@lenne.tech/nest-server 11.43.3 → 12.1.0

package/src/core/modules/better-auth/better-auth-token.service.ts

@@ -1,9 +1,11 @@
 import { Injectable, Logger, Optional } from '@nestjs/common';
-import { InjectConnection } from '@nestjs/mongoose';
-import { Connection, Types } from 'mongoose';
+import { InjectConnection } from '../../common/persistence/mongo/mongoose-compat.js';
+import type { Connection } from 'mongoose';
 
-import { BetterAuthenticatedUser } from './better-auth.types';
-import { CoreBetterAuthService } from './core-better-auth.service';
+import { BetterAuthenticatedUser } from './better-auth.types.js';
+import { BetterAuthMongoUsers, type IamUserLookup } from './core-better-auth-mongo.users.js';
+import { getBetterAuthSqlStore } from './core-better-auth-sql.registry.js';
+import { CoreBetterAuthService } from './core-better-auth.service.js';
 
 /**
  * Result of token extraction from a request
@@ -95,7 +97,7 @@ export class BetterAuthTokenService {
    * @returns User object with hasRole method, or null if verification fails
    */
   async verifyAndLoadUser(token: string): Promise<BetterAuthenticatedUser | null> {
-    if (!this.betterAuthService || !this.connection) {
+    if (!this.betterAuthService || !this.users()) {
       return null;
     }
 
@@ -152,10 +154,19 @@ export class BetterAuthTokenService {
         }
         return roles.some((role) => userRoles.includes(role));
       },
-      id: (user._id as Types.ObjectId)?.toString() || (user.id as string),
+      // The row's id as a string, whatever the database: MongoDB's `_id`, the column `id` on SQL
+      id: user._id?.toString() || (user.id as string),
     } as BetterAuthenticatedUser;
   }
 
+  /**
+   * Where the app user is looked up: the SQL store when Better-Auth runs on SQL, MongoDB otherwise. Ids stay strings
+   * here — only the MongoDB lookup knows what an ObjectId is.
+   */
+  protected users(): IamUserLookup | undefined {
+    return getBetterAuthSqlStore() ?? (this.connection ? new BetterAuthMongoUsers(this.connection) : undefined);
+  }
+
   /**
    * Loads a user from JWT payload using direct MongoDB query.
    *
@@ -166,23 +177,14 @@ export class BetterAuthTokenService {
     [key: string]: unknown;
     sub: string;
   }): Promise<BetterAuthenticatedUser | null> {
-    if (!this.connection) {
+    const users = this.users();
+    if (!users) {
       return null;
     }
 
     try {
-      const usersCollection = this.connection.collection('users');
-      let user: null | Record<string, unknown> = null;
-
-      // Try to find by MongoDB _id first
-      if (Types.ObjectId.isValid(payload.sub)) {
-        user = await usersCollection.findOne({ _id: new Types.ObjectId(payload.sub) });
-      }
-
-      // If not found, try by iamId
-      if (!user) {
-        user = await usersCollection.findOne({ iamId: payload.sub });
-      }
+      // By the row's id first, then by iamId
+      const user = (await users.findUser({ id: payload.sub })) ?? (await users.findUser({ iamId: payload.sub }));
 
       if (!user) {
         return null;
@@ -207,28 +209,17 @@ export class BetterAuthTokenService {
     email?: string;
     id?: string;
   }): Promise<BetterAuthenticatedUser | null> {
-    if (!this.connection || !sessionUser) {
+    const users = this.users();
+    if (!users || !sessionUser) {
       return null;
     }
 
     try {
-      const usersCollection = this.connection.collection('users');
-      let user: null | Record<string, unknown> = null;
-
-      // Try to find by email (most reliable)
-      if (sessionUser.email) {
-        user = await usersCollection.findOne({ email: sessionUser.email });
-      }
-
-      // If not found by email, try by iamId
-      if (!user && sessionUser.id) {
-        user = await usersCollection.findOne({ iamId: sessionUser.id });
-      }
-
-      // If still not found, try by _id (if the ID looks like a MongoDB ObjectId)
-      if (!user && sessionUser.id && Types.ObjectId.isValid(sessionUser.id)) {
-        user = await usersCollection.findOne({ _id: new Types.ObjectId(sessionUser.id) });
-      }
+      // By email (most reliable), then by iamId, then by the row's id
+      const user =
+        (await users.findUser({ email: sessionUser.email })) ??
+        (await users.findUser({ iamId: sessionUser.id })) ??
+        (await users.findUser({ id: sessionUser.id }));
 
       if (!user) {
         return null;

package/src/core/modules/better-auth/better-auth.config.ts

@@ -1,18 +1,20 @@
 import { passkey } from '@better-auth/passkey';
 import { Logger } from '@nestjs/common';
 import { betterAuth, BetterAuthPlugin } from 'better-auth';
-import { mongodbAdapter } from 'better-auth/adapters/mongodb';
 import { jwt, openAPI, twoFactor } from 'better-auth/plugins';
 import * as crypto from 'crypto';
 import * as fs from 'fs';
 import * as path from 'path';
+import { inspect } from 'util';
 
-import { resolveServerUrls, strippedApiHostname } from '../../common/helpers/cookies.helper';
-import { revalidateWsConnectionsOf } from '../../common/helpers/graphql-ws-connection.helper';
-import { IBetterAuth, ICorsConfig } from '../../common/interfaces/server-options.interface';
-import { ConfigService } from '../../common/services/config.service';
-import { detectCookiePrefixDrift, resolveBetterAuthCookiePrefix } from './better-auth-cookie-prefix.helper';
-import { projectProvidesOpenApiPlugin } from './core-better-auth-openapi.helper';
+import { resolveServerUrls, strippedApiHostname } from '../../common/helpers/cookies.helper.js';
+import { revalidateWsConnectionsOf } from '../../common/helpers/graphql-ws-connection.helper.js';
+import { IBetterAuth, ICorsConfig } from '../../common/interfaces/server-options.interface.js';
+import { ConfigService } from '../../common/services/config.service.js';
+import { detectCookiePrefixDrift, resolveBetterAuthCookiePrefix } from './better-auth-cookie-prefix.helper.js';
+import { withSqlStorage } from './better-auth-sql.helper.js';
+import { projectProvidesOpenApiPlugin } from './core-better-auth-openapi.helper.js';
+import { requireBetterAuthMongoAdapter } from '../../common/persistence/mongo/mongo-packages.js';
 
 /**
  * Type for better-auth instance with plugins
@@ -24,6 +26,48 @@ export type BetterAuthInstance = ReturnType<typeof betterAuth>;
  */
 const logger = new Logger('BetterAuthConfig');
 
+/** Better-Auth's own runtime messages ("Invalid password", blocked CSRF attempts, …). */
+const betterAuthRuntimeLogger = new Logger('BetterAuth');
+
+/**
+ * Better-Auth's `logger.log` handler: its messages go through Nest's logger, so they carry a context and honour
+ * the application's log levels and JSON mode instead of being printed by Better-Auth's own console logger.
+ * Better-Auth still filters by its `level` (default `warn`) before calling this, so what is logged is unchanged.
+ */
+function logThroughNest(level: 'debug' | 'error' | 'info' | 'warn', message: string, ...args: unknown[]): void {
+  const detail = args.length ? ` ${args.map(formatBetterAuthLogArg).join(' ')}` : '';
+  const line = `${message}${detail}`;
+  if (level === 'error') {
+    betterAuthRuntimeLogger.error(line);
+  } else if (level === 'warn') {
+    betterAuthRuntimeLogger.warn(line);
+  } else if (level === 'info') {
+    betterAuthRuntimeLogger.log(line);
+  } else {
+    betterAuthRuntimeLogger.debug(line);
+  }
+}
+
+/**
+ * One argument of a Better-Auth log call as text. Better-Auth passes caught errors here ("Failed to run background
+ * task:", e) — `JSON.stringify` turns an `Error` into `{}`, which threw away the message and stack its own console
+ * logger used to print. A plain object stays compact JSON; one that cannot be serialized (a circular reference)
+ * falls back to `inspect()` instead of making the logger throw inside Better-Auth's error handling.
+ */
+function formatBetterAuthLogArg(arg: unknown): string {
+  if (typeof arg === 'string') {
+    return arg;
+  }
+  if (arg instanceof Error) {
+    return arg.stack ?? `${arg.name}: ${arg.message}`;
+  }
+  try {
+    return JSON.stringify(arg) ?? String(arg);
+  } catch {
+    return inspect(arg, { breakLength: Infinity, depth: 3 });
+  }
+}
+
 // ---------------------------------------------------------------------------
 // Performance-optimized password hashing using Node.js native crypto.scrypt
 //
@@ -112,7 +156,7 @@ export interface CreateBetterAuthOptions {
    * MongoDB database instance
    * Note: Uses 'any' type to handle version incompatibilities between
    * mongoose's bundled mongodb types and the project's mongodb package.
-   * At runtime, this is a mongodb.Db instance.
+   * At runtime, this is a mongodb.Db instance. Unused when `sqlPool` is set.
    */
   db: any;
 
@@ -187,6 +231,13 @@ export interface CreateBetterAuthOptions {
    * Used for local environment defaults.
    */
   serverEnv?: string;
+
+  /**
+   * The `pg` pool of the SQL data source the `users` table lives in (the application role's pool of the configured
+   * engine). Set, Better-Auth runs its built-in Kysely adapter on it instead of MongoDB, with the framework's ids and
+   * table and column names — see `withSqlStorage()`.
+   */
+  sqlPool?: unknown;
 }
 
 /**
@@ -375,7 +426,13 @@ interface PasskeyNormalizationResult {
   trustedOrigins: null | string[];
 
   /**
-   * Warnings generated during normalization
+   * What was auto-detected — information, logged at `log` level. Not a warning: auto-detection is the
+   * intended default, and a WARN on every boot of every project trains people to ignore the real ones.
+   */
+  notices: string[];
+
+  /**
+   * Warnings generated during normalization (something needs attention, e.g. Passkey had to be disabled)
    */
   warnings: string[];
 }
@@ -431,7 +488,31 @@ export interface CreateBetterAuthResult {
   instance: BetterAuthInstance;
 }
 
+/** The options `createBetterAuthInstance()` builds, before Better-Auth is constructed from them */
+export interface BetterAuthOptionsResult {
+  /** Resolved cookie domain for cross-subdomain cookies, or undefined if disabled */
+  cookieDomain: string | undefined;
+  /** What `betterAuth()` receives */
+  options: Record<string, unknown>;
+}
+
 export function createBetterAuthInstance(options: CreateBetterAuthOptions): CreateBetterAuthResult | null {
+  const built = buildBetterAuthOptions(options);
+  return built ? instantiateBetterAuth(built) : null;
+}
+
+/** Construct Better-Auth from built options — a separate step so a SQL schema can be brought up to date in between */
+export function instantiateBetterAuth(built: BetterAuthOptionsResult): CreateBetterAuthResult {
+  // Type assertion needed for maximum flexibility - allows projects to use any Better-Auth option
+  return { cookieDomain: built.cookieDomain, instance: betterAuth(built.options as any) };
+}
+
+/**
+ * Better-Auth's options as `createBetterAuthInstance()` builds them, without constructing Better-Auth: on a SQL data
+ * source its tables must exist before the instance does, because Better-Auth validates its schema as it starts and
+ * reports every missing table as an error.
+ */
+export function buildBetterAuthOptions(options: CreateBetterAuthOptions): BetterAuthOptionsResult | null {
   const {
     config,
     db,
@@ -441,6 +522,7 @@ export function createBetterAuthInstance(options: CreateBetterAuthOptions): Crea
     sendResetPasswordEmail,
     sendVerificationEmail,
     serverEnv,
+    sqlPool,
   } = options;
 
   // Return null only if better-auth is explicitly disabled
@@ -462,7 +544,10 @@ export function createBetterAuthInstance(options: CreateBetterAuthOptions): Crea
   // Passkey is now AUTO-ACTIVATED by default (not opt-in)
   const passkeyNormalization = normalizePasskeyConfig(config, { resolvedUrls, serverEnv });
 
-  // Log passkey normalization warnings (info about auto-detection or disabled status)
+  // Auto-detected values are information; only what needs attention (Passkey disabled) is a warning.
+  for (const notice of passkeyNormalization.notices) {
+    logger.log(notice);
+  }
   for (const warning of passkeyNormalization.warnings) {
     logger.warn(warning);
   }
@@ -530,6 +615,8 @@ export function createBetterAuthInstance(options: CreateBetterAuthOptions): Crea
   const secureCookies = betterAuthBaseUrl.startsWith('https://');
 
   const betterAuthConfig: Record<string, unknown> = {
+    // Through Nest's logger; a project's own `options.logger` is merged over it (see below).
+    logger: { log: logThroughNest },
     advanced: {
       cookiePrefix,
       ...(crossSubDomain.enabled && {
@@ -561,7 +648,7 @@ export function createBetterAuthInstance(options: CreateBetterAuthOptions): Crea
     },
     basePath,
     baseURL: betterAuthBaseUrl,
-    database: mongodbAdapter(db),
+    database: sqlPool ? undefined : (requireBetterAuthMongoAdapter()(db) as any),
     // Enable email/password authentication by default (required by Better-Auth 1.x)
     // Can be disabled by setting config.emailAndPassword.enabled = false
     emailAndPassword: {
@@ -677,6 +764,12 @@ export function createBetterAuthInstance(options: CreateBetterAuthOptions): Crea
     } = config.options as Record<string, unknown>;
     finalConfig = { ...betterAuthConfig, ...restOptions };
 
+    // `logger` is merged, not replaced: a project that only sets `level` or `disabled` keeps the Nest routing,
+    // one that passes its own `log` handler gets exactly that.
+    if (restOptions.logger && typeof restOptions.logger === 'object') {
+      finalConfig.logger = { ...(betterAuthConfig.logger as object), ...(restOptions.logger as object) };
+    }
+
     // `emailAndPassword` needs a DEEP merge, and this one is load-bearing.
     // The block above carries `password: { hash: nativeScryptHash, verify:
     // nativeScryptVerify }` — the hashing every stored credential was created
@@ -750,12 +843,14 @@ export function createBetterAuthInstance(options: CreateBetterAuthOptions): Crea
     finalConfig = betterAuthConfig;
   }
 
-  // Create and return the better-auth instance with resolved metadata
-  // Type assertion needed for maximum flexibility - allows projects to use any Better-Auth option
+  // On SQL the storage is applied last, so the naming also covers fields and plugins `config.options` added
+  if (sqlPool) {
+    finalConfig = withSqlStorage(finalConfig, sqlPool);
+  }
 
   return {
     cookieDomain: crossSubDomain.enabled ? crossSubDomain.domain : undefined,
-    instance: betterAuth(finalConfig as any),
+    options: finalConfig,
   };
 }
 
@@ -977,7 +1072,8 @@ function buildPlugins(
       passkeyOptions.userVerification = normalizedPasskey.userVerification;
     }
     if (normalizedPasskey.webAuthnChallengeCookie) {
-      passkeyOptions.webAuthnChallengeCookie = normalizedPasskey.webAuthnChallengeCookie;
+      // The plugin reads the name from `advanced`; a top-level option is ignored
+      passkeyOptions.advanced = { webAuthnChallengeCookie: normalizedPasskey.webAuthnChallengeCookie };
     }
 
     plugins.push(passkey(passkeyOptions));
@@ -1487,6 +1583,7 @@ function normalizePasskeyConfig(
   options: { resolvedUrls: ResolvedUrls; serverEnv?: string },
 ): PasskeyNormalizationResult {
   const { resolvedUrls, serverEnv } = options;
+  const notices: string[] = [];
   const warnings: string[] = [];
 
   // Check if Passkey is explicitly DISABLED
@@ -1495,7 +1592,7 @@ function normalizePasskeyConfig(
     config.passkey === false || (typeof config.passkey === 'object' && config.passkey?.enabled === false);
 
   if (isExplicitlyDisabled) {
-    return { enabled: false, normalizedConfig: null, trustedOrigins: null, warnings };
+    return { enabled: false, normalizedConfig: null, notices, trustedOrigins: null, warnings };
   }
 
   // Get the raw passkey config (if object)
@@ -1531,18 +1628,18 @@ function normalizePasskeyConfig(
         '  3. Disable Passkey explicitly: passkey: false (no warning)',
     );
 
-    return { enabled: false, normalizedConfig: null, trustedOrigins: null, warnings };
+    return { enabled: false, normalizedConfig: null, notices, trustedOrigins: null, warnings };
   }
 
   // Log auto-detection info
   if (!rawConfig.rpId && resolvedUrls.rpId) {
-    warnings.push(`PASSKEY: Using rpId="${finalRpId}" (auto-detected from appUrl)`);
+    notices.push(`PASSKEY: Using rpId="${finalRpId}" (auto-detected from appUrl)`);
   }
   if (!rawConfig.origin && resolvedUrls.appUrl) {
-    warnings.push(`PASSKEY: Using origin="${finalOrigin}" (= appUrl)`);
+    notices.push(`PASSKEY: Using origin="${finalOrigin}" (= appUrl)`);
   }
   if (!config.trustedOrigins?.length && resolvedUrls.appUrl) {
-    warnings.push(`PASSKEY: Using trustedOrigins=${JSON.stringify(finalTrustedOrigins)} (= [appUrl])`);
+    notices.push(`PASSKEY: Using trustedOrigins=${JSON.stringify(finalTrustedOrigins)} (= [appUrl])`);
   }
 
   // Build normalized config
@@ -1576,6 +1673,7 @@ function normalizePasskeyConfig(
   return {
     enabled: true,
     normalizedConfig,
+    notices,
     trustedOrigins: finalTrustedOrigins,
     warnings,
   };
@@ -1600,7 +1698,10 @@ export interface ResolvedCrossSubDomainCookies {
  * dedicated helper module to avoid pulling the heavy config-builder into the
  * dependency graph (which forces import cycles in some build setups).
  */
-export { resolveBetterAuthCookiePrefix, resolveBetterAuthSessionCookieName } from './better-auth-cookie-prefix.helper';
+export {
+  resolveBetterAuthCookiePrefix,
+  resolveBetterAuthSessionCookieName,
+} from './better-auth-cookie-prefix.helper.js';
 
 /**
  * Resolves the cross-subdomain cookies configuration.

package/src/core/modules/better-auth/better-auth.resolver.ts

@@ -2,21 +2,21 @@ import { Optional } from '@nestjs/common';
 import { Args, Context, Mutation, Query, Resolver } from '@nestjs/graphql';
 import { Request, Response } from 'express';
 
-import { Roles } from '../../common/decorators/roles.decorator';
-import { RoleEnum } from '../../common/enums/role.enum';
-import { CoreBetterAuthAuthModel } from './core-better-auth-auth.model';
-import { CoreBetterAuthEmailVerificationService } from './core-better-auth-email-verification.service';
+import { Roles } from '../../common/decorators/roles.decorator.js';
+import { RoleEnum } from '../../common/enums/role.enum.js';
+import { CoreBetterAuthAuthModel } from './core-better-auth-auth.model.js';
+import { CoreBetterAuthEmailVerificationService } from './core-better-auth-email-verification.service.js';
 import {
   CoreBetterAuth2FASetupModel,
   CoreBetterAuthFeaturesModel,
   CoreBetterAuthPasskeyChallengeModel,
   CoreBetterAuthPasskeyModel,
   CoreBetterAuthSessionModel,
-} from './core-better-auth-models';
-import { CoreBetterAuthSignUpValidatorService } from './core-better-auth-signup-validator.service';
-import { CoreBetterAuthUserMapper } from './core-better-auth-user.mapper';
-import { CoreBetterAuthResolver } from './core-better-auth.resolver';
-import { CoreBetterAuthService } from './core-better-auth.service';
+} from './core-better-auth-models.js';
+import { CoreBetterAuthSignUpValidatorService } from './core-better-auth-signup-validator.service.js';
+import { CoreBetterAuthUserMapper } from './core-better-auth-user.mapper.js';
+import { CoreBetterAuthResolver } from './core-better-auth.resolver.js';
+import { CoreBetterAuthService } from './core-better-auth.service.js';
 
 /**
  * Default BetterAuth GraphQL Resolver

package/src/core/modules/better-auth/better-auth.types.ts

@@ -5,9 +5,9 @@
  * and reduce the need for `as any` casts throughout the codebase.
  */
 
-import { Types } from 'mongoose';
+import type { Types } from 'mongoose';
 
-import { BetterAuthSessionUser } from './core-better-auth-user.mapper';
+import { BetterAuthSessionUser } from './core-better-auth-user.mapper.js';
 
 /**
  * Better-Auth 2FA verification response

package/src/core/modules/better-auth/core-better-auth-api.middleware.ts

@@ -1,16 +1,16 @@
-import { BadRequestException, Injectable, Logger, NestMiddleware, Optional } from '@nestjs/common';
+import { BadRequestException, HttpException, Injectable, Logger, NestMiddleware, Optional } from '@nestjs/common';
 import { Response as ExpressResponse, NextFunction, Request } from 'express';
 
-import { isProduction } from '../../common/helpers/logging.helper';
-import { ConfigService } from '../../common/services/config.service';
-import { CoreBetterAuthChallengeService } from './core-better-auth-challenge.service';
-import { BetterAuthCookieHelper, createCookieHelper } from './core-better-auth-cookie.helper';
-import { wrapBetterAuthErrorResponse } from './core-better-auth-error-codes.helper';
-import { isControllerHandledPath } from './core-better-auth-openapi.helper';
-import { runWithResetPassword } from './core-better-auth-password-reset.registry';
-import { CoreBetterAuthUserMapper } from './core-better-auth-user.mapper';
-import { extractSessionToken, sendWebResponse, signCookieValue, toWebRequest } from './core-better-auth-web.helper';
-import { CoreBetterAuthService } from './core-better-auth.service';
+import { isProduction } from '../../common/helpers/logging.helper.js';
+import { ConfigService } from '../../common/services/config.service.js';
+import { CoreBetterAuthChallengeService } from './core-better-auth-challenge.service.js';
+import { BetterAuthCookieHelper, createCookieHelper } from './core-better-auth-cookie.helper.js';
+import { wrapBetterAuthErrorResponse } from './core-better-auth-error-codes.helper.js';
+import { isControllerHandledPath } from './core-better-auth-openapi.helper.js';
+import { runWithResetPassword } from './core-better-auth-password-reset.registry.js';
+import { CoreBetterAuthUserMapper } from './core-better-auth-user.mapper.js';
+import { extractSessionToken, sendWebResponse, signCookieValue, toWebRequest } from './core-better-auth-web.helper.js';
+import { CoreBetterAuthService } from './core-better-auth.service.js';
 
 /**
  * Native Better-Auth routes that set a NEW password from a token or OTP, with the body
@@ -35,6 +35,43 @@ export const PASSWORD_RESET_PATHS: { field: string; path: string }[] = [
   { field: 'newPassword', path: '/phone-number/reset-password' },
 ];
 
+/**
+ * The other native Better-Auth routes whose body carries a password (Better-Auth 1.7 sources): `verify`
+ * fields are checked against the stored credential, `set` fields become the new one.
+ *
+ * Same reason as above, from the other side. Sign-in normalizes, so a client may send a plaintext or a
+ * sha256 password — but until 12.0.0 these routes were forwarded untouched. A plaintext `password` was then
+ * compared as `scrypt(plaintext)` against `scrypt(sha256(...))`: enabling 2FA, deleting the account or
+ * generating backup codes answered "Invalid password" for the right password. Worse, `change-password` stored
+ * a plaintext `newPassword` as `scrypt(plaintext)` and locked the account out at the next sign-in.
+ * nuxt-extensions hashes in the browser and never noticed; every other client (an app, a script, a test) did.
+ * Normalizing an already-hashed value is a no-op, so hashing clients are unaffected.
+ */
+/**
+ * A request path without trailing slashes and lower-cased — the form the route tables above are matched in.
+ *
+ * A loop, not `path.replace(/\/+$/, '')`: that regex backtracks quadratically on a long run of slashes followed by
+ * another character, and the path comes from an unauthenticated request. A 16 KB path (what Node's header limit
+ * allows) blocked the event loop for ~115 ms per call.
+ */
+export function normalizeIamRoutePath(path: string): string {
+  let end = path.length;
+  while (end > 0 && path.charCodeAt(end - 1) === 47 /* '/' */) {
+    end--;
+  }
+  return path.slice(0, end).toLowerCase();
+}
+
+export const PASSWORD_FIELD_PATHS: { path: string; set: string[]; verify: string[] }[] = [
+  { path: '/change-password', set: ['newPassword'], verify: ['currentPassword'] },
+  { path: '/delete-user', set: [], verify: ['password'] },
+  { path: '/two-factor/disable', set: [], verify: ['password'] },
+  { path: '/two-factor/enable', set: [], verify: ['password'] },
+  { path: '/two-factor/generate-backup-codes', set: [], verify: ['password'] },
+  { path: '/two-factor/get-totp-uri', set: [], verify: ['password'] },
+  { path: '/verify-password', set: [], verify: ['password'] },
+];
+
 /**
  * Passkey paths that generate challenges
  */
@@ -89,7 +126,7 @@ export class CoreBetterAuthApiMiddleware implements NestMiddleware {
     // `===` — so a variant it accepts but this table does not would silently skip BOTH the
     // normalization and the legacy mirror, i.e. reproduce the exact lockout this method exists
     // to prevent, through a URL shape rather than a code change.
-    const normalizedPath = relativePath.replace(/\/+$/, '').toLowerCase();
+    const normalizedPath = normalizeIamRoutePath(relativePath);
     const route = PASSWORD_RESET_PATHS.find((entry) => normalizedPath === entry.path);
     if (!route) {
       return undefined;
@@ -123,6 +160,32 @@ export class CoreBetterAuthApiMiddleware implements NestMiddleware {
     return normalized;
   }
 
+  /**
+   * Brings every other password a native route carries (see {@link PASSWORD_FIELD_PATHS}) to the shape the
+   * stored credential was written in. Matched like {@link normalizeResetPassword}: exact, after trimming a
+   * trailing slash and lower-casing.
+   *
+   * @throws BadRequestException when a plaintext NEW password violates the configured length policy
+   */
+  protected normalizeNativePasswords(req: Request, relativePath: string): void {
+    const normalizedPath = normalizeIamRoutePath(relativePath);
+    const route = PASSWORD_FIELD_PATHS.find((entry) => normalizedPath === entry.path);
+    if (!route || !this.userMapper) {
+      // A missing mapper is reported by normalizeResetPassword() for the routes where it locks accounts out.
+      return;
+    }
+    for (const field of [...route.verify, ...route.set]) {
+      const submitted = req.body?.[field];
+      if (!submitted || typeof submitted !== 'string') {
+        continue;
+      }
+      if (route.set.includes(field)) {
+        this.assertResetPasswordLength(submitted);
+      }
+      req.body[field] = this.userMapper.normalizePasswordForIam(submitted);
+    }
+  }
+
   /**
    * Enforces the configured password length on the value the CLIENT actually sent.
    *
@@ -180,6 +243,17 @@ export class CoreBetterAuthApiMiddleware implements NestMiddleware {
     return this.cookieHelper;
   }
 
+  /**
+   * The passkey challenge cookie as Better-Auth names it: the configured key under the instance's cookie prefix
+   * (`iam.better-auth-passkey` by default). Asked from Better-Auth itself, so the prefix the session cookie follows
+   * (`COOKIE_PREFIX`, the base path) applies here too.
+   */
+  protected async passkeyChallengeCookieName(authInstance: unknown): Promise<string> {
+    const key = this.challengeService?.getCookieName() || 'better-auth-passkey';
+    const context = await (authInstance as { $context?: Promise<any> }).$context;
+    return context?.createAuthCookie?.(key)?.name ?? key;
+  }
+
   /**
    * Check if database challenge storage should be used.
    * This is checked dynamically because the ChallengeService initializes in onModuleInit.
@@ -249,7 +323,8 @@ export class CoreBetterAuthApiMiddleware implements NestMiddleware {
 
       // Get config for cookie signing
       const config = this.betterAuthService.getConfig();
-      const cookieName = this.challengeService?.getCookieName() || 'better-auth.better-auth-passkey';
+      const cookieName =
+        isPasskeyGenerate || isPasskeyVerify ? await this.passkeyChallengeCookieName(authInstance) : '';
 
       // For passkey verify requests with DB storage, inject the verificationToken as a cookie
       let challengeIdToDelete: string | undefined;
@@ -283,6 +358,8 @@ export class CoreBetterAuthApiMiddleware implements NestMiddleware {
       // Put a reset password into the shape sign-in expects BEFORE the body is
       // serialized, and keep the value for the legacy mirror below.
       const resetPassword = this.normalizeResetPassword(req, relativePath);
+      // …and every password a non-reset native route carries (2FA, change-password, delete-user, …).
+      this.normalizeNativePasswords(req, relativePath);
 
       // Convert Express request to Web Standard Request with proper cookie signing
       const webRequest = await toWebRequest(req, {
@@ -458,6 +535,13 @@ export class CoreBetterAuthApiMiddleware implements NestMiddleware {
       // Convert Web Standard Response to Express response using shared helper
       await sendWebResponse(res, response);
     } catch (error) {
+      // A refused request (the password length policy) is an answer, not a handler failure. Nest's middleware
+      // proxy hands a thrown exception to the exception filters, so it is rendered like the same refusal from a
+      // controller: 400 with its message, and no ERROR line. Answering it here as a 500 told the client nothing.
+      if (error instanceof HttpException) {
+        throw error;
+      }
+
       // Log error with appropriate detail level
       if (this.isProd) {
         this.logger.error('Better Auth handler error');

package/src/core/modules/better-auth/core-better-auth-auth.model.ts

@@ -1,8 +1,8 @@
 import { Field, ObjectType } from '@nestjs/graphql';
 
-import { Restricted } from '../../common/decorators/restricted.decorator';
-import { RoleEnum } from '../../common/enums/role.enum';
-import { CoreBetterAuthSessionInfoModel, CoreBetterAuthUserModel } from './core-better-auth-models';
+import { Restricted } from '../../common/decorators/restricted.decorator.js';
+import { RoleEnum } from '../../common/enums/role.enum.js';
+import { CoreBetterAuthSessionInfoModel, CoreBetterAuthUserModel } from './core-better-auth-models.js';
 
 /**
  * Better-Auth Authentication Response Model