
+import { Schema } from '../../common/persistence/mongo/mongoose-compat.js';
+
+import { Restricted } from '../../common/decorators/restricted.decorator.js';
+import { UnifiedField } from '../../common/decorators/unified-field.decorator.js';
+import { RoleEnum } from '../../common/enums/role.enum.js';
+import { accessDeniedException } from '../../common/exceptions/access-denied.exception.js';
+import { CorePersistenceModel } from '../../common/models/core-persistence.model.js';
+import { ConfigService } from '../../common/services/config.service.js';
+import { RequestContext } from '../../common/services/request-context.service.js';
+import { checkRoleAccess } from '../tenant/core-tenant.helpers.js';
+import { ApiTokenKind } from './core-api-token.constants.js';
+import { getApiTokenContext, getApiTokenManageRole } from './core-api-token.helpers.js';
 
 /**
  * API token (`apiTokens` config): a USER token or a TENANT token, see {@link ApiTokenKind}.

package/src/core/modules/api-token/core-api-token.module.ts

@@ -1,10 +1,11 @@
 import { DynamicModule, Global, MiddlewareConsumer, Module, NestModule, Type } from '@nestjs/common';
-import { MongooseModule, SchemaFactory } from '@nestjs/mongoose';
+import { SchemaFactory } from '../../common/persistence/mongo/mongoose-compat.js';
 
-import { API_TOKEN_MODEL_TOKEN } from './core-api-token.constants';
-import { CoreApiTokenMiddleware } from './core-api-token.middleware';
-import { CoreApiTokenModel } from './core-api-token.model';
-import { CoreApiTokenService } from './core-api-token.service';
+import { CorePersistenceModule } from '../../common/persistence/core-persistence.module.js';
+import { API_TOKEN_MODEL_TOKEN } from './core-api-token.constants.js';
+import { CoreApiTokenMiddleware } from './core-api-token.middleware.js';
+import { CoreApiTokenModel } from './core-api-token.model.js';
+import { CoreApiTokenService } from './core-api-token.service.js';
 
 /**
  * Options for `CoreApiTokenModule.forRoot()`.
@@ -36,7 +37,8 @@ export class CoreApiTokenModule implements NestModule {
     return {
       exports: [CoreApiTokenService],
       global: true,
-      imports: [MongooseModule.forFeature([{ name: API_TOKEN_MODEL_TOKEN, schema }])],
+      // Database-neutral registration: the token model follows `database` like every other model
+      imports: [CorePersistenceModule.forFeature([{ name: API_TOKEN_MODEL_TOKEN, schema }])],
       module: CoreApiTokenModule,
       providers: [{ provide: CoreApiTokenService, useClass: options.service || CoreApiTokenService }],
     };

package/src/core/modules/api-token/core-api-token.service.ts

@@ -11,17 +11,24 @@ import {
   Optional,
   UnauthorizedException,
 } from '@nestjs/common';
-import { InjectConnection, InjectModel } from '@nestjs/mongoose';
-import { Connection, Model, Types } from 'mongoose';
-
-import { RoleEnum } from '../../common/enums/role.enum';
-import { ConfigService } from '../../common/services/config.service';
-import { CoreRedisService } from '../../common/services/core-redis.service';
-import { InMemoryRateLimitStore, RateLimitStore, RedisRateLimitStore } from '../../common/services/rate-limit-store';
-import { ErrorCode } from '../error-code/error-codes';
-import { checkRoleAccess, getRoleHierarchy, resolveGlobalAndTenantRoles } from '../tenant/core-tenant.helpers';
-import { CoreTenantService } from '../tenant/core-tenant.service';
-import { API_TOKEN_MODEL_TOKEN, ApiTokenKind } from './core-api-token.constants';
+import { ModuleRef } from '@nestjs/core';
+import { InjectConnection, InjectModel } from '../../common/persistence/mongo/mongoose-compat.js';
+import type { Connection, Model } from 'mongoose';
+import type { Types } from 'mongoose';
+
+import { RoleEnum } from '../../common/enums/role.enum.js';
+import type { DataStore } from '../../common/persistence/data-store.interface.js';
+import { isWellFormedId } from '../../common/persistence/id-format.js';
+import { getModelDescriptor } from '../../common/persistence/model-metadata.registry.js';
+import { getStoreForModel } from '../../common/persistence/persistence-runtime.registry.js';
+import { getStoreToken } from '../../common/persistence/persistence.tokens.js';
+import { ConfigService } from '../../common/services/config.service.js';
+import { CoreRedisService } from '../../common/services/core-redis.service.js';
+import { InMemoryRateLimitStore, RateLimitStore, RedisRateLimitStore } from '../../common/services/rate-limit-store.js';
+import { ErrorCode } from '../error-code/error-codes.js';
+import { checkRoleAccess, getRoleHierarchy, resolveGlobalAndTenantRoles } from '../tenant/core-tenant.helpers.js';
+import { CoreTenantService } from '../tenant/core-tenant.service.js';
+import { API_TOKEN_MODEL_TOKEN, ApiTokenKind } from './core-api-token.constants.js';
 import {
   assertApiTokenConfigIsUsable,
   attachApiTokenContext,
@@ -41,9 +48,10 @@ import {
   resolveApiTokenEncryptionKey,
   safeEqualHex,
   verifyApiTokenAssertionSignature,
-} from './core-api-token.helpers';
-import { CoreApiTokenModel } from './core-api-token.model';
-import { ApiTokenOwnerIdentity, setApiTokenRevoker } from './core-api-token.registry';
+} from './core-api-token.helpers.js';
+import { CoreApiTokenModel } from './core-api-token.model.js';
+import { ApiTokenOwnerIdentity, setApiTokenRevoker } from './core-api-token.registry.js';
+import { newObjectId } from '../../common/persistence/mongo/mongoose-compat.js';
 
 /** Fields a caller can never set through a create/update input. */
 const PROTECTED_FIELDS = new Set([
@@ -65,6 +73,24 @@ const PROTECTED_FIELDS = new Set([
 ]);
 
 /** User fields never loaded onto a token-authenticated request user. */
+/** Name of the user model whose store a token owner is loaded from on a SQL database */
+const API_TOKEN_USER_MODEL = 'User';
+
+/** A filter built for MongoDB (`_id`) as the neutral filter of a data store (`id`) */
+function toNeutralFilter(filter: Record<string, unknown>): Record<string, unknown> {
+  const { _id, ...rest } = filter;
+  return _id === undefined ? rest : { ...rest, id: String(_id) };
+}
+
+/** A user record without the fields `USER_SECRET_PROJECTION` keeps out of a request user */
+function withoutSecrets(record: Record<string, any>): Record<string, any> {
+  const copy = { ...record };
+  for (const field of Object.keys(USER_SECRET_PROJECTION)) {
+    delete copy[field];
+  }
+  return copy;
+}
+
 const USER_SECRET_PROJECTION = {
   password: 0,
   passwordResetToken: 0,
@@ -161,8 +187,30 @@ export class CoreApiTokenService implements OnModuleDestroy, OnModuleInit {
     @Optional() @InjectConnection() protected readonly connection?: Connection,
     @Optional() protected readonly tenantService?: CoreTenantService,
     @Optional() protected readonly redisService?: CoreRedisService,
+    @Optional() protected readonly moduleRef?: ModuleRef,
   ) {}
 
+  /** The token store when the token model is routed to SQL; `undefined` keeps the Mongoose path (MongoDB) */
+  protected get tokenStore(): DataStore<any> | undefined {
+    const store = getStoreForModel(this.apiTokenModel);
+    return store && !store.capabilities.mongoosePopulate ? store : undefined;
+  }
+
+  /**
+   * The users' store when the user model (`User`) is routed to SQL: a token's owner is loaded from where the users
+   * live. `undefined` keeps the `users` collection, the document Better-Auth and the legacy strategy resolve on MongoDB.
+   * `protected` so a project whose user model has another name can return its store.
+   */
+  protected userStore(): DataStore<any> | undefined {
+    let store: DataStore<any> | undefined;
+    try {
+      store = this.moduleRef?.get(getStoreToken(API_TOKEN_USER_MODEL), { strict: false });
+    } catch {
+      return undefined;
+    }
+    return store && !store.capabilities.mongoosePopulate ? store : undefined;
+  }
+
   onModuleInit(): void {
     assertApiTokenConfigIsUsable();
     // Let the password-reset paths (Better-Auth hook, legacy resetPassword) revoke user tokens
@@ -262,10 +310,13 @@ export class CoreApiTokenService implements OnModuleDestroy, OnModuleInit {
       this.lastUsedWrites.clear();
     }
     this.lastUsedWrites.set(tokenId, now);
-    this.apiTokenModel
-      .updateOne({ _id: tokenId }, { $set: { lastUsedAt: new Date(now) } }, { timestamps: false })
-      .exec()
-      .catch((error: Error) => this.logger.debug(`lastUsedAt update failed: ${error.message}`));
+    const tokens = this.tokenStore;
+    const write = tokens
+      ? tokens.updateById(tokenId, { $set: { lastUsedAt: new Date(now) } }, { timestamps: false })
+      : this.apiTokenModel
+          .updateOne({ _id: tokenId }, { $set: { lastUsedAt: new Date(now) } }, { timestamps: false })
+          .exec();
+    write.catch((error: Error) => this.logger.debug(`lastUsedAt update failed: ${error.message}`));
   }
 
   /** A token that may authenticate right now: known, not revoked, not expired, kind enabled. */
@@ -273,11 +324,14 @@ export class CoreApiTokenService implements OnModuleDestroy, OnModuleInit {
     publicId: string,
     config: IResolvedApiTokenConfig,
   ): Promise<CoreApiTokenModel | null> {
-    const token = (await this.apiTokenModel
-      .findOne({ publicId })
-      .select('+secretHash +signingKeyEncrypted')
-      .lean()
-      .exec()) as (CoreApiTokenModel & { _id: Types.ObjectId }) | null;
+    const tokens = this.tokenStore;
+    const token = (
+      tokens
+        ? await tokens
+            .findOne({ publicId }, { select: Object.keys(getModelDescriptor(tokens.modelName)?.fields ?? {}) })
+            .then((record) => record && { ...record, _id: record.id })
+        : await this.apiTokenModel.findOne({ publicId }).select('+secretHash +signingKeyEncrypted').lean().exec()
+    ) as (CoreApiTokenModel & { _id: Types.ObjectId | string }) | null;
     if (!token || token.revokedAt || (token.expiresAt && new Date(token.expiresAt).getTime() <= Date.now())) {
       return null;
     }
@@ -323,12 +377,15 @@ export class CoreApiTokenService implements OnModuleDestroy, OnModuleInit {
    * `protected` so a project with a different user store can override it.
    */
   protected async loadTokenUser(userId: string): Promise<null | Record<string, any>> {
-    if (!this.connection || !userId || !Types.ObjectId.isValid(userId)) {
+    const users = this.userStore();
+    if ((!users && !this.connection) || !userId || !isWellFormedId(userId)) {
       return null;
     }
-    const doc = await this.connection
-      .collection('users')
-      .findOne({ _id: new Types.ObjectId(userId) }, { projection: USER_SECRET_PROJECTION });
+    const doc = users
+      ? await users.findById(userId).then((record) => record && withoutSecrets({ ...record, _id: record.id }))
+      : await this.connection
+          .collection('users')
+          .findOne({ _id: newObjectId(userId) }, { projection: USER_SECRET_PROJECTION });
     if (!doc) {
       return null;
     }
@@ -425,12 +482,11 @@ export class CoreApiTokenService implements OnModuleDestroy, OnModuleInit {
    * or when the user is blocked. Returns the number of tokens revoked.
    */
   async revokeAllForUser(userId: string): Promise<number> {
-    const result = await this.apiTokenModel
-      .updateMany(
-        { kind: ApiTokenKind.USER, revokedAt: null, user: String(userId) },
-        { $set: { revokedAt: new Date() } },
-      )
-      .exec();
+    const active = { kind: ApiTokenKind.USER, revokedAt: null, user: String(userId) };
+    if (this.tokenStore) {
+      return this.tokenStore.updateMany(active, { $set: { revokedAt: new Date() } });
+    }
+    const result = await this.apiTokenModel.updateMany(active, { $set: { revokedAt: new Date() } }).exec();
     return result.modifiedCount ?? 0;
   }
 
@@ -441,19 +497,25 @@ export class CoreApiTokenService implements OnModuleDestroy, OnModuleInit {
    */
   async revokeAllForOwner(identity: ApiTokenOwnerIdentity): Promise<number> {
     let userId = identity?.userId;
-    if (!userId && this.connection && (identity?.email || identity?.iamId)) {
+    const users = this.userStore();
+    if (!userId && (users || this.connection) && (identity?.email || identity?.iamId)) {
       const or: Record<string, string>[] = [];
       if (identity.email) or.push({ email: identity.email });
       if (identity.iamId) or.push({ iamId: identity.iamId });
-      const doc = await this.connection.collection('users').findOne({ $or: or }, { projection: { _id: 1 } });
-      userId = doc?._id?.toString();
+      userId = users
+        ? (await users.findOne({ $or: or }, { select: ['id'] }))?.id
+        : (await this.connection.collection('users').findOne({ $or: or }, { projection: { _id: 1 } }))?._id?.toString();
     }
     return userId ? this.revokeAllForUser(userId) : 0;
   }
 
   /** Delete every token of a user (system operation, no rights check) — call it when deleting the user. */
   async deleteAllForUser(userId: string): Promise<number> {
-    const result = await this.apiTokenModel.deleteMany({ kind: ApiTokenKind.USER, user: String(userId) }).exec();
+    const owned = { kind: ApiTokenKind.USER, user: String(userId) };
+    if (this.tokenStore) {
+      return this.tokenStore.deleteMany(owned);
+    }
+    const result = await this.apiTokenModel.deleteMany(owned).exec();
     return result.deletedCount ?? 0;
   }
 
@@ -536,6 +598,9 @@ export class CoreApiTokenService implements OnModuleDestroy, OnModuleInit {
     if (!tenantId?.trim()) {
       throw new BadRequestException('tenantId must not be empty');
     }
+    if (this.tokenStore) {
+      return this.tokenStore.deleteMany({ tenant: tenantId });
+    }
     const result = await this.apiTokenModel.deleteMany({ tenant: tenantId }).exec();
     return result.deletedCount ?? 0;
   }
@@ -632,7 +697,7 @@ export class CoreApiTokenService implements OnModuleDestroy, OnModuleInit {
     const config = getApiTokenConfig();
     const { publicId, secret, token } = generateApiToken(config.prefix);
     const signingKey = generateApiTokenSigningKey();
-    const created = await this.apiTokenModel.create({
+    const record = {
       ...document,
       createdBy: String(currentUser.id),
       publicId,
@@ -640,12 +705,18 @@ export class CoreApiTokenService implements OnModuleDestroy, OnModuleInit {
       secretHash: hashApiTokenSecret(secret),
       signingKeyEncrypted: this.encryptSigningKey(signingKey),
       updatedBy: String(currentUser.id),
-    });
+    };
+    if (this.tokenStore) {
+      return { apiToken: this.toInfo(await this.tokenStore.insert(record)), signingKey, token };
+    }
+    const created = await this.apiTokenModel.create(record);
     return { apiToken: this.toInfo(created.toObject()), signingKey, token };
   }
 
   protected async list(filter: Record<string, unknown>): Promise<ApiTokenInfo[]> {
-    const tokens = await this.apiTokenModel.find(filter).sort({ createdAt: -1 }).lean().exec();
+    const tokens = this.tokenStore
+      ? await this.tokenStore.find(toNeutralFilter(filter), { sort: { createdAt: -1 } })
+      : await this.apiTokenModel.find(filter).sort({ createdAt: -1 }).lean().exec();
     return tokens.map((token) => this.toInfo(token));
   }
 
@@ -654,10 +725,10 @@ export class CoreApiTokenService implements OnModuleDestroy, OnModuleInit {
     $set: Record<string, unknown>,
     currentUser: any,
   ): Promise<ApiTokenInfo> {
-    const updated = await this.apiTokenModel
-      .findOneAndUpdate(filter, { $set: { ...$set, updatedBy: String(currentUser.id) } }, { returnDocument: 'after' })
-      .lean()
-      .exec();
+    const update = { $set: { ...$set, updatedBy: String(currentUser.id) } };
+    const updated = this.tokenStore
+      ? await this.tokenStore.updateOne(toNeutralFilter(filter), update)
+      : await this.apiTokenModel.findOneAndUpdate(filter, update, { returnDocument: 'after' }).lean().exec();
     if (!updated) {
       throw new NotFoundException('API token not found');
     }
@@ -665,19 +736,21 @@ export class CoreApiTokenService implements OnModuleDestroy, OnModuleInit {
   }
 
   protected async applyRevoke(filter: Record<string, unknown>, currentUser: any): Promise<ApiTokenInfo> {
-    const revoked = await this.apiTokenModel
-      .findOneAndUpdate(
-        { ...filter, revokedAt: null },
-        { $set: { revokedAt: new Date(), updatedBy: String(currentUser.id) } },
-        { returnDocument: 'after' },
-      )
-      .lean()
-      .exec();
+    const revocation = { $set: { revokedAt: new Date(), updatedBy: String(currentUser.id) } };
+    const tokens = this.tokenStore;
+    const revoked = tokens
+      ? await tokens.updateOne(toNeutralFilter({ ...filter, revokedAt: null }), revocation)
+      : await this.apiTokenModel
+          .findOneAndUpdate({ ...filter, revokedAt: null }, revocation, { returnDocument: 'after' })
+          .lean()
+          .exec();
     if (revoked) {
       return this.toInfo(revoked);
     }
     // Already revoked: answer with the current state rather than an error.
-    const existing = await this.apiTokenModel.findOne(filter).lean().exec();
+    const existing = tokens
+      ? await tokens.findOne(toNeutralFilter(filter))
+      : await this.apiTokenModel.findOne(filter).lean().exec();
     if (!existing) {
       throw new NotFoundException('API token not found');
     }
@@ -685,7 +758,9 @@ export class CoreApiTokenService implements OnModuleDestroy, OnModuleInit {
   }
 
   protected async applyDelete(filter: Record<string, unknown>): Promise<ApiTokenInfo> {
-    const deleted = await this.apiTokenModel.findOneAndDelete(filter).lean().exec();
+    const deleted = this.tokenStore
+      ? await this.tokenStore.deleteOne(toNeutralFilter(filter))
+      : await this.apiTokenModel.findOneAndDelete(filter).lean().exec();
     if (!deleted) {
       throw new NotFoundException('API token not found');
     }
@@ -705,7 +780,7 @@ export class CoreApiTokenService implements OnModuleDestroy, OnModuleInit {
     if (typeof tokenId !== 'string' || !/^[0-9a-f]{24}$/i.test(tokenId)) {
       throw new NotFoundException('API token not found');
     }
-    return new Types.ObjectId(tokenId);
+    return newObjectId(tokenId);
   }
 
   protected commonUpdate(input: IUpdateApiTokenInput, config: IResolvedApiTokenConfig): Record<string, unknown> {

package/src/core/modules/auth/core-auth.controller.ts

@@ -8,26 +8,26 @@ import {
   ApiQuery,
   ApiTooManyRequestsResponse,
 } from '@nestjs/swagger';
-import { Response as ResponseType } from 'express';
+import type { Response as ResponseType } from 'express';
 
-import { ApiCommonErrorResponses } from '../../common/decorators/common-error.decorator';
-import { CurrentUser } from '../../common/decorators/current-user.decorator';
-import { Roles } from '../../common/decorators/roles.decorator';
-import { RoleEnum } from '../../common/enums/role.enum';
-import { setLegacyAuthCookies } from '../../common/helpers/cookies.helper';
-import type { ICookiesConfig } from '../../common/interfaces/server-options.interface';
-import { ConfigService } from '../../common/services/config.service';
-import { AuthGuardStrategy } from './auth-guard-strategy.enum';
-import { CoreAuthModel } from './core-auth.model';
-import { LegacyAuthDisabledException } from './exceptions/legacy-auth-disabled.exception';
-import { AuthGuard } from './guards/auth.guard';
-import { LegacyAuthRateLimitGuard } from './guards/legacy-auth-rate-limit.guard';
-import { isLegacyEndpointEnabled } from './helpers/legacy-endpoints.helper';
-import { CoreAuthSignInInput } from './inputs/core-auth-sign-in.input';
-import { CoreAuthSignUpInput } from './inputs/core-auth-sign-up.input';
-import { ICoreAuthUser } from './interfaces/core-auth-user.interface';
-import { CoreAuthService } from './services/core-auth.service';
-import { Tokens } from './tokens.decorator';
+import { ApiCommonErrorResponses } from '../../common/decorators/common-error.decorator.js';
+import { CurrentUser } from '../../common/decorators/current-user.decorator.js';
+import { Roles } from '../../common/decorators/roles.decorator.js';
+import { RoleEnum } from '../../common/enums/role.enum.js';
+import { setLegacyAuthCookies } from '../../common/helpers/cookies.helper.js';
+import type { ICookiesConfig } from '../../common/interfaces/server-options.interface.js';
+import { ConfigService } from '../../common/services/config.service.js';
+import { AuthGuardStrategy } from './auth-guard-strategy.enum.js';
+import { CoreAuthModel } from './core-auth.model.js';
+import { LegacyAuthDisabledException } from './exceptions/legacy-auth-disabled.exception.js';
+import { AuthGuard } from './guards/auth.guard.js';
+import { LegacyAuthRateLimitGuard } from './guards/legacy-auth-rate-limit.guard.js';
+import { isLegacyEndpointEnabled } from './helpers/legacy-endpoints.helper.js';
+import { CoreAuthSignInInput } from './inputs/core-auth-sign-in.input.js';
+import { CoreAuthSignUpInput } from './inputs/core-auth-sign-up.input.js';
+import type { ICoreAuthUser } from './interfaces/core-auth-user.interface.js';
+import { CoreAuthService } from './services/core-auth.service.js';
+import { Tokens } from './tokens.decorator.js';
 
 /**
  * Authentication controller for REST endpoints

package/src/core/modules/auth/core-auth.model.ts

@@ -1,10 +1,10 @@
 import { ObjectType } from '@nestjs/graphql';
 
-import { Restricted } from '../../common/decorators/restricted.decorator';
-import { UnifiedField } from '../../common/decorators/unified-field.decorator';
-import { RoleEnum } from '../../common/enums/role.enum';
-import { CoreModel } from '../../common/models/core-model.model';
-import { CoreUserModel } from '../user/core-user.model';
+import { Restricted } from '../../common/decorators/restricted.decorator.js';
+import { UnifiedField } from '../../common/decorators/unified-field.decorator.js';
+import { RoleEnum } from '../../common/enums/role.enum.js';
+import { CoreModel } from '../../common/models/core-model.model.js';
+import { CoreUserModel } from '../user/core-user.model.js';
 
 /**
  * CoreAuth model for the response after the sign in

package/src/core/modules/auth/core-auth.module.ts

@@ -4,18 +4,19 @@ import { JwtModule, JwtModuleOptions } from '@nestjs/jwt';
 import { PassportModule } from '@nestjs/passport';
 import { PubSub } from 'graphql-subscriptions';
 
-import { CoreRedisPubSub } from '../../common/services/core-redis-pubsub';
-import { CoreRedisService } from '../../common/services/core-redis.service';
-import { AuthGuardStrategy } from './auth-guard-strategy.enum';
-import { LegacyAuthRateLimitGuard } from './guards/legacy-auth-rate-limit.guard';
-import { RolesGuardRegistry } from './guards/roles-guard-registry';
-import { RolesGuard } from './guards/roles.guard';
-import { CoreAuthUserService } from './services/core-auth-user.service';
-import { CoreAuthService } from './services/core-auth.service';
-import { CoreLegacyAuthDeprecationInitializer } from './core-legacy-auth-deprecation.initializer';
-import { LegacyAuthRateLimiter } from './services/legacy-auth-rate-limiter.service';
-import { JwtRefreshStrategy } from './strategies/jwt-refresh.strategy';
-import { JwtStrategy } from './strategies/jwt.strategy';
+import { CoreRedisPubSub } from '../../common/services/core-redis-pubsub.js';
+import { CoreRedisService } from '../../common/services/core-redis.service.js';
+import { AuthGuardStrategy } from './auth-guard-strategy.enum.js';
+import { LegacyAuthRateLimitGuard } from './guards/legacy-auth-rate-limit.guard.js';
+import { RolesGuardRegistry } from './guards/roles-guard-registry.js';
+import { ROLE_GUARD } from './guards/role-guard.token.js';
+import { RolesGuard } from './guards/roles.guard.js';
+import { CoreAuthUserService } from './services/core-auth-user.service.js';
+import { CoreAuthService } from './services/core-auth.service.js';
+import { CoreLegacyAuthDeprecationInitializer } from './core-legacy-auth-deprecation.initializer.js';
+import { LegacyAuthRateLimiter } from './services/legacy-auth-rate-limiter.service.js';
+import { JwtRefreshStrategy } from './strategies/jwt-refresh.strategy.js';
+import { JwtStrategy } from './strategies/jwt.strategy.js';
 
 /**
  * CoreAuthModule to handle user authentication and enables Roles
@@ -59,6 +60,7 @@ export class CoreAuthModule {
           return [
             RolesGuard, // Register as regular provider first
             { provide: APP_GUARD, useExisting: RolesGuard }, // Reference the registered provider
+            { provide: ROLE_GUARD, useExisting: RolesGuard }, // How CoreTenantGuard reaches it
           ];
         })();
 

package/src/core/modules/auth/core-auth.resolver.ts

@@ -2,25 +2,25 @@ import { UseGuards } from '@nestjs/common';
 import { Args, Context, Mutation, Resolver } from '@nestjs/graphql';
 import { Response as ResponseType } from 'express';
 
-import { CurrentUser } from '../../common/decorators/current-user.decorator';
-import { GraphQLServiceOptions } from '../../common/decorators/graphql-service-options.decorator';
-import { Roles } from '../../common/decorators/roles.decorator';
-import { RoleEnum } from '../../common/enums/role.enum';
-import { setLegacyAuthCookies } from '../../common/helpers/cookies.helper';
-import type { ICookiesConfig } from '../../common/interfaces/server-options.interface';
-import { ServiceOptions } from '../../common/interfaces/service-options.interface';
-import { ConfigService } from '../../common/services/config.service';
-import { AuthGuardStrategy } from './auth-guard-strategy.enum';
-import { CoreAuthModel } from './core-auth.model';
-import { LegacyAuthDisabledException } from './exceptions/legacy-auth-disabled.exception';
-import { AuthGuard } from './guards/auth.guard';
-import { LegacyAuthRateLimitGuard } from './guards/legacy-auth-rate-limit.guard';
-import { isLegacyEndpointEnabled } from './helpers/legacy-endpoints.helper';
-import { CoreAuthSignInInput } from './inputs/core-auth-sign-in.input';
-import { CoreAuthSignUpInput } from './inputs/core-auth-sign-up.input';
-import { ICoreAuthUser } from './interfaces/core-auth-user.interface';
-import { CoreAuthService } from './services/core-auth.service';
-import { Tokens } from './tokens.decorator';
+import { CurrentUser } from '../../common/decorators/current-user.decorator.js';
+import { GraphQLServiceOptions } from '../../common/decorators/graphql-service-options.decorator.js';
+import { Roles } from '../../common/decorators/roles.decorator.js';
+import { RoleEnum } from '../../common/enums/role.enum.js';
+import { setLegacyAuthCookies } from '../../common/helpers/cookies.helper.js';
+import type { ICookiesConfig } from '../../common/interfaces/server-options.interface.js';
+import type { ServiceOptions } from '../../common/interfaces/service-options.interface.js';
+import { ConfigService } from '../../common/services/config.service.js';
+import { AuthGuardStrategy } from './auth-guard-strategy.enum.js';
+import { CoreAuthModel } from './core-auth.model.js';
+import { LegacyAuthDisabledException } from './exceptions/legacy-auth-disabled.exception.js';
+import { AuthGuard } from './guards/auth.guard.js';
+import { LegacyAuthRateLimitGuard } from './guards/legacy-auth-rate-limit.guard.js';
+import { isLegacyEndpointEnabled } from './helpers/legacy-endpoints.helper.js';
+import { CoreAuthSignInInput } from './inputs/core-auth-sign-in.input.js';
+import { CoreAuthSignUpInput } from './inputs/core-auth-sign-up.input.js';
+import type { ICoreAuthUser } from './interfaces/core-auth-user.interface.js';
+import { CoreAuthService } from './services/core-auth.service.js';
+import { Tokens } from './tokens.decorator.js';
 
 /**
  * Authentication resolver for the sign in

package/src/core/modules/auth/core-legacy-auth-deprecation.initializer.ts

@@ -1,8 +1,8 @@
 import { Injectable, Logger, OnApplicationBootstrap, Optional } from '@nestjs/common';
 
-import { ConfigService } from '../../common/services/config.service';
-import { CoreBetterAuthUserMapper } from '../better-auth/core-better-auth-user.mapper';
-import { isLegacyEndpointEnabled } from './helpers/legacy-endpoints.helper';
+import { ConfigService } from '../../common/services/config.service.js';
+import { CoreBetterAuthUserMapper } from '../better-auth/core-better-auth-user.mapper.js';
+import { isLegacyEndpointEnabled } from './helpers/legacy-endpoints.helper.js';
 
 /**
  * Says out loud, once at boot, that this deployment still exposes Legacy Auth.
@@ -25,6 +25,15 @@ import { isLegacyEndpointEnabled } from './helpers/legacy-endpoints.helper';
  * default — the migration has to be finished before the door closes, and only the
  * operator can know when that is.
  */
+/**
+ * Applications already reported on, keyed by their (application-wide, singleton) `ConfigService`.
+ *
+ * The classic legacy server module passes `AuthModule.forRoot()` to `CoreModule.forRoot()` AND imports
+ * `AuthModule.forRoot()` itself, which registers `CoreAuthModule` — and this initializer — twice. Without
+ * this, every warning appeared twice per boot and the collection-scale status read ran twice.
+ */
+const reportedApplications = new WeakSet<object>();
+
 @Injectable()
 export class CoreLegacyAuthDeprecationInitializer implements OnApplicationBootstrap {
   protected readonly logger = new Logger(CoreLegacyAuthDeprecationInitializer.name);
@@ -35,6 +44,11 @@ export class CoreLegacyAuthDeprecationInitializer implements OnApplicationBootst
   ) {}
 
   onApplicationBootstrap(): void {
+    if (reportedApplications.has(this.configService)) {
+      return;
+    }
+    reportedApplications.add(this.configService);
+
     const legacyConfig = this.configService.getFastButReadOnly('auth')?.legacyEndpoints;
     const graphqlOn = isLegacyEndpointEnabled(legacyConfig, 'graphql');
     const restOn = isLegacyEndpointEnabled(legacyConfig, 'rest');