@lenne.tech/nest-server 11.43.3 → 12.1.0

package/src/core/modules/tus/index.ts

@@ -1,6 +1,6 @@
 // TUS Module exports
-export * from './core-tus.controller';
-export * from './core-tus.service';
-export * from './interfaces/tus-config.interface';
-export * from './tus.constants';
-export * from './tus.module';
+export * from './core-tus.controller.js';
+export * from './core-tus.service.js';
+export * from './interfaces/tus-config.interface.js';
+export * from './tus.constants.js';
+export * from './tus.module.js';

package/src/core/modules/tus/interfaces/tus-config.interface.ts

@@ -4,15 +4,15 @@
  * The interfaces are defined in server-options.interface.ts to avoid circular imports.
  * This file contains helper functions and defaults.
  */
-import { RoleEnum } from '../../../common/enums/role.enum';
-import { ITusConfig, ITusExpirationConfig } from '../../../common/interfaces/server-options.interface';
+import { RoleEnum } from '../../../common/enums/role.enum.js';
+import type { ITusConfig, ITusExpirationConfig } from '../../../common/interfaces/server-options.interface.js';
 
-// Re-export for convenience
-export {
+// Re-export for convenience (type-only: an `export { … }` of a type is a value re-export in ESM and fails to link)
+export type {
   ITusConfig,
   ITusCreationConfig,
   ITusExpirationConfig,
-} from '../../../common/interfaces/server-options.interface';
+} from '../../../common/interfaces/server-options.interface.js';
 
 /**
  * Additional allowed headers for TUS requests (beyond @tus/server defaults).

package/src/core/modules/tus/tus-redis-locker.ts

@@ -1,7 +1,7 @@
 import { Logger } from '@nestjs/common';
 import { randomUUID } from 'node:crypto';
 
-import { CoreRedisService } from '../../common/services/core-redis.service';
+import { CoreRedisService } from '../../common/services/core-redis.service.js';
 
 /** Release callback handed to the current lock holder when someone else wants the resource */
 type RequestRelease = () => Promise<void> | void;

package/src/core/modules/tus/tus.module.ts

@@ -1,17 +1,17 @@
 import { DynamicModule, Global, Logger, Module, OnModuleInit, Type } from '@nestjs/common';
 import { PATH_METADATA } from '@nestjs/common/constants';
 import { ModuleRef } from '@nestjs/core';
-import { getConnectionToken } from '@nestjs/mongoose';
-import { Connection } from 'mongoose';
+import { getConnectionToken } from '../../common/persistence/mongo/mongoose-compat.js';
+import type { Connection } from 'mongoose';
 
-import { ITusConfig } from '../../common/interfaces/server-options.interface';
-import { ConfigService } from '../../common/services/config.service';
-import { CoreRedisService } from '../../common/services/core-redis.service';
-import { CoreS3Service } from '../../common/services/core-s3.service';
-import { CoreTusController } from './core-tus.controller';
-import { CoreTusService } from './core-tus.service';
-import { TUS_CONFIG } from './tus.constants';
-import { DEFAULT_TUS_CONFIG, normalizeTusConfig } from './interfaces/tus-config.interface';
+import { ITusConfig } from '../../common/interfaces/server-options.interface.js';
+import { ConfigService } from '../../common/services/config.service.js';
+import { CoreRedisService } from '../../common/services/core-redis.service.js';
+import { CoreS3Service } from '../../common/services/core-s3.service.js';
+import { CoreTusController } from './core-tus.controller.js';
+import { CoreTusService } from './core-tus.service.js';
+import { TUS_CONFIG } from './tus.constants.js';
+import { DEFAULT_TUS_CONFIG, normalizeTusConfig } from './interfaces/tus-config.interface.js';
 
 /**
  * @deprecated Import from `./tus.constants` instead. Re-exported only so existing deep imports keep
@@ -20,7 +20,7 @@ import { DEFAULT_TUS_CONFIG, normalizeTusConfig } from './interfaces/tus-config.
  *
  * Do NOT import it from here inside the TUS module itself — that is what re-creates the cycle.
  */
-export { TUS_CONFIG } from './tus.constants';
+export { TUS_CONFIG } from './tus.constants.js';
 
 /**
  * Options for TusModule.forRoot()

package/src/core/modules/user/core-user.model.ts

@@ -1,13 +1,13 @@
 import { ObjectType } from '@nestjs/graphql';
-import { Schema as MongooseSchema, Prop, raw } from '@nestjs/mongoose';
+import { Prop, raw, Schema as MongooseSchema } from '../../common/persistence/mongo/mongoose-compat.js';
 import { ApiExtraModels, ApiProperty } from '@nestjs/swagger';
-import { Document } from 'mongoose';
+import type { Document } from 'mongoose';
 
-import { Restricted } from '../../common/decorators/restricted.decorator';
-import { UnifiedField } from '../../common/decorators/unified-field.decorator';
-import { RoleEnum } from '../../common/enums/role.enum';
-import { CorePersistenceModel } from '../../common/models/core-persistence.model';
-import { CoreTokenData } from '../auth/interfaces/core-token-data.interface';
+import { Restricted } from '../../common/decorators/restricted.decorator.js';
+import { UnifiedField } from '../../common/decorators/unified-field.decorator.js';
+import { RoleEnum } from '../../common/enums/role.enum.js';
+import { CorePersistenceModel } from '../../common/models/core-persistence.model.js';
+import { CoreTokenData } from '../auth/interfaces/core-token-data.interface.js';
 
 export type CoreUserModelDocument = CoreUserModel & Document;
 

package/src/core/modules/user/core-user.service.ts

@@ -1,26 +1,27 @@
 import { BadRequestException, Logger, NotFoundException, UnprocessableEntityException } from '@nestjs/common';
-import bcrypt = require('bcrypt');
-import crypto = require('crypto');
+import bcrypt from 'bcrypt';
+import * as crypto from 'crypto';
 import { sha256 } from 'js-sha256';
-import { Document, Model } from 'mongoose';
-
-import { looksLikeSystemRole, SYSTEM_ROLE_PREFIX } from '../../common/enums/role.enum';
-import { accessDeniedException } from '../../common/exceptions/access-denied.exception';
-import { resolveAppUrlFromConfig } from '../../common/helpers/cookies.helper';
-import { revalidateWsConnectionsOf } from '../../common/helpers/graphql-ws-connection.helper';
-import { maskEmail } from '../../common/helpers/logging.helper';
-import { assignPlain, isQueryableString, prepareServiceOptionsForCreate } from '../../common/helpers/input.helper';
-import { ServiceOptions } from '../../common/interfaces/service-options.interface';
-import { ConfigService } from '../../common/services/config.service';
-import { CrudService } from '../../common/services/crud.service';
-import { ErrorCode } from '../error-code/error-codes';
-import { EmailService } from '../../common/services/email.service';
-import { revokeApiTokensOfUser } from '../api-token/core-api-token.registry';
-import { CoreModelConstructor } from '../../common/types/core-model-constructor.type';
-import { CoreUserModel } from './core-user.model';
-import { CoreUserCreateInput } from './inputs/core-user-create.input';
-import { CoreUserInput } from './inputs/core-user.input';
-import { CoreUserServiceOptions } from './interfaces/core-user-service-options.interface';
+import type { Document, Model } from 'mongoose';
+
+import { looksLikeSystemRole, SYSTEM_ROLE_PREFIX } from '../../common/enums/role.enum.js';
+import { accessDeniedException } from '../../common/exceptions/access-denied.exception.js';
+import { resolveAppUrlFromConfig } from '../../common/helpers/cookies.helper.js';
+import { revalidateWsConnectionsOf } from '../../common/helpers/graphql-ws-connection.helper.js';
+import { maskEmail } from '../../common/helpers/logging.helper.js';
+import { assignPlain, isQueryableString, prepareServiceOptionsForCreate } from '../../common/helpers/input.helper.js';
+import { ServiceOptions } from '../../common/interfaces/service-options.interface.js';
+import { isWellFormedId } from '../../common/persistence/id-format.js';
+import { ConfigService } from '../../common/services/config.service.js';
+import { CrudService } from '../../common/services/crud.service.js';
+import { ErrorCode } from '../error-code/error-codes.js';
+import { EmailService } from '../../common/services/email.service.js';
+import { revokeApiTokensOfUser } from '../api-token/core-api-token.registry.js';
+import { CoreModelConstructor } from '../../common/types/core-model-constructor.type.js';
+import { CoreUserModel } from './core-user.model.js';
+import { CoreUserCreateInput } from './inputs/core-user-create.input.js';
+import { CoreUserInput } from './inputs/core-user.input.js';
+import { CoreUserServiceOptions } from './interfaces/core-user-service-options.interface.js';
 
 /**
  * User service
@@ -125,7 +126,9 @@ export abstract class CoreUserService<
         // window exists on a freshly deployed production database. The index
         // remains the backstop for truly concurrent duplicate requests.
         if (data.input?.email) {
-          const existing = await this.mainDbModel.findOne({ email: data.input.email }).lean().exec();
+          const existing = this.usesNeutralStore
+            ? await this.dataStore.findOne({ email: data.input.email })
+            : await this.mainDbModel.findOne({ email: data.input.email }).lean().exec();
           if (existing) {
             throw new BadRequestException('Email address already in use');
           }
@@ -133,15 +136,19 @@ export abstract class CoreUserService<
 
         // Create user with verification token
         const currentUserId = serviceOptions?.currentUser?._id;
-        const createdUser = new this.mainDbModel({
+        const fields = {
           ...data.input,
           createdBy: currentUserId,
           updatedBy: currentUserId,
           verificationToken: crypto.randomBytes(32).toString('hex'),
-        });
+        };
+        const createdUser = this.usesNeutralStore ? undefined : new this.mainDbModel(fields);
 
         // Distinguish between different error messages when saving
         try {
+          if (!createdUser) {
+            return await this.dataStore.insert(fields);
+          }
           await createdUser.save();
         } catch (error) {
           if (error?.errors?.email?.kind === 'unique' || error?.code === 11000) {
@@ -158,11 +165,27 @@ export abstract class CoreUserService<
     );
   }
 
+  /**
+   * The stored user matching `where`: the Mongoose document on MongoDB — what this service always worked with — and
+   * the plain record when the user model is routed to a SQL store
+   */
+  protected async findStoredUser(where: Record<string, unknown>): Promise<any> {
+    return this.usesNeutralStore ? this.dataStore.findOne(where) : this.mainDbModel.findOne(where).exec();
+  }
+
+  /** Write `changes` to a stored user (as `findStoredUser()` returned it) and return it as stored afterwards */
+  protected async saveStoredUser(stored: any, changes: Record<string, unknown>): Promise<any> {
+    if (this.usesNeutralStore) {
+      return this.dataStore.updateById(stored.id, changes as any);
+    }
+    return assignPlain(stored, changes).save();
+  }
+
   /**
    * Get user via email
    */
   async getViaEmail(email: string, serviceOptions?: ServiceOptions): Promise<TUser> {
-    const dbObject = await this.mainDbModel.findOne({ email }).exec();
+    const dbObject = await this.findStoredUser({ email });
     if (!dbObject) {
       throw new NotFoundException(`No user found with email: ${email}`);
     }
@@ -181,6 +204,10 @@ export abstract class CoreUserService<
    * @returns User object or null if not found
    */
   async getByIdOrIamId(idOrIamId: string): Promise<null | TUser> {
+    if (this.usesNeutralStore) {
+      const byId = isWellFormedId(String(idOrIamId)) ? await this.dataStore.findById(String(idOrIamId)) : null;
+      return (byId ?? (await this.dataStore.findOne({ iamId: idOrIamId }))) as null | TUser;
+    }
     try {
       // First, try to find by MongoDB _id
       const byId = await this.mainDbModel.findById(idOrIamId).exec();
@@ -204,7 +231,7 @@ export abstract class CoreUserService<
       return false;
     }
 
-    const user = await this.mainDbModel.findOne({ verificationToken: token }).exec();
+    const user = await this.findStoredUser({ verificationToken: token });
 
     if (!user) {
       throw new NotFoundException(`No user found with verify token: ${token}`);
@@ -222,7 +249,7 @@ export abstract class CoreUserService<
       throw new NotFoundException(ErrorCode.INVALID_TOKEN);
     }
 
-    const dbObject = await this.mainDbModel.findOne({ verificationToken: token }).exec();
+    const dbObject = await this.findStoredUser({ verificationToken: token });
     if (!dbObject) {
       throw new NotFoundException(`No user found with verify token: ${token}`);
     }
@@ -238,6 +265,9 @@ export abstract class CoreUserService<
     return this.process(
       async () => {
         // Update and return user
+        if (this.usesNeutralStore) {
+          return this.dataStore.updateById(dbObject.id, { verified: true, verifiedAt: new Date() } as any);
+        }
         await this.mainDbModel.updateOne({ _id: dbObject.id }, { verified: true, verifiedAt: new Date() }).exec();
         // Return the updated user
         return await this.mainDbModel.findById(dbObject.id).exec();
@@ -262,7 +292,7 @@ export abstract class CoreUserService<
       throw new NotFoundException(ErrorCode.LINK_INVALID_OR_EXPIRED);
     }
 
-    const dbObject = await this.mainDbModel.findOne({ passwordResetToken: token }).exec();
+    const dbObject = await this.findStoredUser({ passwordResetToken: token });
 
     // An EXPIRED token is answered exactly like an unknown one — same exception, same 404. The
     // distinction would tell a caller holding a stale token that it was once real and belongs to a
@@ -270,12 +300,15 @@ export abstract class CoreUserService<
     if (dbObject && this.isPasswordResetTokenExpired(dbObject.passwordResetTokenExpiresAt)) {
       // Burn it on sight rather than leaving it to be retried. It is worthless now, and a value
       // that stays in the row is one a later change could start honouring again.
-      await this.mainDbModel
-        // `$unset`, not `$set: null` — a null still counts as present, so it would keep an entry
-        // in the partial index the token field carries and grow it by one per user who ever
-        // requested a reset.
-        .updateOne({ _id: dbObject._id }, { $unset: { passwordResetToken: 1, passwordResetTokenExpiresAt: 1 } })
-        .exec();
+      // `$unset`, not `$set: null` — a null still counts as present, so it would keep an entry
+      // in the partial index the token field carries and grow it by one per user who ever
+      // requested a reset.
+      const burn = { $unset: { passwordResetToken: 1 as const, passwordResetTokenExpiresAt: 1 as const } };
+      if (this.usesNeutralStore) {
+        await this.dataStore.updateById(dbObject.id, burn);
+      } else {
+        await this.mainDbModel.updateOne({ _id: dbObject._id }, burn).exec();
+      }
       this.userServiceLogger.debug(`Rejected an expired password-reset token for ${maskEmail(dbObject.email)}`);
     }
 
@@ -325,7 +358,7 @@ export abstract class CoreUserService<
         }
 
         // Update Legacy Auth password
-        const updatedUser = await assignPlain(dbObject, {
+        const updatedUser = await this.saveStoredUser(dbObject, {
           password: await bcrypt.hash(newPassword, 10),
           passwordResetToken: null,
           passwordResetTokenExpiresAt: null,
@@ -338,7 +371,7 @@ export abstract class CoreUserService<
           // Without this, "the reset now lands in both stores" would still leave the account
           // reachable with the credential the reset was meant to retire.
           refreshTokens: {},
-        }).save();
+        });
 
         // Sync password to Better-Auth (IAM) if mapper is available
         // This ensures users can sign in via IAM after password reset
@@ -455,7 +488,7 @@ export abstract class CoreUserService<
     }
 
     // Get user
-    const dbObject = await this.mainDbModel.findOne({ email }).exec();
+    const dbObject = await this.findStoredUser({ email });
     if (!dbObject) {
       const preventEnumeration =
         this.configService.getFastButReadOnly('auth')?.passwordReset?.preventUserEnumeration !== false;
@@ -478,6 +511,12 @@ export abstract class CoreUserService<
     const user = await this.process(
       async () => {
         // Set reset token and return
+        if (this.usesNeutralStore) {
+          return this.dataStore.updateById(dbObject.id, {
+            passwordResetToken: token,
+            passwordResetTokenExpiresAt: expiresAt,
+          } as any);
+        }
         dbObject.passwordResetToken = token;
         dbObject.passwordResetTokenExpiresAt = expiresAt;
 
@@ -646,7 +685,9 @@ export abstract class CoreUserService<
     // Update and return user
     return this.process(
       async () => {
-        const user = await this.mainDbModel.findByIdAndUpdate(userId, { roles }).exec();
+        const user = this.usesNeutralStore
+          ? await this.dataStore.updateById(String(userId), { roles } as any)
+          : await this.mainDbModel.findByIdAndUpdate(userId, { roles }).exec();
 
         // Invalidate BetterAuth user cache so changed roles take effect immediately
         if (this.options?.betterAuthUserMapper && (user as any)?.iamId) {
@@ -680,7 +721,9 @@ export abstract class CoreUserService<
    */
   override async update(id: string, input: TUserInput, serviceOptions?: ServiceOptions): Promise<TUser> {
     // Get the current user before update to detect email changes
-    const oldUser = (await this.mainDbModel.findById(id).lean().exec()) as null | TUser;
+    const oldUser = (
+      this.usesNeutralStore ? await this.dataStore.findById(id) : await this.mainDbModel.findById(id).lean().exec()
+    ) as null | TUser;
     const oldEmail = oldUser?.email;
 
     this.assertCredentialChangeAllowed(oldUser, input, serviceOptions);
@@ -710,6 +753,37 @@ export abstract class CoreUserService<
       }
     }
 
+    // Sync name change to IAM if firstName/lastName was changed and mapper is available.
+    // Without this, the next sign-in reverse-syncs the STALE Better-Auth `name` back into
+    // firstName/lastName (linkOrCreateUser), silently discarding the user's edit.
+    if (this.options?.betterAuthUserMapper && (input.firstName !== undefined || input.lastName !== undefined)) {
+      // The names come from the STORED record, not from `updatedUser`: that one went through the
+      // output pipeline, which strips every field the caller may not read. A caller allowed to
+      // edit one name field but not to read the other would otherwise sync a truncated name.
+      const stored = (
+        this.usesNeutralStore
+          ? await this.dataStore.findById(id, { select: ['email', 'firstName', 'lastName'] })
+          : await this.mainDbModel.findById(id).select('email firstName lastName').lean().exec()
+      ) as null | TUser;
+      // An emptied name is synced as well. Skipping it left the old Better-Auth `name` in place,
+      // and the next IAM sign-in wrote it back into the fields the user had just cleared.
+      const fullName = [stored?.firstName, stored?.lastName].filter(Boolean).join(' ');
+      const currentEmail = stored?.email ?? oldEmail;
+      if (currentEmail) {
+        try {
+          const synced = await this.options.betterAuthUserMapper.syncNameChangeFromLegacy(currentEmail, fullName);
+          if (synced) {
+            this.userServiceLogger.debug(`Synced name change from Legacy to IAM for user ${maskEmail(currentEmail)}`);
+          }
+        } catch (error) {
+          this.userServiceLogger.warn(
+            `Failed to sync name change to IAM for ${maskEmail(currentEmail)}: ${error instanceof Error ? error.message : 'Unknown error'}`,
+          );
+          // Don't throw - name sync failure shouldn't block the update
+        }
+      }
+    }
+
     // Sync password change to IAM if password was changed and mapper is available
     if (this.options?.betterAuthUserMapper && passwordForIamSync && oldUser?.email) {
       try {
@@ -815,7 +889,11 @@ export abstract class CoreUserService<
    */
   override async delete(id: string, serviceOptions?: ServiceOptions): Promise<TUser> {
     // Get the user before deletion to cleanup IAM data
-    const user = (await this.mainDbModel.findById(id).lean().exec()) as null | (TUser & { _id: any });
+    const user = (
+      this.usesNeutralStore
+        ? await this.dataStore.findById(id).then((record) => record && { ...record, _id: record.id })
+        : await this.mainDbModel.findById(id).lean().exec()
+    ) as null | (TUser & { _id: any });
 
     // Perform the deletion
     const deletedUser = await super.delete(id, serviceOptions);

package/src/core/modules/user/inputs/core-user-create.input.ts

@@ -1,10 +1,10 @@
 import { InputType } from '@nestjs/graphql';
 import { IsEmail } from 'class-validator';
 
-import { Restricted } from '../../../common/decorators/restricted.decorator';
-import { UnifiedField } from '../../../common/decorators/unified-field.decorator';
-import { RoleEnum } from '../../../common/enums/role.enum';
-import { CoreUserInput } from './core-user.input';
+import { Restricted } from '../../../common/decorators/restricted.decorator.js';
+import { UnifiedField } from '../../../common/decorators/unified-field.decorator.js';
+import { RoleEnum } from '../../../common/enums/role.enum.js';
+import { CoreUserInput } from './core-user.input.js';
 
 /**
  * User input to create a new user

package/src/core/modules/user/inputs/core-user.input.ts

@@ -1,11 +1,11 @@
 import { InputType } from '@nestjs/graphql';
 import { IsEmail, IsString, Matches } from 'class-validator';
 
-import { Restricted } from '../../../common/decorators/restricted.decorator';
-import { UnifiedField } from '../../../common/decorators/unified-field.decorator';
-import { ProcessType } from '../../../common/enums/process-type.enum';
-import { RoleEnum, SYSTEM_ROLE_PREFIX, SYSTEM_ROLE_REJECT_PATTERN } from '../../../common/enums/role.enum';
-import { CoreInput } from '../../../common/inputs/core-input.input';
+import { Restricted } from '../../../common/decorators/restricted.decorator.js';
+import { UnifiedField } from '../../../common/decorators/unified-field.decorator.js';
+import { ProcessType } from '../../../common/enums/process-type.enum.js';
+import { RoleEnum, SYSTEM_ROLE_PREFIX, SYSTEM_ROLE_REJECT_PATTERN } from '../../../common/enums/role.enum.js';
+import { CoreInput } from '../../../common/inputs/core-input.input.js';
 
 /**
  * User input to update a user

package/src/core/modules/user/interfaces/core-user-service-options.interface.ts

@@ -1,4 +1,4 @@
-import { CoreBetterAuthUserMapper } from '../../better-auth/core-better-auth-user.mapper';
+import { CoreBetterAuthUserMapper } from '../../better-auth/core-better-auth-user.mapper.js';
 
 /**
  * Optional configuration for CoreUserService