@starci/hfs 4.9.8 → 4.9.11

package/templates/be/skeleton/src/modules/platform/http-security/persistence/migrations/1789900000000-create-rate-windows.ts

@@ -0,0 +1,24 @@
+import type { MigrationInterface, QueryRunner } from "typeorm"
+
+/** Creates the rate limit windows every api replica counts in. */
+export class CreateRateWindows1789900000000 implements MigrationInterface {
+    name = "CreateRateWindows1789900000000"
+
+    /** Creates the windows table and the index the prune reads. */
+    async up(queryRunner: QueryRunner): Promise<void> {
+        await queryRunner.query(`CREATE TABLE http_security_rate_windows (
+    key varchar(128) PRIMARY KEY,
+    hits integer NOT NULL CHECK (hits > 0),
+    reset_at timestamptz NOT NULL
+)`)
+        await queryRunner.query(
+            `CREATE INDEX ix_http_security_rate_windows_reset_at ON http_security_rate_windows (reset_at)`,
+        )
+    }
+
+    /** Drops the index and the table. */
+    async down(queryRunner: QueryRunner): Promise<void> {
+        await queryRunner.query(`DROP INDEX ix_http_security_rate_windows_reset_at`)
+        await queryRunner.query(`DROP TABLE http_security_rate_windows`)
+    }
+}

package/templates/be/skeleton/src/modules/platform/http-security/persistence/rate-limit.rows.ts

@@ -0,0 +1,5 @@
+/** The row HIT_RATE_WINDOW answers. */
+export interface RateWindowRow {
+    /** The hits of the caller's current window, this one included. */
+    readonly hits: number
+}

package/templates/be/skeleton/src/modules/platform/http-security/persistence/rate-limit.sql.ts

@@ -0,0 +1,20 @@
+import { sql } from "@modules/platform/database"
+
+/**
+ * Counts one hit in the caller's window and answers the hits of that window: a missing or expired window opens afresh at one
+ * hit and ends at $3 ($1 tier and address key, $2 instant, $3 end of a fresh window).
+ */
+export const HIT_RATE_WINDOW = sql`INSERT INTO http_security_rate_windows (key, hits, reset_at)
+    VALUES ($1::varchar, 1, $3::timestamptz)
+    ON CONFLICT (key) DO UPDATE SET
+        hits = CASE WHEN http_security_rate_windows.reset_at <= $2::timestamptz THEN 1
+            ELSE http_security_rate_windows.hits + 1 END,
+        reset_at = CASE WHEN http_security_rate_windows.reset_at <= $2::timestamptz THEN EXCLUDED.reset_at
+            ELSE http_security_rate_windows.reset_at END
+    RETURNING hits`
+
+/** Deletes a bounded batch of the windows that ended by $1; a second replica skips the rows this one holds. */
+export const PRUNE_RATE_WINDOWS = sql`DELETE FROM http_security_rate_windows WHERE key IN (
+    SELECT key FROM http_security_rate_windows WHERE reset_at <= $1::timestamptz
+    LIMIT 100 FOR UPDATE SKIP LOCKED
+)`

package/templates/be/skeleton/src/modules/platform/http-security/rate-limit.guard.spec.ts

@@ -1,111 +1,213 @@
 import "reflect-metadata"
 import type { ExecutionContext, Type } from "@nestjs/common"
-import type { Request } from "express"
+import type { Request, Response } from "express"
 import { Reflector } from "@nestjs/core"
 import { Test } from "@nestjs/testing"
-import { FakeClock, mock } from "@starci/jest-preset"
+import { FakeClock, mock, mockEntityManager } from "@starci/jest-preset"
+import type { MockEntityManager } from "@starci/jest-preset"
 import { CLOCK } from "@modules/platform/clock"
+import { PRIMARY_ENTITY_MANAGER } from "@modules/platform/database"
 import { HttpSecurityErrorCode } from "./errors/http-security.error"
 import { HTTP_SECURITY_OPTIONS } from "./http-security.decorators"
 import type { HttpSecurityOptions } from "./http-security.options"
+import { HIT_RATE_WINDOW, PRUNE_RATE_WINDOWS } from "./persistence/rate-limit.sql"
 import { RateLimit, RateLimitGuard, RateTier } from "./rate-limit.guard"
+import type { RateLimitExceeded } from "./rate-limit.guard"
 
 const AT = "2026-02-03T04:05:06.000Z"
+const RESET_AT = "2026-02-03T04:06:06.000Z"
 const options: HttpSecurityOptions = {
     allowedOrigins: [],
     rateLimit: { windowMs: 60_000, defaultLimit: 2, strictLimit: 1 },
     webhooks: {},
 }
 
-const build = async (clock: FakeClock, tier?: RateTier) => {
+const build = async (entityManager: MockEntityManager, tier?: RateTier, exceeded?: RateLimitExceeded) => {
     const reflector = mock<Reflector>()
-    reflector.getAllAndOverride.mockReturnValue(tier)
+    reflector.getAllAndOverride.mockImplementation((key: unknown) =>
+        key === "platform.http-security.rate-exceeded" ? exceeded : tier,
+    )
     const moduleRef = await Test.createTestingModule({
         providers: [
             RateLimitGuard,
             { provide: Reflector, useValue: reflector },
-            { provide: CLOCK, useValue: clock },
+            { provide: CLOCK, useValue: new FakeClock(AT) },
             { provide: HTTP_SECURITY_OPTIONS, useValue: options },
+            { provide: PRIMARY_ENTITY_MANAGER, useValue: entityManager },
         ],
     }).compile()
     return { guard: moduleRef.get(RateLimitGuard), reflector }
 }
 
 /** An execution context of one POST from `ip` on the door; the handler and the class carry the tier metadata. */
-const contextOf = (ip: string | undefined, handler = () => undefined, door: Type<unknown> = class Door {}) => {
-    let address = ip
+const contextOf = (
+    ip: string | undefined,
+    handler = () => undefined,
+    door: Type<unknown> = class Door {},
+    response = mock<Response>(),
+) => {
     const http = mock<ReturnType<ExecutionContext["switchToHttp"]>>()
-    http.getRequest.mockImplementation(() => mock<Request>({ headers: {}, method: "POST", ip: address }))
+    http.getRequest.mockImplementation(() => mock<Request>({ headers: {}, method: "POST", ip }))
+    http.getResponse.mockReturnValue(response)
     const context = mock<ExecutionContext>()
+    context.getType.mockReturnValue("http")
     context.switchToHttp.mockReturnValue(http)
     context.getHandler.mockReturnValue(handler)
     context.getClass.mockReturnValue(door)
-    return { context, setIp: (value: string | undefined) => (address = value) }
+    return context
 }
 
 describe("RateLimit", () => {
     it("marks a door with the tier it declares, and the guard counts it under that tier's limit", async () => {
         class Door {}
         RateLimit(RateTier.Strict)(Door)
-        const { guard, reflector } = await build(new FakeClock(AT), RateTier.Strict)
+        const entityManager = mockEntityManager({ query: [HIT_RATE_WINDOW, [{ hits: 2 }]] })
+        const { guard, reflector } = await build(entityManager, RateTier.Strict)
         const handler = () => undefined
-        const { context } = contextOf("127.0.0.1", handler, Door)
 
         expect(Reflect.getMetadata("platform.http-security.rate-tier", Door)).toBe(RateTier.Strict)
-        expect(guard.canActivate(context)).toBe(true)
-        expect(() => guard.canActivate(context)).toThrow(HttpSecurityErrorCode.RateLimited)
+        await expect(guard.canActivate(contextOf("127.0.0.1", handler, Door))).rejects.toMatchObject({
+            code: HttpSecurityErrorCode.RateLimited,
+        })
         expect(reflector.getAllAndOverride).toHaveBeenCalledWith("platform.http-security.rate-tier", [handler, Door])
+        expect(entityManager.query).toHaveBeenCalledWith(HIT_RATE_WINDOW, [
+            "strict:127.0.0.1",
+            new Date(AT),
+            new Date(RESET_AT),
+        ])
     })
+
+    it("marks a redirect-only door with its exceeded redirect beside the tier", () => {
+        class Door {}
+        RateLimit(RateTier.Strict, { redirect: "/sign-in?auth=error" })(Door)
+
+        expect(Reflect.getMetadata("platform.http-security.rate-tier", Door)).toBe(RateTier.Strict)
+        expect(Reflect.getMetadata("platform.http-security.rate-exceeded", Door)).toEqual({
+            redirect: "/sign-in?auth=error",
+        })
+    })
+
+    it.each(["https://foreign.test/sign-in", "//foreign.test/sign-in", "/\\foreign.test", "sign-in"])(
+        "refuses an exceeded redirect %s that is not a same-site path",
+        (redirect) => {
+            expect(() => RateLimit(RateTier.Strict, { redirect })).toThrow(HttpSecurityErrorCode.RequestInvalid)
+        },
+    )
 })
 
 describe("RateLimitGuard", () => {
-    it("counts an unmarked door under the default limit", async () => {
-        const { guard } = await build(new FakeClock(AT))
-        const { context } = contextOf("127.0.0.1")
+    it("admits a caller under the default limit of an unmarked door, counting in the shared window", async () => {
+        const entityManager = mockEntityManager({ query: [HIT_RATE_WINDOW, [{ hits: 2 }]] })
+        const { guard } = await build(entityManager)
+
+        await expect(guard.canActivate(contextOf("127.0.0.1"))).resolves.toBe(true)
+        expect(entityManager.query).toHaveBeenCalledWith(HIT_RATE_WINDOW, [
+            "default:127.0.0.1",
+            new Date(AT),
+            new Date(RESET_AT),
+        ])
+    })
+
+    it("refuses a caller whose shared window is over the default limit", async () => {
+        const { guard } = await build(mockEntityManager({ query: [HIT_RATE_WINDOW, [{ hits: 3 }]] }))
+
+        await expect(guard.canActivate(contextOf("127.0.0.1"))).rejects.toMatchObject({
+            code: HttpSecurityErrorCode.RateLimited,
+        })
+    })
 
-        expect(guard.canActivate(context)).toBe(true)
-        expect(guard.canActivate(context)).toBe(true)
-        expect(() => guard.canActivate(context)).toThrow(HttpSecurityErrorCode.RateLimited)
+    it("prunes the expired windows when a hit opens a fresh one", async () => {
+        const entityManager = mockEntityManager({
+            query: [
+                [HIT_RATE_WINDOW, [{ hits: 1 }]],
+                [PRUNE_RATE_WINDOWS, []],
+            ],
+        })
+        const { guard } = await build(entityManager)
+
+        await expect(guard.canActivate(contextOf("127.0.0.1"))).resolves.toBe(true)
+        expect(entityManager.query).toHaveBeenCalledWith(PRUNE_RATE_WINDOWS, [new Date(AT)])
     })
 
-    it("opens a fresh window for a caller whose bucket expired", async () => {
-        const clock = new FakeClock(AT)
-        const { guard } = await build(clock)
-        const { context } = contextOf("127.0.0.1")
+    it("counts a request without an address under the unknown key", async () => {
+        const entityManager = mockEntityManager({ query: [HIT_RATE_WINDOW, [{ hits: 2 }]] })
+        const { guard } = await build(entityManager)
+
+        await expect(guard.canActivate(contextOf(undefined))).resolves.toBe(true)
+        expect(entityManager.query).toHaveBeenCalledWith(HIT_RATE_WINDOW, [
+            "default:unknown",
+            new Date(AT),
+            new Date(RESET_AT),
+        ])
+    })
 
-        guard.canActivate(context)
-        guard.canActivate(context)
-        expect(() => guard.canActivate(context)).toThrow(HttpSecurityErrorCode.RateLimited)
+    it("bounds the window key to the length the table stores", async () => {
+        const entityManager = mockEntityManager({ query: [HIT_RATE_WINDOW, [{ hits: 2 }]] })
+        const { guard } = await build(entityManager)
 
-        clock.advance(60_001)
+        await guard.canActivate(contextOf("f".repeat(300)))
 
-        expect(guard.canActivate(context)).toBe(true)
+        expect(entityManager.query).toHaveBeenCalledWith(HIT_RATE_WINDOW, [
+            `default:${"f".repeat(120)}`,
+            new Date(AT),
+            new Date(RESET_AT),
+        ])
     })
 
-    it("counts a request without an address under the unknown bucket", async () => {
-        const { guard } = await build(new FakeClock(AT))
-        const { context } = contextOf(undefined)
+    it("refuses the request when the store answers no window", async () => {
+        const { guard } = await build(mockEntityManager({ query: [HIT_RATE_WINDOW, []] }))
 
-        guard.canActivate(context)
-        guard.canActivate(context)
-        expect(() => guard.canActivate(context)).toThrow(HttpSecurityErrorCode.RateLimited)
+        await expect(guard.canActivate(contextOf("127.0.0.1"))).rejects.toMatchObject({
+            code: HttpSecurityErrorCode.RateLimited,
+        })
     })
+})
+
+describe("RateLimitGuard on a redirect-only door", () => {
+    const EXCEEDED: RateLimitExceeded = { redirect: "/sign-in?auth=error" }
 
-    it("prunes the expired buckets when the map outgrows the bucket cap", async () => {
-        const clock = new FakeClock(AT)
-        const { guard } = await build(clock)
-        const { context, setIp } = contextOf("0.0.0.0")
+    /** A response whose redirect is a plain double, so the spec reads the call without the deprecated overload. */
+    const responseOf = () => {
+        const redirect = jest.fn()
+        return { response: mock<Response>({ redirect }), redirect }
+    }
 
-        for (let index = 0; index <= 10_000; index += 1) {
-            setIp(`10.${(index >> 16) % 256}.${(index >> 8) % 256}.${index % 256}`)
-            guard.canActivate(context)
-        }
+    it("answers the door's own 303 when the caller is over the limit, and still refuses", async () => {
+        const entityManager = mockEntityManager({ query: [HIT_RATE_WINDOW, [{ hits: 2 }]] })
+        const { guard } = await build(entityManager, RateTier.Strict, EXCEEDED)
+        const { response, redirect } = responseOf()
+
+        await expect(
+            guard.canActivate(contextOf("127.0.0.1", () => undefined, class Door {}, response)),
+        ).rejects.toMatchObject({ code: HttpSecurityErrorCode.RateLimited })
+        expect(redirect).toHaveBeenCalledWith(303, "/sign-in?auth=error")
+    })
+
+    it("writes no redirect while the caller is under the limit", async () => {
+        const entityManager = mockEntityManager({
+            query: [
+                [HIT_RATE_WINDOW, [{ hits: 1 }]],
+                [PRUNE_RATE_WINDOWS, []],
+            ],
+        })
+        const { guard } = await build(entityManager, RateTier.Strict, EXCEEDED)
+        const { response, redirect } = responseOf()
+
+        await expect(guard.canActivate(contextOf("127.0.0.1", () => undefined, class Door {}, response))).resolves.toBe(
+            true,
+        )
+        expect(redirect).not.toHaveBeenCalled()
+    })
 
-        clock.advance(60_001)
-        setIp("127.0.0.1")
+    it("refuses a GraphQL operation over the limit without writing a redirect", async () => {
+        const entityManager = mockEntityManager({ query: [HIT_RATE_WINDOW, [{ hits: 2 }]] })
+        const { guard } = await build(entityManager, RateTier.Strict, EXCEEDED)
+        const { response, redirect } = responseOf()
+        const context = contextOf("127.0.0.1", () => undefined, class Door {}, response)
+        context.getType.mockReturnValue("graphql")
+        context.getArgs.mockReturnValue([{}, {}, { req: mock<Request>({ headers: {}, ip: "127.0.0.1" }) }, {}])
 
-        expect(guard.canActivate(context)).toBe(true)
-        expect(guard.canActivate(context)).toBe(true)
-        expect(() => guard.canActivate(context)).toThrow(HttpSecurityErrorCode.RateLimited)
+        await expect(guard.canActivate(context)).rejects.toMatchObject({ code: HttpSecurityErrorCode.RateLimited })
+        expect(redirect).not.toHaveBeenCalled()
     })
 })

package/templates/be/skeleton/src/modules/platform/http-security/rate-limit.guard.ts

@@ -1,13 +1,19 @@
-import { Injectable, SetMetadata } from "@nestjs/common"
+import { Injectable, SetMetadata, applyDecorators } from "@nestjs/common"
 import type { CanActivate, ExecutionContext } from "@nestjs/common"
 import type { Reflector } from "@nestjs/core"
+import type { Response } from "express"
+import type { EntityManager } from "typeorm"
 import { InjectClock } from "@modules/platform/clock"
 import type { Clock } from "@modules/platform/clock"
 import { InjectReflector } from "@modules/platform/composition"
+import type { DoorDecorator } from "@modules/platform/composition"
+import { InjectPrimaryEntityManager } from "@modules/platform/database"
 import { HttpSecurityError, HttpSecurityErrorCode } from "./errors/http-security.error"
 import { requestOf } from "./execution-request.mapper"
 import { InjectHttpSecurityOptions } from "./http-security.decorators"
 import type { HttpSecurityOptions } from "./http-security.options"
+import type { RateWindowRow } from "./persistence/rate-limit.rows"
+import { HIT_RATE_WINDOW, PRUNE_RATE_WINDOWS } from "./persistence/rate-limit.sql"
 
 /** The rate limit tiers of a door. */
 export enum RateTier {
@@ -17,52 +23,69 @@ export enum RateTier {
     Strict = "strict",
 }
 
+/** What a door answers when its caller is over the limit, when that is not the 429 error body. */
+export interface RateLimitExceeded {
+    /** A same-site path the door's own contract answers with a 303 (an OAuth callback's error redirect). */
+    readonly redirect: string
+}
+
 const RATE_TIER_KEY = "platform.http-security.rate-tier"
-const BUCKETS_MAX = 10_000
+const RATE_EXCEEDED_KEY = "platform.http-security.rate-exceeded"
+/** The longest window key the table stores: the tier, a colon and the caller address. */
+const KEY_MAX = 128
 
-interface Bucket {
-    count: number
-    resetAt: number
-}
+/** A same-site path: one leading slash, never a protocol-relative `//` or `/\` that leaves the site. */
+const isSameSitePath = (location: string): boolean =>
+    location.startsWith("/") && !location.startsWith("//") && !location.startsWith("/\\")
 
-/** Marks a door with a rate limit tier other than the default. */
-export const RateLimit = (tier: RateTier): ReturnType<typeof SetMetadata> => SetMetadata(RATE_TIER_KEY, tier)
+/**
+ * Marks a door with a rate limit tier other than the default. A door whose contract answers only redirects (an OAuth
+ * callback) names its error redirect in `exceeded`, and a caller over the limit gets that 303 instead of a 429 body.
+ */
+export const RateLimit = (tier: RateTier, exceeded?: RateLimitExceeded): DoorDecorator => {
+    if (exceeded === undefined) return applyDecorators(SetMetadata(RATE_TIER_KEY, tier))
+    if (!isSameSitePath(exceeded.redirect))
+        throw new HttpSecurityError({
+            code: HttpSecurityErrorCode.RequestInvalid,
+            params: { fields: "RATE_LIMIT_REDIRECT" },
+        })
+    return applyDecorators(SetMetadata(RATE_TIER_KEY, tier), SetMetadata(RATE_EXCEEDED_KEY, exceeded))
+}
 
 @Injectable()
-/** The first app guard: a fixed-window counter per caller address and tier, kept in process memory and stamped by the Clock. */
+/**
+ * The first app guard: a fixed-window counter per caller address and tier, stamped by the Clock and kept in the primary
+ * database, so every replica counts against the same window. A hit that opens a fresh window also prunes a bounded batch of
+ * expired windows.
+ */
 export class RateLimitGuard implements CanActivate {
-    private readonly buckets = new Map<string, Bucket>()
-
     constructor(
         @InjectReflector() private readonly reflector: Reflector,
         @InjectClock() private readonly clock: Clock,
         @InjectHttpSecurityOptions() private readonly options: HttpSecurityOptions,
+        @InjectPrimaryEntityManager() private readonly entityManager: EntityManager,
     ) {}
 
-    /** Counts the request and refuses it when the caller is over the limit of the door tier. */
-    canActivate(context: ExecutionContext): boolean {
-        const tier =
-            this.reflector.getAllAndOverride<RateTier | undefined>(RATE_TIER_KEY, [
-                context.getHandler(),
-                context.getClass(),
-            ]) ?? RateTier.Default
+    /**
+     * Counts the request and refuses it when the caller is over the limit of the door tier. A door that declares its
+     * exceeded redirect has the 303 written here; the refusal still travels, and the errors filter leaves the sent
+     * response as it is.
+     */
+    async canActivate(context: ExecutionContext): Promise<boolean> {
+        const targets = [context.getHandler(), context.getClass()]
+        const tier = this.reflector.getAllAndOverride<RateTier | undefined>(RATE_TIER_KEY, targets) ?? RateTier.Default
         const limit =
             tier === RateTier.Strict ? this.options.rateLimit.strictLimit : this.options.rateLimit.defaultLimit
-        const now = this.clock.now().getTime()
-        const key = `${tier}:${requestOf(context).ip ?? "unknown"}`
-        const current = this.buckets.get(key)
-        const bucket =
-            current && current.resetAt > now ? current : { count: 0, resetAt: now + this.options.rateLimit.windowMs }
-        bucket.count += 1
-        this.buckets.set(key, bucket)
-        if (this.buckets.size > BUCKETS_MAX) this.prune(now)
-        if (bucket.count > limit) throw new HttpSecurityError({ code: HttpSecurityErrorCode.RateLimited })
-        return true
-    }
-
-    private prune(now: number): void {
-        for (const [key, bucket] of this.buckets) {
-            if (bucket.resetAt <= now) this.buckets.delete(key)
-        }
+        const now = this.clock.now()
+        const key = `${tier}:${requestOf(context).ip ?? "unknown"}`.slice(0, KEY_MAX)
+        const resetAt = new Date(now.getTime() + this.options.rateLimit.windowMs)
+        const rows: Array<RateWindowRow> = await this.entityManager.query(HIT_RATE_WINDOW, [key, now, resetAt])
+        const hits = rows[0]?.hits ?? Number.POSITIVE_INFINITY
+        if (hits === 1) await this.entityManager.query(PRUNE_RATE_WINDOWS, [now])
+        if (hits <= limit) return true
+        const exceeded = this.reflector.getAllAndOverride<RateLimitExceeded | undefined>(RATE_EXCEEDED_KEY, targets)
+        if (exceeded !== undefined && context.getType() === "http")
+            context.switchToHttp().getResponse<Response>().redirect(303, exceeded.redirect)
+        throw new HttpSecurityError({ code: HttpSecurityErrorCode.RateLimited })
     }
 }

package/templates/be/skeleton-lite/src/modules/domain/identity/identity.decorators.ts

@@ -1,12 +1,13 @@
-import { SetMetadata, createParamDecorator } from "@nestjs/common"
+import { SetMetadata, applyDecorators, createParamDecorator } from "@nestjs/common"
 import type { ExecutionContext } from "@nestjs/common"
 import { injector } from "@modules/platform/composition"
-import type { TypedParameterDecorator } from "@modules/platform/composition"
+import type { DoorDecorator, TypedParameterDecorator } from "@modules/platform/composition"
 import type { VerifySupabaseAccessToken } from "@modules/integrations/supabase"
-import { requestOf } from "@modules/platform/http-security"
+import { ServerToServer, requestOf } from "@modules/platform/http-security"
 import type { Principal } from "@modules/platform/cqrs"
 import type { CredentialAuthenticator, CredentialMetadata } from "./credential.contracts"
 import { IdentityError, IdentityErrorCode } from "./errors/identity.error"
+import { PublicReason } from "./identity.contracts"
 import type { PublicMetadata } from "./identity.contracts"
 
 /** Token of the access-token verifier the composition root hands to identity. */
@@ -19,8 +20,14 @@ export const InjectAccessTokenVerifier = (): TypedParameterDecorator<VerifySupab
 /** Metadata key of `@Public`. */
 export const PUBLIC_KEY = "domain.identity.public"
 
-/** Opens a door to anonymous callers, stating why; every other door needs a credential or a verified Supabase session. */
-export const Public = (metadata: PublicMetadata): ReturnType<typeof SetMetadata> => SetMetadata(PUBLIC_KEY, metadata)
+/**
+ * Opens a door to anonymous callers, stating why; every other door needs a credential or a verified Supabase session.
+ * A signed webhook proves its caller by its signature, so it owes no browser origin.
+ */
+export const Public = (metadata: PublicMetadata): DoorDecorator =>
+    metadata.reason === PublicReason.SignedWebhook
+        ? applyDecorators(SetMetadata(PUBLIC_KEY, metadata), ServerToServer())
+        : applyDecorators(SetMetadata(PUBLIC_KEY, metadata))
 
 /** Metadata key of `@Credential`. */
 export const CREDENTIAL_KEY: unique symbol = Symbol("domain.identity.credential")
@@ -32,9 +39,12 @@ export const CREDENTIAL_AUTHENTICATOR: unique symbol = Symbol("domain.identity.c
 export const InjectCredentialAuthenticator = (): TypedParameterDecorator<CredentialAuthenticator> =>
     injector<CredentialAuthenticator>(CREDENTIAL_AUTHENTICATOR)
 
-/** Marks a door authenticated by its own credential; `CredentialGuard` authenticates it and `AuthGuard` admits it. */
-export const Credential = (metadata: CredentialMetadata): ReturnType<typeof SetMetadata> =>
-    SetMetadata(CREDENTIAL_KEY, metadata)
+/**
+ * Marks a door authenticated by its own credential; `CredentialGuard` authenticates it and `AuthGuard` admits it. The
+ * credential travels in a header no browser attaches by itself, so the door owes no browser origin.
+ */
+export const Credential = (metadata: CredentialMetadata): DoorDecorator =>
+    applyDecorators(SetMetadata(CREDENTIAL_KEY, metadata), ServerToServer())
 
 /** The authenticated Supabase caller established by the default-deny guard. */
 export const CurrentPrincipal = createParamDecorator((_data: unknown, context: ExecutionContext): Principal => {

package/templates/be/skeleton-lite/src/modules/platform/database/errors/database.error.ts

@@ -5,11 +5,14 @@ import type { ErrorKind } from "@modules/platform/errors"
 export enum DatabaseErrorCode {
     /** A configured connection has no declared EntityManager injection token. */
     ConnectionUndeclared = "DATABASE_CONNECTION_UNDECLARED",
+    /** A dynamic SQL identifier was not on the names its caller allows. */
+    IdentifierRejected = "DATABASE_IDENTIFIER_REJECTED",
 }
 
 /** How each database code travels. */
 export const DATABASE_ERROR_KINDS: Record<DatabaseErrorCode, ErrorKind> = {
     [DatabaseErrorCode.ConnectionUndeclared]: "internal",
+    [DatabaseErrorCode.IdentifierRejected]: "internal",
 }
 
 /** The one error class of the database capability. */

package/templates/be/skeleton-lite/src/modules/platform/database/index.ts

@@ -1,7 +1,8 @@
 export { DatabaseModule } from "./database.module"
-export { DATABASE_PROBE, InjectDatabaseProbe } from "./primary.decorators"
+export { DATABASE_PROBE, InjectDatabaseProbe, InjectPrimaryEntityManager, PRIMARY_ENTITY_MANAGER } from "./primary.decorators"
 export { DatabaseProbeService } from "./database-probe.service"
 export type { DatabaseConnectionOptions } from "./database.options"
 export { PRIMARY_DATA_SOURCE } from "./database.port"
+export { sql } from "./database.sql"
 export { DATABASE_ERROR_KINDS } from "./errors/database.error"
 export { parsePrimaryDatabaseConfig } from "./primary.config"

package/templates/be/skeleton-lite/src/modules/platform/http-security/index.ts

@@ -4,7 +4,7 @@ export { parseHttpSecurityConfig } from "./http-security.config"
 export { HttpSecurityModule } from "./http-security.module"
 export type { HttpSecurityOptions } from "./http-security.options"
 export { HTTP_SECURITY_MESSAGES } from "./messages/http-security.messages"
-export { OriginGuard } from "./origin.guard"
+export { OriginGuard, ServerToServer } from "./origin.guard"
 export { RateLimitGuard } from "./rate-limit.guard"
 export { applyHttpSecurity } from "./edge-security.service"
 export { ReadinessService } from "./readiness.service"