@lenne.tech/nest-server 12.3.0 → 12.3.2

package/src/core/modules/ai/core-ai.controller.ts

@@ -1,4 +1,4 @@
-import { Body, Controller, Delete, Get, Inject, Param, Post, Put, Query, Res } from '@nestjs/common';
+import { Body, Controller, Delete, Get, Inject, Optional, Param, Post, Put, Query, Res } from '@nestjs/common';
 import type { Response } from 'express';
 
 import { RESTServiceOptions } from '../../common/decorators/rest-service-options.decorator.js';
@@ -6,6 +6,7 @@ import { Roles } from '../../common/decorators/roles.decorator.js';
 import { RoleEnum } from '../../common/enums/role.enum.js';
 import type { ServiceOptions } from '../../common/interfaces/service-options.interface.js';
 import { RequestContext } from '../../common/services/request-context.service.js';
+import { AI_MCP_ENABLED } from './core-ai.constants.js';
 import { CoreAiBudgetLimitCreateInput } from './inputs/core-ai-budget-limit-create.input.js';
 import { CoreAiBudgetLimitInput } from './inputs/core-ai-budget-limit.input.js';
 import { CoreAiConnectionCreateInput } from './inputs/core-ai-connection-create.input.js';
@@ -31,6 +32,7 @@ import { CoreAiPrompt } from './models/core-ai-prompt.model.js';
 import { CoreAiSlot } from './models/core-ai-slot.model.js';
 import { CoreAiResponse } from './models/core-ai-response.model.js';
 import { CoreAiSettings } from './models/core-ai-settings.model.js';
+import { CoreAiStatus } from './models/core-ai-status.model.js';
 import { CoreAiUsageInfo } from './models/core-ai-usage-info.model.js';
 import { CoreAiBudgetService } from './services/core-ai-budget.service.js';
 import { CoreAiConnectionPreferenceService } from './services/core-ai-connection-preference.service.js';
@@ -48,6 +50,7 @@ import { CoreAiService } from './services/core-ai.service.js';
 /**
  * REST controller for AI prompts and connection management.
  *
+ * - `GET /ai/status`: everyone, also without a session.
  * - `POST /ai/prompt`: any authenticated user.
  * - `/ai/connections*`: admin only.
  *
@@ -77,6 +80,22 @@ export class CoreAiController {
   @Inject(CoreAiUserSettingService)
   protected readonly userSettingService: CoreAiUserSettingService;
 
+  /** Whether the MCP endpoint is registered (`ai.mcp`, 12.3.1+). A property for the same reason as the settings. */
+  @Optional()
+  @Inject(AI_MCP_ENABLED)
+  protected readonly mcpEnabled?: boolean;
+
+  /**
+   * What the AI module offers on this server (12.3.1+). Public on purpose: a frontend asks before anybody signs in,
+   * to decide whether it shows the assistant at all. The route exists only while the module is registered, so a
+   * `404` is the answer "AI is off"; the body names no user data.
+   */
+  @Get('status')
+  @Roles(RoleEnum.S_EVERYONE)
+  async status(): Promise<CoreAiStatus> {
+    return { mcp: this.mcpEnabled === true };
+  }
+
   /**
    * Send a prompt to the AI assistant.
    */

package/src/core/modules/ai/core-ai.module.ts

@@ -8,6 +8,7 @@ import { CoreAiMcpOAuthService } from './services/core-ai-mcp-oauth.service.js';
 import { CoreAiMcpService } from './services/core-ai-mcp.service.js';
 import { CorePersistenceModule } from '../../common/persistence/core-persistence.module.js';
 import {
+  AI_MCP_ENABLED,
   AI_MCP_OAUTH_CLIENT_MODEL,
   AI_MCP_OAUTH_CODE_MODEL,
   AI_MCP_OAUTH_REFRESH_TOKEN_MODEL,
@@ -274,6 +275,7 @@ export class CoreAiModule {
         AskUserQuestionAiTool,
         SearchToolsAiTool,
         LlmProviderFactory,
+        { provide: AI_MCP_ENABLED, useValue: options.mcpEnabled === true },
         { provide: AI_BUDGET_LIMIT_CLASS, useValue: CoreAiBudgetLimit },
         { provide: AI_CONNECTION_CLASS, useValue: CoreAiConnection },
         { provide: AI_CONNECTION_PREFERENCE_CLASS, useValue: CoreAiConnectionPreference },

package/src/core/modules/ai/index.ts

@@ -57,6 +57,7 @@ export * from './models/core-ai-tool-grant.model.js';
 export * from './models/core-ai-mode.model.js';
 export * from './models/core-ai-tool-policy.model.js';
 export * from './models/core-ai-settings.model.js';
+export * from './models/core-ai-status.model.js';
 export * from './models/core-ai-user-setting.model.js';
 export * from './models/core-ai-response.model.js';
 export * from './models/core-ai-usage-info.model.js';

package/src/core/modules/ai/models/core-ai-status.model.ts

@@ -0,0 +1,16 @@
+import { Field, ObjectType } from '@nestjs/graphql';
+
+import { Restricted } from '../../../common/decorators/restricted.decorator.js';
+import { RoleEnum } from '../../../common/enums/role.enum.js';
+
+/**
+ * What the AI module offers on this server (12.3.1+). Answer of the public `GET /ai/status`, which exists only while
+ * the module is registered — a `404` there is the answer "AI is off". Names no user data.
+ */
+@ObjectType({ description: 'What the AI module offers on this server' })
+@Restricted(RoleEnum.S_EVERYONE)
+export class CoreAiStatus {
+  /** Whether the MCP server answers at `/ai/mcp` (`ai.mcp`). */
+  @Field(() => Boolean, { description: 'Whether the MCP server answers at /ai/mcp' })
+  mcp: boolean;
+}

package/src/core/modules/better-auth/INTEGRATION-CHECKLIST.md

@@ -18,14 +18,17 @@ From `@lenne.tech/nest-server` 11.37.0, better-auth is **not** a dependency of t
 non-optional **peer dependency**, so your project declares and owns the version:
 
 ```bash
-pnpm add better-auth@1.7.7 @better-auth/passkey@1.7.7 @better-auth/core@1.7.7
+pnpm add better-auth@1.7.16 @better-auth/passkey@1.7.16 @better-auth/core@1.7.16
 ```
 
+1.7.16 is the floor since nest-server 12.3.1: it closes the better-auth advisories published on 2026-11-03 (social
+sign-in, passkeys, e-mail change links, revoked sessions with a session cache).
+
 **Pin all three to the same exact version** — no `^`, no `~`. They are one release train, and a
 mixed set fails in ways the type checker does not catch.
 
 > **Do not rely on `pnpm install` to remind you.** On pnpm's default `autoInstallPeers: true` the
-> packages are installed silently at whatever version satisfies `>=1.7.7 <1.8.0` — your build stays
+> packages are installed silently at whatever version satisfies `>=1.7.16 <1.8.0` — your build stays
 > green while the version is unpinned and free to drift. Verify with `pnpm why better-auth`.
 
 **Why peers rather than dependencies:** in a fullstack project the frontend talks to better-auth

package/src/core/modules/better-auth/better-auth.config.ts

@@ -1065,15 +1065,20 @@ function buildPlugins(
       rpName: normalizedPasskey.rpName,
     };
 
-    // Add optional WebAuthn configuration if specified
+    // The plugin reads these three from `authenticatorSelection` only. Until 12.3.1 they were set at the top level and
+    // ignored, so `userVerification: 'required'` enforced nothing; the plugin's own defaults fill what is not set
+    const authenticatorSelection: Record<string, string> = {};
     if (normalizedPasskey.authenticatorAttachment) {
-      passkeyOptions.authenticatorAttachment = normalizedPasskey.authenticatorAttachment;
+      authenticatorSelection.authenticatorAttachment = normalizedPasskey.authenticatorAttachment;
     }
     if (normalizedPasskey.residentKey) {
-      passkeyOptions.residentKey = normalizedPasskey.residentKey;
+      authenticatorSelection.residentKey = normalizedPasskey.residentKey;
     }
     if (normalizedPasskey.userVerification) {
-      passkeyOptions.userVerification = normalizedPasskey.userVerification;
+      authenticatorSelection.userVerification = normalizedPasskey.userVerification;
+    }
+    if (Object.keys(authenticatorSelection).length > 0) {
+      passkeyOptions.authenticatorSelection = authenticatorSelection;
     }
     if (normalizedPasskey.webAuthnChallengeCookie) {
       // The plugin reads the name from `advanced`; a top-level option is ignored