@hexabot-ai/api 3.2.2-alpha.0 → 3.2.2-alpha.10

package/src/mcp/types.ts

@@ -0,0 +1,14 @@
+/*
+ * Hexabot — Fair Core License (FCL-1.0-ALv2)
+ * Copyright (c) 2026 Hexastack.
+ * Full terms: see LICENSE.md.
+ */
+
+import type { User } from '@hexabot-ai/types';
+import type { Request } from 'express';
+
+export type HexabotMcpRequest = Request & {
+  user?: User;
+  hexabotUser?: User;
+  mcpTokenId?: string;
+};

package/src/user/entities/model.entity.ts

@@ -4,6 +4,8 @@
  * Full terms: see LICENSE.md.
  */
 
+import { createRequire } from 'node:module';
+
 import { modelSchema, modelFullSchema } from '@hexabot-ai/types';
 import { Column, Entity, Index, OneToMany } from 'typeorm';
 
@@ -14,7 +16,9 @@ import { BaseOrmEntity } from '@/database/entities/base.entity';
 import { ModelDto } from '../dto/model.dto';
 import { TRelation } from '../types/index.type';
 
-import { PermissionOrmEntity } from './permission.entity';
+import type { PermissionOrmEntity } from './permission.entity';
+
+const requireEntity = createRequire(__filename);
 
 @Entity({ name: 'models' })
 @Index(['name'], { unique: true })
@@ -34,11 +38,15 @@ export class ModelOrmEntity extends BaseOrmEntity<ModelDto> {
   @JsonColumn({ default: '{}' })
   attributes: Record<string, unknown>;
 
-  @Column({ nullable: true })
+  @Column({ type: 'varchar', nullable: true })
   relation?: TRelation;
 
-  @OneToMany(() => PermissionOrmEntity, (permission) => permission.model, {
-    cascade: ['remove'],
-  })
+  @OneToMany(
+    () => requireEntity('./permission.entity').PermissionOrmEntity,
+    (permission: PermissionOrmEntity) => permission.model,
+    {
+      cascade: ['remove'],
+    },
+  )
   permissions?: PermissionOrmEntity[];
 }

package/src/user/entities/permission.entity.ts

@@ -4,6 +4,8 @@
  * Full terms: see LICENSE.md.
  */
 
+import { createRequire } from 'node:module';
+
 import { permissionSchema, permissionFullSchema } from '@hexabot-ai/types';
 import {
   Column,
@@ -22,8 +24,10 @@ import { PermissionDto } from '../dto/permission.dto';
 import { Action } from '../types/action.type';
 import { TRelation } from '../types/index.type';
 
-import { ModelOrmEntity } from './model.entity';
-import { RoleOrmEntity } from './role.entity';
+import type { ModelOrmEntity } from './model.entity';
+import type { RoleOrmEntity } from './role.entity';
+
+const requireEntity = createRequire(__filename);
 
 @Entity({ name: 'permissions' })
 @Index(['model', 'action', 'role', 'relation'], { unique: true })
@@ -32,9 +36,13 @@ export class PermissionOrmEntity extends BaseOrmEntity<PermissionDto> {
 
   fullCls = permissionFullSchema;
 
-  @ManyToOne(() => ModelOrmEntity, (model) => model.permissions, {
-    onDelete: 'CASCADE',
-  })
+  @ManyToOne(
+    () => requireEntity('./model.entity').ModelOrmEntity,
+    (model: ModelOrmEntity) => model.permissions,
+    {
+      onDelete: 'CASCADE',
+    },
+  )
   @JoinColumn({ name: 'model_id' })
   @AsRelation()
   model!: ModelOrmEntity;
@@ -45,9 +53,13 @@ export class PermissionOrmEntity extends BaseOrmEntity<PermissionDto> {
   @EnumColumn({ enum: Action })
   action!: Action;
 
-  @ManyToOne(() => RoleOrmEntity, (role) => role.permissions, {
-    onDelete: 'CASCADE',
-  })
+  @ManyToOne(
+    () => requireEntity('./role.entity').RoleOrmEntity,
+    (role: RoleOrmEntity) => role.permissions,
+    {
+      onDelete: 'CASCADE',
+    },
+  )
   @JoinColumn({ name: 'role_id' })
   @AsRelation()
   role!: RoleOrmEntity;
@@ -55,6 +67,6 @@ export class PermissionOrmEntity extends BaseOrmEntity<PermissionDto> {
   @RelationId((permission: PermissionOrmEntity) => permission.role)
   private readonly roleId!: string;
 
-  @Column({ default: 'role' })
+  @Column({ type: 'varchar', default: 'role' })
   relation!: TRelation;
 }

package/src/user/entities/role.entity.ts

@@ -4,6 +4,8 @@
  * Full terms: see LICENSE.md.
  */
 
+import { createRequire } from 'node:module';
+
 import { roleSchema, roleFullSchema } from '@hexabot-ai/types';
 import { Column, Entity, Index, ManyToMany, OneToMany } from 'typeorm';
 
@@ -12,9 +14,11 @@ import { BaseOrmEntity } from '@/database/entities/base.entity';
 
 import { RoleDto } from '../dto/role.dto';
 
-import { PermissionOrmEntity } from './permission.entity';
+import type { PermissionOrmEntity } from './permission.entity';
 import { UserOrmEntity } from './user.entity';
 
+const requireEntity = createRequire(__filename);
+
 export type TRole = 'admin' | 'public';
 
 @Entity({ name: 'roles' })
@@ -31,9 +35,13 @@ export class RoleOrmEntity extends BaseOrmEntity<RoleDto> {
   @Column({ default: true })
   active!: boolean;
 
-  @OneToMany(() => PermissionOrmEntity, (permission) => permission.role, {
-    cascade: ['remove'],
-  })
+  @OneToMany(
+    () => requireEntity('./permission.entity').PermissionOrmEntity,
+    (permission: PermissionOrmEntity) => permission.role,
+    {
+      cascade: ['remove'],
+    },
+  )
   permissions?: PermissionOrmEntity[];
 
   @ManyToMany(() => UserOrmEntity, (user) => user.roles)

package/src/user/guards/ability.guard.ts

@@ -17,6 +17,8 @@ import {
 import { Reflector } from '@nestjs/core';
 import { Request } from 'express';
 
+import { config } from '@/config';
+
 import { TRole } from '../entities/role.entity';
 import { PermissionService } from '../services/permission.service';
 import { MethodToAction } from '../types/action.type';
@@ -31,12 +33,20 @@ export class Ability implements CanActivate {
 
   async canActivate(context: ExecutionContext): Promise<boolean> {
     const roles = this.reflector.get<TRole[]>('roles', context.getHandler());
+    const { _parsedUrl } = context
+      .switchToHttp()
+      .getRequest<Request & { _parsedUrl: Url }>();
+    const pathname = _parsedUrl.pathname?.replace(`/api`, '');
+
+    if (config.mcp.enabled && pathname && pathname === '/mcp') {
+      return true;
+    }
 
     if (roles?.includes('public')) {
       return true;
     }
 
-    const { user, method, _parsedUrl, session } = context
+    const { user, method, session } = context
       .switchToHttp()
       .getRequest<Request & { user: User; _parsedUrl: Url }>();
     if (!user) {
@@ -49,11 +59,13 @@ export class Ability implements CanActivate {
       throw new UnauthorizedException('Session expired');
     }
 
+    if (config.mcp.enabled && pathname?.startsWith('/mcp-token')) {
+      return true;
+    }
+
     const roleIds = Array.isArray(user.roles) ? user.roles : [];
 
     if (roleIds.length) {
-      const pathname = _parsedUrl.pathname?.replace(`/api`, '');
-
       if (
         pathname &&
         [

package/src/utils/generics/extension.ts

@@ -8,13 +8,11 @@ import { Inject, OnModuleInit } from '@nestjs/common';
 
 import { LoggerService } from '@/logger/logger.service';
 
-import { ExtensionName } from '../types/extension';
-
 export abstract class Extension implements OnModuleInit {
   @Inject(LoggerService)
   protected readonly logger: LoggerService;
 
-  constructor(public readonly name: ExtensionName) {}
+  constructor(public readonly name: string) {}
 
   getName() {
     return this.name;

package/src/utils/helpers/safe-property-path.ts

@@ -0,0 +1,13 @@
+/*
+ * Hexabot — Fair Core License (FCL-1.0-ALv2)
+ * Copyright (c) 2025 Hexastack.
+ * Full terms: see LICENSE.md.
+ */
+
+import toPath from 'lodash/toPath';
+
+const FORBIDDEN_SEGMENTS = new Set(['__proto__', 'constructor', 'prototype']);
+
+export function hasForbiddenSegment(path: string): boolean {
+  return toPath(path).some((segment) => FORBIDDEN_SEGMENTS.has(segment));
+}

package/src/utils/index.ts

@@ -62,8 +62,6 @@ export * from './pipes/zod.pipe';
 
 export * from './types/dto.types';
 
-export * from './types/extension';
-
 export * from './types/filter.types';
 
 export * from './types/format.types';

package/src/utils/pipes/typeorm-search-filter.pipe.ts

@@ -22,6 +22,7 @@ import {
   Not,
 } from 'typeorm';
 
+import { hasForbiddenSegment } from '../helpers/safe-property-path';
 import {
   TFilterNestedKeysOfType,
   TSearchFilterValue,
@@ -200,7 +201,7 @@ export class TypeOrmSearchFilterPipe<T>
     }
 
     const [field = '', direction = 'desc'] = sort.trim().split(/\s+/);
-    if (!field) {
+    if (!field || hasForbiddenSegment(field)) {
       return undefined;
     }
 
@@ -396,7 +397,7 @@ export class TypeOrmSearchFilterPipe<T>
     path: string,
     value: unknown,
   ): void {
-    if (value === undefined) return;
+    if (value === undefined || hasForbiddenSegment(path)) return;
     const segments = path.split('.');
     let cursor = target;
 
@@ -416,7 +417,7 @@ export class TypeOrmSearchFilterPipe<T>
     right: FindOptionsWhere<T>,
   ): FindOptionsWhere<T> {
     for (const [key, value] of Object.entries(right)) {
-      if (value === undefined) {
+      if (value === undefined || hasForbiddenSegment(key)) {
         continue;
       }
 

package/src/utils/pipes/uuid.pipe.ts

@@ -10,7 +10,7 @@ import {
   Injectable,
   PipeTransform,
 } from '@nestjs/common';
-import { validate as uuidValidate, version as uuidVersion } from 'uuid';
+import { isUUID } from 'class-validator';
 
 /**
  * Validates UUID route parameters by automatically checking parameters named `id`
@@ -56,13 +56,13 @@ export class UuidPipe implements PipeTransform {
 
   private ensureUuid(rawValue: string, paramName: string): void {
     const candidate = rawValue.trim();
-    if (!uuidValidate(candidate)) {
+    if (!isUUID(candidate)) {
       throw new BadRequestException(
         `Invalid UUID supplied for "${paramName}".`,
       );
     }
 
-    const version = uuidVersion(candidate);
+    const version = Number(candidate[14]);
     if (!this.allowedVersions.has(version)) {
       throw new BadRequestException(
         `Unsupported UUID version (${version}) supplied for "${paramName}".`,

package/src/utils/test/fixtures/contenttype.ts

@@ -7,9 +7,9 @@
 import { ContentType } from '@hexabot-ai/types';
 import { DataSource, DeepPartial } from 'typeorm';
 
-import { DEFAULT_CONTENT_TYPE_SCHEMA } from '@/cms';
 import { ContentTypeCreateDto } from '@/cms/dto/contentType.dto';
 import { ContentTypeOrmEntity } from '@/cms/entities/content-type.entity';
+import { DEFAULT_CONTENT_TYPE_SCHEMA } from '@/cms/services/content-type.service';
 
 import { getFixturesWithDefaultValues } from '../defaultValues';
 import { FixturesTypeBuilder } from '../types';

package/src/utils/test/fixtures/label.ts

@@ -23,34 +23,16 @@ export const contentLabelDefaultValues: TLabelFixtures['defaultValues'] = {
 export const labels: TLabelFixtures['values'][] = [
   {
     description: 'test description 1',
-    label_id: {
-      messenger: 'messenger',
-      web: 'web',
-      twitter: 'twitter',
-      dimelo: 'dimelo',
-    },
     name: 'TEST_TITLE_1',
     title: 'test title 1',
   },
   {
     description: 'test description 2',
-    label_id: {
-      messenger: 'messenger',
-      web: 'web',
-      twitter: 'twitter',
-      dimelo: 'dimelo',
-    },
     name: 'TEST_TITLE_2',
     title: 'test title 2',
   },
   {
     description: 'test description 3',
-    label_id: {
-      messenger: 'messenger',
-      web: 'web',
-      twitter: 'twitter',
-      dimelo: 'dimelo',
-    },
     name: 'TEST_TITLE_3',
     title: 'test title 3',
   },
@@ -78,7 +60,6 @@ export const installLabelFixturesTypeOrm = async (dataSource: DataSource) => {
       builtin: fixture.builtin ?? false,
       description:
         fixture.description === undefined ? null : fixture.description,
-      label_id: fixture.label_id === undefined ? null : fixture.label_id,
       group: group ? ({ id: group } as Pick<LabelGroupOrmEntity, 'id'>) : null,
     });
   });

package/src/utils/test/fixtures/workflow.ts

@@ -11,7 +11,7 @@ import {
   installUserFixturesTypeOrm,
   userFixtureIds,
 } from '@/utils/test/fixtures/user';
-import { WorkflowCreateDto } from '@/workflow';
+import { WorkflowCreateDto } from '@/workflow/dto/workflow.dto';
 import { WorkflowVersionOrmEntity } from '@/workflow/entities/workflow-version.entity';
 import { WorkflowOrmEntity } from '@/workflow/entities/workflow.entity';
 import {

package/src/utils/test/providers/i18n-service.provider.ts

@@ -4,7 +4,7 @@
  * Full terms: see LICENSE.md.
  */
 
-import { I18nService } from '@/i18n';
+import { I18nService } from '@/i18n/services/i18n.service';
 
 export const I18nServiceProvider = {
   provide: I18nService,

package/src/utils/test/providers/mailer-service.provider.ts

@@ -4,7 +4,7 @@
  * Full terms: see LICENSE.md.
  */
 
-import { MailerService } from '@/mailer';
+import { MailerService } from '@/mailer/mailer.service';
 
 export const mailerMock = {
   sendMail: jest.fn((_options) =>

package/src/utils/test/providers/setting-service.provider.ts

@@ -4,7 +4,7 @@
  * Full terms: see LICENSE.md.
  */
 
-import { SettingService } from '@/setting';
+import { SettingService } from '@/setting/services/setting.service';
 
 export const SettingServiceProvider = {
   provide: SettingService,

package/src/utils/test/test.ts

@@ -4,14 +4,45 @@
  * Full terms: see LICENSE.md.
  */
 
+import type { TestingModule } from '@nestjs/testing';
 import { DataSource } from 'typeorm';
 
 const typeOrmDataSources: DataSource[] = [];
+const testingModules: TestingModule[] = [];
 
 export const registerTypeOrmDataSource = (dataSource: DataSource) => {
   typeOrmDataSources.push(dataSource);
 };
 
+export const registerTestingModule = (module: TestingModule) => {
+  const close = module.close.bind(module);
+  let closed = false;
+
+  module.close = async () => {
+    if (closed) {
+      return;
+    }
+
+    closed = true;
+    const moduleIndex = testingModules.indexOf(module);
+
+    if (moduleIndex >= 0) {
+      testingModules.splice(moduleIndex, 1);
+    }
+
+    await close();
+  };
+
+  testingModules.push(module);
+};
+
+export const closeTestingModules = async () => {
+  const modules = [...testingModules];
+
+  testingModules.length = 0;
+  await Promise.all(modules.map((module) => module.close()));
+};
+
 export const closeTypeOrmConnections = async () => {
   await Promise.all(
     typeOrmDataSources.map(async (dataSource) => {
@@ -25,3 +56,11 @@ export const closeTypeOrmConnections = async () => {
 
 export const getLastTypeOrmDataSource = () =>
   typeOrmDataSources[typeOrmDataSources.length - 1];
+
+export const closeTestingResources = async () => {
+  try {
+    await closeTestingModules();
+  } finally {
+    await closeTypeOrmConnections();
+  }
+};