@lenne.tech/nest-server 11.43.3 → 12.1.0

package/src/core/modules/tenant/core-tenant-member.store.ts

@@ -0,0 +1,13 @@
+import type { DataStore } from '../../common/persistence/data-store.interface.js';
+import { getStoreForModel } from '../../common/persistence/persistence-runtime.registry.js';
+
+/**
+ * The store serving the membership model when it is routed to a SQL database; `undefined` on MongoDB, where the
+ * guard and the service keep their Mongoose path unchanged.
+ *
+ * Read from the model INSTANCE the guard and the service were given, so it is the store of their own application.
+ */
+export function routedMemberStore(memberModel: unknown): DataStore<any> | undefined {
+  const store = getStoreForModel(memberModel);
+  return store && !store.capabilities.mongoosePopulate ? store : undefined;
+}

package/src/core/modules/tenant/core-tenant-role.helper.ts

@@ -1,7 +1,7 @@
-import { looksLikeSystemRole } from '../../common/enums/role.enum';
-import { accessDeniedException } from '../../common/exceptions/access-denied.exception';
-import { RequestContext } from '../../common/services/request-context.service';
-import { checkRoleAccess, resolveGlobalAndTenantRoles, tenantSatisfiableRoles } from './core-tenant.helpers';
+import { looksLikeSystemRole } from '../../common/enums/role.enum.js';
+import { accessDeniedException } from '../../common/exceptions/access-denied.exception.js';
+import { RequestContext } from '../../common/services/request-context.service.js';
+import { checkRoleAccess, resolveGlobalAndTenantRoles, tenantSatisfiableRoles } from './core-tenant.helpers.js';
 
 /**
  * Service-level tenant role checks.

package/src/core/modules/tenant/core-tenant.decorators.ts

@@ -1,6 +1,6 @@
 import { createParamDecorator, SetMetadata } from '@nestjs/common';
 
-import { RequestContext } from '../../common/services/request-context.service';
+import { RequestContext } from '../../common/services/request-context.service.js';
 
 /**
  * Metadata key for @SkipTenantCheck() decorator.

package/src/core/modules/tenant/core-tenant.guard.ts

@@ -9,33 +9,39 @@ import {
   Optional,
   UnauthorizedException,
 } from '@nestjs/common';
-import { Reflector } from '@nestjs/core';
+import { ModuleRef, Reflector } from '@nestjs/core';
 import { GqlExecutionContext } from '@nestjs/graphql';
-import { InjectModel } from '@nestjs/mongoose';
-import { Model } from 'mongoose';
+import { InjectModel } from '../../common/persistence/mongo/mongoose-compat.js';
+import type { Model } from 'mongoose';
+import { firstValueFrom, isObservable } from 'rxjs';
 
-import { RoleEnum } from '../../common/enums/role.enum';
-import { resolveGuardRequest } from '../../common/helpers/execution-context-request.helper';
+import { RoleEnum } from '../../common/enums/role.enum.js';
+import { ROLE_GUARD } from '../auth/guards/role-guard.token.js';
+import { resolveGuardRequest } from '../../common/helpers/execution-context-request.helper.js';
 import {
   revalidateAllWsConnections,
   revalidateWsConnectionsForTenant,
   revalidateWsConnectionsOf,
-} from '../../common/helpers/graphql-ws-connection.helper';
-import { ConfigService } from '../../common/services/config.service';
-import { ResolvedTenantContext, setTenantContextResolver } from '../../common/services/core-tenant-context.registry';
-import { CoreRedisService } from '../../common/services/core-redis.service';
-import { ApiTokenKind } from '../api-token/core-api-token.constants';
+} from '../../common/helpers/graphql-ws-connection.helper.js';
+import { DataSourceConfigError } from '../../common/persistence/data-source.config.js';
+import type { DataStore } from '../../common/persistence/data-store.interface.js';
+import { getStoreToken } from '../../common/persistence/persistence.tokens.js';
+import { ConfigService } from '../../common/services/config.service.js';
+import { ResolvedTenantContext, setTenantContextResolver } from '../../common/services/core-tenant-context.registry.js';
+import { CoreRedisService } from '../../common/services/core-redis.service.js';
+import { ApiTokenKind } from '../api-token/core-api-token.constants.js';
 import {
   capApiTokenTenantRole,
   enforceApiTokenRoute,
   getApiTokenContext,
   getApiTokenTenantRestriction,
-} from '../api-token/core-api-token.helpers';
-import { ErrorCode } from '../error-code/error-codes';
-import { CoreTenantMemberModel } from './core-tenant-member.model';
-import { registerActiveTenantGuard } from './core-tenant-guard.registry';
-import { SKIP_TENANT_CHECK_KEY } from './core-tenant.decorators';
-import { TENANT_MEMBER_MODEL_TOKEN, TenantMemberStatus } from './core-tenant.enums';
+} from '../api-token/core-api-token.helpers.js';
+import { ErrorCode } from '../error-code/error-codes.js';
+import { CoreTenantMemberModel } from './core-tenant-member.model.js';
+import { routedMemberStore } from './core-tenant-member.store.js';
+import { registerActiveTenantGuard } from './core-tenant-guard.registry.js';
+import { SKIP_TENANT_CHECK_KEY } from './core-tenant.decorators.js';
+import { TENANT_MEMBER_MODEL_TOKEN, TenantMemberStatus } from './core-tenant.enums.js';
 import {
   checkRoleAccess,
   getMinRequiredLevel,
@@ -44,7 +50,8 @@ import {
   mergeRolesMetadata,
   resolveGlobalAndTenantRoles,
   tenantSatisfiableRoles,
-} from './core-tenant.helpers';
+} from './core-tenant.helpers.js';
+import { isBetterAuthHandlerClass } from '../better-auth/core-better-auth.registry.js';
 
 /**
  * Cached membership entry with TTL
@@ -170,6 +177,7 @@ export class CoreTenantGuard implements CanActivate, OnApplicationBootstrap, OnM
     private readonly reflector: Reflector,
     @InjectModel(TENANT_MEMBER_MODEL_TOKEN) private readonly memberModel: Model<CoreTenantMemberModel>,
     @Optional() protected readonly redisService?: CoreRedisService,
+    @Optional() protected readonly moduleRef?: ModuleRef,
   ) {
     // Clean up expired cache entries every 60 seconds
     this.cleanupInterval = setInterval(() => this.evictExpired(), 60_000);
@@ -188,6 +196,31 @@ export class CoreTenantGuard implements CanActivate, OnApplicationBootstrap, OnM
     this.releaseTenantGuard = registerActiveTenantGuard();
   }
 
+  /**
+   * The data store of a model registered with `CorePersistenceModule.forFeature()` in THIS application, for the
+   * `isTenantActive` hook — the tenant model may live in a SQL database, where `connection` cannot reach it.
+   *
+   * Throws for a model that is not registered that way, never answers `undefined`: the hook decides whether a
+   * deactivated tenant stays locked, and `store('Tenant')?.findById(id)` on an unregistered model would read as
+   * "active" — every tenant open, without a log line. A thrown error refuses the request instead.
+   */
+  protected readonly storeOf = (modelName: string): DataStore<any> => {
+    let store: DataStore<any> | undefined;
+    try {
+      store = this.moduleRef?.get(getStoreToken(modelName), { strict: false });
+    } catch {
+      store = undefined;
+    }
+    if (!store) {
+      throw new DataSourceConfigError(
+        `multiTenancy.isTenantActive asked for the store of '${modelName}', which is not registered with ` +
+          'CorePersistenceModule.forFeature() in this application — register it there, or look the tenant up ' +
+          'through context.connection',
+      );
+    }
+    return store;
+  };
+
   /** Releases this guard's registration (see core-tenant-guard.registry.ts). */
   private releaseTenantGuard?: () => void;
 
@@ -457,6 +490,14 @@ export class CoreTenantGuard implements CanActivate, OnApplicationBootstrap, OnM
       return true;
     }
 
+    // Global guards run in registration order, and CoreModule registers this module AHEAD of a project's AuthModule:
+    // with legacy JWTs (no middleware identifies them) the role guard has not run yet and nobody is on the request.
+    // The documented order is role guard, then tenant guard — so let this application's role guard identify the
+    // caller first. It decides exactly what it would decide right after this guard, so its 401/403 is the answer.
+    if (!request.user) {
+      await this.identifyThroughRoleGuard(context);
+    }
+
     const user = request.user;
     const adminBypass = config.adminBypass !== false;
     const isAdmin = adminBypass && user?.roles?.includes(RoleEnum.ADMIN);
@@ -678,14 +719,11 @@ export class CoreTenantGuard implements CanActivate, OnApplicationBootstrap, OnM
       }
     }
 
-    const memberships = await this.memberModel
-      .find({
-        status: TenantMemberStatus.ACTIVE,
-        user: userId,
-      })
-      .select('tenant role')
-      .lean()
-      .exec();
+    const active = { status: TenantMemberStatus.ACTIVE, user: userId };
+    const memberStore = routedMemberStore(this.memberModel);
+    const memberships = memberStore
+      ? await memberStore.find(active, { select: ['tenant', 'role'] })
+      : await this.memberModel.find(active).select('tenant role').lean().exec();
 
     let ids: string[];
     if (minLevel !== undefined) {
@@ -822,6 +860,32 @@ export class CoreTenantGuard implements CanActivate, OnApplicationBootstrap, OnM
     }
   }
 
+  /**
+   * Run this application's role guard when no caller is identified yet — see canActivate(). A no-op without one (a
+   * custom guard chain) and when the role guard is this guard.
+   */
+  protected async identifyThroughRoleGuard(context: ExecutionContext): Promise<void> {
+    let roleGuard: CanActivate | undefined;
+    try {
+      roleGuard = this.moduleRef?.get<CanActivate>(ROLE_GUARD, { strict: false });
+    } catch {
+      return;
+    }
+    if (roleGuard && roleGuard !== (this as CanActivate)) {
+      const result = roleGuard.canActivate(context);
+      await (isObservable(result) ? firstValueFrom(result) : result);
+    }
+  }
+
+  /** The active membership, from the membership store of the database the model is routed to */
+  private async findActiveMembership(userId: string, tenantId: string): Promise<CoreTenantMemberModel | null> {
+    const where = { status: TenantMemberStatus.ACTIVE, tenant: tenantId, user: userId };
+    const memberStore = routedMemberStore(this.memberModel);
+    return (
+      memberStore ? await memberStore.findOne(where) : await this.memberModel.findOne(where).lean().exec()
+    ) as CoreTenantMemberModel | null;
+  }
+
   /**
    * Look up a membership with process-level TTL cache.
    * Avoids repeated DB queries when the same user accesses the same tenant repeatedly.
@@ -831,10 +895,7 @@ export class CoreTenantGuard implements CanActivate, OnApplicationBootstrap, OnM
 
     // Cache disabled (ttl = 0): always query DB
     if (ttl <= 0) {
-      return this.memberModel
-        .findOne({ status: TenantMemberStatus.ACTIVE, tenant: tenantId, user: userId })
-        .lean()
-        .exec() as Promise<CoreTenantMemberModel | null>;
+      return this.findActiveMembership(userId, tenantId);
     }
 
     const key = `${userId}:${tenantId}`;
@@ -845,14 +906,7 @@ export class CoreTenantGuard implements CanActivate, OnApplicationBootstrap, OnM
       return cached.result;
     }
 
-    const result = (await this.memberModel
-      .findOne({
-        status: TenantMemberStatus.ACTIVE,
-        tenant: tenantId,
-        user: userId,
-      })
-      .lean()
-      .exec()) as CoreTenantMemberModel | null;
+    const result = await this.findActiveMembership(userId, tenantId);
 
     // Only cache positive results (active membership found).
     // Negative results (null) are NOT cached to ensure that:
@@ -927,7 +981,7 @@ export class CoreTenantGuard implements CanActivate, OnApplicationBootstrap, OnM
         return cached.active;
       }
     }
-    const active = (await hook(tenantId, { connection: this.memberModel.db })) !== false;
+    const active = (await hook(tenantId, { connection: this.memberModel.db, store: this.storeOf })) !== false;
     if (ttl > 0) {
       this.evictIfOverCapacity(this.tenantActiveCache);
       this.tenantActiveCache.set(tenantId, { active, expiresAt: now + ttl });
@@ -1025,32 +1079,11 @@ export class CoreTenantGuard implements CanActivate, OnApplicationBootstrap, OnM
    * Check if the current request is handled by a BetterAuth (IAM) handler
    * (controller or resolver). Used for auto-skip tenant check on IAM endpoints.
    *
-   * Uses require() instead of import to avoid a circular dependency:
-   * tenant module → better-auth module (which may depend on tenant module indirectly).
-   * The require() is lazy and resolved only when needed (Node.js caches the result).
+   * Reads the classes from the better-auth registry leaf, where both register themselves as their files load: a
+   * direct import would put tenant and better-auth on an import cycle, and the lazy `require()` this used before
+   * exists only in CommonJS. A handler whose file was never loaded cannot be the current handler anyway.
    */
   private isBetterAuthHandler(context: ExecutionContext): boolean {
-    const handler = context.getClass();
-    try {
-      // eslint-disable-next-line @typescript-eslint/no-require-imports
-      const { CoreBetterAuthController } =
-        require('../better-auth/core-better-auth.controller') as typeof import('../better-auth/core-better-auth.controller');
-      if (handler === CoreBetterAuthController || handler.prototype instanceof CoreBetterAuthController) {
-        return true;
-      }
-    } catch {
-      /* BetterAuth controller not available */
-    }
-    try {
-      // eslint-disable-next-line @typescript-eslint/no-require-imports
-      const { CoreBetterAuthResolver } =
-        require('../better-auth/core-better-auth.resolver') as typeof import('../better-auth/core-better-auth.resolver');
-      if (handler === CoreBetterAuthResolver || handler.prototype instanceof CoreBetterAuthResolver) {
-        return true;
-      }
-    } catch {
-      /* BetterAuth resolver not available */
-    }
-    return false;
+    return isBetterAuthHandlerClass(context.getClass());
   }
 }

package/src/core/modules/tenant/core-tenant.helpers.ts

@@ -1,10 +1,10 @@
 import { Logger } from '@nestjs/common';
 
-import { isForbiddenMembershipRole, isGlobalOnlyRole, looksLikeSystemRole } from '../../common/enums/role.enum';
-import { ConfigService } from '../../common/services/config.service';
-import { RoleScope, roleScopeRegistry, RoleScopeSource } from './core-role-scope.registry';
-import { hasActiveTenantGuard } from './core-tenant-guard.registry';
-import { DEFAULT_ROLE_HIERARCHY } from './core-tenant.enums';
+import { isForbiddenMembershipRole, isGlobalOnlyRole, looksLikeSystemRole } from '../../common/enums/role.enum.js';
+import { ConfigService } from '../../common/services/config.service.js';
+import { RoleScope, roleScopeRegistry, RoleScopeSource } from './core-role-scope.registry.js';
+import { hasActiveTenantGuard } from './core-tenant-guard.registry.js';
+import { DEFAULT_ROLE_HIERARCHY } from './core-tenant.enums.js';
 
 /**
  * Merge handler-level and class-level @Roles() metadata arrays into a single flat array.
@@ -37,7 +37,7 @@ export {
   looksLikeGlobalOnlyRole,
   looksLikeSystemRole,
   SYSTEM_ROLE_PREFIX,
-} from '../../common/enums/role.enum';
+} from '../../common/enums/role.enum.js';
 
 /**
  * Feeds the role-scope registry from `multiTenancy` config.

package/src/core/modules/tenant/core-tenant.module.ts

@@ -1,15 +1,16 @@
 import { CanActivate, DynamicModule, Global, Module, OnModuleDestroy, OnModuleInit, Type } from '@nestjs/common';
 import { APP_GUARD } from '@nestjs/core';
-import { MongooseModule, SchemaFactory, getModelToken } from '@nestjs/mongoose';
-import { Model } from 'mongoose';
+import { getModelToken, SchemaFactory } from '../../common/persistence/mongo/mongoose-compat.js';
+import type { Model } from 'mongoose';
 
-import { roleScopeRegistry } from './core-role-scope.registry';
-import { registerActiveTenantGuard } from './core-tenant-guard.registry';
-import { CoreTenantMemberModel } from './core-tenant-member.model';
-import { TENANT_MEMBER_MODEL_TOKEN } from './core-tenant.enums';
-import { assertRoleVocabularyIsCoherent, configRoleScopeSource } from './core-tenant.helpers';
-import { CoreTenantGuard } from './core-tenant.guard';
-import { CoreTenantService } from './core-tenant.service';
+import { CorePersistenceModule } from '../../common/persistence/core-persistence.module.js';
+import { roleScopeRegistry } from './core-role-scope.registry.js';
+import { registerActiveTenantGuard } from './core-tenant-guard.registry.js';
+import { CoreTenantMemberModel } from './core-tenant-member.model.js';
+import { TENANT_MEMBER_MODEL_TOKEN } from './core-tenant.enums.js';
+import { assertRoleVocabularyIsCoherent, configRoleScopeSource } from './core-tenant.helpers.js';
+import { CoreTenantGuard } from './core-tenant.guard.js';
+import { CoreTenantService } from './core-tenant.service.js';
 
 /**
  * Options for CoreTenantModule.forRoot().
@@ -127,7 +128,9 @@ export class CoreTenantModule implements OnModuleDestroy, OnModuleInit {
     return {
       exports: [CoreTenantService],
       global: true,
-      imports: [MongooseModule.forFeature([{ name: modelName, schema: memberSchema }])],
+      // Database-neutral registration: the membership model follows `database` like every other model, and the guard
+      // and the service switch to its store when it is routed to a SQL database
+      imports: [CorePersistenceModule.forFeature([{ name: modelName, schema: memberSchema }])],
       module: CoreTenantModule,
       providers,
     };

package/src/core/modules/tenant/core-tenant.service.ts

@@ -1,13 +1,15 @@
 import { BadRequestException, Injectable, Logger, NotFoundException, Optional } from '@nestjs/common';
-import { InjectModel } from '@nestjs/mongoose';
-import { Model } from 'mongoose';
+import { InjectModel } from '../../common/persistence/mongo/mongoose-compat.js';
+import type { Model } from 'mongoose';
 
-import { looksLikeGlobalOnlyRole, looksLikeSystemRole, SYSTEM_ROLE_PREFIX } from '../../common/enums/role.enum';
-import { ConfigService } from '../../common/services/config.service';
-import { RequestContext } from '../../common/services/request-context.service';
-import { CoreTenantMemberModel } from './core-tenant-member.model';
-import { DEFAULT_ROLE_HIERARCHY, TENANT_MEMBER_MODEL_TOKEN, TenantMemberStatus } from './core-tenant.enums';
-import { CoreTenantGuard } from './core-tenant.guard';
+import { looksLikeGlobalOnlyRole, looksLikeSystemRole, SYSTEM_ROLE_PREFIX } from '../../common/enums/role.enum.js';
+import type { DataStore } from '../../common/persistence/data-store.interface.js';
+import { ConfigService } from '../../common/services/config.service.js';
+import { RequestContext } from '../../common/services/request-context.service.js';
+import { CoreTenantMemberModel } from './core-tenant-member.model.js';
+import { routedMemberStore } from './core-tenant-member.store.js';
+import { DEFAULT_ROLE_HIERARCHY, TENANT_MEMBER_MODEL_TOKEN, TenantMemberStatus } from './core-tenant.enums.js';
+import { CoreTenantGuard } from './core-tenant.guard.js';
 
 /**
  * Core service for tenant membership operations.
@@ -37,6 +39,11 @@ export class CoreTenantService {
     @Optional() protected readonly tenantGuard?: CoreTenantGuard,
   ) {}
 
+  /** The membership store when the model is routed to SQL; `undefined` keeps the Mongoose path (MongoDB) */
+  protected get memberStore(): DataStore<any> | undefined {
+    return routedMemberStore(this.memberModel);
+  }
+
   /**
    * Get the configured role hierarchy.
    */
@@ -68,6 +75,11 @@ export class CoreTenantService {
    * Find all active tenant memberships for a user.
    */
   async findMemberships(userId: string): Promise<CoreTenantMemberModel[]> {
+    if (this.memberStore) {
+      return this.memberStore.find({ status: TenantMemberStatus.ACTIVE, user: userId }) as Promise<
+        CoreTenantMemberModel[]
+      >;
+    }
     return this.memberModel.find({ status: TenantMemberStatus.ACTIVE, user: userId }).lean().exec() as Promise<
       CoreTenantMemberModel[]
     >;
@@ -92,6 +104,9 @@ export class CoreTenantService {
    * For an authorization check use {@link getActiveMembership}.
    */
   async getMembership(tenantId: string, userId: string): Promise<CoreTenantMemberModel | null> {
+    if (this.memberStore) {
+      return this.memberStore.findOne({ tenant: tenantId, user: userId }) as Promise<CoreTenantMemberModel | null>;
+    }
     return this.memberModel
       .findOne({ tenant: tenantId, user: userId })
       .lean()
@@ -111,10 +126,11 @@ export class CoreTenantService {
       return null;
     }
 
-    return this.memberModel
-      .findOne({ status: TenantMemberStatus.ACTIVE, tenant: tenantId, user: userId })
-      .lean()
-      .exec() as Promise<CoreTenantMemberModel | null>;
+    const where = { status: TenantMemberStatus.ACTIVE, tenant: tenantId, user: userId };
+    if (this.memberStore) {
+      return this.memberStore.findOne(where) as Promise<CoreTenantMemberModel | null>;
+    }
+    return this.memberModel.findOne(where).lean().exec() as Promise<CoreTenantMemberModel | null>;
   }
 
   /**
@@ -146,33 +162,40 @@ export class CoreTenantService {
       }
       // Reactivate suspended/invited membership
       return RequestContext.runWithBypassTenantGuard(async () => {
-        const result = (await this.memberModel
-          .findOneAndUpdate(
-            { tenant: tenantId, user: userId },
-            {
-              invitedBy: invitedById,
-              joinedAt: new Date(),
-              role: effectiveRole,
-              status: TenantMemberStatus.ACTIVE,
-            },
-            { returnDocument: 'after' },
-          )
-          .lean()
-          .exec()) as CoreTenantMemberModel;
+        const reactivation = {
+          invitedBy: invitedById,
+          joinedAt: new Date(),
+          role: effectiveRole,
+          status: TenantMemberStatus.ACTIVE,
+        };
+        const result = (
+          this.memberStore
+            ? await this.memberStore.updateOne({ tenant: tenantId, user: userId }, reactivation)
+            : await this.memberModel
+                .findOneAndUpdate({ tenant: tenantId, user: userId }, reactivation, { returnDocument: 'after' })
+                .lean()
+                .exec()
+        ) as CoreTenantMemberModel;
         this.tenantGuard?.invalidateUser(userId);
         return result;
       });
     }
 
     return RequestContext.runWithBypassTenantGuard(async () => {
-      const doc = await this.memberModel.create({
+      const member = {
         invitedBy: invitedById,
         joinedAt: new Date(),
         role: effectiveRole,
         status: TenantMemberStatus.ACTIVE,
         tenant: tenantId,
         user: userId,
-      });
+      };
+      if (this.memberStore) {
+        const created = await this.memberStore.insert(member);
+        this.tenantGuard?.invalidateUser(userId);
+        return created as CoreTenantMemberModel;
+      }
+      const doc = await this.memberModel.create(member);
       this.tenantGuard?.invalidateUser(userId);
       return doc.toObject() as CoreTenantMemberModel;
     });
@@ -192,14 +215,13 @@ export class CoreTenantService {
     await this.assertNotLastOwner(tenantId, userId);
 
     return RequestContext.runWithBypassTenantGuard(async () => {
-      const result = await this.memberModel
-        .findOneAndUpdate(
-          { status: TenantMemberStatus.ACTIVE, tenant: tenantId, user: userId },
-          { status: TenantMemberStatus.SUSPENDED },
-          { returnDocument: 'after' },
-        )
-        .lean()
-        .exec();
+      const where = { status: TenantMemberStatus.ACTIVE, tenant: tenantId, user: userId };
+      const result = this.memberStore
+        ? await this.memberStore.updateOne(where, { status: TenantMemberStatus.SUSPENDED })
+        : await this.memberModel
+            .findOneAndUpdate(where, { status: TenantMemberStatus.SUSPENDED }, { returnDocument: 'after' })
+            .lean()
+            .exec();
 
       if (!result) {
         throw new NotFoundException('Membership not found');
@@ -237,14 +259,10 @@ export class CoreTenantService {
     }
 
     return RequestContext.runWithBypassTenantGuard(async () => {
-      const result = await this.memberModel
-        .findOneAndUpdate(
-          { status: TenantMemberStatus.ACTIVE, tenant: tenantId, user: userId },
-          { role },
-          { returnDocument: 'after' },
-        )
-        .lean()
-        .exec();
+      const where = { status: TenantMemberStatus.ACTIVE, tenant: tenantId, user: userId };
+      const result = this.memberStore
+        ? await this.memberStore.updateOne(where, { role })
+        : await this.memberModel.findOneAndUpdate(where, { role }, { returnDocument: 'after' }).lean().exec();
 
       if (!result) {
         throw new NotFoundException('Active membership not found');
@@ -267,11 +285,10 @@ export class CoreTenantService {
     const highestRole = this.getHighestRole();
 
     return RequestContext.runWithBypassTenantGuard(async () => {
-      const ownerCount = await this.memberModel.countDocuments({
-        role: highestRole,
-        status: TenantMemberStatus.ACTIVE,
-        tenant: tenantId,
-      });
+      const owners = { role: highestRole, status: TenantMemberStatus.ACTIVE, tenant: tenantId };
+      const ownerCount = this.memberStore
+        ? await this.memberStore.count(owners)
+        : await this.memberModel.countDocuments(owners);
 
       if (ownerCount <= 1) {
         const membership = await this.getActiveMembership(tenantId, userId);

package/src/core/modules/tus/core-tus.controller.ts

@@ -1,11 +1,11 @@
 import { All, Controller, Logger, Options, Req, Res } from '@nestjs/common';
-import { Request, Response } from 'express';
+import type { Request, Response } from 'express';
 
-import { ApiMethods } from '../../common/decorators/api-methods.decorator';
-import { Roles } from '../../common/decorators/roles.decorator';
-import { RoleEnum } from '../../common/enums/role.enum';
-import { SkipTenantCheck } from '../tenant/core-tenant.decorators';
-import { CoreTusService } from './core-tus.service';
+import { ApiMethods } from '../../common/decorators/api-methods.decorator.js';
+import { Roles } from '../../common/decorators/roles.decorator.js';
+import { RoleEnum } from '../../common/enums/role.enum.js';
+import { SkipTenantCheck } from '../tenant/core-tenant.decorators.js';
+import { CoreTusService } from './core-tus.service.js';
 
 /**
  * Core TUS Controller

package/src/core/modules/tus/core-tus.service.ts

@@ -3,32 +3,31 @@ import { ModuleRef } from '@nestjs/core';
 import { FileStore } from '@tus/file-store';
 import { Server, Upload } from '@tus/server';
 import * as fs from 'fs';
-import { Connection, mongo } from 'mongoose';
+import type { Connection } from 'mongoose';
+import type { mongo } from 'mongoose';
 import * as path from 'path';
 import { Readable } from 'stream';
 
-import { GridFSHelper } from '../../common/helpers/gridfs.helper';
-import { ITusConfig } from '../../common/interfaces/server-options.interface';
-import { buildCorsConfig } from '../../common/helpers/cookies.helper';
-import { ConfigService } from '../../common/services/config.service';
-import { CoreRedisService } from '../../common/services/core-redis.service';
-import { CoreS3Service } from '../../common/services/core-s3.service';
-import { getTenantContextResolver } from '../../common/services/core-tenant-context.registry';
-import { resolveFileStorage } from '../file/file-storage.helper';
-import {
-  DEFAULT_FILESYSTEM_DIR,
-  FILESYSTEM_FILES_COLLECTION,
-  FilesystemFileHelper,
-} from '../file/filesystem-file.helper';
-import { S3_FILES_COLLECTION, S3FileHelper } from '../file/s3-file.helper';
-import { TUS_FILE_ID_HEADER, TUS_OWNER_METADATA_KEY, TUS_TENANT_METADATA_KEY } from './tus.constants';
-import { TusRedisLocker } from './tus-redis-locker';
+import { GridFSHelper } from '../../common/helpers/gridfs.helper.js';
+import { ITusConfig } from '../../common/interfaces/server-options.interface.js';
+import { buildCorsConfig } from '../../common/helpers/cookies.helper.js';
+import { ConfigService } from '../../common/services/config.service.js';
+import { CoreRedisService } from '../../common/services/core-redis.service.js';
+import { CoreS3Service } from '../../common/services/core-s3.service.js';
+import { getTenantContextResolver } from '../../common/services/core-tenant-context.registry.js';
+import { fileMetadataCollection } from '../file/file-metadata.store.js';
+import { resolveFileStorage } from '../file/file-storage.helper.js';
+import { DEFAULT_FILESYSTEM_DIR, FilesystemFileHelper } from '../file/filesystem-file.helper.js';
+import { S3FileHelper } from '../file/s3-file.helper.js';
+import { TUS_FILE_ID_HEADER, TUS_OWNER_METADATA_KEY, TUS_TENANT_METADATA_KEY } from './tus.constants.js';
+import { TusRedisLocker } from './tus-redis-locker.js';
 import {
   DEFAULT_TUS_ALLOWED_HEADERS,
   DEFAULT_TUS_CONFIG,
   normalizeTusConfig,
   parseExpirationTime,
-} from './interfaces/tus-config.interface';
+} from './interfaces/tus-config.interface.js';
+import { createGridFsBucket } from '../../common/persistence/mongo/mongoose-compat.js';
 
 /**
  * Optional dependencies of CoreTusService.
@@ -141,8 +140,8 @@ export class CoreTusService implements OnModuleDestroy, OnModuleInit {
       return;
     }
 
-    // Initialize GridFS bucket
-    this.files = new mongo.GridFSBucket(this.connection.db, { bucketName: 'fs' });
+    // Initialize GridFS bucket — where MongoDB is connected; finished uploads go to GridFS only on that driver
+    this.files = this.connection?.db ? createGridFsBucket(this.connection.db, { bucketName: 'fs' }) : undefined;
 
     // Ensure upload directory exists
     const uploadDir = this.config.uploadDir || DEFAULT_TUS_CONFIG.uploadDir;
@@ -233,7 +232,7 @@ export class CoreTusService implements OnModuleDestroy, OnModuleInit {
       if (this.canCopyWithinS3(upload)) {
         const fileInfo = await S3FileHelper.copyFile(
           this.options.s3Service,
-          this.connection.db.collection(S3_FILES_COLLECTION),
+          fileMetadataCollection(this.connection, 's3'),
           {
             contentLength: upload.size,
             contentType,
@@ -260,14 +259,14 @@ export class CoreTusService implements OnModuleDestroy, OnModuleInit {
       if (this.fileStorageDriver === 'filesystem') {
         fileInfo = await FilesystemFileHelper.writeFile(
           this.fileStorageDir,
-          this.connection.db.collection(FILESYSTEM_FILES_COLLECTION),
+          fileMetadataCollection(this.connection, 'filesystem'),
           { body: readStream, contentType, filename, metadata: fileMetadata },
         );
         this.logger.debug(`Upload ${upload.id} migrated to the filesystem as ${fileInfo._id} (filename: ${filename})`);
       } else if (this.s3FileStorage) {
         fileInfo = await S3FileHelper.writeFile(
           this.options.s3Service,
-          this.connection.db.collection(S3_FILES_COLLECTION),
+          fileMetadataCollection(this.connection, 's3'),
           // Streamed with the length TUS already knows, so a multi-GB resumable upload is never
           // materialised in memory.
           { body: readStream, contentLength: upload.size, contentType, filename, metadata: fileMetadata },