@flusys/nestjs-storage 9.1.2 → 9.2.0

package/fesm/493.js

@@ -8,13 +8,14 @@ import * as __rspack_external__nestjs_common_a04939da from "@nestjs/common";
 import * as __rspack_external__nestjs_swagger_7cd450b5 from "@nestjs/swagger";
 import * as __rspack_external_class_transformer_c5a479fb from "class-transformer";
 import * as __rspack_external_class_validator_7b99ef4d from "class-validator";
+import * as __rspack_external_path from "path";
 import * as __rspack_external_typeorm from "typeorm";
 import * as __rspack_external__nestjs_core_d7b00a1a from "@nestjs/core";
 import * as __rspack_external_crypto from "crypto";
 export const __rspack_esm_id = 493;
 export const __rspack_esm_ids = [493];
 export const __webpack_modules__ = {
-884(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
+4884(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
 /**
  * Domain event actions published by the storage module, alongside the CRUD
  * lifecycle actions every ApiService emits.
@@ -38,7 +39,7 @@ __webpack_require__.d(__webpack_exports__, {
 
 
 },
-450(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
+5450(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
 // ==================== STORAGE MODULE MESSAGE KEYS ====================
 const FILE_MESSAGES = {
     GET_ALL_SUCCESS: 'file.get.all.success',
@@ -72,7 +73,7 @@ __webpack_require__.d(__webpack_exports__, {
 
 
 },
-188(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
+9188(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
 /**
  * Storage Module Constants
  */ const STORAGE_MODULE_OPTIONS = 'STORAGE_MODULE_OPTIONS';
@@ -90,10 +91,10 @@ __webpack_require__.d(__webpack_exports__, {
 
 
 },
-322(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
-/* import */ var _nestjs_swagger__rspack_import_0 = __webpack_require__(176);
-/* import */ var class_transformer__rspack_import_1 = __webpack_require__(812);
-/* import */ var class_validator__rspack_import_2 = __webpack_require__(421);
+7322(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
+/* import */ var _nestjs_swagger__rspack_import_0 = __webpack_require__(6176);
+/* import */ var class_transformer__rspack_import_1 = __webpack_require__(5812);
+/* import */ var class_validator__rspack_import_2 = __webpack_require__(5421);
 function _ts_decorate(decorators, target, key, desc) {
     var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
     if (typeof Reflect === "object" && typeof Reflect.decorate === "function") {
@@ -266,7 +267,7 @@ _ts_decorate([
         default: true
     }),
     (0,class_validator__rspack_import_2.IsOptional)(),
-    (0,class_transformer__rspack_import_1.Type)(()=>Boolean),
+    (0,class_transformer__rspack_import_1.Transform)(({ value })=>value === 'true' ? true : value === 'false' ? false : value),
     (0,class_validator__rspack_import_2.IsBoolean)(),
     _ts_metadata("design:type", Boolean)
 ], UploadOptionsDto.prototype, "compress", void 0);
@@ -338,7 +339,7 @@ __webpack_require__.d(__webpack_exports__, {
 
 
 },
-975(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
+1975(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
 
 // EXPORTS
 __webpack_require__.d(__webpack_exports__, {
@@ -359,7 +360,7 @@ __webpack_require__.d(__webpack_exports__, {
 ;// CONCATENATED MODULE: external "@flusys/nestjs-shared/entities"
 
 // EXTERNAL MODULE: external "typeorm"
-var external_typeorm_ = __webpack_require__(158);
+var external_typeorm_ = __webpack_require__(7158);
 ;// CONCATENATED MODULE: ./projects/nestjs-storage/src/entities/file-manager.entity.ts
 function _ts_decorate(decorators, target, key, desc) {
     var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
@@ -530,7 +531,7 @@ Folder = folder_entity_ts_decorate([
 ], Folder);
 
 // EXTERNAL MODULE: external "@flusys/nestjs-shared"
-var nestjs_shared_ = __webpack_require__(422);
+var nestjs_shared_ = __webpack_require__(3422);
 ;// CONCATENATED MODULE: ./projects/nestjs-storage/src/entities/storage-config.entity.ts
 function storage_config_entity_ts_decorate(decorators, target, key, desc) {
     var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
@@ -779,7 +780,7 @@ function getStorageEntitiesByConfig(enableCompanyFeature) {
 
 
 },
-733(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
+2733(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
 var FileLocationEnum = /*#__PURE__*/ function(FileLocationEnum) {
     FileLocationEnum["AWS"] = "aws";
     FileLocationEnum["AZURE"] = "azure";
@@ -794,7 +795,7 @@ __webpack_require__.d(__webpack_exports__, {
 
 
 },
-192(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
+2192(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
 
 // EXPORTS
 __webpack_require__.d(__webpack_exports__, {
@@ -802,15 +803,15 @@ __webpack_require__.d(__webpack_exports__, {
 });
 
 // EXTERNAL MODULE: external "@flusys/nestjs-shared/constants"
-var constants_ = __webpack_require__(140);
+var constants_ = __webpack_require__(9140);
 // EXTERNAL MODULE: external "@nestjs/common"
-var common_ = __webpack_require__(157);
+var common_ = __webpack_require__(6157);
 ;// CONCATENATED MODULE: external "crypto"
 
 // EXTERNAL MODULE: ./projects/nestjs-storage/src/services/index.ts
-var services = __webpack_require__(148);
+var services = __webpack_require__(4148);
 // EXTERNAL MODULE: ./projects/nestjs-storage/src/providers/storage-provider.registry.ts
-var storage_provider_registry = __webpack_require__(264);
+var storage_provider_registry = __webpack_require__(9264);
 ;// CONCATENATED MODULE: ./projects/nestjs-storage/src/providers/storage-factory.service.ts
 function _ts_decorate(decorators, target, key, desc) {
     var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
@@ -840,6 +841,8 @@ function _ts_param(paramIndex, decorator) {
 
 
 
+const MAX_CACHED_PROVIDERS = 50;
+const PROVIDER_IDLE_TTL_MS = 30 * 60 * 1000;
 class StorageFactoryService {
     configService;
     cache = new Map();
@@ -848,8 +851,14 @@ class StorageFactoryService {
     }
     async createProvider(config) {
         const cacheKey = this.generateCacheKey(config);
+        const now = Date.now();
         const cached = this.cache.get(cacheKey);
-        if (cached) return cached;
+        if (cached) {
+            cached.lastUsed = now;
+            this.cache.delete(cacheKey);
+            this.cache.set(cacheKey, cached);
+            return cached.provider;
+        }
         const ProviderClass = storage_provider_registry/* .StorageProviderRegistry.get */.C.get(config.provider);
         if (!ProviderClass) {
             throw new common_.NotFoundException({
@@ -861,10 +870,37 @@ class StorageFactoryService {
                 }
             });
         }
+        // The pending promise is cached so concurrent first requests share one client instead of leaking extras
+        const entry = {
+            provider: this.instantiate(ProviderClass, config),
+            lastUsed: now
+        };
+        this.cache.set(cacheKey, entry);
+        entry.provider.catch(()=>{
+            if (this.cache.get(cacheKey) === entry) this.cache.delete(cacheKey);
+        });
+        this.evict(now);
+        return entry.provider;
+    }
+    /** A provider that needs no configuration; never one created for a specific StorageConfig row */ async getProvider(providerName) {
+        return this.createProvider({
+            provider: providerName,
+            config: {}
+        });
+    }
+    async clearCache() {
+        const entries = Array.from(this.cache.values());
+        this.cache.clear();
+        await Promise.allSettled(entries.map((entry)=>this.closeEntry(entry)));
+    }
+    async onModuleDestroy() {
+        await this.clearCache();
+    }
+    // ─── Private Helpers ──────────────────────────────────────────────────────────
+    async instantiate(ProviderClass, config) {
         try {
             const instance = new ProviderClass();
             await this.initializeProvider(instance, config);
-            this.cache.set(cacheKey, instance);
             return instance;
         } catch (error) {
             const errorMessage = error instanceof Error ? error.message : 'Unknown error';
@@ -878,32 +914,25 @@ class StorageFactoryService {
             });
         }
     }
-    async getProvider(providerName) {
-        const cachedKey = Array.from(this.cache.keys()).find((k)=>k.startsWith(providerName));
-        if (cachedKey) return this.cache.get(cachedKey);
-        return this.createProvider({
-            provider: providerName,
-            config: {}
-        });
-    }
-    getLocalProviderBasePath() {
-        const localKey = Array.from(this.cache.keys()).find((k)=>k.startsWith('local'));
-        const provider = localKey ? this.cache.get(localKey) : null;
-        return provider && 'basePath' in provider ? provider.basePath : null;
-    }
-    clearCache() {
-        this.cache.clear();
+    evict(now) {
+        for (const [key, entry] of this.cache){
+            const overCapacity = this.cache.size > MAX_CACHED_PROVIDERS;
+            if (!overCapacity && now - entry.lastUsed < PROVIDER_IDLE_TTL_MS) continue;
+            this.cache.delete(key);
+            void this.closeEntry(entry);
+        }
     }
-    async onModuleDestroy() {
-        const closePromises = Array.from(this.cache.entries()).filter(([, p])=>'close' in p && typeof p.close === 'function').map(([, p])=>p.close().catch(()=>{}));
-        await Promise.allSettled(closePromises);
-        this.cache.clear();
+    async closeEntry(entry) {
+        try {
+            const provider = await entry.provider;
+            if (typeof provider.close === 'function') await provider.close();
+        } catch  {
+        // A client that failed to initialize or to close has nothing left to release
+        }
     }
-    // ─── Private Helpers ──────────────────────────────────────────────────────────
     generateCacheKey(config) {
-        const sortedKeys = Object.keys(config.config || {}).sort();
-        const hash = __rspack_external_crypto.createHash('sha256').update(JSON.stringify(config.config, sortedKeys)).digest('hex').substring(0, 16);
-        return `${config.provider}-${hash}`;
+        const hash = __rspack_external_crypto.createHash('sha256').update(stableStringify(config.config ?? {})).digest('hex');
+        return `${config.provider}:${hash}`;
     }
     async initializeProvider(instance, config) {
         if (!('initialize' in instance) || typeof instance.initialize !== 'function') {
@@ -931,10 +960,18 @@ StorageFactoryService = _ts_decorate([
         typeof services/* .StorageConfigService */.tP === "undefined" ? Object : services/* .StorageConfigService */.tP
     ])
 ], StorageFactoryService);
+/** Key order never changes the key, and nested values always do - two configs must never share a client */ function stableStringify(value) {
+    if (Array.isArray(value)) return `[${value.map(stableStringify).join(',')}]`;
+    if (value && typeof value === 'object') {
+        const entries = Object.keys(value).toSorted().map((key)=>`${JSON.stringify(key)}:${stableStringify(value[key])}`);
+        return `{${entries.join(',')}}`;
+    }
+    return JSON.stringify(value) ?? 'undefined';
+}
 
 
 },
-264(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
+9264(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
 /**
  * Static registry for storage provider classes
  * Allows dynamic registration at runtime
@@ -963,22 +1000,23 @@ __webpack_require__.d(__webpack_exports__, {
 
 
 },
-955(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
+7955(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
 __webpack_require__.d(__webpack_exports__, {
   D: () => (FileManagerService)
 });
-/* import */ var _flusys_nestjs_shared_classes__rspack_import_0 = __webpack_require__(937);
-/* import */ var _flusys_nestjs_shared_modules__rspack_import_1 = __webpack_require__(236);
-/* import */ var _flusys_nestjs_shared_utils__rspack_import_2 = __webpack_require__(216);
-/* import */ var _nestjs_common__rspack_import_3 = __webpack_require__(157);
-/* import */ var typeorm__rspack_import_4 = __webpack_require__(158);
-/* import */ var _config_index_js__rspack_import_9 = __webpack_require__(884);
-/* import */ var _config_index_js__rspack_import_10 = __webpack_require__(450);
-/* import */ var _entities_index_js__rspack_import_5 = __webpack_require__(975);
-/* import */ var _enums_file_location_enum_js__rspack_import_11 = __webpack_require__(733);
-/* import */ var _storage_config_service_js__rspack_import_6 = __webpack_require__(397);
-/* import */ var _storage_datasource_provider_js__rspack_import_7 = __webpack_require__(616);
-/* import */ var _upload_service_js__rspack_import_8 = __webpack_require__(18);
+/* import */ var _flusys_nestjs_shared_classes__rspack_import_0 = __webpack_require__(6937);
+/* import */ var _flusys_nestjs_shared_modules__rspack_import_1 = __webpack_require__(1236);
+/* import */ var _flusys_nestjs_shared_utils__rspack_import_2 = __webpack_require__(9216);
+/* import */ var _nestjs_common__rspack_import_3 = __webpack_require__(6157);
+/* import */ var typeorm__rspack_import_4 = __webpack_require__(7158);
+/* import */ var _config_index_js__rspack_import_10 = __webpack_require__(4884);
+/* import */ var _config_index_js__rspack_import_11 = __webpack_require__(5450);
+/* import */ var _entities_index_js__rspack_import_5 = __webpack_require__(1975);
+/* import */ var _enums_file_location_enum_js__rspack_import_12 = __webpack_require__(2733);
+/* import */ var _utils_company_ownership_util_js__rspack_import_6 = __webpack_require__(5198);
+/* import */ var _storage_config_service_js__rspack_import_7 = __webpack_require__(6397);
+/* import */ var _storage_datasource_provider_js__rspack_import_8 = __webpack_require__(8616);
+/* import */ var _upload_service_js__rspack_import_9 = __webpack_require__(5018);
 function _ts_decorate(decorators, target, key, desc) {
     var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
     if (typeof Reflect === "object" && typeof Reflect.decorate === "function") {
@@ -1013,6 +1051,7 @@ function _ts_param(paramIndex, decorator) {
 
 
 
+
 const URL_EXPIRY_SECONDS = 3600;
 const DEFAULT_SELECT_FIELDS = [
     'id',
@@ -1035,9 +1074,15 @@ class FileManagerService extends _flusys_nestjs_shared_classes__rspack_import_0.
     dataSourceProvider;
     permissionCacheService;
     constructor(cacheManager, utilsService, uploadService, storageConfig, dataSourceProvider, permissionCacheService){
-        super(_config_index_js__rspack_import_9/* .STORAGE_EVENT_ENTITIES.FILE */.fR.FILE, cacheManager, utilsService, FileManagerService.name, true, _config_index_js__rspack_import_9/* .STORAGE_EVENT_MODULE */.qh, dataSourceProvider, storageConfig.isCompanyFeatureEnabled() ? _entities_index_js__rspack_import_5.FileManagerWithCompany : _entities_index_js__rspack_import_5.FileManager), this.cacheManager = cacheManager, this.utilsService = utilsService, this.uploadService = uploadService, this.storageConfig = storageConfig, this.dataSourceProvider = dataSourceProvider, this.permissionCacheService = permissionCacheService;
+        super(_config_index_js__rspack_import_10/* .STORAGE_EVENT_ENTITIES.FILE */.fR.FILE, cacheManager, utilsService, FileManagerService.name, true, _config_index_js__rspack_import_10/* .STORAGE_EVENT_MODULE */.qh, dataSourceProvider, storageConfig.isCompanyFeatureEnabled() ? _entities_index_js__rspack_import_5.FileManagerWithCompany : _entities_index_js__rspack_import_5.FileManager), this.cacheManager = cacheManager, this.utilsService = utilsService, this.uploadService = uploadService, this.storageConfig = storageConfig, this.dataSourceProvider = dataSourceProvider, this.permissionCacheService = permissionCacheService;
     }
     // ─── Override Methods ───────────────────────────────────────────────────────
+    /** Cached reads join the folder (id, name), and a hard folder delete nulls file.folder_id */ cacheDependencies() {
+        return [
+            this.entityName,
+            _config_index_js__rspack_import_10/* .STORAGE_EVENT_ENTITIES.FOLDER */.fR.FOLDER
+        ];
+    }
     async convertSingleDtoToEntity(dto, user) {
         let entity = {};
         if ('id' in dto && dto.id && typeof dto.id === 'string') {
@@ -1048,30 +1093,36 @@ class FileManagerService extends _flusys_nestjs_shared_classes__rspack_import_0.
             });
             if (!existing) throw new _nestjs_common__rspack_import_3.NotFoundException({
                 message: 'Entity not found for update',
-                messageKey: _config_index_js__rspack_import_10/* .FILE_MESSAGES.NOT_FOUND */.uA.NOT_FOUND
+                messageKey: _config_index_js__rspack_import_11/* .FILE_MESSAGES.NOT_FOUND */.uA.NOT_FOUND
             });
             entity = existing;
         }
-        const validatedFolder = dto.folderId ? await this.validateFolder(dto.folderId, user) : null;
-        const storageLocation = await this.resolveStorageLocation(dto, user);
         const merged = {
             ...entity,
             ...dto,
-            location: storageLocation,
-            folder: validatedFolder
+            location: await this.resolveStorageLocation(dto, user, entity.location)
         };
+        // A partial update that leaves folderId out keeps the file where it is; null moves it to the root
+        if (dto.folderId !== undefined || !entity.id) {
+            merged.folder = dto.folderId ? await this.validateFolder(dto.folderId, user) : null;
+        }
         if (this.storageConfig.isCompanyFeatureEnabled()) {
             merged.companyId = user?.companyId ?? null;
         }
         return merged;
     }
-    async getSelectQuery(query, _user, select) {
+    /** Every read (get-all, get/:id, get-by-ids) is scoped here: company first, then private files */ async getSelectQuery(query, user, select) {
         const fields = (select?.length ? select : DEFAULT_SELECT_FIELDS).map((f)=>`${this.entityName}.${f}`);
         if (this.storageConfig.isCompanyFeatureEnabled()) {
             fields.push('file_manager.companyId');
         }
         fields.push('folder.id', 'folder.name');
         query.leftJoinAndSelect('file_manager.folder', 'folder').select(fields);
+        (0,_flusys_nestjs_shared_utils__rspack_import_2.applyCompanyFilter)(query, {
+            isCompanyFeatureEnabled: this.storageConfig.isCompanyFeatureEnabled(),
+            entityAlias: 'file_manager'
+        }, user);
+        await this.applyPrivateFileFilter(query, user);
         return {
             query,
             isRaw: false
@@ -1090,27 +1141,28 @@ class FileManagerService extends _flusys_nestjs_shared_classes__rspack_import_0.
             isRaw: false
         };
     }
-    async getExtraManipulateQuery(query, filterDto, user) {
-        const result = await super.getExtraManipulateQuery(query, filterDto, user);
-        (0,_flusys_nestjs_shared_utils__rspack_import_2.applyCompanyFilter)(query, {
-            isCompanyFeatureEnabled: this.storageConfig.isCompanyFeatureEnabled(),
-            entityAlias: 'file_manager'
-        }, user);
-        await this.applyPrivateFileFilter(query, user);
-        return result;
+    async beforeUpdateOperation(dto, user) {
+        const ids = (Array.isArray(dto) ? dto : [
+            dto
+        ]).map((d)=>d.id).filter(Boolean);
+        await this.assertInUserCompany(ids, user);
     }
     async beforeDeleteOperation(dto, user, _qr) {
-        if (dto.type !== 'permanent') return;
         const ids = Array.isArray(dto.id) ? dto.id : [
             dto.id
         ];
-        const files = await this.repository.findBy({
-            id: (0,typeorm__rspack_import_4.In)(ids)
+        await this.assertInUserCompany(ids, user);
+        if (dto.type !== 'permanent') return;
+        const files = await this.repository.find({
+            where: {
+                id: (0,typeorm__rspack_import_4.In)(ids)
+            },
+            withDeleted: true
         });
         const grouped = this.groupFilesByConfig(files);
         for (const [configId, { keys, location }] of grouped){
             let deleteKeys = keys;
-            if (location === _enums_file_location_enum_js__rspack_import_11/* .FileLocationEnum.LOCAL */.N.LOCAL && configId !== 'default') {
+            if (location === _enums_file_location_enum_js__rspack_import_12/* .FileLocationEnum.LOCAL */.N.LOCAL && configId !== 'default') {
                 const basePath = await this.getStorageConfigBasePath(configId);
                 if (basePath) {
                     deleteKeys = keys.map((k)=>k.includes('/') ? k : `${basePath}/${k}`);
@@ -1125,7 +1177,7 @@ class FileManagerService extends _flusys_nestjs_shared_classes__rspack_import_0.
         const ids = dtos.map((d)=>d.id).filter(Boolean);
         if (!ids.length) throw new _nestjs_common__rspack_import_3.BadRequestException({
             message: 'No valid file IDs provided',
-            messageKey: _config_index_js__rspack_import_10/* .UPLOAD_MESSAGES.NO_FILES_PROVIDED */.dS.NO_FILES_PROVIDED
+            messageKey: _config_index_js__rspack_import_11/* .UPLOAD_MESSAGES.NO_FILES_PROVIDED */.dS.NO_FILES_PROVIDED
         });
         const fetched = await this.repository.findBy({
             id: (0,typeorm__rspack_import_4.In)(ids)
@@ -1141,28 +1193,25 @@ class FileManagerService extends _flusys_nestjs_shared_classes__rspack_import_0.
         if (updatedFiles.length) {
             try {
                 await this.repository.save(updatedFiles);
-                await Promise.all([
-                    this.clearCacheForAll(),
-                    this.clearCacheForId(updatedFiles)
-                ]);
             } catch  {
             // Silent failure - URL update is non-critical
             }
+            await this.invalidateCache();
         }
         return responses;
     }
     // ─── Private Helpers ────────────────────────────────────────────────────────
     buildWhereWithCompany(id, user) {
-        const where = {
+        return (0,_flusys_nestjs_shared_utils__rspack_import_2.buildCompanyWhereCondition)({
             id
-        };
-        if (this.storageConfig.isCompanyFeatureEnabled() && user?.companyId) {
-            where.companyId = user.companyId;
-        }
-        return where;
+        }, this.storageConfig.isCompanyFeatureEnabled(), user);
+    }
+    async assertInUserCompany(ids, user) {
+        await this.ensureDataSourceRepository();
+        await (0,_utils_company_ownership_util_js__rspack_import_6/* .assertRowsInUserCompany */.p)(this.repository, ids, user, this.storageConfig.isCompanyFeatureEnabled(), 'File');
     }
     async getStorageConfigRepository() {
-        const entity = this.storageConfig.isCompanyFeatureEnabled() ? (await Promise.resolve(/* import() */).then(__webpack_require__.bind(__webpack_require__, 975))).StorageConfigWithCompany : (await Promise.resolve(/* import() */).then(__webpack_require__.bind(__webpack_require__, 975))).StorageConfig;
+        const entity = this.storageConfig.isCompanyFeatureEnabled() ? (await Promise.resolve(/* import() */).then(__webpack_require__.bind(__webpack_require__, 1975))).StorageConfigWithCompany : (await Promise.resolve(/* import() */).then(__webpack_require__.bind(__webpack_require__, 1975))).StorageConfig;
         return this.dataSourceProvider.getRepository(entity);
     }
     async getStorageConfigBasePath(configId) {
@@ -1191,7 +1240,7 @@ class FileManagerService extends _flusys_nestjs_shared_classes__rspack_import_0.
         if (!folder) {
             throw new _nestjs_common__rspack_import_3.BadRequestException({
                 message: `Folder "${folderId}" not found or access denied`,
-                messageKey: _config_index_js__rspack_import_10/* .FOLDER_MESSAGES.NOT_FOUND */.Ee.NOT_FOUND,
+                messageKey: _config_index_js__rspack_import_11/* .FOLDER_MESSAGES.NOT_FOUND */.Ee.NOT_FOUND,
                 messageVariables: {
                     folderId
                 }
@@ -1199,22 +1248,23 @@ class FileManagerService extends _flusys_nestjs_shared_classes__rspack_import_0.
         }
         return folder;
     }
-    async resolveStorageLocation(dto, user) {
+    async resolveStorageLocation(dto, user, currentLocation) {
+        const fallback = dto.location || currentLocation || _enums_file_location_enum_js__rspack_import_12/* .FileLocationEnum.LOCAL */.N.LOCAL;
         const configId = dto.storageConfigId;
-        if (!configId) return dto.location || _enums_file_location_enum_js__rspack_import_11/* .FileLocationEnum.LOCAL */.N.LOCAL;
+        if (!configId) return fallback;
         try {
             const repo = await this.getStorageConfigRepository();
             const config = await repo.findOne({
                 where: this.buildWhereWithCompany(configId, user)
             });
-            return config?.storage || dto.location || _enums_file_location_enum_js__rspack_import_11/* .FileLocationEnum.LOCAL */.N.LOCAL;
+            return config?.storage || fallback;
         } catch  {
-            return dto.location || _enums_file_location_enum_js__rspack_import_11/* .FileLocationEnum.LOCAL */.N.LOCAL;
+            return fallback;
         }
     }
     applyContentTypeFilter(query, value) {
         const patterns = value.split(',').map((t)=>t.trim().replace('*', '%'));
-        query.where(new typeorm__rspack_import_4.Brackets((qb)=>{
+        query.andWhere(new typeorm__rspack_import_4.Brackets((qb)=>{
             patterns.forEach((p, i)=>{
                 const method = i === 0 ? 'where' : 'orWhere';
                 qb[method](`${this.entityName}.contentType LIKE :p${i}`, {
@@ -1230,8 +1280,8 @@ class FileManagerService extends _flusys_nestjs_shared_classes__rspack_import_0.
    * for any file ID, including other companies' or other users' private files.
    */ async scopeFilesToRequester(files, user) {
         let scoped = files;
-        if (this.storageConfig.isCompanyFeatureEnabled() && user?.companyId) {
-            scoped = scoped.filter((file)=>file.companyId === user.companyId);
+        if (this.storageConfig.isCompanyFeatureEnabled() && user) {
+            scoped = user.companyId ? scoped.filter((file)=>file.companyId === user.companyId) : [];
         }
         const canViewPrivate = user ? await this.permissionCacheService.hasPermission({
             userId: user.id,
@@ -1280,7 +1330,7 @@ class FileManagerService extends _flusys_nestjs_shared_classes__rspack_import_0.
         return appUrl || `${protocol}://${host}`;
     }
     async refreshFileUrl(file, protocol, host, now, user) {
-        const isCloudProvider = file.location === _enums_file_location_enum_js__rspack_import_11/* .FileLocationEnum.AWS */.N.AWS || file.location === _enums_file_location_enum_js__rspack_import_11/* .FileLocationEnum.AZURE */.N.AZURE;
+        const isCloudProvider = file.location === _enums_file_location_enum_js__rspack_import_12/* .FileLocationEnum.AWS */.N.AWS || file.location === _enums_file_location_enum_js__rspack_import_12/* .FileLocationEnum.AZURE */.N.AZURE;
         const needsNewUrl = !file.url || isCloudProvider && (typeof file.expiresAt !== 'number' || now >= file.expiresAt);
         if (needsNewUrl && file.storageConfigId) {
             try {
@@ -1291,7 +1341,7 @@ class FileManagerService extends _flusys_nestjs_shared_classes__rspack_import_0.
                 file.url = `${this.getFileBaseUrl(protocol, host)}/storage/upload/file/${file.key}`;
             }
         }
-        if (file.location === _enums_file_location_enum_js__rspack_import_11/* .FileLocationEnum.SFTP */.N.SFTP || file.location === _enums_file_location_enum_js__rspack_import_11/* .FileLocationEnum.LOCAL */.N.LOCAL) {
+        if (file.location === _enums_file_location_enum_js__rspack_import_12/* .FileLocationEnum.SFTP */.N.SFTP || file.location === _enums_file_location_enum_js__rspack_import_12/* .FileLocationEnum.LOCAL */.N.LOCAL) {
             let fileKey = file.key;
             if (!fileKey.includes('/') && file.storageConfigId) {
                 const basePath = await this.getStorageConfigBasePath(file.storageConfigId);
@@ -1322,32 +1372,33 @@ FileManagerService = _ts_decorate([
     }),
     _ts_param(0, (0,_nestjs_common__rspack_import_3.Inject)('CACHE_INSTANCE')),
     _ts_param(1, (0,_nestjs_common__rspack_import_3.Inject)(_flusys_nestjs_shared_modules__rspack_import_1.UtilsService)),
-    _ts_param(2, (0,_nestjs_common__rspack_import_3.Inject)(_upload_service_js__rspack_import_8/* .UploadService */.B)),
-    _ts_param(3, (0,_nestjs_common__rspack_import_3.Inject)(_storage_config_service_js__rspack_import_6/* .StorageConfigService */.t)),
-    _ts_param(4, (0,_nestjs_common__rspack_import_3.Inject)(_storage_datasource_provider_js__rspack_import_7/* .StorageDataSourceProvider */.M)),
+    _ts_param(2, (0,_nestjs_common__rspack_import_3.Inject)(_upload_service_js__rspack_import_9/* .UploadService */.B)),
+    _ts_param(3, (0,_nestjs_common__rspack_import_3.Inject)(_storage_config_service_js__rspack_import_7/* .StorageConfigService */.t)),
+    _ts_param(4, (0,_nestjs_common__rspack_import_3.Inject)(_storage_datasource_provider_js__rspack_import_8/* .StorageDataSourceProvider */.M)),
     _ts_param(5, (0,_nestjs_common__rspack_import_3.Inject)(_flusys_nestjs_shared_modules__rspack_import_1.SharedPermissionCacheService)),
     _ts_metadata("design:type", Function),
     _ts_metadata("design:paramtypes", [
         typeof _flusys_nestjs_shared_classes__rspack_import_0.HybridCache === "undefined" ? Object : _flusys_nestjs_shared_classes__rspack_import_0.HybridCache,
         typeof _flusys_nestjs_shared_modules__rspack_import_1.UtilsService === "undefined" ? Object : _flusys_nestjs_shared_modules__rspack_import_1.UtilsService,
-        typeof _upload_service_js__rspack_import_8/* .UploadService */.B === "undefined" ? Object : _upload_service_js__rspack_import_8/* .UploadService */.B,
-        typeof _storage_config_service_js__rspack_import_6/* .StorageConfigService */.t === "undefined" ? Object : _storage_config_service_js__rspack_import_6/* .StorageConfigService */.t,
-        typeof _storage_datasource_provider_js__rspack_import_7/* .StorageDataSourceProvider */.M === "undefined" ? Object : _storage_datasource_provider_js__rspack_import_7/* .StorageDataSourceProvider */.M,
+        typeof _upload_service_js__rspack_import_9/* .UploadService */.B === "undefined" ? Object : _upload_service_js__rspack_import_9/* .UploadService */.B,
+        typeof _storage_config_service_js__rspack_import_7/* .StorageConfigService */.t === "undefined" ? Object : _storage_config_service_js__rspack_import_7/* .StorageConfigService */.t,
+        typeof _storage_datasource_provider_js__rspack_import_8/* .StorageDataSourceProvider */.M === "undefined" ? Object : _storage_datasource_provider_js__rspack_import_8/* .StorageDataSourceProvider */.M,
         typeof _flusys_nestjs_shared_modules__rspack_import_1.SharedPermissionCacheService === "undefined" ? Object : _flusys_nestjs_shared_modules__rspack_import_1.SharedPermissionCacheService
     ])
 ], FileManagerService);
 
 
 },
-195(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
-/* import */ var _flusys_nestjs_shared_classes__rspack_import_0 = __webpack_require__(937);
-/* import */ var _flusys_nestjs_shared_modules__rspack_import_1 = __webpack_require__(236);
-/* import */ var _flusys_nestjs_shared_utils__rspack_import_2 = __webpack_require__(216);
-/* import */ var _nestjs_common__rspack_import_3 = __webpack_require__(157);
-/* import */ var _config_index_js__rspack_import_7 = __webpack_require__(884);
-/* import */ var _entities_index_js__rspack_import_4 = __webpack_require__(975);
-/* import */ var _storage_config_service_js__rspack_import_5 = __webpack_require__(397);
-/* import */ var _storage_datasource_provider_js__rspack_import_6 = __webpack_require__(616);
+8195(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
+/* import */ var _flusys_nestjs_shared_classes__rspack_import_0 = __webpack_require__(6937);
+/* import */ var _flusys_nestjs_shared_modules__rspack_import_1 = __webpack_require__(1236);
+/* import */ var _flusys_nestjs_shared_utils__rspack_import_2 = __webpack_require__(9216);
+/* import */ var _nestjs_common__rspack_import_3 = __webpack_require__(6157);
+/* import */ var _config_index_js__rspack_import_8 = __webpack_require__(4884);
+/* import */ var _entities_index_js__rspack_import_4 = __webpack_require__(1975);
+/* import */ var _utils_company_ownership_util_js__rspack_import_5 = __webpack_require__(5198);
+/* import */ var _storage_config_service_js__rspack_import_6 = __webpack_require__(6397);
+/* import */ var _storage_datasource_provider_js__rspack_import_7 = __webpack_require__(8616);
 function _ts_decorate(decorators, target, key, desc) {
     var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
     if (typeof Reflect === "object" && typeof Reflect.decorate === "function") {
@@ -1379,12 +1430,13 @@ function _ts_param(paramIndex, decorator) {
 
 
 
+
 class FolderService extends _flusys_nestjs_shared_classes__rspack_import_0.ApiService {
     cacheManager;
     utilsService;
     storageConfig;
     constructor(cacheManager, utilsService, storageConfig, dataSourceProvider){
-        super(_config_index_js__rspack_import_7/* .STORAGE_EVENT_ENTITIES.FOLDER */.fR.FOLDER, cacheManager, utilsService, FolderService.name, true, _config_index_js__rspack_import_7/* .STORAGE_EVENT_MODULE */.qh, dataSourceProvider, storageConfig.isCompanyFeatureEnabled() ? _entities_index_js__rspack_import_4.FolderWithCompany : _entities_index_js__rspack_import_4.Folder), this.cacheManager = cacheManager, this.utilsService = utilsService, this.storageConfig = storageConfig;
+        super(_config_index_js__rspack_import_8/* .STORAGE_EVENT_ENTITIES.FOLDER */.fR.FOLDER, cacheManager, utilsService, FolderService.name, true, _config_index_js__rspack_import_8/* .STORAGE_EVENT_MODULE */.qh, dataSourceProvider, storageConfig.isCompanyFeatureEnabled() ? _entities_index_js__rspack_import_4.FolderWithCompany : _entities_index_js__rspack_import_4.Folder), this.cacheManager = cacheManager, this.utilsService = utilsService, this.storageConfig = storageConfig;
     }
     // ─── Override Methods ───────────────────────────────────────────────────────
     async convertSingleDtoToEntity(dto, user) {
@@ -1394,7 +1446,7 @@ class FolderService extends _flusys_nestjs_shared_classes__rspack_import_0.ApiSe
         }
         return entity;
     }
-    async getSelectQuery(query, _user, select) {
+    async getSelectQuery(query, user, select) {
         if (!select?.length) {
             select = [
                 'id',
@@ -1408,18 +1460,28 @@ class FolderService extends _flusys_nestjs_shared_classes__rspack_import_0.ApiSe
             }
         }
         query.select(select.map((f)=>`${this.entityName}.${f}`));
+        (0,_flusys_nestjs_shared_utils__rspack_import_2.applyCompanyFilter)(query, {
+            isCompanyFeatureEnabled: this.storageConfig.isCompanyFeatureEnabled(),
+            entityAlias: 'folder'
+        }, user);
         return {
             query,
             isRaw: false
         };
     }
-    async getExtraManipulateQuery(query, filterDto, user) {
-        const result = await super.getExtraManipulateQuery(query, filterDto, user);
-        (0,_flusys_nestjs_shared_utils__rspack_import_2.applyCompanyFilter)(query, {
-            isCompanyFeatureEnabled: this.storageConfig.isCompanyFeatureEnabled(),
-            entityAlias: 'folder'
-        }, user);
-        return result;
+    async beforeUpdateOperation(dto, user) {
+        await this.assertInUserCompany((Array.isArray(dto) ? dto : [
+            dto
+        ]).map((d)=>d.id), user);
+    }
+    async beforeDeleteOperation(dto, user) {
+        await this.assertInUserCompany(Array.isArray(dto.id) ? dto.id : [
+            dto.id
+        ], user);
+    }
+    async assertInUserCompany(ids, user) {
+        await this.ensureDataSourceRepository();
+        await (0,_utils_company_ownership_util_js__rspack_import_5/* .assertRowsInUserCompany */.p)(this.repository, ids.filter(Boolean), user, this.storageConfig.isCompanyFeatureEnabled(), 'Folder');
     }
 }
 FolderService = _ts_decorate([
@@ -1428,14 +1490,14 @@ FolderService = _ts_decorate([
     }),
     _ts_param(0, (0,_nestjs_common__rspack_import_3.Inject)('CACHE_INSTANCE')),
     _ts_param(1, (0,_nestjs_common__rspack_import_3.Inject)(_flusys_nestjs_shared_modules__rspack_import_1.UtilsService)),
-    _ts_param(2, (0,_nestjs_common__rspack_import_3.Inject)(_storage_config_service_js__rspack_import_5/* .StorageConfigService */.t)),
-    _ts_param(3, (0,_nestjs_common__rspack_import_3.Inject)(_storage_datasource_provider_js__rspack_import_6/* .StorageDataSourceProvider */.M)),
+    _ts_param(2, (0,_nestjs_common__rspack_import_3.Inject)(_storage_config_service_js__rspack_import_6/* .StorageConfigService */.t)),
+    _ts_param(3, (0,_nestjs_common__rspack_import_3.Inject)(_storage_datasource_provider_js__rspack_import_7/* .StorageDataSourceProvider */.M)),
     _ts_metadata("design:type", Function),
     _ts_metadata("design:paramtypes", [
         typeof _flusys_nestjs_shared_classes__rspack_import_0.HybridCache === "undefined" ? Object : _flusys_nestjs_shared_classes__rspack_import_0.HybridCache,
         typeof _flusys_nestjs_shared_modules__rspack_import_1.UtilsService === "undefined" ? Object : _flusys_nestjs_shared_modules__rspack_import_1.UtilsService,
-        typeof _storage_config_service_js__rspack_import_5/* .StorageConfigService */.t === "undefined" ? Object : _storage_config_service_js__rspack_import_5/* .StorageConfigService */.t,
-        typeof _storage_datasource_provider_js__rspack_import_6/* .StorageDataSourceProvider */.M === "undefined" ? Object : _storage_datasource_provider_js__rspack_import_6/* .StorageDataSourceProvider */.M
+        typeof _storage_config_service_js__rspack_import_6/* .StorageConfigService */.t === "undefined" ? Object : _storage_config_service_js__rspack_import_6/* .StorageConfigService */.t,
+        typeof _storage_datasource_provider_js__rspack_import_7/* .StorageDataSourceProvider */.M === "undefined" ? Object : _storage_datasource_provider_js__rspack_import_7/* .StorageDataSourceProvider */.M
     ])
 ], FolderService);
 
@@ -1445,7 +1507,7 @@ __webpack_require__.d(__webpack_exports__, {
 
 
 },
-148(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
+4148(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
 __webpack_require__.d(__webpack_exports__, {
   BB: () => (/* reexport safe */ _upload_service_js__rspack_import_5.B),
   DL: () => (/* reexport safe */ _file_manager_service_js__rspack_import_0.D),
@@ -1454,12 +1516,12 @@ __webpack_require__.d(__webpack_exports__, {
   ol: () => (/* reexport safe */ _storage_provider_config_service_js__rspack_import_3.o),
   tP: () => (/* reexport safe */ _storage_config_service_js__rspack_import_2.t)
 });
-/* import */ var _file_manager_service_js__rspack_import_0 = __webpack_require__(955);
-/* import */ var _folder_service_js__rspack_import_1 = __webpack_require__(195);
-/* import */ var _storage_config_service_js__rspack_import_2 = __webpack_require__(397);
-/* import */ var _storage_provider_config_service_js__rspack_import_3 = __webpack_require__(623);
-/* import */ var _storage_datasource_provider_js__rspack_import_4 = __webpack_require__(616);
-/* import */ var _upload_service_js__rspack_import_5 = __webpack_require__(18);
+/* import */ var _file_manager_service_js__rspack_import_0 = __webpack_require__(7955);
+/* import */ var _folder_service_js__rspack_import_1 = __webpack_require__(8195);
+/* import */ var _storage_config_service_js__rspack_import_2 = __webpack_require__(6397);
+/* import */ var _storage_provider_config_service_js__rspack_import_3 = __webpack_require__(8623);
+/* import */ var _storage_datasource_provider_js__rspack_import_4 = __webpack_require__(8616);
+/* import */ var _upload_service_js__rspack_import_5 = __webpack_require__(5018);
 
 
 
@@ -1469,10 +1531,10 @@ __webpack_require__.d(__webpack_exports__, {
 
 
 },
-397(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
-/* import */ var _nestjs_common__rspack_import_0 = __webpack_require__(157);
-/* import */ var _config_index_js__rspack_import_2 = __webpack_require__(450);
-/* import */ var _config_storage_constants_js__rspack_import_1 = __webpack_require__(188);
+6397(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
+/* import */ var _nestjs_common__rspack_import_0 = __webpack_require__(6157);
+/* import */ var _config_index_js__rspack_import_2 = __webpack_require__(5450);
+/* import */ var _config_storage_constants_js__rspack_import_1 = __webpack_require__(9188);
 function _ts_decorate(decorators, target, key, desc) {
     var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
     if (typeof Reflect === "object" && typeof Reflect.decorate === "function") {
@@ -1539,7 +1601,7 @@ class StorageConfigService {
         if (allowedTypes.includes('*/*')) {
             return true;
         }
-        return allowedTypes.some((type)=>type.endsWith('/*') ? mimeType.startsWith(type.slice(0, -2)) : type === mimeType);
+        return allowedTypes.some((type)=>type.endsWith('/*') ? mimeType.startsWith(type.slice(0, -1)) : type === mimeType);
     }
     validateFileSize(fileSize) {
         const maxSize = this.getMaxFileSize();
@@ -1594,7 +1656,7 @@ __webpack_require__.d(__webpack_exports__, {
 
 
 },
-616(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
+8616(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
 
 // EXPORTS
 __webpack_require__.d(__webpack_exports__, {
@@ -1602,13 +1664,13 @@ __webpack_require__.d(__webpack_exports__, {
 });
 
 // EXTERNAL MODULE: external "@flusys/nestjs-shared/modules"
-var modules_ = __webpack_require__(236);
+var modules_ = __webpack_require__(1236);
 // EXTERNAL MODULE: external "@nestjs/common"
-var common_ = __webpack_require__(157);
+var common_ = __webpack_require__(6157);
 ;// CONCATENATED MODULE: external "@nestjs/core"
 
 // EXTERNAL MODULE: ./projects/nestjs-storage/src/services/storage-config.service.ts
-var storage_config_service = __webpack_require__(397);
+var storage_config_service = __webpack_require__(6397);
 ;// CONCATENATED MODULE: ./projects/nestjs-storage/src/services/storage-datasource.provider.ts
 function _ts_decorate(decorators, target, key, desc) {
     var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
@@ -1661,7 +1723,7 @@ class StorageDataSourceProvider extends modules_.MultiTenantDataSourceService {
     }
     async getStorageEntities(enableCompanyFeature) {
         const enable = enableCompanyFeature ?? this.configService.isCompanyFeatureEnabled();
-        const entities = await Promise.resolve(/* import() */).then(__webpack_require__.bind(__webpack_require__, 975));
+        const entities = await Promise.resolve(/* import() */).then(__webpack_require__.bind(__webpack_require__, 1975));
         return enable ? [
             entities.FileManagerWithCompany,
             entities.FolderWithCompany,
@@ -1695,17 +1757,20 @@ StorageDataSourceProvider = _ts_decorate([
 
 
 },
-623(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
-/* import */ var _flusys_nestjs_shared_classes__rspack_import_0 = __webpack_require__(937);
-/* import */ var _flusys_nestjs_shared_modules__rspack_import_1 = __webpack_require__(236);
-/* import */ var _flusys_nestjs_shared_utils__rspack_import_2 = __webpack_require__(216);
-/* import */ var _nestjs_common__rspack_import_3 = __webpack_require__(157);
-/* import */ var typeorm__rspack_import_4 = __webpack_require__(158);
-/* import */ var _config_index_js__rspack_import_8 = __webpack_require__(884);
-/* import */ var _config_index_js__rspack_import_9 = __webpack_require__(450);
-/* import */ var _entities_index_js__rspack_import_5 = __webpack_require__(975);
-/* import */ var _storage_config_service_js__rspack_import_6 = __webpack_require__(397);
-/* import */ var _storage_datasource_provider_js__rspack_import_7 = __webpack_require__(616);
+8623(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
+/* import */ var _flusys_nestjs_shared_classes__rspack_import_0 = __webpack_require__(6937);
+/* import */ var _flusys_nestjs_shared_modules__rspack_import_1 = __webpack_require__(1236);
+/* import */ var _flusys_nestjs_shared_utils__rspack_import_2 = __webpack_require__(9216);
+/* import */ var _nestjs_common__rspack_import_3 = __webpack_require__(6157);
+/* import */ var path__rspack_import_4 = __webpack_require__(2521);
+/* import */ var typeorm__rspack_import_5 = __webpack_require__(7158);
+/* import */ var _config_index_js__rspack_import_10 = __webpack_require__(4884);
+/* import */ var _config_index_js__rspack_import_11 = __webpack_require__(5450);
+/* import */ var _enums_file_location_enum_js__rspack_import_12 = __webpack_require__(2733);
+/* import */ var _entities_index_js__rspack_import_6 = __webpack_require__(1975);
+/* import */ var _utils_company_ownership_util_js__rspack_import_7 = __webpack_require__(5198);
+/* import */ var _storage_config_service_js__rspack_import_8 = __webpack_require__(6397);
+/* import */ var _storage_datasource_provider_js__rspack_import_9 = __webpack_require__(8616);
 function _ts_decorate(decorators, target, key, desc) {
     var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
     if (typeof Reflect === "object" && typeof Reflect.decorate === "function") {
@@ -1738,30 +1803,39 @@ function _ts_param(paramIndex, decorator) {
 
 
 
+
+
+
 class StorageProviderConfigService extends _flusys_nestjs_shared_classes__rspack_import_0.ApiService {
     cacheManager;
     utilsService;
     storageConfig;
     constructor(cacheManager, utilsService, storageConfig, dataSourceProvider){
-        super(_config_index_js__rspack_import_8/* .STORAGE_EVENT_ENTITIES.STORAGE_CONFIG */.fR.STORAGE_CONFIG, cacheManager, utilsService, StorageProviderConfigService.name, true, _config_index_js__rspack_import_8/* .STORAGE_EVENT_MODULE */.qh, dataSourceProvider, storageConfig.isCompanyFeatureEnabled() ? _entities_index_js__rspack_import_5.StorageConfigWithCompany : _entities_index_js__rspack_import_5.StorageConfig), this.cacheManager = cacheManager, this.utilsService = utilsService, this.storageConfig = storageConfig;
+        super(_config_index_js__rspack_import_10/* .STORAGE_EVENT_ENTITIES.STORAGE_CONFIG */.fR.STORAGE_CONFIG, cacheManager, utilsService, StorageProviderConfigService.name, // Rows carry provider credentials - keep them out of the shared cache
+        false, _config_index_js__rspack_import_10/* .STORAGE_EVENT_MODULE */.qh, dataSourceProvider, storageConfig.isCompanyFeatureEnabled() ? _entities_index_js__rspack_import_6.StorageConfigWithCompany : _entities_index_js__rspack_import_6.StorageConfig), this.cacheManager = cacheManager, this.utilsService = utilsService, this.storageConfig = storageConfig;
+    }
+    async beforeUpdateOperation(dto, user) {
+        await this.assertInUserCompany((Array.isArray(dto) ? dto : [
+            dto
+        ]).map((d)=>d.id), user);
     }
-    async beforeDeleteOperation(dto, _user, _queryRunner) {
+    async beforeDeleteOperation(dto, user, _queryRunner) {
         const ids = Array.isArray(dto.id) ? dto.id : [
             dto.id
         ];
-        await this.ensureDataSourceRepository();
+        await this.assertInUserCompany(ids, user);
         const defaultConfigs = await this.repository.find({
             where: {
-                id: (0,typeorm__rspack_import_4.In)(ids),
+                id: (0,typeorm__rspack_import_5.In)(ids),
                 isDefault: true,
-                deletedAt: (0,typeorm__rspack_import_4.IsNull)()
+                deletedAt: (0,typeorm__rspack_import_5.IsNull)()
             }
         });
         if (defaultConfigs.length > 0) {
             const names = defaultConfigs.map((c)=>c.name).join(', ');
             throw new _nestjs_common__rspack_import_3.ForbiddenException({
                 message: `Cannot delete the default storage config(s): ${names}. Set another config as default first.`,
-                messageKey: _config_index_js__rspack_import_9/* .STORAGE_CONFIG_MESSAGES.DEFAULT_DELETE_FORBIDDEN */.Y8.DEFAULT_DELETE_FORBIDDEN,
+                messageKey: _config_index_js__rspack_import_11/* .STORAGE_CONFIG_MESSAGES.DEFAULT_DELETE_FORBIDDEN */.Y8.DEFAULT_DELETE_FORBIDDEN,
                 messageVariables: {
                     names
                 }
@@ -1776,7 +1850,7 @@ class StorageProviderConfigService extends _flusys_nestjs_shared_classes__rspack
         }
         return entity;
     }
-    async getSelectQuery(query, _user, select) {
+    async getSelectQuery(query, user, select) {
         if (!select?.length) {
             select = [
                 'id',
@@ -1793,6 +1867,10 @@ class StorageProviderConfigService extends _flusys_nestjs_shared_classes__rspack
             }
         }
         query.select(select.map((f)=>`${this.entityName}.${f}`));
+        (0,_flusys_nestjs_shared_utils__rspack_import_2.applyCompanyFilter)(query, {
+            isCompanyFeatureEnabled: this.storageConfig.isCompanyFeatureEnabled(),
+            entityAlias: this.entityName
+        }, user);
         return {
             query,
             isRaw: false
@@ -1800,10 +1878,6 @@ class StorageProviderConfigService extends _flusys_nestjs_shared_classes__rspack
     }
     async getExtraManipulateQuery(query, filterDto, user) {
         const result = await super.getExtraManipulateQuery(query, filterDto, user);
-        (0,_flusys_nestjs_shared_utils__rspack_import_2.applyCompanyFilter)(query, {
-            isCompanyFeatureEnabled: this.storageConfig.isCompanyFeatureEnabled(),
-            entityAlias: 'storageConfig'
-        }, user);
         query.orderBy(`${this.entityName}.createdAt`, 'DESC');
         return result;
     }
@@ -1839,6 +1913,10 @@ class StorageProviderConfigService extends _flusys_nestjs_shared_classes__rspack
             }
         });
     }
+    async assertInUserCompany(ids, user) {
+        await this.ensureDataSourceRepository();
+        await (0,_utils_company_ownership_util_js__rspack_import_7/* .assertRowsInUserCompany */.p)(this.repository, ids.filter(Boolean), user, this.storageConfig.isCompanyFeatureEnabled(), 'Storage configuration');
+    }
     async getConfigByType(storage, user) {
         await this.ensureDataSourceRepository();
         const where = (0,_flusys_nestjs_shared_utils__rspack_import_2.buildCompanyWhereCondition)({
@@ -1849,6 +1927,42 @@ class StorageProviderConfigService extends _flusys_nestjs_shared_classes__rspack
             where
         });
     }
+    /**
+   * Absolute storage roots of every active local config in the current tenant, resolved the way
+   * LocalProvider resolves them. Cached under the storage-config stamp, which every config write
+   * moves, so an edited or deactivated config stops being served on all instances.
+   */ async getActiveLocalBasePaths() {
+        await this.ensureDataSourceRepository();
+        const tenantId = this.cacheTenant();
+        let cacheKey = null;
+        try {
+            const stamp = await this.utilsService.getCacheStamp(this.cacheManager, [
+                this.entityName
+            ], tenantId);
+            cacheKey = this.utilsService.getCacheKey(this.entityName, {
+                localBasePaths: true
+            }, undefined, tenantId, stamp);
+            const cached = await this.cacheManager.get(cacheKey);
+            if (cached) return cached;
+        } catch  {
+            cacheKey = null;
+        }
+        const configs = await this.repository.find({
+            where: {
+                storage: _enums_file_location_enum_js__rspack_import_12/* .FileLocationEnum.LOCAL */.N.LOCAL,
+                isActive: true
+            },
+            select: [
+                'id',
+                'config'
+            ]
+        });
+        const basePaths = [
+            ...new Set(configs.map((c)=>path__rspack_import_4.resolve(c.config?.basePath || './uploads')))
+        ];
+        if (cacheKey) await this.cacheManager.set(cacheKey, basePaths).catch(()=>undefined);
+        return basePaths;
+    }
 }
 StorageProviderConfigService = _ts_decorate([
     (0,_nestjs_common__rspack_import_3.Injectable)({
@@ -1856,14 +1970,14 @@ StorageProviderConfigService = _ts_decorate([
     }),
     _ts_param(0, (0,_nestjs_common__rspack_import_3.Inject)('CACHE_INSTANCE')),
     _ts_param(1, (0,_nestjs_common__rspack_import_3.Inject)(_flusys_nestjs_shared_modules__rspack_import_1.UtilsService)),
-    _ts_param(2, (0,_nestjs_common__rspack_import_3.Inject)(_storage_config_service_js__rspack_import_6/* .StorageConfigService */.t)),
-    _ts_param(3, (0,_nestjs_common__rspack_import_3.Inject)(_storage_datasource_provider_js__rspack_import_7/* .StorageDataSourceProvider */.M)),
+    _ts_param(2, (0,_nestjs_common__rspack_import_3.Inject)(_storage_config_service_js__rspack_import_8/* .StorageConfigService */.t)),
+    _ts_param(3, (0,_nestjs_common__rspack_import_3.Inject)(_storage_datasource_provider_js__rspack_import_9/* .StorageDataSourceProvider */.M)),
     _ts_metadata("design:type", Function),
     _ts_metadata("design:paramtypes", [
         typeof _flusys_nestjs_shared_classes__rspack_import_0.HybridCache === "undefined" ? Object : _flusys_nestjs_shared_classes__rspack_import_0.HybridCache,
         typeof _flusys_nestjs_shared_modules__rspack_import_1.UtilsService === "undefined" ? Object : _flusys_nestjs_shared_modules__rspack_import_1.UtilsService,
-        typeof _storage_config_service_js__rspack_import_6/* .StorageConfigService */.t === "undefined" ? Object : _storage_config_service_js__rspack_import_6/* .StorageConfigService */.t,
-        typeof _storage_datasource_provider_js__rspack_import_7/* .StorageDataSourceProvider */.M === "undefined" ? Object : _storage_datasource_provider_js__rspack_import_7/* .StorageDataSourceProvider */.M
+        typeof _storage_config_service_js__rspack_import_8/* .StorageConfigService */.t === "undefined" ? Object : _storage_config_service_js__rspack_import_8/* .StorageConfigService */.t,
+        typeof _storage_datasource_provider_js__rspack_import_9/* .StorageDataSourceProvider */.M === "undefined" ? Object : _storage_datasource_provider_js__rspack_import_9/* .StorageDataSourceProvider */.M
     ])
 ], StorageProviderConfigService);
 
@@ -1873,7 +1987,7 @@ __webpack_require__.d(__webpack_exports__, {
 
 
 },
-18(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
+5018(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
 
 // EXPORTS
 __webpack_require__.d(__webpack_exports__, {
@@ -1881,23 +1995,23 @@ __webpack_require__.d(__webpack_exports__, {
 });
 
 // EXTERNAL MODULE: external "@flusys/nestjs-shared"
-var nestjs_shared_ = __webpack_require__(422);
+var nestjs_shared_ = __webpack_require__(3422);
 // EXTERNAL MODULE: external "@flusys/nestjs-shared/classes"
-var classes_ = __webpack_require__(937);
+var classes_ = __webpack_require__(6937);
 // EXTERNAL MODULE: external "@flusys/nestjs-shared/utils"
-var utils_ = __webpack_require__(216);
+var utils_ = __webpack_require__(9216);
 // EXTERNAL MODULE: external "@nestjs/common"
-var common_ = __webpack_require__(157);
+var common_ = __webpack_require__(6157);
 // EXTERNAL MODULE: ./projects/nestjs-storage/src/config/message-keys.ts
-var message_keys = __webpack_require__(450);
+var message_keys = __webpack_require__(5450);
 // EXTERNAL MODULE: ./projects/nestjs-storage/src/config/event-actions.ts
-var event_actions = __webpack_require__(884);
+var event_actions = __webpack_require__(4884);
 // EXTERNAL MODULE: ./projects/nestjs-storage/src/dtos/upload.dto.ts
-var upload_dto = __webpack_require__(322);
+var upload_dto = __webpack_require__(7322);
 // EXTERNAL MODULE: ./projects/nestjs-storage/src/enums/file-location.enum.ts
-var file_location_enum = __webpack_require__(733);
+var file_location_enum = __webpack_require__(2733);
 // EXTERNAL MODULE: ./projects/nestjs-storage/src/providers/storage-factory.service.ts + 1 modules
-var storage_factory_service = __webpack_require__(192);
+var storage_factory_service = __webpack_require__(2192);
 ;// CONCATENATED MODULE: ./projects/nestjs-storage/src/utils/file-validator.util.ts
 /**
  * Result of file content validation.
@@ -1963,12 +2077,12 @@ var storage_factory_service = __webpack_require__(192);
     },
     {
         signature: [
-            0x52,
-            0x49,
-            0x46,
-            0x46
+            0x57,
+            0x45,
+            0x42,
+            0x50
         ],
-        offset: 0,
+        offset: 8,
         mimeType: 'image/webp'
     },
     {
@@ -2058,33 +2172,25 @@ var storage_factory_service = __webpack_require__(192);
         offset: 0,
         mimeType: 'audio/flac'
     },
-    // Video
     {
         signature: [
-            0x00,
-            0x00,
-            0x00,
-            0x1c,
-            0x66,
-            0x74,
-            0x79,
-            0x70
+            0x57,
+            0x41,
+            0x56,
+            0x45
         ],
-        offset: 0,
-        mimeType: 'video/mp4'
+        offset: 8,
+        mimeType: 'audio/wav'
     },
+    // Video
     {
         signature: [
-            0x00,
-            0x00,
-            0x00,
-            0x20,
             0x66,
             0x74,
             0x79,
             0x70
         ],
-        offset: 0,
+        offset: 4,
         mimeType: 'video/mp4'
     },
     {
@@ -2099,12 +2205,12 @@ var storage_factory_service = __webpack_require__(192);
     },
     {
         signature: [
-            0x52,
+            0x41,
+            0x56,
             0x49,
-            0x46,
-            0x46
+            0x20
         ],
-        offset: 0,
+        offset: 8,
         mimeType: 'video/avi'
     },
     // Archives
@@ -2237,7 +2343,8 @@ var storage_factory_service = __webpack_require__(192);
     /**
    * Check if a MIME type is a dangerous text type that can execute scripts.
    */ static isDangerousTextType(mimeType) {
-        return DANGEROUS_TEXT_TYPES.some((t)=>mimeType === t);
+        const baseType = mimeType.split(';')[0].trim().toLowerCase();
+        return DANGEROUS_TEXT_TYPES.includes(baseType);
     }
     /**
    * Check if two MIME types are compatible (exact match or aliases).
@@ -2267,7 +2374,7 @@ var storage_factory_service = __webpack_require__(192);
         return allowedTypes.some((allowed)=>{
             // Category wildcard (e.g., "image/*")
             if (allowed.endsWith('/*')) {
-                const category = allowed.slice(0, -2);
+                const category = allowed.slice(0, -1);
                 return mimeType.startsWith(category);
             }
             return allowed === mimeType;
@@ -2283,6 +2390,8 @@ var storage_factory_service = __webpack_require__(192);
         '*/*'
     ]) {
         try {
+            const dangerous = this.rejectUnlistedDangerousType(declaredMimeType, allowedTypes);
+            if (dangerous) return dangerous;
             const detectedType = this.detectFileType(buffer);
             // No magic bytes detected - handle text-based types
             if (!detectedType) {
@@ -2302,15 +2411,16 @@ var storage_factory_service = __webpack_require__(192);
         }
     }
     /**
+   * Script-capable types (HTML, JS, SVG) pass only when listed by exact name - a polyglot
+   * with a GIF or PNG header must not slip through as "same category as the content".
+   */ static rejectUnlistedDangerousType(declaredMimeType, allowedTypes) {
+        if (!this.isDangerousTextType(declaredMimeType)) return null;
+        if (allowedTypes.includes(declaredMimeType)) return null;
+        return this.failureResult(`File type "${declaredMimeType}" is potentially dangerous and not explicitly allowed`, declaredMimeType, declaredMimeType);
+    }
+    /**
    * Handle validation for files without detectable magic bytes.
    */ static validateUndetectedType(declaredMimeType, allowedTypes) {
-        // Check for dangerous text types first (HTML, JS, SVG)
-        if (this.isDangerousTextType(declaredMimeType)) {
-            const explicitlyAllowed = allowedTypes.some((t)=>t === declaredMimeType && t !== '*/*' && !t.endsWith('/*'));
-            if (!explicitlyAllowed) {
-                return this.failureResult(`File type "${declaredMimeType}" is potentially dangerous and not explicitly allowed`, declaredMimeType, declaredMimeType);
-            }
-        }
         // Safe text-based files don't have magic bytes, trust declared type
         if (this.isTextBasedType(declaredMimeType)) {
             const isAllowed = this.isTypeAllowed(declaredMimeType, allowedTypes);
@@ -2334,9 +2444,9 @@ var storage_factory_service = __webpack_require__(192);
 }
 
 // EXTERNAL MODULE: ./projects/nestjs-storage/src/services/storage-config.service.ts
-var storage_config_service = __webpack_require__(397);
+var storage_config_service = __webpack_require__(6397);
 // EXTERNAL MODULE: ./projects/nestjs-storage/src/services/storage-provider-config.service.ts
-var storage_provider_config_service = __webpack_require__(623);
+var storage_provider_config_service = __webpack_require__(8623);
 ;// CONCATENATED MODULE: ./projects/nestjs-storage/src/services/upload.service.ts
 function _ts_decorate(decorators, target, key, desc) {
     var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
@@ -2442,7 +2552,7 @@ class UploadService {
     /**
    * Get storage provider and config info based on storage config ID
    * Validates company ownership when company feature is enabled
-   */ async getStorageProviderWithConfig(storageConfigId, user) {
+   */ async getStorageProviderWithConfig(storageConfigId, user, requireActive = false) {
         let storageConfig;
         // Get storage config from database
         if (storageConfigId) {
@@ -2456,6 +2566,13 @@ class UploadService {
             }
             // Validate company ownership using shared utility
             (0,utils_.validateCompanyOwnership)(config, user, this.storageConfigService.isCompanyFeatureEnabled(), 'Storage configuration');
+            // A deactivated config keeps serving and deleting its existing files but takes no new uploads
+            if (requireActive && config.isActive === false) {
+                throw new common_.NotFoundException({
+                    message: 'Storage configuration is inactive',
+                    messageKey: message_keys/* .UPLOAD_MESSAGES.CONFIG_NOT_FOUND */.dS.CONFIG_NOT_FOUND
+                });
+            }
             storageConfig = config;
         } else {
             // Use default config (scoped to user's company/branch)
@@ -2483,6 +2600,7 @@ class UploadService {
         if (storageConfigId) {
             const config = await this.storageProviderConfigService.findByIdDirect(storageConfigId);
             if (config) {
+                (0,utils_.validateCompanyOwnership)(config, user, this.storageConfigService.isCompanyFeatureEnabled(), 'Storage configuration');
                 return this.createProviderFromConfig(config);
             }
         }
@@ -2504,8 +2622,11 @@ class UploadService {
         return this.createFallbackLocalProvider();
     }
     async uploadSingleFile(file, options, user) {
+        this.assertFilesProvided(file ? [
+            file
+        ] : []);
         this.validateFile(file);
-        const { provider, location, configId } = await this.getStorageProviderWithConfig(options.storageConfigId, user);
+        const { provider, location, configId } = await this.getStorageProviderWithConfig(options.storageConfigId, user, true);
         const result = await provider.uploadFile(file, options);
         await this.publishFileEvent(event_actions/* .STORAGE_EVENT_ACTIONS.UPLOADED */.hw.UPLOADED, [
             result.key
@@ -2522,11 +2643,12 @@ class UploadService {
         };
     }
     async uploadMultipleFiles(files, options, user) {
+        this.assertFilesProvided(files);
         for (const file of files){
             this.validateFile(file);
         }
-        const { provider, location, configId } = await this.getStorageProviderWithConfig(options.storageConfigId, user);
-        const results = await provider.uploadMultipleFiles(files, options);
+        const { provider, location, configId } = await this.getStorageProviderWithConfig(options.storageConfigId, user, true);
+        const results = await this.uploadAllOrNothing(provider, files, options);
         await this.publishFileEvent(event_actions/* .STORAGE_EVENT_ACTIONS.UPLOADED */.hw.UPLOADED, results.map((result)=>result.key), user, {
             location,
             storageConfigId: configId,
@@ -2567,6 +2689,26 @@ class UploadService {
         });
         return true;
     }
+    assertFilesProvided(files) {
+        if (!files?.length) {
+            throw new common_.BadRequestException({
+                message: 'No files provided',
+                messageKey: message_keys/* .UPLOAD_MESSAGES.NO_FILES_PROVIDED */.dS.NO_FILES_PROVIDED
+            });
+        }
+    }
+    /** One failed file fails the batch, and the files already stored are removed again */ async uploadAllOrNothing(provider, files, options) {
+        const settled = await Promise.allSettled(files.map((file)=>provider.uploadFile(file, options)));
+        const uploaded = settled.filter((r)=>r.status === 'fulfilled').map((r)=>r.value);
+        const failure = settled.find((r)=>r.status === 'rejected');
+        if (failure) {
+            if (uploaded.length) {
+                await provider.deleteMultipleFiles(uploaded.map((r)=>r.key)).catch(()=>undefined);
+            }
+            throw failure.reason;
+        }
+        return uploaded;
+    }
     async publishFileEvent(action, keys, user, metadata) {
         await (0,classes_.publishDomainEvent)({
             module: event_actions/* .STORAGE_EVENT_MODULE */.qh,
@@ -2580,31 +2722,11 @@ class UploadService {
     bytesToKb(bytes) {
         return Number((bytes * 0.001).toFixed(2));
     }
-    /**
-   * Get local storage basePath from DB config
-   * Initializes local provider if not cached, ensuring basePath is from DB
-   */ async getLocalStorageBasePath() {
+    /** Storage roots the public file route may serve from; empty when they cannot be read */ async getLocalStorageBasePaths() {
         try {
-            // First check if already cached
-            const cachedPath = this.storageFactory.getLocalProviderBasePath();
-            if (cachedPath) {
-                return cachedPath;
-            }
-            // Get local config from DB (without user context for public access)
-            const localConfigs = await this.storageProviderConfigService.getConfigByType(file_location_enum/* .FileLocationEnum.LOCAL */.N.LOCAL);
-            if (localConfigs.length > 0) {
-                const localConfig = localConfigs[0];
-                // Initialize provider to cache it
-                await this.storageFactory.createProvider({
-                    provider: file_location_enum/* .FileLocationEnum.LOCAL */.N.LOCAL,
-                    config: localConfig.config
-                });
-                // Now get the cached basePath
-                return this.storageFactory.getLocalProviderBasePath();
-            }
-            return null;
+            return await this.storageProviderConfigService.getActiveLocalBasePaths();
         } catch  {
-            return null;
+            return [];
         }
     }
     async makeFileUrl(key, storageConfigId, expiresIn = 3600, user) {
@@ -2702,61 +2824,104 @@ UploadService = _ts_decorate([
 
 
 },
-422(module) {
+5198(__unused_rspack_module, __webpack_exports__, __webpack_require__) {
+/* import */ var _flusys_nestjs_shared_constants__rspack_import_0 = __webpack_require__(9140);
+/* import */ var _nestjs_common__rspack_import_1 = __webpack_require__(6157);
+/* import */ var typeorm__rspack_import_2 = __webpack_require__(7158);
+
+
+
+/**
+ * Write paths of ApiService load rows by id alone, so a caller could update or delete another
+ * company's row by guessing its id. Every row must belong to the caller's company - a caller
+ * without a company may only touch rows without one.
+ */ async function assertRowsInUserCompany(repository, ids, user, isCompanyFeatureEnabled, entityName) {
+    if (!isCompanyFeatureEnabled || !user || !ids.length) return;
+    const rows = await repository.find({
+        where: {
+            id: (0,typeorm__rspack_import_2.In)(ids)
+        },
+        withDeleted: true
+    });
+    const userCompanyId = user.companyId ?? null;
+    if (rows.some((row)=>(row.companyId ?? null) !== userCompanyId)) {
+        throw new _nestjs_common__rspack_import_1.ForbiddenException({
+            message: `${entityName} belongs to another company`,
+            messageKey: _flusys_nestjs_shared_constants__rspack_import_0.AUTH_MESSAGES.ENTITY_BELOG_ANOTHER_COMPANY,
+            messageVariables: {
+                entity: entityName
+            }
+        });
+    }
+}
+
+__webpack_require__.d(__webpack_exports__, {
+  p: () => (assertRowsInUserCompany)
+});
+
+
+},
+3422(module) {
 
 module.exports = __rspack_external__flusys_nestjs_shared_393d2cae;
 
 
 },
-937(module) {
+6937(module) {
 
 module.exports = __rspack_external__flusys_nestjs_shared_classes_6076a329;
 
 
 },
-140(module) {
+9140(module) {
 
 module.exports = __rspack_external__flusys_nestjs_shared_constants_81f33d5b;
 
 
 },
-236(module) {
+1236(module) {
 
 module.exports = __rspack_external__flusys_nestjs_shared_modules_24702bee;
 
 
 },
-216(module) {
+9216(module) {
 
 module.exports = __rspack_external__flusys_nestjs_shared_utils_9125c1f1;
 
 
 },
-157(module) {
+6157(module) {
 
 module.exports = __rspack_external__nestjs_common_a04939da;
 
 
 },
-176(module) {
+6176(module) {
 
 module.exports = __rspack_external__nestjs_swagger_7cd450b5;
 
 
 },
-812(module) {
+5812(module) {
 
 module.exports = __rspack_external_class_transformer_c5a479fb;
 
 
 },
-421(module) {
+5421(module) {
 
 module.exports = __rspack_external_class_validator_7b99ef4d;
 
 
 },
-158(module) {
+2521(module) {
+
+module.exports = __rspack_external_path;
+
+
+},
+7158(module) {
 
 module.exports = __rspack_external_typeorm;