@hexabot-ai/api 3.2.2-alpha.0 → 3.2.2-alpha.2

package/src/user/entities/permission.entity.ts

@@ -4,6 +4,8 @@
  * Full terms: see LICENSE.md.
  */
 
+import { createRequire } from 'node:module';
+
 import { permissionSchema, permissionFullSchema } from '@hexabot-ai/types';
 import {
   Column,
@@ -22,8 +24,10 @@ import { PermissionDto } from '../dto/permission.dto';
 import { Action } from '../types/action.type';
 import { TRelation } from '../types/index.type';
 
-import { ModelOrmEntity } from './model.entity';
-import { RoleOrmEntity } from './role.entity';
+import type { ModelOrmEntity } from './model.entity';
+import type { RoleOrmEntity } from './role.entity';
+
+const requireEntity = createRequire(__filename);
 
 @Entity({ name: 'permissions' })
 @Index(['model', 'action', 'role', 'relation'], { unique: true })
@@ -32,9 +36,13 @@ export class PermissionOrmEntity extends BaseOrmEntity<PermissionDto> {
 
   fullCls = permissionFullSchema;
 
-  @ManyToOne(() => ModelOrmEntity, (model) => model.permissions, {
-    onDelete: 'CASCADE',
-  })
+  @ManyToOne(
+    () => requireEntity('./model.entity').ModelOrmEntity,
+    (model: ModelOrmEntity) => model.permissions,
+    {
+      onDelete: 'CASCADE',
+    },
+  )
   @JoinColumn({ name: 'model_id' })
   @AsRelation()
   model!: ModelOrmEntity;
@@ -45,9 +53,13 @@ export class PermissionOrmEntity extends BaseOrmEntity<PermissionDto> {
   @EnumColumn({ enum: Action })
   action!: Action;
 
-  @ManyToOne(() => RoleOrmEntity, (role) => role.permissions, {
-    onDelete: 'CASCADE',
-  })
+  @ManyToOne(
+    () => requireEntity('./role.entity').RoleOrmEntity,
+    (role: RoleOrmEntity) => role.permissions,
+    {
+      onDelete: 'CASCADE',
+    },
+  )
   @JoinColumn({ name: 'role_id' })
   @AsRelation()
   role!: RoleOrmEntity;
@@ -55,6 +67,6 @@ export class PermissionOrmEntity extends BaseOrmEntity<PermissionDto> {
   @RelationId((permission: PermissionOrmEntity) => permission.role)
   private readonly roleId!: string;
 
-  @Column({ default: 'role' })
+  @Column({ type: 'varchar', default: 'role' })
   relation!: TRelation;
 }

package/src/user/entities/role.entity.ts

@@ -4,6 +4,8 @@
  * Full terms: see LICENSE.md.
  */
 
+import { createRequire } from 'node:module';
+
 import { roleSchema, roleFullSchema } from '@hexabot-ai/types';
 import { Column, Entity, Index, ManyToMany, OneToMany } from 'typeorm';
 
@@ -12,9 +14,11 @@ import { BaseOrmEntity } from '@/database/entities/base.entity';
 
 import { RoleDto } from '../dto/role.dto';
 
-import { PermissionOrmEntity } from './permission.entity';
+import type { PermissionOrmEntity } from './permission.entity';
 import { UserOrmEntity } from './user.entity';
 
+const requireEntity = createRequire(__filename);
+
 export type TRole = 'admin' | 'public';
 
 @Entity({ name: 'roles' })
@@ -31,9 +35,13 @@ export class RoleOrmEntity extends BaseOrmEntity<RoleDto> {
   @Column({ default: true })
   active!: boolean;
 
-  @OneToMany(() => PermissionOrmEntity, (permission) => permission.role, {
-    cascade: ['remove'],
-  })
+  @OneToMany(
+    () => requireEntity('./permission.entity').PermissionOrmEntity,
+    (permission: PermissionOrmEntity) => permission.role,
+    {
+      cascade: ['remove'],
+    },
+  )
   permissions?: PermissionOrmEntity[];
 
   @ManyToMany(() => UserOrmEntity, (user) => user.roles)

package/src/utils/generics/extension.ts

@@ -8,13 +8,11 @@ import { Inject, OnModuleInit } from '@nestjs/common';
 
 import { LoggerService } from '@/logger/logger.service';
 
-import { ExtensionName } from '../types/extension';
-
 export abstract class Extension implements OnModuleInit {
   @Inject(LoggerService)
   protected readonly logger: LoggerService;
 
-  constructor(public readonly name: ExtensionName) {}
+  constructor(public readonly name: string) {}
 
   getName() {
     return this.name;

package/src/utils/helpers/safe-property-path.ts

@@ -0,0 +1,13 @@
+/*
+ * Hexabot — Fair Core License (FCL-1.0-ALv2)
+ * Copyright (c) 2025 Hexastack.
+ * Full terms: see LICENSE.md.
+ */
+
+import toPath from 'lodash/toPath';
+
+const FORBIDDEN_SEGMENTS = new Set(['__proto__', 'constructor', 'prototype']);
+
+export function hasForbiddenSegment(path: string): boolean {
+  return toPath(path).some((segment) => FORBIDDEN_SEGMENTS.has(segment));
+}

package/src/utils/index.ts

@@ -62,8 +62,6 @@ export * from './pipes/zod.pipe';
 
 export * from './types/dto.types';
 
-export * from './types/extension';
-
 export * from './types/filter.types';
 
 export * from './types/format.types';

package/src/utils/pipes/typeorm-search-filter.pipe.ts

@@ -22,6 +22,7 @@ import {
   Not,
 } from 'typeorm';
 
+import { hasForbiddenSegment } from '../helpers/safe-property-path';
 import {
   TFilterNestedKeysOfType,
   TSearchFilterValue,
@@ -200,7 +201,7 @@ export class TypeOrmSearchFilterPipe<T>
     }
 
     const [field = '', direction = 'desc'] = sort.trim().split(/\s+/);
-    if (!field) {
+    if (!field || hasForbiddenSegment(field)) {
       return undefined;
     }
 
@@ -396,7 +397,7 @@ export class TypeOrmSearchFilterPipe<T>
     path: string,
     value: unknown,
   ): void {
-    if (value === undefined) return;
+    if (value === undefined || hasForbiddenSegment(path)) return;
     const segments = path.split('.');
     let cursor = target;
 
@@ -416,7 +417,7 @@ export class TypeOrmSearchFilterPipe<T>
     right: FindOptionsWhere<T>,
   ): FindOptionsWhere<T> {
     for (const [key, value] of Object.entries(right)) {
-      if (value === undefined) {
+      if (value === undefined || hasForbiddenSegment(key)) {
         continue;
       }
 

package/src/utils/pipes/uuid.pipe.ts

@@ -10,7 +10,7 @@ import {
   Injectable,
   PipeTransform,
 } from '@nestjs/common';
-import { validate as uuidValidate, version as uuidVersion } from 'uuid';
+import { isUUID } from 'class-validator';
 
 /**
  * Validates UUID route parameters by automatically checking parameters named `id`
@@ -56,13 +56,13 @@ export class UuidPipe implements PipeTransform {
 
   private ensureUuid(rawValue: string, paramName: string): void {
     const candidate = rawValue.trim();
-    if (!uuidValidate(candidate)) {
+    if (!isUUID(candidate)) {
       throw new BadRequestException(
         `Invalid UUID supplied for "${paramName}".`,
       );
     }
 
-    const version = uuidVersion(candidate);
+    const version = Number(candidate[14]);
     if (!this.allowedVersions.has(version)) {
       throw new BadRequestException(
         `Unsupported UUID version (${version}) supplied for "${paramName}".`,

package/src/utils/test/fixtures/contenttype.ts

@@ -7,9 +7,9 @@
 import { ContentType } from '@hexabot-ai/types';
 import { DataSource, DeepPartial } from 'typeorm';
 
-import { DEFAULT_CONTENT_TYPE_SCHEMA } from '@/cms';
 import { ContentTypeCreateDto } from '@/cms/dto/contentType.dto';
 import { ContentTypeOrmEntity } from '@/cms/entities/content-type.entity';
+import { DEFAULT_CONTENT_TYPE_SCHEMA } from '@/cms/services/content-type.service';
 
 import { getFixturesWithDefaultValues } from '../defaultValues';
 import { FixturesTypeBuilder } from '../types';

package/src/utils/test/test.ts

@@ -4,14 +4,45 @@
  * Full terms: see LICENSE.md.
  */
 
+import type { TestingModule } from '@nestjs/testing';
 import { DataSource } from 'typeorm';
 
 const typeOrmDataSources: DataSource[] = [];
+const testingModules: TestingModule[] = [];
 
 export const registerTypeOrmDataSource = (dataSource: DataSource) => {
   typeOrmDataSources.push(dataSource);
 };
 
+export const registerTestingModule = (module: TestingModule) => {
+  const close = module.close.bind(module);
+  let closed = false;
+
+  module.close = async () => {
+    if (closed) {
+      return;
+    }
+
+    closed = true;
+    const moduleIndex = testingModules.indexOf(module);
+
+    if (moduleIndex >= 0) {
+      testingModules.splice(moduleIndex, 1);
+    }
+
+    await close();
+  };
+
+  testingModules.push(module);
+};
+
+export const closeTestingModules = async () => {
+  const modules = [...testingModules];
+
+  testingModules.length = 0;
+  await Promise.all(modules.map((module) => module.close()));
+};
+
 export const closeTypeOrmConnections = async () => {
   await Promise.all(
     typeOrmDataSources.map(async (dataSource) => {
@@ -25,3 +56,11 @@ export const closeTypeOrmConnections = async () => {
 
 export const getLastTypeOrmDataSource = () =>
   typeOrmDataSources[typeOrmDataSources.length - 1];
+
+export const closeTestingResources = async () => {
+  try {
+    await closeTestingModules();
+  } finally {
+    await closeTypeOrmConnections();
+  }
+};