nestjs-slightly-better-auth 1.5.2 → 1.6.0

package/README.md

@@ -343,7 +343,7 @@ Better Auth treats a process with `NODE_ENV=test` or a truthy `TEST` variable (V
 
 The kits verify extension units against the invariants of the [reviewed specification](docs/design/design-v7.md) (§4 and §14.1). Each kit returns `ConformanceCase[]` (`{ id, title, skip?, run() }`) that `runConformance(cases, { describe, it })` registers with Vitest, Jest or `node:test`. Assertions use `node:assert/strict`; the kits import no test runner.
 
-Applicability comes from the unit, not from the options a harness passes. A platform that declares `capabilities.http2` needs the `http2` option. A transport with a lineage needs `invokeTwice`, one that nests handlers (`defaultAccessFor`) needs `invokeGraph`, and one that claims the kit's federation reference resolver needs `invokeEntities`. A transport whose browser leg is a connection's handshake, shared by the connection's messages (the WebSocket transports), runs the `T-ws-origin-*` cases instead of the `T-csrf-*` cases and needs `invokeConnection`, plus `authenticateConnection` when the app provides `WS_CONNECTION_AUTH`. Such a case fails when the helper is missing, and `T-selection` fails `expectBrowserLeg: false` for a transport that describes a browser leg. A case whose optional capability is absent is skipped with the reason. The kits read these members from unit objects before running; for classes and `defineExtension()` definitions they boot once and read the resolved unit. A case known to be inapplicable registers with its reason in the test name. A case that finds out at run time resolves with `{ skipped: reason }`, which `runConformance` reports through the runner's `context.skip(reason)` (Vitest, `node:test`; Jest has no runtime skip, so the test passes).
+Applicability comes from the unit, not from the options a harness passes. A platform that declares `capabilities.http2` needs the `http2` option. The platform kit's trusted-hop rows need `trustOneProxy`, and its microservice rows of `H-no-adapter` need `microservice`, which returns the transport options to boot with (for example `{ transport: Transport.TCP, options: { host: "127.0.0.1", port: 0 } }`); the kit does not load the optional `@nestjs/microservices` peer itself. The production-mode rows set `process.env.NODE_ENV` to `production` while they run and restore it afterwards, so run the kit's cases sequentially. A transport with a lineage needs `invokeTwice`, one that nests handlers (`defaultAccessFor`) needs `invokeGraph`, and one that claims the kit's federation reference resolver needs `invokeEntities`. A transport whose browser leg is a connection's handshake, shared by the connection's messages (the WebSocket transports), runs the `T-ws-origin-*` cases instead of the `T-csrf-*` cases and needs `invokeConnection`, plus `authenticateConnection` when the app provides `WS_CONNECTION_AUTH`. Such a case fails when the helper is missing, and `T-selection` fails `expectBrowserLeg: false` for a transport that describes a browser leg. A case whose optional capability is absent is skipped with the reason. The kits read these members from unit objects before running; for classes and `defineExtension()` definitions they boot once and read the resolved unit. A case known to be inapplicable registers with its reason in the test name. A case that finds out at run time resolves with `{ skipped: reason }`, which `runConformance` reports through the runner's `context.skip(reason)` (Vitest, `node:test`; Jest has no runtime skip, so the test passes).
 
 ```ts
 import { ExpressAdapter } from "@nestjs/platform-express";
@@ -380,14 +380,14 @@ runConformance(
 
 | Kit                          | Unit                  | Covers                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   |
 | ---------------------------- | --------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
-| `httpPlatformConformance`    | `HttpPlatform`        | Mounting, byte-exact bodies, limits with host CORS, URL and header facts, client IP, HTTP/2, write-back, request accessors, error delivery, lifecycle (no adapter, late adapter, reused `TestingModule`, double `forRoot`), diagnostics and log hygiene                                                                                                                                                                                                                                                                                                                  |
+| `httpPlatformConformance`    | `HttpPlatform`        | Mounting (including a dynamic `allowedHosts` base URL), byte-exact bodies, limits with host CORS, URL and header facts, client IP (production-mode per-IP rate-limit buckets, Better Auth `trustedProxies`), HTTP/2, write-back, request accessors, error delivery, lifecycle (no adapter, including microservices, late adapter, reused `TestingModule`, double `forRoot`, hooks kept after `close()`), diagnostics (404 hints, `W_PROXY_UNTRUSTED`) and log hygiene                                                                                                    |
 | `transportConformance`       | `AuthTransport`       | Selection, credentials, per-request memoization, per-invocation decisions, acceptance, cookie forwarding or refresh suppression, origin and form-CSRF rules including forwarding on safe operations, WebSocket handshake origins on every message and at connection time (untrusted, missing and forwarded origins, junk tokens, dynamic base URLs, function-valued `trustedOrigins`), error shapes and logging, the exact coverage report of the transport's claims, `globalScope: false`, mixed-kind session reads, lazy scope construction and fail-closed extraction |
 | `principalSourceConformance` | `PrincipalSource`     | Rejection without throwing, storage outages, delivery of every own-credential `Set-Cookie` exactly once, refresh suppression, clean absence, principal shape, declared credential headers, `sessionBacked` and `delegates` declarations                                                                                                                                                                                                                                                                                                                                  |
 | `policyConformance`          | `AuthorizationPolicy` | Deny values, storage outages, APIError mapping and re-classification, delegation scope, unnamed-kind gating, per-invocation decisions with shared I/O and plugin prerequisites; requirements name policy objects (construct a DI policy with its dependencies)                                                                                                                                                                                                                                                                                                           |
 
 Every case boots real Nest applications or modules with a real Better Auth instance that includes `conformanceProbePlugin()`. The probe counts and faults every operation of the instance's database adapter, so storage outages reach endpoints that would swallow them, and records the `Set-Cookie` lines each call produces. `createConformanceAuth({ plugins })` builds such an instance: memory adapter, `testUtils()`, `bearer()`, the probe plugin, `nestjs()` last, and `session.updateAge: 0` and origin checks on, whatever `options` says. The principal-source and policy kits take that instance as `auth`; the principal-source kit rejects an instance without `session.updateAge: 0`. The transport kit creates its own instance and passes it to your `createApp` harness together with the kit's API-key source in `principals`, a `logger` to boot with, and the `globalScope`, `appEnhancers`, `fieldResolverEnhancers` and `federation` settings of each boot. Apply every fixture decorator, including the kit's `SetMetadata()` marker, which maps the transport's claims to fixtures. On a connection-shaped browser leg, the kit's cookie credential carries the instance's base URL, `http://localhost:3000`, as `Origin`, as a browser page of that origin does; the `T-ws-origin-*` cases pass their own `Origin`, `Host` and forwarding headers, which the harness sends in the handshake.
 
-This repository runs the platform kit against Express and Fastify; the transport kit against the built-in HTTP transport, an in-process reference transport, Socket.IO and `ws` (each with and without a principal TTL), the RPC transport over TCP (standalone and hybrid), gRPC, NATS, RabbitMQ, MQTT, Redis and Kafka, and the Apollo (Express and Fastify) and Mercurius transports over HTTP and over graphql-ws (with and without a subscription principal TTL; Mercurius also without `mercuriusSubscriptionContext()`), with federation 2 subgraphs and a federation 1 run of `T-reference-resolver`; the principal-source kit against the session and API-key sources; and the policy kit against the admin, organization, API-key and fresh-session policies. gRPC skips `T-error-shape`, because it delivers only a status and a message. The kit reads each call's browser leg while its invocation runs, because the GraphQL transports reject a completed request. Mutation tests confirm that each of these defects fails the intended case: a platform merging `Set-Cookie`, a transport sharing invocation state across aliases, a transport without a browser leg on safe operations, a `defineExtension()` transport with a lineage or nesting and no helper, a WebSocket transport that enforces its handshake like a safe read, exempts handshakes that carry a token, builds its leg URL from the bare handshake path or from forwarded headers, or answers internal errors with their cause, a GraphQL transport whose aliases share one invocation, whose lineage gives every field of an operation one position, whose field resolvers do not inherit their root's access, or that serves reference resolvers without field guards, a GraphQL harness that omits `invokeGraph`, `invokeEntities` or `invokeConnection`, a source throwing its denial, a source dropping its refresh cookie, a source turning a storage outage into a 401, and a policy widening delegated principals.
+This repository runs the platform kit against Express and Fastify, including the Fastify HTTP/2 adapter for the HTTP/2 rows; the transport kit against the built-in HTTP transport, an in-process reference transport, Socket.IO and `ws` (each with and without a principal TTL), the RPC transport over TCP (standalone and hybrid), gRPC, NATS, RabbitMQ, MQTT, Redis and Kafka, and the Apollo (Express and Fastify) and Mercurius transports over HTTP and over graphql-ws (with and without a subscription principal TTL; Mercurius also without `mercuriusSubscriptionContext()`), with federation 2 subgraphs and a federation 1 run of `T-reference-resolver`; the principal-source kit against the session and API-key sources; and the policy kit against the admin, organization, API-key and fresh-session policies. gRPC skips `T-error-shape`, because it delivers only a status and a message. The kit reads each call's browser leg while its invocation runs, because the GraphQL transports reject a completed request. Mutation tests confirm that each of these defects fails the intended case: a platform merging `Set-Cookie`, handing Better Auth no client IP, ignoring its proxy trust, dropping the request host or stripping forwarding headers, a kernel that unbinds hooks on `close()`, reports taking over a closed binding or keeps a microservice's binding open, a transport sharing invocation state across aliases, a transport without a browser leg on safe operations, a `defineExtension()` transport with a lineage or nesting and no helper, a WebSocket transport that enforces its handshake like a safe read, exempts handshakes that carry a token, builds its leg URL from the bare handshake path or from forwarded headers, or answers internal errors with their cause, a GraphQL transport whose aliases share one invocation, whose lineage gives every field of an operation one position, whose field resolvers do not inherit their root's access, or that serves reference resolvers without field guards, a GraphQL harness that omits `invokeGraph`, `invokeEntities` or `invokeConnection`, a source throwing its denial, a source dropping its refresh cookie, a source turning a storage outage into a 401, and a policy widening delegated principals.
 
 ## Develop in this monorepo
 

package/dist/testing/conformance.cjs

@@ -493,7 +493,10 @@ function probePlugin(options = {}) {
 			probeIp: (0, better_auth_api.createAuthEndpoint)("/probe/ip", {
 				method: "GET",
 				requireRequest: true
-			}, async (ctx) => ctx.json({ ip: (0, better_auth_api.getIP)(ctx.request, ctx.context.options) })),
+			}, async (ctx) => ctx.json({
+				ip: (0, better_auth_api.getIP)(ctx.request, ctx.context.options),
+				resolved: resolvedIp(ctx.request, ctx.context.options)
+			})),
 			probeThrowApiError: (0, better_auth_api.createAuthEndpoint)("/probe/throw-api-error", { method: "GET" }, async () => {
 				throw new better_auth_api.APIError("BAD_REQUEST", {
 					code: "PROBE_API_ERROR",
@@ -536,6 +539,30 @@ function probePlugin(options = {}) {
 	Object.defineProperty(plugin, PROBE_STATE, { value: state });
 	return plugin;
 }
+/** A TEST-NET-2 address that no kit request sends and no kit configuration trusts. */
+const IP_SENTINEL = "198.51.100.254";
+const IP_SENTINEL_HEADER = "x-conformance-ip-sentinel";
+/**
+* The client IP Better Auth resolves from the request's IP headers, without the localhost fallback getIP() returns
+* under NODE_ENV=development/test or a truthy TEST (vitest sets it): the sentinel header is read last, so getIP()
+* returns the sentinel exactly when the configured headers yield no trusted address.
+*/
+function resolvedIp(request, options) {
+	const ipAddress = options.advanced?.ipAddress;
+	const headers = new Headers(request.headers);
+	headers.set(IP_SENTINEL_HEADER, IP_SENTINEL);
+	const ip = (0, better_auth_api.getIP)(headers, {
+		...options,
+		advanced: {
+			...options.advanced,
+			ipAddress: {
+				...ipAddress,
+				ipAddressHeaders: [...ipAddress?.ipAddressHeaders ?? ["x-forwarded-for"], IP_SENTINEL_HEADER]
+			}
+		}
+	});
+	return ip === IP_SENTINEL ? null : ip;
+}
 /** The probe state of an instance that includes conformanceProbePlugin(). */
 async function probeOf(auth) {
 	const plugin = (await auth.$context).getPlugin(PROBE_PLUGIN_ID);
@@ -756,6 +783,9 @@ function bootIssueCodes(error) {
 //#endregion
 //#region src/conformance-http.ts
 const AUTH = "/api/auth";
+const DYNAMIC_AUTH = "/tenant/auth";
+/** The client IP of the kit's requests: baseUrl() always connects over IPv4 loopback. */
+const LOOPBACK = "127.0.0.1";
 const CORS_ORIGIN = "https://app.example";
 /** Makes the kit's `around` interceptor throw, so auth.handler rejects with a non-APIError. */
 const THROW_HEADER = "x-conformance-throw";
@@ -796,7 +826,19 @@ async function capabilitiesOf(options) {
 		await boot.close();
 	}
 }
+/** Whether the resolved platform implements an optional member, booting a testing app when the reference cannot tell. */
+async function implementsMember(options, name) {
+	const known = staticMember$1(options.platform, name);
+	if (known !== void 0) return known;
+	const boot = await bootHttp(options, "testing", {});
+	try {
+		return typeof Reflect.get(resolvedPlatform(boot.app), name) === "function";
+	} finally {
+		await boot.close();
+	}
+}
 function kitModule(options, auth, probe, config, state) {
+	const hooks = state.hooks ?? config.hooks;
 	const record = async (call, next) => {
 		state.around.push(`${call.request.method.toUpperCase()} ${new URL(call.request.url).pathname}`);
 		const failure = call.request.headers.get(THROW_HEADER);
@@ -949,7 +991,7 @@ function kitModule(options, auth, probe, config, state) {
 	ConformanceAppController = require_decorate.__decorate([(0, _nestjs_common.Controller)()], ConformanceAppController);
 	let ConformanceHookProvider = class ConformanceHookProvider {
 		record(_context) {
-			state.hooks?.push("/probe/html");
+			hooks?.push("/probe/html");
 		}
 	};
 	require_decorate.__decorate([
@@ -976,6 +1018,9 @@ function kitModule(options, auth, probe, config, state) {
 				method: _nestjs_common.RequestMethod.ALL
 			});
 		}
+		async onApplicationShutdown() {
+			await config.onShutdown?.();
+		}
 	};
 	ConformanceHttpModule = require_decorate.__decorate([(0, _nestjs_common.Module)({
 		imports,
@@ -988,7 +1033,7 @@ function kitModule(options, auth, probe, config, state) {
 	return ConformanceHttpModule;
 }
 async function bootHttp(options, bootstrap, config) {
-	const auth = createConformanceAuth(config.auth);
+	const auth = config.instance ?? createConformanceAuth(config.auth);
 	const probe = await probeOf(auth);
 	const logger = new CapturingLogger();
 	const filtered = [];
@@ -1104,6 +1149,53 @@ async function waitFor(predicate, message, timeoutMs = 2e3) {
 		await new Promise((resolve) => setTimeout(resolve, 10));
 	}
 }
+/**
+* Runs `fn` with process.env.NODE_ENV set to `value`, then restores it. The kit's production-mode rows use it: the
+* library treats every NODE_ENV except development, dev and test as production (§5.4). Run kit cases sequentially.
+*/
+async function withNodeEnv(value, fn) {
+	const previous = process.env.NODE_ENV;
+	process.env.NODE_ENV = value;
+	try {
+		return await fn();
+	} finally {
+		if (previous === void 0) Reflect.deleteProperty(process.env, "NODE_ENV");
+		else process.env.NODE_ENV = previous;
+	}
+}
+const inProduction = (fn) => withNodeEnv("production", fn);
+/** The per-IP rule the rate-limit rows apply to /probe/ip, counted in a per-boot store that records every key. */
+const IP_RULE = {
+	window: 60,
+	max: 2
+};
+function rateLimited(keys) {
+	const counts = /* @__PURE__ */ new Map();
+	return { auth: { rateLimit: {
+		enabled: true,
+		customRules: { "/probe/ip": IP_RULE },
+		customStorage: { async consume(key, rule) {
+			keys.push(key);
+			const count = (counts.get(key) ?? 0) + 1;
+			counts.set(key, count);
+			return count > rule.max ? {
+				allowed: false,
+				retryAfter: rule.window
+			} : {
+				allowed: true,
+				retryAfter: null
+			};
+		} }
+	} } };
+}
+/** Better Auth trustedProxies covering every loopback address the kit's requests come from. */
+const loopbackProxies = { auth: { advanced: { ipAddress: { trustedProxies: ["127.0.0.0/8", "::1/128"] } } } };
+function warningsWith(boot, ...parts) {
+	return boot.logger.entries.filter((entry) => entry.level === "warn" && parts.every((part) => entry.text.includes(part))).map((entry) => entry.text);
+}
+function http2Origin(boot) {
+	return boot.url.replace(/^https?:/, "http:");
+}
 function http2Request(origin, headers, body) {
 	return new Promise((resolve, reject) => {
 		const session = (0, node_http2.connect)(origin);
@@ -1146,7 +1238,9 @@ const multipartBody = [
 * Auth instance that includes conformanceProbePlugin(), an app controller, a @BeforeAuth() hook provider, a recording
 * global filter and an `around` recorder. HTTP/2 is required when the platform declares capabilities.http2; a platform
 * without the capability, or without the optional proxyTrust() or trustOneProxy, gets a skip with the reason: before
-* the run for platform objects, at run time for classes and definitions.
+* the run for platform objects, at run time for classes and definitions. The microservice rows of H-no-adapter need the
+* `microservice` option. Production-mode rows set process.env.NODE_ENV to 'production' while they run and restore it,
+* so run the cases sequentially.
 */
 function httpPlatformConformance(options) {
 	const bootstraps = options.bootstrap ?? ["factory", "testing"];
@@ -1154,6 +1248,14 @@ function httpPlatformConformance(options) {
 	const add = (id, title, run, only) => {
 		for (const bootstrap of bootstraps) cases.push(conformanceCase(id, `${title} [${bootstrap}]`, () => run(options, bootstrap), only?.(bootstrap)));
 	};
+	const noHttp2 = () => declaredCapabilities(options.platform) !== void 0 && !declaredCapabilities(options.platform)?.http2 ? "the platform declares no http2 capability" : void 0;
+	/** A skip when the resolved platform declares no http2 capability; requires the http2 option when it does. */
+	const http2Ready = async (o) => {
+		if (!(await capabilitiesOf(o))?.http2) return conformanceSkip("the platform declares no http2 capability");
+		node_assert_strict.default.ok(o.http2, "the platform declares capabilities.http2, so the kit requires the http2 option");
+	};
+	const noProxyTrust = () => staticMember$1(options.platform, "proxyTrust") === false ? "the platform does not implement the optional proxyTrust()" : void 0;
+	const noTrustHook = () => options.trustOneProxy ? void 0 : "no trustOneProxy option was given";
 	add("H-mount-methods", "every method under the base path reaches Better Auth", (o, b) => withBoot(o, b, {}, async (boot) => {
 		for (const method of [
 			"GET",
@@ -1203,6 +1305,53 @@ function httpPlatformConformance(options) {
 			node_assert_strict.default.equal(response.status, 200);
 		});
 	});
+	const dynamicHosts = [new URL(KIT_BASE_URL).host, "tenant.example"];
+	const dynamicMount = {
+		auth: {
+			baseURL: {
+				allowedHosts: dynamicHosts,
+				fallback: KIT_BASE_URL
+			},
+			basePath: DYNAMIC_AUTH
+		},
+		prefix: "v1",
+		versioning: true
+	};
+	const assertDynamicUrl = (value, host) => {
+		const url = new URL(String(value));
+		node_assert_strict.default.equal(url.host, host, `the request URL lost the allowed host ${host}`);
+		node_assert_strict.default.equal(url.pathname, `${DYNAMIC_AUTH}/probe/url`);
+	};
+	add("H-mount-custom-path", "a dynamic allowedHosts baseURL mounts at basePath for every allowed host, unaffected by a global prefix and URI versioning", (o, b) => withBoot(o, b, dynamicMount, async (boot) => {
+		for (const host of dynamicHosts) {
+			const response = await sendRaw(`${boot.url}${DYNAMIC_AUTH}/probe/url`, { headers: { host } });
+			node_assert_strict.default.equal(response.status, 200, `${host}: ${response.body.toString("utf8").slice(0, 200)}`);
+			assertDynamicUrl(json(response).url, host);
+		}
+		const ping = await sendRaw(`${boot.url}/v1/app/ping`);
+		node_assert_strict.default.equal(ping.status, 200);
+		const prefixed = await sendRaw(`${boot.url}/v1${DYNAMIC_AUTH}/probe/html`);
+		node_assert_strict.default.notEqual(prefixed.status, 200);
+		const fallthrough = await sendRaw(`${boot.url}${AUTH}/probe/html`);
+		node_assert_strict.default.equal(fallthrough.status, 404);
+		node_assert_strict.default.ok(!boot.around.some((entry) => entry.includes(AUTH)), `the default base path reached Better Auth: ${boot.around.join(", ")}`);
+	}));
+	add("H-mount-custom-path", "over HTTP/2, a dynamic allowedHosts baseURL serves the :authority host at basePath", async (o, b) => {
+		const skip = await http2Ready(o);
+		if (skip) return skip;
+		await withBoot(o, b, {
+			...dynamicMount,
+			http2: true
+		}, async (boot) => {
+			const response = await http2Request(http2Origin(boot), {
+				":method": "GET",
+				":path": `${DYNAMIC_AUTH}/probe/url`,
+				":authority": "tenant.example"
+			});
+			node_assert_strict.default.equal(response.status, 200, response.body.toString("utf8"));
+			assertDynamicUrl(JSON.parse(response.body.toString("utf8")).url, "tenant.example");
+		});
+	}, noHttp2);
 	add("H-app-route-precedence", "a controller route under the base path is served by Nest", (o, b) => withBoot(o, b, {}, async (boot) => {
 		const response = await sendRaw(`${boot.url}${AUTH}/app-owned`);
 		node_assert_strict.default.equal(response.status, 200);
@@ -1410,10 +1559,87 @@ function httpPlatformConformance(options) {
 		});
 		for (const [name, value] of Object.entries(headers)) node_assert_strict.default.equal(result.headers.get(name), value, `${name} changed`);
 	}));
+	const probeIp = async (boot, headers = {}) => {
+		const response = await sendRaw(`${boot.url}${AUTH}/probe/ip`, { headers });
+		return response.status === 200 ? {
+			status: response.status,
+			...json(response)
+		} : { status: response.status };
+	};
 	add("H-ip-platform", "Better Auth's getIP sees the platform client IP", (o, b) => withBoot(o, b, {}, async (boot) => {
-		const response = await sendRaw(`${boot.url}${AUTH}/probe/ip`);
-		node_assert_strict.default.equal(json(response).ip, "127.0.0.1");
+		const value = await probeIp(boot);
+		node_assert_strict.default.equal(value.resolved, LOOPBACK, "Better Auth resolved no client IP from the request headers the platform set");
+		node_assert_strict.default.equal(value.ip, LOOPBACK);
 	}));
+	add("H-ip-platform", "over HTTP/2, Better Auth's getIP sees the platform client IP", async (o, b) => {
+		const skip = await http2Ready(o);
+		if (skip) return skip;
+		await withBoot(o, b, { http2: true }, async (boot) => {
+			const response = await http2Request(http2Origin(boot), {
+				":method": "GET",
+				":path": `${AUTH}/probe/ip`
+			});
+			node_assert_strict.default.equal(response.status, 200, response.body.toString("utf8"));
+			const value = JSON.parse(response.body.toString("utf8"));
+			node_assert_strict.default.equal(value.resolved, LOOPBACK, "Better Auth resolved no client IP over HTTP/2");
+		});
+	}, noHttp2);
+	const spoofedIp = {
+		"x-forwarded-for": "203.0.113.20",
+		"x-real-ip": "203.0.113.21",
+		[`x-nsba-ip-${"0".repeat(32)}`]: "203.0.113.22"
+	};
+	add("H-ip-platform", "in production mode, the platform IP keys a per-IP rate-limit bucket that client-sent IP headers cannot leave", (o, b) => {
+		const keys = [];
+		return inProduction(() => withBoot(o, b, rateLimited(keys), async (boot) => {
+			const first = await probeIp(boot);
+			node_assert_strict.default.equal(first.resolved, LOOPBACK);
+			const statuses = [first.status];
+			for (let index = 1; index <= IP_RULE.max; index++) statuses.push((await probeIp(boot)).status);
+			node_assert_strict.default.deepEqual(statuses, [
+				200,
+				200,
+				429
+			], `the per-IP rule (max ${IP_RULE.max}) answered ${statuses.join(", ")}`);
+			node_assert_strict.default.equal((await probeIp(boot, spoofedIp)).status, 429, "client-sent IP headers moved the request out of the platform IP's bucket");
+			node_assert_strict.default.deepEqual([...new Set(keys)], [`${LOOPBACK}|/probe/ip`], "the rate limiter was not keyed by the platform IP");
+		}));
+	});
+	add("H-ip-platform", "in production mode behind a trusted hop, every forwarded client gets its own rate-limit bucket", (o, b) => {
+		const keys = [];
+		const [left, right] = ["203.0.113.30", "203.0.113.31"];
+		return inProduction(() => withBoot(o, b, {
+			...rateLimited(keys),
+			trustProxy: true
+		}, async (boot) => {
+			const statuses = [];
+			for (let index = 0; index <= IP_RULE.max; index++) statuses.push((await probeIp(boot, { "x-forwarded-for": left })).status);
+			node_assert_strict.default.deepEqual(statuses, [
+				200,
+				200,
+				429
+			]);
+			const other = await probeIp(boot, { "x-forwarded-for": right });
+			node_assert_strict.default.equal(other.status, 200, "a second client shared the first client's bucket");
+			node_assert_strict.default.equal(other.resolved, right);
+			node_assert_strict.default.deepEqual([...new Set(keys)].sort(), [`${left}|/probe/ip`, `${right}|/probe/ip`]);
+		}));
+	}, noTrustHook);
+	add("H-ip-platform", "with trustedProxies covering the platform IP and trust off, Better Auth resolves no IP and B18 warns where proxyTrust() reports 'none'", (o, b) => inProduction(() => withBoot(o, b, loopbackProxies, async (boot) => {
+		const value = await probeIp(boot, { "x-forwarded-for": "203.0.113.40" });
+		node_assert_strict.default.equal(value.resolved, null, `Better Auth resolved ${String(value.resolved)} although trustedProxies covers the socket IP`);
+		const trust = resolvedPlatform(boot.app).proxyTrust?.(boot.app.getHttpAdapter());
+		const b18 = warningsWith(boot, "W_CLIENT_IP", "trustedProxies");
+		if (trust?.mode === "none") node_assert_strict.default.equal(b18.length, 1, boot.logger.text());
+	})));
+	add("H-ip-platform", "with trustedProxies covering the proxy and trust on, Better Auth resolves the client IP without a B18 warning", (o, b) => inProduction(() => withBoot(o, b, {
+		...loopbackProxies,
+		trustProxy: true
+	}, async (boot) => {
+		const value = await probeIp(boot, { "x-forwarded-for": "203.0.113.41" });
+		node_assert_strict.default.equal(value.resolved, "203.0.113.41");
+		node_assert_strict.default.deepEqual(warningsWith(boot, "W_CLIENT_IP", "trustedProxies"), []);
+	})), noTrustHook);
 	add("H-ip-spoof", "client-sent client-IP headers are ignored", (o, b) => withBoot(o, b, {}, async (boot) => {
 		const ip = json(await sendRaw(`${boot.url}${AUTH}/probe/ip`, { headers: {
 			"x-forwarded-for": "203.0.113.7",
@@ -1461,10 +1687,10 @@ function httpPlatformConformance(options) {
 		node_assert_strict.default.equal((await probedUrl(boot)).origin, "https://proxy.example");
 	}), () => options.trustOneProxy ? void 0 : "no trustOneProxy option was given");
 	add("H-h2-pseudo", "HTTP/2 pseudo-headers never reach Better Auth", async (o, b) => {
-		if (!(await capabilitiesOf(o))?.http2) return conformanceSkip("the platform declares no http2 capability");
-		node_assert_strict.default.ok(o.http2, "the platform declares capabilities.http2, so the kit requires the http2 option");
+		const skip = await http2Ready(o);
+		if (skip) return skip;
 		await withBoot(o, b, { http2: true }, async (boot) => {
-			const response = await http2Request(boot.url.replace(/^https?:/, "http:"), {
+			const response = await http2Request(http2Origin(boot), {
 				":method": "POST",
 				":path": `${AUTH}/probe/echo-raw`,
 				origin: KIT_BASE_URL,
@@ -1475,7 +1701,7 @@ function httpPlatformConformance(options) {
 			node_assert_strict.default.equal(Buffer.from(value.body, "base64").toString(), "h2 body");
 			node_assert_strict.default.ok(value.headers.every(([name]) => !name.startsWith(":")), "pseudo-headers reached Better Auth");
 		});
-	}, () => declaredCapabilities(options.platform) !== void 0 && !declaredCapabilities(options.platform)?.http2 ? "the platform declares no http2 capability" : void 0);
+	}, noHttp2);
 	add("H-resp-multicookie", "three Set-Cookie values arrive on separate lines", (o, b) => withBoot(o, b, {}, async (boot) => {
 		const lines = setCookieLines((await sendRaw(`${boot.url}${AUTH}/probe/multi-cookie`)).headers);
 		node_assert_strict.default.equal(lines.length, 3, `Set-Cookie lines: ${lines.join(" | ")}`);
@@ -1640,6 +1866,39 @@ function httpPlatformConformance(options) {
 		await moduleRef.close();
 		node_assert_strict.default.equal(bridge.state, "closed");
 	});
+	add("H-no-adapter", "a microservice boots once without an HTTP adapter, with listen() and with init() then listen()", async (o, b) => {
+		for (const initFirst of [false, true]) {
+			const label = `${b === "factory" ? "NestFactory.createMicroservice()" : "Test.createNestMicroservice()"} with ${initFirst ? "init() then listen()" : "listen()"}`;
+			const auth = createConformanceAuth();
+			const bridge = await bridgeOf(auth);
+			const logger = new CapturingLogger();
+			const module = kitModule(o, auth, await probeOf(auth), { module: { logSummary: true } }, {
+				filtered: [],
+				around: [],
+				accessor: {},
+				requests: () => node_assert_strict.default.fail("no HTTP platform expected"),
+				adapter: () => node_assert_strict.default.fail("no HTTP adapter expected")
+			});
+			const microserviceOptions = {
+				...o.microservice(),
+				logger,
+				abortOnError: false
+			};
+			const microservice = b === "factory" ? await _nestjs_core.NestFactory.createMicroservice(module, microserviceOptions) : (await _nestjs_testing.Test.createTestingModule({ imports: [module] }).compile()).createNestMicroservice(microserviceOptions);
+			try {
+				if (initFirst) await microservice.init();
+				await microservice.listen();
+				node_assert_strict.default.equal(bridge.state, "bound", `${label}: the instance is not bound`);
+				const summaries = logger.entries.filter((entry) => entry.text.startsWith("'default': "));
+				node_assert_strict.default.equal(summaries.length, 1, `${label}: the lifecycle ran ${summaries.length} times\n${logger.text()}`);
+				node_assert_strict.default.match(summaries[0].text, /not mounted/, label);
+				node_assert_strict.default.deepEqual(logger.errors(), [], `${label}: ${logger.text()}`);
+			} finally {
+				await microservice.close();
+			}
+			node_assert_strict.default.equal(bridge.state, "closed", `${label}: close() left the binding ${bridge.state}`);
+		}
+	}, () => options.microservice ? void 0 : "no microservice option was given");
 	add("H-late-adapter", "module init followed by an application init fails with LATE_HTTP_ADAPTER", async (o) => {
 		const auth = createConformanceAuth();
 		const module = kitModule(o, auth, await probeOf(auth), {}, {
@@ -1713,6 +1972,46 @@ function httpPlatformConformance(options) {
 		}
 		node_assert_strict.default.ok(bootIssueCodes(result.error).includes("DUPLICATE_INSTANCE"), String(result.error));
 	});
+	add("H-close-keeps-hooks", "app.close() closes the binding without unbinding its hooks, and the next application takes it over silently", async (o, b) => {
+		const auth = createConformanceAuth();
+		const bridge = await bridgeOf(auth);
+		const direct = async () => (await auth.handler(new Request(`${KIT_BASE_URL}${AUTH}/probe/html`))).status;
+		const closedHooks = [];
+		let duringShutdown;
+		const first = await bootHttp(o, b, {
+			instance: auth,
+			hooks: closedHooks,
+			onShutdown: async () => {
+				duringShutdown = await direct();
+			}
+		});
+		try {
+			const served = await sendRaw(`${first.url}${AUTH}/probe/html`);
+			node_assert_strict.default.equal(served.status, 200);
+			node_assert_strict.default.equal(closedHooks.length, 1, "the @BeforeAuth() hook did not run");
+		} finally {
+			await first.close();
+		}
+		const warns = (boot) => boot.logger.entries.filter((entry) => entry.level === "warn").map((entry) => entry.text);
+		const expected = new Set(warns(first));
+		node_assert_strict.default.equal(duringShutdown, 200);
+		node_assert_strict.default.equal(closedHooks.length, 2, "a Better Auth call from another module's shutdown hook skipped the application's @BeforeAuth() hook");
+		node_assert_strict.default.equal(bridge.state, "closed", `app.close() left the binding ${bridge.state}`);
+		node_assert_strict.default.equal(await direct(), 200);
+		node_assert_strict.default.equal(closedHooks.length, 3, "a Better Auth call after app.close() skipped the closed application's @BeforeAuth() hook");
+		const nextHooks = [];
+		await withBoot(o, b, {
+			instance: auth,
+			hooks: nextHooks
+		}, async (next) => {
+			node_assert_strict.default.equal(bridge.state, "bound");
+			node_assert_strict.default.deepEqual(warns(next).filter((text) => !expected.has(text)), [], "the next application warned while taking over the closed binding");
+			const served = await sendRaw(`${next.url}${AUTH}/probe/html`);
+			node_assert_strict.default.equal(served.status, 200);
+			node_assert_strict.default.equal(nextHooks.length, 1, "the next application's hook did not run");
+			node_assert_strict.default.equal(closedHooks.length, 3, "the closed application's hook still ran after the next application bound");
+		});
+	});
 	add("H-diagnostics-404", "an unknown auth path logs one WARN with a suggestion and keeps the 404", (o, b) => withBoot(o, b, { module: { http: { diagnostics: true } } }, async (boot) => {
 		for (let index = 0; index < 2; index++) {
 			const response = await sendRaw(`${boot.url}${AUTH}/sign-inn/email`, {
@@ -1729,6 +2028,43 @@ function httpPlatformConformance(options) {
 		node_assert_strict.default.equal(warnings.length, 1, boot.logger.text());
 		node_assert_strict.default.match(warnings[0].text, /Did you mean/);
 	}));
+	const proxyWarnings = (boot) => warningsWith(boot, "W_PROXY_UNTRUSTED");
+	add("H-proxy-untrusted-warning", "in production with proxy trust off, the first forwarded auth request logs W_PROXY_UNTRUSTED once and changes no response", (o, b) => inProduction(() => withBoot(o, b, {}, async (boot) => {
+		const platform = resolvedPlatform(boot.app);
+		if (typeof platform.proxyTrust !== "function") return conformanceSkip("the platform does not implement the optional proxyTrust()");
+		const trust = platform.proxyTrust(boot.app.getHttpAdapter());
+		if (trust.mode !== "none") return conformanceSkip(`a fresh adapter reports proxy trust '${trust.mode}', not 'none'`);
+		const html = async (headers = {}) => {
+			const response = await sendRaw(`${boot.url}${AUTH}/probe/html`, { headers });
+			node_assert_strict.default.equal(response.status, 200);
+			node_assert_strict.default.equal(response.body.toString("utf8"), "<p>probe</p>");
+		};
+		await html();
+		node_assert_strict.default.deepEqual(proxyWarnings(boot), [], "a request without forwarding headers logged");
+		const ping = await sendRaw(`${boot.url}/app/ping`, { headers: { "x-forwarded-for": "203.0.113.50" } });
+		node_assert_strict.default.equal(ping.status, 200);
+		node_assert_strict.default.deepEqual(proxyWarnings(boot), [], "an app route logged");
+		await html({ "x-forwarded-for": "203.0.113.51" });
+		const [warning, ...repeated] = proxyWarnings(boot);
+		node_assert_strict.default.ok(warning, "a forwarded auth request logged no W_PROXY_UNTRUSTED");
+		node_assert_strict.default.ok(warning.includes(`socket IP ${LOOPBACK}.`), `the warning did not name the platform's socket IP: ${warning}`);
+		node_assert_strict.default.ok(!warning.includes("203.0.113.51"), "the warning named a client-sent address as the socket IP");
+		node_assert_strict.default.deepEqual(repeated, []);
+		await html({ forwarded: "for=203.0.113.52" });
+		await html({ "x-real-ip": "203.0.113.53" });
+		node_assert_strict.default.equal(proxyWarnings(boot).length, 1, "W_PROXY_UNTRUSTED was logged more than once per application");
+	})), noProxyTrust);
+	add("H-proxy-untrusted-warning", "outside production, forwarded auth requests log no W_PROXY_UNTRUSTED", (o, b) => withNodeEnv("test", () => withBoot(o, b, {}, async (boot) => {
+		await sendRaw(`${boot.url}${AUTH}/probe/html`, { headers: { "x-forwarded-for": "203.0.113.54" } });
+		node_assert_strict.default.deepEqual(proxyWarnings(boot), []);
+	})), noProxyTrust);
+	add("H-proxy-untrusted-warning", "in production behind a trusted hop, forwarded auth requests log no W_PROXY_UNTRUSTED", async (o, b) => {
+		if (!await implementsMember(o, "proxyTrust")) return conformanceSkip("the platform does not implement the optional proxyTrust()");
+		return inProduction(() => withBoot(o, b, { trustProxy: true }, async (boot) => {
+			await sendRaw(`${boot.url}${AUTH}/probe/html`, { headers: { "x-forwarded-for": "203.0.113.55" } });
+			node_assert_strict.default.deepEqual(proxyWarnings(boot), []);
+		}));
+	}, () => noProxyTrust() ?? noTrustHook());
 	add("H-log-hygiene", "session and probe cookies never appear in captured logs", (o, b) => withBoot(o, b, {}, async (boot) => {
 		const identity = await kitIdentity(boot.auth);
 		const token = identity.cookie.split("=")[1].split(".")[0];