@lenne.tech/nest-server 11.43.3 → 12.1.0

package/dist/core/modules/better-auth/core-better-auth.module.js

@@ -1,4 +1,3 @@
-"use strict";
 var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
     var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
     if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
@@ -12,37 +11,40 @@ var __param = (this && this.__param) || function (paramIndex, decorator) {
     return function (target, key) { decorator(target, key, paramIndex); }
 };
 var CoreBetterAuthModule_1;
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.CoreBetterAuthModule = exports.BETTER_AUTH_INSTANCE = void 0;
-const common_1 = require("@nestjs/common");
-const core_1 = require("@nestjs/core");
-const mongoose_1 = require("@nestjs/mongoose");
-const mongoose_2 = require("mongoose");
-const logging_helper_1 = require("../../common/helpers/logging.helper");
-const brevo_service_1 = require("../../common/services/brevo.service");
-const config_service_1 = require("../../common/services/config.service");
-const roles_guard_registry_1 = require("../auth/guards/roles-guard-registry");
-const legacy_endpoints_helper_1 = require("../auth/helpers/legacy-endpoints.helper");
-const better_auth_roles_guard_1 = require("./better-auth-roles.guard");
-const better_auth_token_service_1 = require("./better-auth-token.service");
-const better_auth_config_1 = require("./better-auth.config");
-const better_auth_resolver_1 = require("./better-auth.resolver");
-const core_better_auth_api_middleware_1 = require("./core-better-auth-api.middleware");
-const core_better_auth_challenge_service_1 = require("./core-better-auth-challenge.service");
-const core_better_auth_email_verification_service_1 = require("./core-better-auth-email-verification.service");
-const core_better_auth_rate_limit_middleware_1 = require("./core-better-auth-rate-limit.middleware");
-const core_better_auth_rate_limiter_service_1 = require("./core-better-auth-rate-limiter.service");
-const core_api_token_registry_1 = require("../api-token/core-api-token.registry");
-const core_better_auth_password_reset_registry_1 = require("./core-better-auth-password-reset.registry");
-const core_better_auth_signup_validator_service_1 = require("./core-better-auth-signup-validator.service");
-const core_better_auth_user_mapper_1 = require("./core-better-auth-user.mapper");
-const core_better_auth_constants_1 = require("./core-better-auth.constants");
-const core_better_auth_controller_1 = require("./core-better-auth.controller");
-const core_better_auth_middleware_1 = require("./core-better-auth.middleware");
-const core_better_auth_registry_1 = require("./core-better-auth.registry");
-const core_better_auth_service_1 = require("./core-better-auth.service");
-var core_better_auth_constants_2 = require("./core-better-auth.constants");
-Object.defineProperty(exports, "BETTER_AUTH_INSTANCE", { enumerable: true, get: function () { return core_better_auth_constants_2.BETTER_AUTH_INSTANCE; } });
+import { Global, Logger, Module, Optional, } from '@nestjs/common';
+import { APP_GUARD } from '@nestjs/core';
+import { getConnectionToken } from '../../common/persistence/mongo/mongoose-compat.js';
+import { maskEmail } from '../../common/helpers/logging.helper.js';
+import { getPersistenceRuntime } from '../../common/persistence/persistence-runtime.registry.js';
+import { BrevoService } from '../../common/services/brevo.service.js';
+import { ConfigService } from '../../common/services/config.service.js';
+import { RolesGuardRegistry } from '../auth/guards/roles-guard-registry.js';
+import { ROLE_GUARD } from '../auth/guards/role-guard.token.js';
+import { isLegacyEndpointEnabled } from '../auth/helpers/legacy-endpoints.helper.js';
+import { BetterAuthRolesGuard } from './better-auth-roles.guard.js';
+import { BetterAuthTokenService } from './better-auth-token.service.js';
+import { buildBetterAuthOptions, instantiateBetterAuth, } from './better-auth.config.js';
+import { applyBetterAuthSchema } from './better-auth-sql.helper.js';
+import { getBetterAuthSqlStore, setBetterAuthSqlStore } from './core-better-auth-sql.registry.js';
+import { BetterAuthSqlStore } from './core-better-auth-sql.store.js';
+import { DefaultBetterAuthResolver } from './better-auth.resolver.js';
+import { CoreBetterAuthApiMiddleware } from './core-better-auth-api.middleware.js';
+import { CoreBetterAuthChallengeService } from './core-better-auth-challenge.service.js';
+import { CoreBetterAuthEmailVerificationService } from './core-better-auth-email-verification.service.js';
+import { CoreBetterAuthRateLimitMiddleware } from './core-better-auth-rate-limit.middleware.js';
+import { CoreBetterAuthRateLimiter } from './core-better-auth-rate-limiter.service.js';
+import { revokeApiTokensOfUser } from '../api-token/core-api-token.registry.js';
+import { getInFlightResetPassword } from './core-better-auth-password-reset.registry.js';
+import { CoreBetterAuthSignUpValidatorService } from './core-better-auth-signup-validator.service.js';
+import { CoreBetterAuthUserMapper } from './core-better-auth-user.mapper.js';
+import { BETTER_AUTH_CONFIG, BETTER_AUTH_COOKIE_DOMAIN, BETTER_AUTH_INSTANCE } from './core-better-auth.constants.js';
+import { CoreBetterAuthController } from './core-better-auth.controller.js';
+import { CoreBetterAuthMiddleware } from './core-better-auth.middleware.js';
+import { getBetterAuthTokenService, resetBetterAuthRegistry, setBetterAuthTokenService, } from './core-better-auth.registry.js';
+import { CoreBetterAuthService } from './core-better-auth.service.js';
+import { newObjectId } from '../../common/persistence/mongo/mongoose-compat.js';
+import { requireMongoPackages } from '../../common/persistence/mongo/mongo-packages.js';
+export { BETTER_AUTH_INSTANCE } from './core-better-auth.constants.js';
 function normalizeBetterAuthConfig(config) {
     if (config === undefined || config === null)
         return {};
@@ -65,7 +67,7 @@ let CoreBetterAuthModule = class CoreBetterAuthModule {
     rateLimiter;
     userMapper;
     tokenService;
-    static logger = new common_1.Logger(CoreBetterAuthModule_1.name);
+    static logger = new Logger(CoreBetterAuthModule_1.name);
     static authInstance = null;
     static initialized = false;
     static initLogged = false;
@@ -84,10 +86,10 @@ let CoreBetterAuthModule = class CoreBetterAuthModule {
     static userMapperInstance = null;
     static resolvedCookieDomain = undefined;
     static getControllerClass() {
-        return this.customController || core_better_auth_controller_1.CoreBetterAuthController;
+        return this.customController || CoreBetterAuthController;
     }
     static getResolverClass() {
-        return this.customResolver || better_auth_resolver_1.DefaultBetterAuthResolver;
+        return this.customResolver || DefaultBetterAuthResolver;
     }
     static getServiceInstance() {
         return this.serviceInstance;
@@ -96,7 +98,7 @@ let CoreBetterAuthModule = class CoreBetterAuthModule {
         return this.userMapperInstance;
     }
     static getTokenServiceInstance() {
-        return (0, core_better_auth_registry_1.getBetterAuthTokenService)();
+        return getBetterAuthTokenService();
     }
     static getCookieDomain() {
         return this.resolvedCookieDomain;
@@ -119,13 +121,13 @@ let CoreBetterAuthModule = class CoreBetterAuthModule {
             CoreBetterAuthModule_1.userMapperInstance = this.userMapper;
         }
         if (this.tokenService) {
-            (0, core_better_auth_registry_1.setBetterAuthTokenService)(this.tokenService);
+            setBetterAuthTokenService(this.tokenService);
         }
         if (this.rateLimiter && CoreBetterAuthModule_1.currentConfig?.rateLimit) {
             this.rateLimiter.configure(CoreBetterAuthModule_1.currentConfig.rateLimit);
         }
         if (CoreBetterAuthModule_1.currentConfig) {
-            const globalConfig = config_service_1.ConfigService.configFastButReadOnly;
+            const globalConfig = ConfigService.configFastButReadOnly;
             const cookiesDisabled = globalConfig?.cookies === false;
             const jwtExplicitlyDisabled = CoreBetterAuthModule_1.currentConfig.jwt === false ||
                 (typeof CoreBetterAuthModule_1.currentConfig.jwt === 'object' &&
@@ -137,7 +139,7 @@ let CoreBetterAuthModule = class CoreBetterAuthModule {
                     'or set cookies: true to use cookie-based sessions.');
             }
         }
-        if (CoreBetterAuthModule_1.rolesGuardExplicitlyDisabled && !roles_guard_registry_1.RolesGuardRegistry.isRegistered()) {
+        if (CoreBetterAuthModule_1.rolesGuardExplicitlyDisabled && !RolesGuardRegistry.isRegistered()) {
             CoreBetterAuthModule_1.logger.warn('⚠️ SECURITY WARNING: registerRolesGuardGlobally is explicitly set to false, ' +
                 'but no RolesGuard is registered globally. @Roles() decorators will NOT enforce access control! ' +
                 'Either set registerRolesGuardGlobally: true, or ensure CoreAuthModule (Legacy) is imported.');
@@ -146,25 +148,50 @@ let CoreBetterAuthModule = class CoreBetterAuthModule {
     configure(consumer) {
         if (this.betterAuthService?.isEnabled()) {
             const basePath = CoreBetterAuthModule_1.currentConfig?.basePath || '/iam';
-            consumer.apply(core_better_auth_middleware_1.CoreBetterAuthMiddleware).forRoutes('(.*)');
+            consumer.apply(CoreBetterAuthMiddleware).forRoutes('{*path}');
             CoreBetterAuthModule_1.logger.debug('CoreBetterAuthMiddleware registered for all routes');
             if (CoreBetterAuthModule_1.currentConfig?.rateLimit &&
                 CoreBetterAuthModule_1.currentConfig.rateLimit.enabled !== false) {
-                consumer.apply(core_better_auth_rate_limit_middleware_1.CoreBetterAuthRateLimitMiddleware).forRoutes(`${basePath}/*path`);
+                consumer.apply(CoreBetterAuthRateLimitMiddleware).forRoutes(`${basePath}/*path`);
                 CoreBetterAuthModule_1.logger.debug(`Rate limiting middleware registered for ${basePath}/*path endpoints`);
             }
-            consumer.apply(core_better_auth_api_middleware_1.CoreBetterAuthApiMiddleware).forRoutes(`${basePath}/*path`);
+            consumer.apply(CoreBetterAuthApiMiddleware).forRoutes(`${basePath}/*path`);
             CoreBetterAuthModule_1.logger.debug(`CoreBetterAuthApiMiddleware registered for ${basePath}/*path endpoints`);
         }
     }
+    static async createInstance(options) {
+        const storage = await getPersistenceRuntime()?.iamStorage();
+        setBetterAuthSqlStore(undefined);
+        const built = buildBetterAuthOptions({ ...options, sqlPool: storage?.pool });
+        if (!built) {
+            return null;
+        }
+        if (storage) {
+            await applyBetterAuthSchema(built.options, storage);
+        }
+        const result = instantiateBetterAuth(built);
+        if (storage) {
+            setBetterAuthSqlStore(new BetterAuthSqlStore(storage.users, result.instance, storage.pool));
+        }
+        return result;
+    }
+    static async mongoDatabase() {
+        await this.waitForMongoConnection();
+        const db = requireMongoPackages('Better-Auth on MongoDB').mongoose.connection.db;
+        if (!db) {
+            throw new Error('MongoDB database not available');
+        }
+        return db;
+    }
     static async waitForMongoConnection() {
         const maxAttempts = 60;
         const pollInterval = 500;
+        const { mongoose } = requireMongoPackages('Better-Auth on MongoDB (the user model is not routed to a SQL source)');
         for (let attempt = 0; attempt < maxAttempts; attempt++) {
-            if (mongoose_2.default.connection.readyState === 1 && mongoose_2.default.connection.db) {
+            if (mongoose.connection.readyState === 1 && mongoose.connection.db) {
                 return;
             }
-            if (mongoose_2.default.connection.readyState === 0) {
+            if (mongoose.connection.readyState === 0) {
                 this.logger.debug(`MongoDB not connected (attempt ${attempt + 1}/${maxAttempts})`);
             }
             await new Promise((resolve) => setTimeout(resolve, pollInterval));
@@ -184,7 +211,7 @@ let CoreBetterAuthModule = class CoreBetterAuthModule {
         }
         this.forRootCalled = true;
         const { config: rawConfig, controller, fallbackSecrets, registerRolesGuardGlobally, resolver, serverAppUrl, serverBaseUrl, serverCorsConfig, serverEnv, } = options;
-        const globalConfig = config_service_1.ConfigService.configFastButReadOnly;
+        const globalConfig = ConfigService.configFastButReadOnly;
         const effectiveRawConfig = rawConfig ?? globalConfig?.betterAuth;
         const effectiveFallbackSecrets = fallbackSecrets ??
             (globalConfig?.jwt ? [globalConfig.jwt.secret, globalConfig.jwt.refresh?.secret].filter(Boolean) : undefined);
@@ -202,24 +229,24 @@ let CoreBetterAuthModule = class CoreBetterAuthModule {
             this.betterAuthEnabled = false;
             this.cachedDynamicModule = {
                 exports: [
-                    core_better_auth_constants_1.BETTER_AUTH_INSTANCE,
-                    core_better_auth_service_1.CoreBetterAuthService,
-                    core_better_auth_user_mapper_1.CoreBetterAuthUserMapper,
-                    core_better_auth_rate_limiter_service_1.CoreBetterAuthRateLimiter,
-                    better_auth_token_service_1.BetterAuthTokenService,
-                    core_better_auth_challenge_service_1.CoreBetterAuthChallengeService,
+                    BETTER_AUTH_INSTANCE,
+                    CoreBetterAuthService,
+                    CoreBetterAuthUserMapper,
+                    CoreBetterAuthRateLimiter,
+                    BetterAuthTokenService,
+                    CoreBetterAuthChallengeService,
                 ],
                 module: CoreBetterAuthModule_1,
                 providers: [
                     {
-                        provide: core_better_auth_constants_1.BETTER_AUTH_INSTANCE,
+                        provide: BETTER_AUTH_INSTANCE,
                         useValue: null,
                     },
-                    core_better_auth_service_1.CoreBetterAuthService,
-                    core_better_auth_user_mapper_1.CoreBetterAuthUserMapper,
-                    core_better_auth_rate_limiter_service_1.CoreBetterAuthRateLimiter,
-                    better_auth_token_service_1.BetterAuthTokenService,
-                    core_better_auth_challenge_service_1.CoreBetterAuthChallengeService,
+                    CoreBetterAuthService,
+                    CoreBetterAuthUserMapper,
+                    CoreBetterAuthRateLimiter,
+                    BetterAuthTokenService,
+                    CoreBetterAuthChallengeService,
                 ],
             };
             return this.cachedDynamicModule;
@@ -239,33 +266,33 @@ let CoreBetterAuthModule = class CoreBetterAuthModule {
         return {
             controllers: [this.getControllerClass()],
             exports: [
-                core_better_auth_constants_1.BETTER_AUTH_INSTANCE,
-                core_better_auth_service_1.CoreBetterAuthService,
-                core_better_auth_user_mapper_1.CoreBetterAuthUserMapper,
-                core_better_auth_rate_limiter_service_1.CoreBetterAuthRateLimiter,
-                better_auth_token_service_1.BetterAuthTokenService,
-                core_better_auth_challenge_service_1.CoreBetterAuthChallengeService,
-                core_better_auth_email_verification_service_1.CoreBetterAuthEmailVerificationService,
-                core_better_auth_signup_validator_service_1.CoreBetterAuthSignUpValidatorService,
+                BETTER_AUTH_INSTANCE,
+                CoreBetterAuthService,
+                CoreBetterAuthUserMapper,
+                CoreBetterAuthRateLimiter,
+                BetterAuthTokenService,
+                CoreBetterAuthChallengeService,
+                CoreBetterAuthEmailVerificationService,
+                CoreBetterAuthSignUpValidatorService,
             ],
             imports: [],
             module: CoreBetterAuthModule_1,
             providers: [
                 {
-                    inject: [config_service_1.ConfigService],
-                    provide: core_better_auth_email_verification_service_1.CoreBetterAuthEmailVerificationService.BREVO_SERVICE_TOKEN,
+                    inject: [ConfigService],
+                    provide: CoreBetterAuthEmailVerificationService.BREVO_SERVICE_TOKEN,
                     useFactory: (configService) => {
                         if (configService.configFastButReadOnly?.brevo?.apiKey) {
-                            return new brevo_service_1.BrevoService(configService);
+                            return new BrevoService(configService);
                         }
                         return null;
                     },
                 },
-                core_better_auth_email_verification_service_1.CoreBetterAuthEmailVerificationService,
-                core_better_auth_signup_validator_service_1.CoreBetterAuthSignUpValidatorService,
+                CoreBetterAuthEmailVerificationService,
+                CoreBetterAuthSignUpValidatorService,
                 {
-                    inject: [config_service_1.ConfigService, core_better_auth_email_verification_service_1.CoreBetterAuthEmailVerificationService],
-                    provide: core_better_auth_constants_1.BETTER_AUTH_INSTANCE,
+                    inject: [ConfigService, CoreBetterAuthEmailVerificationService],
+                    provide: BETTER_AUTH_INSTANCE,
                     useFactory: async (configService, emailVerificationService) => {
                         this.setEmailVerificationService(emailVerificationService);
                         const rawConfig = configService.get('betterAuth');
@@ -277,16 +304,12 @@ let CoreBetterAuthModule = class CoreBetterAuthModule {
                             return null;
                         }
                         this.betterAuthEnabled = true;
-                        await this.waitForMongoConnection();
-                        const db = mongoose_2.default.connection.db;
-                        if (!db) {
-                            throw new Error('MongoDB database not available');
-                        }
+                        const db = (await getPersistenceRuntime()?.iamStorage()) ? undefined : await this.mongoDatabase();
                         this.configServiceInstance = configService;
                         const jwtConfig = configService.get('jwt');
                         const fallbackSecrets = [jwtConfig?.secret, jwtConfig?.refresh?.secret];
                         const { onEmailVerified, onPasswordReset, sendResetPasswordEmail, sendVerificationEmail } = this.createEmailVerificationCallbacks();
-                        const result = (0, better_auth_config_1.createBetterAuthInstance)({
+                        const result = await this.createInstance({
                             config,
                             db,
                             fallbackSecrets,
@@ -308,35 +331,35 @@ let CoreBetterAuthModule = class CoreBetterAuthModule {
                     },
                 },
                 {
-                    inject: [core_better_auth_constants_1.BETTER_AUTH_INSTANCE],
-                    provide: core_better_auth_constants_1.BETTER_AUTH_CONFIG,
+                    inject: [BETTER_AUTH_INSTANCE],
+                    provide: BETTER_AUTH_CONFIG,
                     useFactory: () => this.currentConfig,
                 },
                 {
-                    inject: [core_better_auth_constants_1.BETTER_AUTH_INSTANCE],
-                    provide: core_better_auth_constants_1.BETTER_AUTH_COOKIE_DOMAIN,
+                    inject: [BETTER_AUTH_INSTANCE],
+                    provide: BETTER_AUTH_COOKIE_DOMAIN,
                     useFactory: () => this.resolvedCookieDomain,
                 },
                 {
-                    inject: [core_better_auth_constants_1.BETTER_AUTH_INSTANCE, core_better_auth_constants_1.BETTER_AUTH_CONFIG, (0, mongoose_1.getConnectionToken)(), core_better_auth_constants_1.BETTER_AUTH_COOKIE_DOMAIN],
-                    provide: core_better_auth_service_1.CoreBetterAuthService,
+                    inject: [BETTER_AUTH_INSTANCE, BETTER_AUTH_CONFIG, getConnectionToken(), BETTER_AUTH_COOKIE_DOMAIN],
+                    provide: CoreBetterAuthService,
                     useFactory: (authInstance, resolvedConfig, connection, cookieDomain) => {
-                        return new core_better_auth_service_1.CoreBetterAuthService(authInstance, connection, resolvedConfig, undefined, cookieDomain);
+                        return new CoreBetterAuthService(authInstance, connection, resolvedConfig, undefined, cookieDomain);
                     },
                 },
-                core_better_auth_user_mapper_1.CoreBetterAuthUserMapper,
-                core_better_auth_middleware_1.CoreBetterAuthMiddleware,
-                core_better_auth_api_middleware_1.CoreBetterAuthApiMiddleware,
-                core_better_auth_rate_limiter_service_1.CoreBetterAuthRateLimiter,
-                core_better_auth_rate_limit_middleware_1.CoreBetterAuthRateLimitMiddleware,
+                CoreBetterAuthUserMapper,
+                CoreBetterAuthMiddleware,
+                CoreBetterAuthApiMiddleware,
+                CoreBetterAuthRateLimiter,
+                CoreBetterAuthRateLimitMiddleware,
                 {
-                    inject: [core_better_auth_service_1.CoreBetterAuthService, (0, mongoose_1.getConnectionToken)()],
-                    provide: better_auth_token_service_1.BetterAuthTokenService,
+                    inject: [CoreBetterAuthService, getConnectionToken()],
+                    provide: BetterAuthTokenService,
                     useFactory: (betterAuthService, connection) => {
-                        return new better_auth_token_service_1.BetterAuthTokenService(betterAuthService, connection);
+                        return new BetterAuthTokenService(betterAuthService, connection);
                     },
                 },
-                core_better_auth_challenge_service_1.CoreBetterAuthChallengeService,
+                CoreBetterAuthChallengeService,
                 this.getResolverClass(),
             ],
         };
@@ -346,6 +369,7 @@ let CoreBetterAuthModule = class CoreBetterAuthModule {
     }
     static reset() {
         this.authInstance = null;
+        setBetterAuthSqlStore(undefined);
         this.initialized = false;
         this.initLogged = false;
         this.betterAuthEnabled = false;
@@ -361,8 +385,8 @@ let CoreBetterAuthModule = class CoreBetterAuthModule {
         this.serviceInstance = null;
         this.userMapperInstance = null;
         this.resolvedCookieDomain = undefined;
-        (0, core_better_auth_registry_1.resetBetterAuthRegistry)();
-        roles_guard_registry_1.RolesGuardRegistry.reset();
+        resetBetterAuthRegistry();
+        RolesGuardRegistry.reset();
     }
     static setEmailVerificationService(service) {
         this.emailVerificationService = service;
@@ -377,9 +401,9 @@ let CoreBetterAuthModule = class CoreBetterAuthModule {
             return;
         }
         try {
-            const revoked = await (0, core_api_token_registry_1.revokeApiTokensOfUser)({ email: user.email, iamId: user.id });
+            const revoked = await revokeApiTokensOfUser({ email: user.email, iamId: user.id });
             if (revoked) {
-                this.logger.log(`Revoked ${revoked} API token(s) after the password reset of ${(0, logging_helper_1.maskEmail)(user.email ?? '')}`);
+                this.logger.log(`Revoked ${revoked} API token(s) after the password reset of ${maskEmail(user.email ?? '')}`);
             }
         }
         catch (error) {
@@ -390,12 +414,16 @@ let CoreBetterAuthModule = class CoreBetterAuthModule {
         return {
             onEmailVerified: async (userId) => {
                 try {
+                    const sql = getBetterAuthSqlStore();
                     const db = this.mongoConnection?.db;
-                    if (db) {
-                        const { ObjectId } = await Promise.resolve().then(() => require('mongodb'));
+                    if (sql) {
+                        await sql.updateUser({ id: userId }, { verified: true, verifiedAt: new Date() });
+                        this.logger.debug(`Email verified for user ${userId} - synced verified/verifiedAt`);
+                    }
+                    else if (db) {
                         await db
                             .collection('users')
-                            .updateOne({ _id: new ObjectId(userId) }, { $set: { verified: true, verifiedAt: new Date() } });
+                            .updateOne({ _id: newObjectId(userId) }, { $set: { verified: true, verifiedAt: new Date() } });
                         this.logger.debug(`Email verified for user ${userId} - synced verified/verifiedAt`);
                     }
                     else {
@@ -409,10 +437,10 @@ let CoreBetterAuthModule = class CoreBetterAuthModule {
             onPasswordReset: async ({ user }) => {
                 await this.revokeApiTokensAfterPasswordReset(user);
                 const legacyConfig = this.configServiceInstance?.getFastButReadOnly('auth')?.legacyEndpoints;
-                if (!(0, legacy_endpoints_helper_1.isLegacyEndpointEnabled)(legacyConfig, 'graphql') && !(0, legacy_endpoints_helper_1.isLegacyEndpointEnabled)(legacyConfig, 'rest')) {
+                if (!isLegacyEndpointEnabled(legacyConfig, 'graphql') && !isLegacyEndpointEnabled(legacyConfig, 'rest')) {
                     return;
                 }
-                const normalizedPassword = (0, core_better_auth_password_reset_registry_1.getInFlightResetPassword)();
+                const normalizedPassword = getInFlightResetPassword();
                 if (!normalizedPassword) {
                     this.logger.debug('Password reset without an in-flight password — skipping the legacy mirror.');
                     return;
@@ -423,10 +451,10 @@ let CoreBetterAuthModule = class CoreBetterAuthModule {
                 }
                 const mirrored = await this.userMapperInstance?.syncPasswordToLegacy(user.id, user.email, normalizedPassword);
                 if (mirrored) {
-                    this.logger.debug(`Mirrored IAM password reset to the legacy store for ${(0, logging_helper_1.maskEmail)(user.email)}`);
+                    this.logger.debug(`Mirrored IAM password reset to the legacy store for ${maskEmail(user.email)}`);
                 }
                 else {
-                    this.logger.warn(`Could not mirror the IAM password reset to the legacy store for ${(0, logging_helper_1.maskEmail)(user.email)} — ` +
+                    this.logger.warn(`Could not mirror the IAM password reset to the legacy store for ${maskEmail(user.email)} — ` +
                         'the legacy password now differs from the IAM credential.');
                 }
             },
@@ -435,7 +463,7 @@ let CoreBetterAuthModule = class CoreBetterAuthModule {
                     await this.emailVerificationService.sendPasswordResetEmail(options);
                 }
                 else {
-                    this.logger.error(`Password reset requested for ${(0, logging_helper_1.maskEmail)(options.user.email)} but CoreBetterAuthEmailVerificationService ` +
+                    this.logger.error(`Password reset requested for ${maskEmail(options.user.email)} but CoreBetterAuthEmailVerificationService ` +
                         'is not available — NO mail was sent. Register the service, or disable the flow via ' +
                         'betterAuth.emailAndPassword.passwordReset: false.');
                 }
@@ -445,7 +473,7 @@ let CoreBetterAuthModule = class CoreBetterAuthModule {
                     await this.emailVerificationService.sendVerificationEmail(options);
                 }
                 else {
-                    this.logger.error(`Verification mail requested for ${(0, logging_helper_1.maskEmail)(options.user.email)} but ` +
+                    this.logger.error(`Verification mail requested for ${maskEmail(options.user.email)} but ` +
                         'CoreBetterAuthEmailVerificationService is not available — NO mail was sent.');
                 }
             },
@@ -455,32 +483,32 @@ let CoreBetterAuthModule = class CoreBetterAuthModule {
         return {
             controllers: [this.getControllerClass()],
             exports: [
-                core_better_auth_constants_1.BETTER_AUTH_INSTANCE,
-                core_better_auth_service_1.CoreBetterAuthService,
-                core_better_auth_user_mapper_1.CoreBetterAuthUserMapper,
-                core_better_auth_rate_limiter_service_1.CoreBetterAuthRateLimiter,
-                better_auth_token_service_1.BetterAuthTokenService,
-                core_better_auth_challenge_service_1.CoreBetterAuthChallengeService,
-                core_better_auth_email_verification_service_1.CoreBetterAuthEmailVerificationService,
-                core_better_auth_signup_validator_service_1.CoreBetterAuthSignUpValidatorService,
+                BETTER_AUTH_INSTANCE,
+                CoreBetterAuthService,
+                CoreBetterAuthUserMapper,
+                CoreBetterAuthRateLimiter,
+                BetterAuthTokenService,
+                CoreBetterAuthChallengeService,
+                CoreBetterAuthEmailVerificationService,
+                CoreBetterAuthSignUpValidatorService,
             ],
             module: CoreBetterAuthModule_1,
             providers: [
                 {
-                    inject: [config_service_1.ConfigService],
-                    provide: core_better_auth_email_verification_service_1.CoreBetterAuthEmailVerificationService.BREVO_SERVICE_TOKEN,
+                    inject: [ConfigService],
+                    provide: CoreBetterAuthEmailVerificationService.BREVO_SERVICE_TOKEN,
                     useFactory: (configService) => {
                         if (configService.configFastButReadOnly?.brevo?.apiKey) {
-                            return new brevo_service_1.BrevoService(configService);
+                            return new BrevoService(configService);
                         }
                         return null;
                     },
                 },
-                core_better_auth_email_verification_service_1.CoreBetterAuthEmailVerificationService,
-                core_better_auth_signup_validator_service_1.CoreBetterAuthSignUpValidatorService,
+                CoreBetterAuthEmailVerificationService,
+                CoreBetterAuthSignUpValidatorService,
                 {
-                    inject: [(0, mongoose_1.getConnectionToken)(), core_better_auth_email_verification_service_1.CoreBetterAuthEmailVerificationService, config_service_1.ConfigService],
-                    provide: core_better_auth_constants_1.BETTER_AUTH_INSTANCE,
+                    inject: [getConnectionToken(), CoreBetterAuthEmailVerificationService, ConfigService],
+                    provide: BETTER_AUTH_INSTANCE,
                     useFactory: async (connection, emailVerificationService, configService) => {
                         this.setEmailVerificationService(emailVerificationService);
                         this.mongoConnection = connection;
@@ -498,25 +526,11 @@ let CoreBetterAuthModule = class CoreBetterAuthModule {
                             serverCorsConfig: options?.serverCorsConfig,
                             serverEnv: options?.serverEnv,
                         };
-                        let result;
-                        const db = connection.db;
-                        if (!db) {
-                            await this.waitForMongoConnection();
-                            const globalDb = mongoose_2.default.connection.db;
-                            if (!globalDb) {
-                                throw new Error('MongoDB database not available');
-                            }
-                            result = (0, better_auth_config_1.createBetterAuthInstance)({
-                                ...sharedInstanceOptions,
-                                db: globalDb,
-                            });
-                        }
-                        else {
-                            result = (0, better_auth_config_1.createBetterAuthInstance)({
-                                ...sharedInstanceOptions,
-                                db,
-                            });
-                        }
+                        const sqlStorage = await getPersistenceRuntime()?.iamStorage();
+                        const result = await this.createInstance({
+                            ...sharedInstanceOptions,
+                            db: sqlStorage ? undefined : (connection?.db ?? (await this.mongoDatabase())),
+                        });
                         this.authInstance = result?.instance ?? null;
                         this.resolvedCookieDomain = result?.cookieDomain;
                         const resolvedSecret2 = resolveSigningSecret(this.authInstance, config, options?.fallbackSecrets);
@@ -532,40 +546,44 @@ let CoreBetterAuthModule = class CoreBetterAuthModule {
                     },
                 },
                 {
-                    inject: [core_better_auth_constants_1.BETTER_AUTH_INSTANCE],
-                    provide: core_better_auth_constants_1.BETTER_AUTH_CONFIG,
+                    inject: [BETTER_AUTH_INSTANCE],
+                    provide: BETTER_AUTH_CONFIG,
                     useFactory: () => this.currentConfig,
                 },
                 {
-                    inject: [core_better_auth_constants_1.BETTER_AUTH_INSTANCE],
-                    provide: core_better_auth_constants_1.BETTER_AUTH_COOKIE_DOMAIN,
+                    inject: [BETTER_AUTH_INSTANCE],
+                    provide: BETTER_AUTH_COOKIE_DOMAIN,
                     useFactory: () => this.resolvedCookieDomain,
                 },
                 {
-                    inject: [core_better_auth_constants_1.BETTER_AUTH_INSTANCE, core_better_auth_constants_1.BETTER_AUTH_CONFIG, (0, mongoose_1.getConnectionToken)(), core_better_auth_constants_1.BETTER_AUTH_COOKIE_DOMAIN],
-                    provide: core_better_auth_service_1.CoreBetterAuthService,
+                    inject: [BETTER_AUTH_INSTANCE, BETTER_AUTH_CONFIG, getConnectionToken(), BETTER_AUTH_COOKIE_DOMAIN],
+                    provide: CoreBetterAuthService,
                     useFactory: (authInstance, resolvedConfig, connection, cookieDomain) => {
-                        return new core_better_auth_service_1.CoreBetterAuthService(authInstance, connection, resolvedConfig, undefined, cookieDomain);
+                        return new CoreBetterAuthService(authInstance, connection, resolvedConfig, undefined, cookieDomain);
                     },
                 },
-                core_better_auth_user_mapper_1.CoreBetterAuthUserMapper,
-                core_better_auth_middleware_1.CoreBetterAuthMiddleware,
-                core_better_auth_api_middleware_1.CoreBetterAuthApiMiddleware,
-                core_better_auth_rate_limiter_service_1.CoreBetterAuthRateLimiter,
-                core_better_auth_rate_limit_middleware_1.CoreBetterAuthRateLimitMiddleware,
+                CoreBetterAuthUserMapper,
+                CoreBetterAuthMiddleware,
+                CoreBetterAuthApiMiddleware,
+                CoreBetterAuthRateLimiter,
+                CoreBetterAuthRateLimitMiddleware,
                 {
-                    inject: [core_better_auth_service_1.CoreBetterAuthService, (0, mongoose_1.getConnectionToken)()],
-                    provide: better_auth_token_service_1.BetterAuthTokenService,
+                    inject: [CoreBetterAuthService, getConnectionToken()],
+                    provide: BetterAuthTokenService,
                     useFactory: (betterAuthService, connection) => {
-                        return new better_auth_token_service_1.BetterAuthTokenService(betterAuthService, connection);
+                        return new BetterAuthTokenService(betterAuthService, connection);
                     },
                 },
-                core_better_auth_challenge_service_1.CoreBetterAuthChallengeService,
+                CoreBetterAuthChallengeService,
                 this.getResolverClass(),
-                ...(this.shouldRegisterRolesGuardGlobally && !roles_guard_registry_1.RolesGuardRegistry.isRegistered()
+                ...(this.shouldRegisterRolesGuardGlobally && !RolesGuardRegistry.isRegistered()
                     ? (() => {
-                        roles_guard_registry_1.RolesGuardRegistry.markRegistered('CoreBetterAuthModule');
-                        return [better_auth_roles_guard_1.BetterAuthRolesGuard, { provide: core_1.APP_GUARD, useExisting: better_auth_roles_guard_1.BetterAuthRolesGuard }];
+                        RolesGuardRegistry.markRegistered('CoreBetterAuthModule');
+                        return [
+                            BetterAuthRolesGuard,
+                            { provide: APP_GUARD, useExisting: BetterAuthRolesGuard },
+                            { provide: ROLE_GUARD, useExisting: BetterAuthRolesGuard },
+                        ];
                     })()
                     : []),
             ],
@@ -619,17 +637,17 @@ let CoreBetterAuthModule = class CoreBetterAuthModule {
         }
     }
 };
-exports.CoreBetterAuthModule = CoreBetterAuthModule;
-exports.CoreBetterAuthModule = CoreBetterAuthModule = CoreBetterAuthModule_1 = __decorate([
-    (0, common_1.Global)(),
-    (0, common_1.Module)({}),
-    __param(0, (0, common_1.Optional)()),
-    __param(1, (0, common_1.Optional)()),
-    __param(2, (0, common_1.Optional)()),
-    __param(3, (0, common_1.Optional)()),
-    __metadata("design:paramtypes", [core_better_auth_service_1.CoreBetterAuthService,
-        core_better_auth_rate_limiter_service_1.CoreBetterAuthRateLimiter,
-        core_better_auth_user_mapper_1.CoreBetterAuthUserMapper,
-        better_auth_token_service_1.BetterAuthTokenService])
+CoreBetterAuthModule = CoreBetterAuthModule_1 = __decorate([
+    Global(),
+    Module({}),
+    __param(0, Optional()),
+    __param(1, Optional()),
+    __param(2, Optional()),
+    __param(3, Optional()),
+    __metadata("design:paramtypes", [CoreBetterAuthService,
+        CoreBetterAuthRateLimiter,
+        CoreBetterAuthUserMapper,
+        BetterAuthTokenService])
 ], CoreBetterAuthModule);
+export { CoreBetterAuthModule };
 //# sourceMappingURL=core-better-auth.module.js.map