@lenne.tech/nest-server 12.1.1 → 12.3.0

package/src/core/modules/ai/services/core-ai.service.ts

@@ -10,6 +10,7 @@ import {
 } from '../../../common/services/rate-limit-store.js';
 import { RequestContext } from '../../../common/services/request-context.service.js';
 import { ErrorCode } from '../../error-code/index.js';
+import { authorizeToolCall, toolRequiresConfirmation } from '../helpers/ai-tool-authorization.helper.js';
 import { AiToolAuthorization, AiToolContext, AiToolResult, IAiTool } from '../interfaces/ai-tool.interface.js';
 import { LlmMessage, LlmResponse, LlmToolCall } from '../interfaces/llm-provider.interface.js';
 import { ResolvedAiConnection } from '../interfaces/resolved-ai-connection.interface.js';
@@ -107,6 +108,9 @@ export interface AiRunContext {
 export class CoreAiService {
   protected readonly logger = new Logger(CoreAiService.name);
 
+  /** Connections already warned about a crowded context window; created on first use, at most 1000 entries. */
+  protected crowdedContextWarned?: Set<string>;
+
   /** Rate-limit counters keyed by user id (Redis-backed when configured). */
   protected rateLimitStore?: RateLimitStore;
 
@@ -142,7 +146,10 @@ export class CoreAiService {
     hooks?: { onAction?: (action: CoreAiAction) => void },
   ): Promise<CoreAiResponse> {
     const mode = input.mode || ConfigService.get<string>('ai.defaultMode') || 'auto';
-    const resolvedInput = await this.resolvePromptPlaceholders(input, serviceOptions);
+    const resolvedInput = await this.scopeConversation(
+      await this.resolvePromptPlaceholders(input, serviceOptions),
+      serviceOptions,
+    );
     const run = await this.prepareRun(resolvedInput, serviceOptions);
     // No usable connection → AI handling is effectively disabled.
     if (!run) {
@@ -157,6 +164,28 @@ export class CoreAiService {
     return response;
   }
 
+  /**
+   * Keep `conversationId` only when the caller owns that conversation; otherwise the run has no conversation at all:
+   * no history, no persisted turns, no conversation-scoped tool grants, and no `conversationId` in the response.
+   *
+   * Every conversation use of the run reads the id from the input, so it is decided once, before the run starts. A
+   * foreign id must not reach any of them: its turns would land in another user's history and feed that user's next
+   * runs, where tools act with the owner's rights, and a "remember my decision" grant stored on it would let the
+   * owner's assistant run a mutating tool unconfirmed. Admins included — they may read other users' conversations,
+   * never continue them. An unknown id is answered exactly like a foreign one, so the response tells nobody which
+   * conversation ids exist.
+   */
+  protected async scopeConversation(
+    input: CoreAiPromptInput,
+    serviceOptions: ServiceOptions,
+  ): Promise<CoreAiPromptInput> {
+    if (!input?.conversationId) {
+      return input;
+    }
+    const owned = await this.conversationService?.isOwnedBy(input.conversationId, serviceOptions?.currentUser?.id);
+    return owned ? input : { ...input, conversationId: undefined };
+  }
+
   /**
    * Resolve `{{placeholder}}` tokens in the user's prompt text via the
    * runtime placeholder registry. Returns the input untouched when no
@@ -403,6 +432,10 @@ export class CoreAiService {
       },
     );
     const toolSchemas = this.promptBuilder.buildToolSchemas(tools);
+    // A native connection carries the tool definitions in the payload, outside the messages: they occupy the context
+    // window all the same, so they come off the input budget (12.3.0).
+    const toolTokens = provider.capabilities.nativeTools ? this.estimateTokens(JSON.stringify(toolSchemas)) : 0;
+    this.warnOnCrowdedContext(connection, this.estimateTokens(systemPrompt) + toolTokens);
     // The JSON output contract belongs to the EMULATED protocol only: `output_contract`
     // and `tool_protocol_emulated` both carry `capability: 'emulated'`, so a NATIVE-tools
     // run is asked for PROSE and is handed no JSON shape to fill. Forcing
@@ -475,8 +508,8 @@ export class CoreAiService {
       iterations++;
       // Keep the session within the model's context window before every call:
       // LLM-driven compaction first (summarize), then hard trim as a fallback.
-      await this.compactMessages(messages, connection);
-      this.fitMessagesToContext(messages, connection);
+      await this.compactMessages(messages, connection, toolTokens);
+      this.fitMessagesToContext(messages, connection, toolTokens);
       const completion = await provider.chat(messages, toolSchemas, {
         ...jsonMode,
         maxTokens: connection.defaultMaxTokens,
@@ -642,8 +675,17 @@ export class CoreAiService {
     // Persist the turn pair for multi-turn conversations (not while awaiting confirmation
     // or a pending clarifying question — the user hasn't given a real answer yet).
     if (input.conversationId && this.conversationService && !requiresConfirmation && !pendingQuestion) {
-      await this.conversationService.appendMessage(input.conversationId, { content: input.prompt, role: 'user' });
-      await this.conversationService.appendMessage(input.conversationId, { content: finalText, role: 'assistant' });
+      const owner = currentUser?.id;
+      await this.conversationService.appendMessage(
+        input.conversationId,
+        { content: input.prompt, role: 'user' },
+        owner,
+      );
+      await this.conversationService.appendMessage(
+        input.conversationId,
+        { content: finalText, role: 'assistant' },
+        owner,
+      );
     }
 
     await this.audit({
@@ -676,6 +718,7 @@ export class CoreAiService {
 
     // 1. Planning call — the model returns the full ordered plan, executes nothing.
     const planSystemPrompt = await this.promptBuilder.buildPlanSystemPrompt(tools, currentUser, { language });
+    this.warnOnCrowdedContext(connection, this.estimateTokens(planSystemPrompt));
     const messages: LlmMessage[] = [{ content: planSystemPrompt, role: 'system' }];
     for (const turn of history) {
       messages.push({ content: turn.content, role: turn.role === 'assistant' ? 'assistant' : 'user' });
@@ -782,7 +825,7 @@ export class CoreAiService {
     response.text = finalText;
     response.usage = Object.assign(new CoreAiUsage(), usage);
 
-    await this.persistTurn(input, response);
+    await this.persistTurn(input, response, run);
     await this.audit(this.auditRecord(input, run, response, usage));
     return response;
   }
@@ -895,9 +938,10 @@ export class CoreAiService {
   }
 
   /**
-   * Pre-flight authorization for a planned/requested tool call. Combines the
-   * registry role filter (tool absent from the user's set → denied) with the
-   * tool's optional `authorize()` data-level check. Never mutates anything.
+   * Authorization for one tool call: the registry role filter (tool absent from the user's set → denied) and the
+   * tool's optional `authorize()` data-level check, fail-closed ({@link authorizeToolCall}). Runs before every
+   * execution (`executeToolCall()`) and, in plan mode, once more for the whole plan before any step runs. Never
+   * mutates anything.
    */
   protected async authorizeCall(
     call: LlmToolCall,
@@ -908,11 +952,7 @@ export class CoreAiService {
     if (!tool) {
       return { allowed: false, reason: `Unknown or not permitted tool: ${call.name}` };
     }
-    if (!tool.authorize) {
-      return { allowed: true };
-    }
-    const result = await tool.authorize(call.arguments ?? {}, context);
-    return typeof result === 'boolean' ? { allowed: result } : result;
+    return authorizeToolCall(tool, call.arguments ?? {}, context);
   }
 
   /**
@@ -921,18 +961,7 @@ export class CoreAiService {
    * client override unless enforced).
    */
   protected confirmationRequiredFor(tool: IAiTool, input: CoreAiPromptInput): boolean {
-    if (tool.destructive) {
-      return true;
-    }
-    if (!tool.mutating) {
-      return false;
-    }
-    const cfg = ConfigService.get<{ enabled?: boolean; default?: boolean; enforced?: boolean }>(
-      'ai.confirmation.mutating',
-    );
-    const enforced = cfg?.enforced === true;
-    const adminDefault = cfg?.default === true;
-    return enforced ? true : (input.requireConfirmation ?? adminDefault);
+    return toolRequiresConfirmation(tool, input.requireConfirmation);
   }
 
   /**
@@ -1051,13 +1080,22 @@ export class CoreAiService {
   }
 
   /**
-   * Append the user + assistant turns to the conversation (skipped while awaiting
+   * Append the user + assistant turns to the conversation of the run's user (skipped while awaiting
    * confirmation or when denied).
    */
-  protected async persistTurn(input: CoreAiPromptInput, response: CoreAiResponse): Promise<void> {
+  protected async persistTurn(input: CoreAiPromptInput, response: CoreAiResponse, run: AiRunContext): Promise<void> {
     if (input.conversationId && this.conversationService && !response.requiresConfirmation && !response.denied) {
-      await this.conversationService.appendMessage(input.conversationId, { content: input.prompt, role: 'user' });
-      await this.conversationService.appendMessage(input.conversationId, { content: response.text, role: 'assistant' });
+      const owner = run?.currentUser?.id;
+      await this.conversationService.appendMessage(
+        input.conversationId,
+        { content: input.prompt, role: 'user' },
+        owner,
+      );
+      await this.conversationService.appendMessage(
+        input.conversationId,
+        { content: response.text, role: 'assistant' },
+        owner,
+      );
     }
   }
 
@@ -1195,8 +1233,24 @@ export class CoreAiService {
       }
     }
 
+    // Authorize the arguments that will actually run — after the hooks rewrote them. No learning signal: a refusal
+    // is a decision about this user and these arguments, not a mistake the model should be taught to avoid.
+    const authorization = await this.authorizeCall(call, availableTools, context);
+    if (!authorization.allowed) {
+      action.success = false;
+      action.result = {
+        error: {
+          code: 'TOOL_NOT_AVAILABLE',
+          hint: 'The user may not run this tool with these arguments. Do not retry it; explain this to the user.',
+          message: authorization.reason || `Not permitted: ${call.name}`,
+        },
+      };
+      return action;
+    }
+    const toolContext: AiToolContext = tool.authorize ? { ...context, authorization } : context;
+
     try {
-      const raw = await tool.execute(call.arguments ?? {}, context);
+      const raw = await tool.execute(call.arguments ?? {}, toolContext);
       let success = true;
       let payload: unknown = raw;
       let message: string | undefined;
@@ -1468,6 +1522,47 @@ export class CoreAiService {
     return Math.max(512, window - reserve - margin);
   }
 
+  /**
+   * The share of {@link contextBudget} the messages may take: what remains after `reservedTokens` — the native tool
+   * definitions, which travel beside the messages but occupy the same window.
+   */
+  protected messageBudget(connection: ResolvedAiConnection, reservedTokens = 0): number {
+    return Math.max(512, this.contextBudget(connection) - Math.max(0, reservedTokens));
+  }
+
+  /** Share of the input budget the system prompt and tool definitions may take before {@link warnOnCrowdedContext} warns. */
+  protected crowdedContextShare(): number {
+    return 0.5;
+  }
+
+  /**
+   * Warns once per connection and process when the system prompt and the native tool definitions take more than
+   * {@link crowdedContextShare} of the input budget (12.3.0). What remains is all the conversation has: older turns
+   * are dropped early, and a long user message is cut to fit — which, logged on debug only, read as an assistant that
+   * answers generically. Names the remedy: a context window for the connection, or a smaller catalog.
+   */
+  protected warnOnCrowdedContext(connection: ResolvedAiConnection, fixedTokens: number): void {
+    const budget = this.contextBudget(connection);
+    const key = connection.id ?? connection.name ?? '';
+    const warned = (this.crowdedContextWarned ??= new Set<string>());
+    if (fixedTokens <= budget * this.crowdedContextShare() || warned.has(key)) {
+      return;
+    }
+    if (warned.size >= 1000) {
+      warned.clear();
+    }
+    warned.add(key);
+    const window = connection.contextWindow
+      ? `its context window of ${connection.contextWindow}`
+      : `the ai.contextWindow fallback of ${ConfigService.get<number>('ai.contextWindow') ?? 8192} (the connection has no context window of its own)`;
+    this.logger.warn(
+      `AI connection "${connection.name ?? key}": the system prompt and tool definitions take ~${fixedTokens} of ` +
+        `${budget} input tokens (${window}). Little room is left for the conversation: older turns are dropped ` +
+        `early and a long message is cut. Set the connection's contextWindow, or shrink the tool catalog ` +
+        `(ai.deferToolSchemas, fewer tools per role).`,
+    );
+  }
+
   /**
    * Keep the assembled session messages within the model's context window. Operates
    * per user/session: the system prompt (index 0) and the most recent message (the
@@ -1483,14 +1578,18 @@ export class CoreAiService {
    *
    * Enabled by `ai.compaction !== false`. When OFF, only the hard trim is used.
    */
-  protected async compactMessages(messages: LlmMessage[], connection: ResolvedAiConnection): Promise<number> {
+  protected async compactMessages(
+    messages: LlmMessage[],
+    connection: ResolvedAiConnection,
+    reservedTokens = 0,
+  ): Promise<number> {
     if (ConfigService.get<boolean>('ai.compaction') === false) {
       return 0;
     }
     if (messages.length <= 3) {
       return 0;
     }
-    const budget = this.contextBudget(connection);
+    const budget = this.messageBudget(connection, reservedTokens);
     const total = (): number => messages.reduce((sum, m) => sum + this.estimateTokens(m.content) + 4, 0);
     if (total() <= budget) {
       return 0;
@@ -1539,11 +1638,11 @@ export class CoreAiService {
     }
   }
 
-  protected fitMessagesToContext(messages: LlmMessage[], connection: ResolvedAiConnection): void {
+  protected fitMessagesToContext(messages: LlmMessage[], connection: ResolvedAiConnection, reservedTokens = 0): void {
     if (messages.length === 0) {
       return;
     }
-    const budget = this.contextBudget(connection);
+    const budget = this.messageBudget(connection, reservedTokens);
     const total = (): number => messages.reduce((sum, m) => sum + this.estimateTokens(m.content) + 4, 0);
     let dropped = 0;
     // Drop oldest non-system, non-last messages until within budget.

package/src/core/modules/api-token/README.md

@@ -199,8 +199,10 @@ it has no signed assertions.
   `betterAuth.emailAndPassword.revokeSessionsOnPasswordReset` is on. With it off — and on a password
   CHANGE — user tokens survive, like personal access tokens elsewhere; after a suspected compromise
   call `revokeAllForUser(userId)`. Tenant tokens are never touched by a user's reset.
-- **Deleting a tenant.** Call `deleteAllForTenant(tenantId)` — nothing does it for you, and until you
-  do, the tenant's tokens keep authenticating (the core has no tenant model to notice the deletion).
+- **Deleting a tenant.** Call `CoreTenantService.purgeTenantData(tenantId)`, which deletes the tokens
+  with the rest of the tenant's data, or `deleteAllForTenant(tenantId)` for the tokens alone — nothing
+  does it for you, and until you do, the tenant's tokens keep authenticating (the core has no tenant
+  model to notice the deletion).
 - **Banned users.** If you add Better-Auth's admin plugin, override `loadTokenUser()` so a banned
   user's tokens are refused as well — the framework does not know that flag.
 - **Brute force.** Failed attempts are not limited per IP (guessing 256 bits is not the risk); add an

package/src/core/modules/better-auth/CUSTOMIZATION.md

@@ -472,7 +472,7 @@ const config = {
       template: 'email-verification', // Default: 'email-verification'
       expiresIn: 86400, // Default: 86400 (24 hours)
       callbackURL: '/auth/verify-email', // Frontend verification page
-      autoSignInAfterVerification: true, // Default: true
+      autoSignInAfterVerification: false, // Default: false — true signs in whoever opens the link (see README)
       resendCooldownSeconds: 60, // Default: 60
     },
   },

package/src/core/modules/better-auth/INTEGRATION-CHECKLIST.md

@@ -273,6 +273,10 @@ Email verification is **enabled by default** via Better-Auth's `emailVerificatio
 - Users receive a verification email after sign-up
 - Email contains a verification link with token
 - After verification, `verifiedAt` is automatically set on the user
+- The user is **not** signed in by the verification link and signs in once afterwards (12.3.0+, as in Better-Auth).
+  `emailVerification: { autoSignInAfterVerification: true }` signs in whoever opens the link, to the link owner's
+  account — a forwarded link signs its recipient in to the sender's account. Your frontend's verify page should lead
+  to the sign-in rather than expect a session
 - Templates are provided in German and English
 
 ### Configuration
@@ -448,6 +452,9 @@ After integration, verify:
 - [ ] GraphQL `betterAuthSignUp` returns error `LTNS_0026`
 - [ ] `GET /iam/features` reports `signUpEnabled: false`
 - [ ] Sign-in still works for existing users
+- [ ] With a social provider: a first social sign-in of an unknown user creates no account (`error=signup_disabled`),
+      an existing user still signs in through it. A provider meant for self-registration carries
+      `disableSignUp: false` (12.3.0+)
 
 ### Additional checks for Migration scenario:
 

package/src/core/modules/better-auth/README.md

@@ -550,6 +550,13 @@ const config = {
 
 **Brevo Integration:** When `brevoTemplateId` is set and Brevo is configured (`config.brevo`), verification emails are sent via Brevo's transactional API instead of SMTP/EJS templates. The same template variables (`name`, `link`, `appName`, `expiresIn`) are passed to the Brevo template.
 
+**Auto sign-in after verification (`autoSignInAfterVerification`, default `false` since 12.3.0):** with it on,
+`GET /iam/verify-email` signs in the browser that opens the link — to the account the link belongs to, whoever opens
+it. Someone who signs up with their own address and forwards the unopened link then has the recipient's browser signed
+in to their account, and what the recipient enters there lands with them (login CSRF). Off, the user verifies and then
+signs in once, as in Better-Auth's own default. Switch it on (`emailVerification: { autoSignInAfterVerification: true }`)
+only where a verification link reaches nobody but its owner.
+
 ### Sign-Up Checks (v11.13.0+)
 
 Sign-up validation is **enabled by default** requiring `termsAndPrivacyAccepted: true`.
@@ -622,13 +629,31 @@ When disabled:
 - REST `POST /iam/sign-up/email` returns `400 Bad Request` with error `LTNS_0026`
 - GraphQL `betterAuthSignUp` mutation returns error `LTNS_0026`
 - `betterAuthFeatures` reports `signUpEnabled: false`
-- Sign-in continues to work for existing users
+- A first sign-in through a social provider creates no account (since 12.3.0): the OAuth callback redirects with
+  `error=signup_disabled`, `/sign-in/social` with an `idToken` answers 401 `signup disabled`
+- Sign-in continues to work for existing users, through e-mail and every social provider
 
 **Defense in Depth:** The flag is enforced at two layers:
 
 1. **Custom check** (`CoreBetterAuthService.ensureSignUpEnabled()`) runs in Controller/Resolver _before_ any BetterAuth API call and returns a structured `LTNS_0026` error.
 2. **Native BetterAuth** `emailAndPassword.disableSignUp` acts as a safety net for any direct API access that bypasses the custom check.
 
+**Social providers:** Better-Auth reads `emailAndPassword.disableSignUp` for `/sign-up/email` only and decides a social
+sign-up per provider, so `buildSocialProviders()` hands every provider the flag as its own `disableSignUp`. One provider
+can deviate on purpose:
+
+```typescript
+socialProviders: {
+  google: { clientId: '...', clientSecret: '...', disableSignUp: false }, // new users through Google despite the global flag
+  github: { clientId: '...', clientSecret: '...', disableSignUp: true },  // closed for GitHub even while sign-up is open
+},
+```
+
+Only a boolean counts on the provider; any other value follows `emailAndPassword.disableSignUp`, so a string from
+`NEST_SERVER_CONFIG` cannot open a closed registration. Plugins a project adds itself through `betterAuth.options.plugins`
+(Generic OAuth, Magic Link, …) are not covered and need their own sign-up options. Before 12.3.0 every provider created
+accounts whatever `disableSignUp` said.
+
 **Default:** `false` (sign-up enabled) - fully backward compatible.
 
 ### Additional User Fields
@@ -2205,6 +2230,12 @@ These endpoints bypass rate limiting entirely:
 - `/session` - Session checks (frequent client-side calls)
 - `/callback` - OAuth callbacks
 
+Entries match whole path segments of the path the request is served under (dot segments resolved, case-insensitive, as Express routes): `/sign-in` covers
+`/sign-in/email`, `/session` does not cover `/sessions-export`. A request whose path under the base path carries a
+`.` or `..` segment (also `%2e`-encoded), a backslash, an encoded `/` or `\`, or a `#` is refused with 400
+(`#LTNS_0305: Invalid request path`) before the limiter runs — no route needs such a path, and the limiter and
+Better-Auth would otherwise read it as two different routes.
+
 ### Response Headers
 
 When rate limiting is enabled, the following headers are added to responses:

package/src/core/modules/better-auth/better-auth.config.ts

@@ -444,6 +444,7 @@ interface PasskeyNormalizationResult {
 interface SocialProviderConfig {
   clientId: string;
   clientSecret: string;
+  disableSignUp: boolean;
 }
 
 /**
@@ -955,7 +956,9 @@ function buildEmailVerificationConfig(
   // Get configuration values (with defaults)
   const configObj = typeof emailVerificationConfig === 'object' ? emailVerificationConfig : {};
   const expiresIn = configObj.expiresIn ?? 86400; // 24 hours
-  const autoSignInAfterVerification = configObj.autoSignInAfterVerification ?? true;
+  // Off unless switched on, as Better-Auth has it: on verification Better-Auth signs in the browser that opens the
+  // link, to the account the link belongs to — a forwarded link signs its recipient in to the sender's account
+  const autoSignInAfterVerification = configObj.autoSignInAfterVerification === true;
 
   const result: Record<string, unknown> = {
     autoSignInAfterVerification,
@@ -1118,9 +1121,16 @@ function serverOnlyPlugin<T extends BetterAuthPlugin>(plugin: T): T {
  * Builds the social providers configuration object dynamically.
  * Iterates over all configured providers and includes those that are enabled
  * with valid clientId and clientSecret.
+ *
+ * `emailAndPassword.disableSignUp: true` closes every way to a new account (12.3.0). Better-Auth reads that flag for
+ * `/sign-up/email` only and decides a social sign-up per provider (`provider.options.disableSignUp`, in the OAuth
+ * callback and in `/sign-in/social` with an `idToken`), so each provider receives it explicitly. A boolean
+ * `disableSignUp` on the provider is the deliberate exception for that provider; any other value follows the global
+ * flag, so a string arriving through `NEST_SERVER_CONFIG` cannot open a closed registration.
  */
 function buildSocialProviders(config: IBetterAuth): Record<string, SocialProviderConfig> {
   const socialProvidersConfig: Record<string, SocialProviderConfig> = {};
+  const signUpClosed = config.emailAndPassword?.disableSignUp === true;
 
   // Iterate over all configured social providers dynamically
   // A provider is enabled by default if it has credentials configured
@@ -1131,6 +1141,7 @@ function buildSocialProviders(config: IBetterAuth): Record<string, SocialProvide
         socialProvidersConfig[name] = {
           clientId: provider.clientId,
           clientSecret: provider.clientSecret,
+          disableSignUp: typeof provider.disableSignUp === 'boolean' ? provider.disableSignUp : signUpClosed,
         };
       }
     }

package/src/core/modules/better-auth/core-better-auth-email-verification.service.ts

@@ -38,7 +38,7 @@ type ResolvedEmailVerificationConfig = Pick<
  * Default configuration for email verification
  */
 const DEFAULT_CONFIG: ResolvedEmailVerificationConfig = {
-  autoSignInAfterVerification: true,
+  autoSignInAfterVerification: false,
   callbackURL: '/auth/verify-email',
   enabled: true,
   expiresIn: 86400, // 24 hours in seconds
@@ -192,9 +192,12 @@ export class CoreBetterAuthEmailVerificationService {
 
   /**
    * Check if auto sign-in after verification is enabled
+   *
+   * `=== true` as in `better-auth.config.ts`, which decides what Better-Auth does: a value arriving as
+   * a string in `NEST_SERVER_CONFIG` must not report a sign-in that Better-Auth never performs.
    */
   shouldAutoSignIn(): boolean {
-    return this.config.autoSignInAfterVerification;
+    return this.config.autoSignInAfterVerification === true;
   }
 
   /**

package/src/core/modules/better-auth/core-better-auth-path-guard.middleware.ts

@@ -0,0 +1,85 @@
+import { BadRequestException, Injectable, NestMiddleware } from '@nestjs/common';
+import type { NextFunction, Request, Response } from 'express';
+
+import { ErrorCode } from '../error-code/error-codes.js';
+
+/**
+ * Whether a raw request path contains something URL resolution rewrites: a `.` or `..` segment (also
+ * percent-encoded), a backslash (a segment separator for WHATWG URLs), an encoded slash or backslash, or a `#`
+ * (Express routes the part before it, the forwarding to Better-Auth reads the whole string).
+ *
+ * Every check in front of Better-Auth (rate limiter, controller routes, password routes) reads the RAW path, while
+ * Better-Auth routes the path `new URL()` resolved. A path the two read differently passes those checks as one route
+ * and runs as another. No route under the Better-Auth base path needs any of these, so such a request is refused.
+ *
+ * A loop over segments, no regex over the whole path: the path comes from an unauthenticated request and may be as
+ * long as Node's header limit allows.
+ */
+export function hasNonCanonicalPathSegments(path: string): boolean {
+  if (path.includes('\\') || path.includes('#')) {
+    return true;
+  }
+  for (const segment of path.split('/')) {
+    if (segment.includes('%')) {
+      const lower = segment.toLowerCase();
+      if (lower.includes('%2f') || lower.includes('%5c')) {
+        return true;
+      }
+    }
+    // The longest dot segment is `%2e%2e`
+    if (segment.length === 0 || segment.length > 6) {
+      continue;
+    }
+    const dots = segment.replace(/%2e/gi, '.');
+    if (dots === '.' || dots === '..') {
+      return true;
+    }
+  }
+  return false;
+}
+
+/**
+ * The path as Better-Auth routes it: dot segments resolved (also percent-encoded ones), backslashes read as slashes —
+ * what `new URL()` makes of it. Query string and fragment are dropped. A path `new URL()` refuses comes back as given.
+ */
+export function canonicalRequestPath(path: string): string {
+  try {
+    return new URL(path, 'http://canonical.invalid').pathname;
+  } catch {
+    return path;
+  }
+}
+
+/**
+ * Whether `path` contains the segments of `endpoint` as a contiguous run of WHOLE segments: `/sign-in` matches
+ * `/sign-in/email` and `/phone-number/sign-in`, never `/sign-in-legacy`. Segments are compared as they are; pass a
+ * {@link canonicalRequestPath} result, so `..` is already resolved.
+ */
+export function pathContainsSegments(path: string, endpoint: string): boolean {
+  const wanted = endpoint.split('/').filter(Boolean);
+  if (wanted.length === 0) {
+    return false;
+  }
+  const segments = path.split('/').filter(Boolean);
+  for (let start = 0; start + wanted.length <= segments.length; start++) {
+    if (wanted.every((segment, offset) => segments[start + offset] === segment)) {
+      return true;
+    }
+  }
+  return false;
+}
+
+/**
+ * First middleware under the Better-Auth base path: refuses a request whose path is not in canonical form (see
+ * {@link hasNonCanonicalPathSegments}) with 400, before any check reads that path.
+ */
+@Injectable()
+export class CoreBetterAuthPathGuardMiddleware implements NestMiddleware {
+  use(req: Request, _res: Response, next: NextFunction) {
+    const path = (req.originalUrl || req.url || '').split('?')[0];
+    if (hasNonCanonicalPathSegments(path)) {
+      throw new BadRequestException(ErrorCode.INVALID_REQUEST_PATH);
+    }
+    next();
+  }
+}

package/src/core/modules/better-auth/core-better-auth-rate-limit.middleware.ts

@@ -50,9 +50,12 @@ export class CoreBetterAuthRateLimitMiddleware implements NestMiddleware {
     // Get client IP
     const ip = this.getClientIp(req);
 
-    // Get the path relative to basePath
+    // The path relative to basePath, read from `originalUrl`: Nest mounts this middleware on `${basePath}/*path`, and
+    // Express moves the whole match into `req.baseUrl`, so `req.path` is "/" for every request here. Reading it made
+    // every IAM request of one client share a single counter with the full limit — no skip list, no strict limit
     const basePath = this.betterAuthService.getBasePath();
-    const path = req.path.startsWith(basePath) ? req.path.substring(basePath.length) : req.path;
+    const requestPath = (req.originalUrl || req.url || '').split('?')[0];
+    const path = requestPath.startsWith(basePath) ? requestPath.substring(basePath.length) : requestPath;
 
     // Check rate limit
     const result = await this.rateLimiter.check(ip, path);

package/src/core/modules/better-auth/core-better-auth-rate-limiter.service.ts

@@ -2,6 +2,7 @@ import { Injectable, Logger, Optional } from '@nestjs/common';
 
 import { IBetterAuthRateLimit } from '../../common/interfaces/server-options.interface.js';
 import { CoreRedisService } from '../../common/services/core-redis.service.js';
+import { canonicalRequestPath, pathContainsSegments } from './core-better-auth-path-guard.middleware.js';
 import {
   InMemoryRateLimitStore,
   rateLimitKey,
@@ -134,10 +135,10 @@ export class CoreBetterAuthRateLimiter {
    * Check if a request is allowed under the rate limit
    *
    * @param ip - Client IP address
-   * @param path - Request path (relative to basePath)
+   * @param requestPath - Request path (relative to basePath), as sent; dot segments are resolved here
    * @returns Rate limit check result
    */
-  async check(ip: string, path: string): Promise<RateLimitResult> {
+  async check(ip: string, requestPath: string): Promise<RateLimitResult> {
     // If rate limiting is disabled, always allow
     if (!this.config.enabled) {
       return {
@@ -149,6 +150,13 @@ export class CoreBetterAuthRateLimiter {
       };
     }
 
+    // Decide on the path the request is served under, not the one as sent: `/callback/../sign-in/email` reaches the
+    // sign-in handler, so it must not be skipped as a callback (CoreBetterAuthPathGuardMiddleware refuses such paths
+    // before they get here; this keeps the limiter correct where that guard is not registered). Lower-cased because
+    // Express routes case-insensitively: `/sign-in/EMAIL` is the same sign-in and must share its counter and its
+    // strict limit
+    const path = canonicalRequestPath(requestPath).toLowerCase();
+
     // Check if this endpoint should skip rate limiting
     if (this.shouldSkip(path)) {
       return {
@@ -249,10 +257,11 @@ export class CoreBetterAuthRateLimiter {
   }
 
   /**
-   * Determine if an endpoint should skip rate limiting
+   * Determine if an endpoint should skip rate limiting: an entry matches whole path segments, so `/session` skips
+   * `/session` but not `/sessions-export`
    */
   private shouldSkip(path: string): boolean {
-    return this.config.skipEndpoints.some((skip) => path === skip || path.endsWith(skip) || path.includes(skip));
+    return this.config.skipEndpoints.some((skip) => pathContainsSegments(path, skip.toLowerCase()));
   }
 
   /**
@@ -260,9 +269,7 @@ export class CoreBetterAuthRateLimiter {
    * Strict endpoints get half the normal limit
    */
   private getLimit(path: string): number {
-    const isStrict = this.config.strictEndpoints.some(
-      (strict) => path === strict || path.endsWith(strict) || path.includes(strict),
-    );
+    const isStrict = this.config.strictEndpoints.some((strict) => pathContainsSegments(path, strict.toLowerCase()));
 
     return isStrict ? Math.ceil(this.config.max / 2) : this.config.max;
   }