@solidxai/core 0.1.10-beta.9 → 0.1.11-beta.0

package/src/seeders/system-fields-seeder.service.ts

@@ -37,7 +37,7 @@ export class SystemFieldsSeederService {
   private async seedMissingSystemFields(model: ModelMetadata) {
     this.logger.debug(`Checking system fields for model: ${model.singularName}`);
     const existingSystemFields = model.fields.filter(field => field.isSystem);
-    const systemFieldsMetadata = this.modelHelperService.getSystemFieldsMetadata(model.isLegacyTable, model.isLegacyTableWithId);
+    const systemFieldsMetadata = this.modelHelperService.getSystemFieldsMetadata(model.legacyTableType);
     this.logger.debug(`Model: ${model.singularName} has ${existingSystemFields.length} existing system fields.`);
     // Find out which system fields are missing
     const missingFields = systemFieldsMetadata.filter(

package/src/services/authentication.service.ts

@@ -50,6 +50,7 @@ import { SettingService } from "./setting.service";
 import { UserActivityHistoryService } from "./user-activity-history.service";
 import { UserService } from "./user.service";
 import { SmsFactory } from "src/factories/sms.factory";
+import { WhatsAppFactory } from "src/factories/whatsapp.factory";
 import { SolidRegistry } from "src/helpers/solid-registry";
 
 enum LoginProvider {
@@ -79,6 +80,7 @@ export class AuthenticationService {
     private readonly mailServiceFactory: MailFactory,
     // private readonly smsService: Msg91OTPService,
     private readonly smsFactory: SmsFactory,
+    private readonly whatsAppFactory: WhatsAppFactory,
     private readonly eventEmitter: EventEmitter2,
     private readonly settingService: SettingService,
     private readonly roleMetadataService: RoleMetadataService,
@@ -193,11 +195,22 @@ export class AuthenticationService {
     return this.performSignUp(signUpDto, new User(), this.userRepository);
   }
 
-  private async performSignUp<T extends User>(signUpDto: SignUpDto, entity: T, repo: Repository<T>): Promise<T> {
+  private async performSignUp<T extends User>(
+    signUpDto: SignUpDto,
+    entity: T,
+    repo: Repository<T>,
+  ): Promise<T> {
     try {
-      const onForcePasswordChange = this.settingService.getConfigValue<SolidCoreSetting>("forceChangePasswordOnFirstLogin");
-      const activateUserOnRegistration = this.settingService.getConfigValue<SolidCoreSetting>("activateUserOnRegistration");
-      const defaultRole = this.settingService.getConfigValue<SolidCoreSetting>("defaultRole");
+      const onForcePasswordChange =
+        this.settingService.getConfigValue<SolidCoreSetting>(
+          "forceChangePasswordOnFirstLogin",
+        );
+      const activateUserOnRegistration =
+        this.settingService.getConfigValue<SolidCoreSetting>(
+          "activateUserOnRegistration",
+        );
+      const defaultRole =
+        this.settingService.getConfigValue<SolidCoreSetting>("defaultRole");
 
       var { user, pwd, autoGeneratedPwd } = await this.populateForSignup<T>(
         entity,
@@ -211,14 +224,19 @@ export class AuthenticationService {
       }
       const savedUser = await repo.save(user);
       const userRoles = signUpDto.roles ?? [];
-      if ((signUpDto.roles?.length ?? 0) === 0 && signUpDto.username !== "sa" && defaultRole) {
+      if (
+        (signUpDto.roles?.length ?? 0) === 0 &&
+        signUpDto.username !== "sa" &&
+        defaultRole
+      ) {
         userRoles.push(defaultRole);
       }
       await this.handlePostSignup(savedUser, userRoles, pwd, autoGeneratedPwd);
+      await this.handlePasswordlessSignupOtp(savedUser, signUpDto, autoGeneratedPwd, repo);
+      this.triggerRegistrationEvent(savedUser);
 
       return savedUser;
-    }
-    catch (err: any) {
+    } catch (err: any) {
       const pgUniqueViolationErrorCode = "23505";
       if (err.code === pgUniqueViolationErrorCode) {
         throw new ConflictException(
@@ -231,6 +249,42 @@ export class AuthenticationService {
     }
   }
 
+  private async handlePasswordlessSignupOtp<T extends User>(
+    user: T,
+    signUpDto: SignUpDto,
+    autoGeneratedPwd: string,
+    repo: Repository<T>,
+  ): Promise<void> {
+    const isPasswordProvided = !!signUpDto.password;
+    const isAutoGeneratedPassword = !!autoGeneratedPwd;
+    if (isPasswordProvided || isAutoGeneratedPassword) {
+      return;
+    }
+
+    if (!user.mobile) {
+      this.logger.warn(
+        `Skipping passwordless signup OTP WhatsApp notification for user ${user.username}: mobile is missing.`,
+      );
+      return;
+    }
+
+    const isPasswordlessRegistrationEnabled =
+      await this.isPasswordlessRegistrationEnabled();
+    if (!isPasswordlessRegistrationEnabled) {
+      return;
+    }
+
+    await this.assignRegistrationOtp(
+      PasswordlessRegistrationValidateWhatSources.MOBILE,
+      user,
+    );
+    await repo.save(user);
+    await this.notifyUserOnOtpInitiateRegistration(
+      user,
+      PasswordlessRegistrationValidateWhatSources.MOBILE,
+    );
+  }
+
   /** @deprecated Use IExtensionUserCreationProvider instead. Kept for backward compatibility. */
   async signupForExtensionUser<T extends User>(
     signUpDto: SignUpDto,
@@ -255,7 +309,7 @@ export class AuthenticationService {
     if (signUpDto.roles && signUpDto.roles.length > 0) {
       for (let i = 0; i < signUpDto.roles.length; i++) {
         const roleName = signUpDto.roles[i];
-        await this.roleMetadataService.findRoleByName(roleName);
+        await this.roleMetadataService.assertRoleExistsByName(roleName);
       }
     }
     user.username = signUpDto.username;
@@ -602,7 +656,7 @@ export class AuthenticationService {
     const companyLogo = await this.getCompanyLogo();
     if (
       registrationValidationSource ===
-      PasswordlessLoginValidateWhatSources.EMAIL
+      PasswordlessRegistrationValidateWhatSources.EMAIL
     ) {
       const mailService = this.mailServiceFactory.getMailService();
       mailService.sendEmailUsingTemplate(
@@ -632,25 +686,141 @@ export class AuthenticationService {
     }
     if (
       registrationValidationSource ===
-      PasswordlessLoginValidateWhatSources.MOBILE
+      PasswordlessRegistrationValidateWhatSources.MOBILE
     ) {
-      const smsService = this.smsFactory.getSmsService();
-      smsService.sendSMSUsingTemplate(
+      const templateParams = {
+        solidAppName:
+          this.settingService.getConfigValue<SolidCoreSetting>("appTitle"),
+        otp: user.mobileVerificationTokenOnRegistration,
+        mobileVerificationTokenOnRegistration:
+          user.mobileVerificationTokenOnRegistration,
+        firstName: user.username,
+        fullName: user.fullName ? user.fullName : user.username,
+        companyLogoUrl: companyLogo,
+      };
+
+      const whatsappDestination = this.normalizeWhatsAppDestination(
         user.mobile,
-        "otp-on-register",
-        {
-          solidAppName:
-            this.settingService.getConfigValue<SolidCoreSetting>("appTitle"),
-          otp: user.mobileVerificationTokenOnRegistration,
-          mobileVerificationTokenOnRegistration:
-            user.mobileVerificationTokenOnRegistration,
-          firstName: user.username,
-          fullName: user.fullName ? user.fullName : user.username,
-          companyLogoUrl: companyLogo,
-        },
-        this.settingService.getConfigValue<SolidCoreSetting>("shouldQueueSms"),
       );
+      const gupshupTemplateAppName =
+        process.env.COMMON_GUPSHUP_APP_NAME || "Gupshup";
+      const whatsappTemplateId =
+        this.settingService.getConfigValue<SolidCoreSetting>(
+          "otpWhatsappTemplateId",
+        ) || "common_otp";
+      const whatsappIndependentEnabled =
+        this.settingService.getConfigValue<SolidCoreSetting>(
+          "otpWhatsappIndependentEnabled",
+        ) !== false;
+
+      let smsSent = false;
+      let whatsappSent = false;
+      let smsErrorMessage: string | undefined;
+      let whatsappErrorMessage: string | undefined;
+
+      this.logger.debug(
+        `OTP SMS send attempt: destination=${user.mobile}, whatsappDestination=${whatsappDestination}`,
+      );
+
+      try {
+        const smsService = this.smsFactory.getSmsService();
+        await smsService.sendSMSUsingTemplate(
+          user.mobile,
+          "otp-on-register",
+          templateParams,
+          false,
+        );
+        smsSent = true;
+      } catch (smsError: any) {
+        smsErrorMessage = smsError?.message;
+        this.logger.warn(
+          `OTP SMS failed: destination=${user.mobile}, message=${smsErrorMessage}`,
+        );
+      }
+
+      if (whatsappIndependentEnabled) {
+        if (!whatsappDestination) {
+          whatsappErrorMessage = "Normalized WhatsApp destination is empty";
+          this.logger.error(
+            `Independent OTP WhatsApp skipped: destination=${user.mobile}, message=${whatsappErrorMessage}`,
+          );
+        } else {
+          this.logger.debug(
+            `Independent OTP WhatsApp send attempt: destination=${user.mobile}, whatsappDestination=${whatsappDestination}, templateId=${whatsappTemplateId}`,
+          );
+          try {
+            await this.sendOtpToWhatsappProvider(
+              whatsappDestination,
+              String(whatsappTemplateId),
+              String(gupshupTemplateAppName),
+              String(templateParams.otp || ""),
+            );
+            whatsappSent = true;
+            this.logger.log(
+              `Independent OTP WhatsApp success: destination=${user.mobile}, whatsappDestination=${whatsappDestination}, templateId=${whatsappTemplateId}`,
+            );
+          } catch (waError: any) {
+            whatsappErrorMessage = waError?.message;
+            this.logger.error(
+              `Independent OTP WhatsApp failed: destination=${user.mobile}, whatsappDestination=${whatsappDestination}, templateId=${whatsappTemplateId}, message=${whatsappErrorMessage}`,
+            );
+          }
+        }
+      }
+
+      if (!smsSent && !whatsappSent) {
+        throw new Error(
+          `OTP delivery failed on both channels. smsError=${smsErrorMessage || "unknown"}, whatsappError=${whatsappErrorMessage || "disabled/unknown"}`,
+        );
+      }
+    }
+  }
+
+  private normalizeWhatsAppDestination(rawMobile: string): string {
+    const raw = (rawMobile || "").trim();
+    let sanitized = raw.replace(/[^\d+]/g, "");
+
+    if (sanitized.startsWith("00")) {
+      sanitized = `+${sanitized.slice(2)}`;
+    }
+
+    const defaultDialCode = String(
+      this.settingService.getConfigValue<SolidCoreSetting>(
+        "otpDefaultCountryDialCode",
+      ) || "",
+    ).replace(/\D/g, "");
+
+    if (sanitized.startsWith("+")) {
+      const e164Digits = sanitized.slice(1).replace(/\D/g, "");
+      if (e164Digits.length >= 8 && e164Digits.length <= 15) {
+        return e164Digits;
+      }
+    }
+
+    const digits = sanitized.replace(/\D/g, "");
+
+    if (digits.length >= 11 && digits.length <= 15) {
+      return digits;
     }
+
+    if (digits.length === 10 && defaultDialCode) {
+      return `${defaultDialCode}${digits}`;
+    }
+
+    return digits;
+  }
+
+  private async sendOtpToWhatsappProvider(
+    destination: string,
+    templateId: string,
+    appName: string,
+    otp: string,
+  ): Promise<void> {
+    const whatsappService = this.whatsAppFactory.getWhatsappService();
+    await whatsappService.sendWhatsAppMessage(destination, null, {
+      type: "text",
+      text: `${appName} OTP is ${otp}. It is valid for 10 mins.`,
+    });
   }
 
   async otpConfirmRegistration(confirmSignUpDto: OTPConfirmOTPDto) {
@@ -753,7 +923,7 @@ export class AuthenticationService {
       this.resolvePasswordlessValidationSource();
     if (
       registrationValidationSource ===
-      PasswordlessLoginValidateWhatSources.EMAIL
+      PasswordlessRegistrationValidateWhatSources.EMAIL
     ) {
       if (!user.emailVerifiedOnRegistrationAt) {
         return false;
@@ -761,7 +931,7 @@ export class AuthenticationService {
     }
     if (
       registrationValidationSource ===
-      PasswordlessLoginValidateWhatSources.MOBILE
+      PasswordlessRegistrationValidateWhatSources.MOBILE
     ) {
       if (!user.mobileVerifiedOnRegistrationAt) {
         return false;
@@ -876,7 +1046,7 @@ export class AuthenticationService {
     const dummyOtp = this.getDummyOtpForUser(user);
     if (!dummyOtp) {
       await this.assignLoginOtp(user, type);
-      this.notifyUserOnOtpInititateLogin(user, type);
+      await this.notifyUserOnOtpInititateLogin(user, type);
     }
     return this.buildLoginOtpResponse(user, type);
   }
@@ -1001,21 +1171,88 @@ export class AuthenticationService {
       );
     }
     if (loginType === PasswordlessLoginValidateWhatSources.MOBILE) {
-      const smsService = this.smsFactory.getSmsService();
-      smsService.sendSMSUsingTemplate(
-        user.mobile,
-        "otp-on-login",
-        {
-          solidAppName:
-            this.settingService.getConfigValue<SolidCoreSetting>("appTitle"),
-          otp: user.mobileVerificationTokenOnLogin,
-          mobileVerificationTokenOnLogin: user.mobileVerificationTokenOnLogin,
-          firstName: user.username,
-          fullName: user.fullName ? user.fullName : user.username,
-          companyLogoUrl: companyLogo,
-        },
-        this.settingService.getConfigValue<SolidCoreSetting>("shouldQueueSms"),
+      const templateParams = {
+        solidAppName:
+          this.settingService.getConfigValue<SolidCoreSetting>("appTitle"),
+        otp: user.mobileVerificationTokenOnLogin,
+        mobileVerificationTokenOnLogin: user.mobileVerificationTokenOnLogin,
+        firstName: user.username,
+        fullName: user.fullName ? user.fullName : user.username,
+        companyLogoUrl: companyLogo,
+      };
+
+      const whatsappDestination = this.normalizeWhatsAppDestination(user.mobile);
+      const gupshupTemplateAppName =
+        process.env.COMMON_GUPSHUP_APP_NAME || "Gupshup";
+      const whatsappTemplateId =
+        this.settingService.getConfigValue<SolidCoreSetting>(
+          "otpWhatsappTemplateId",
+        ) || "common_otp";
+      const whatsappIndependentEnabled =
+        this.settingService.getConfigValue<SolidCoreSetting>(
+          "otpWhatsappIndependentEnabled",
+        ) !== false;
+
+      let smsSent = false;
+      let whatsappSent = false;
+      let smsErrorMessage: string | undefined;
+      let whatsappErrorMessage: string | undefined;
+
+      this.logger.debug(
+        `OTP LOGIN SMS send attempt: destination=${user.mobile}, whatsappDestination=${whatsappDestination}`,
       );
+
+      try {
+        const smsService = this.smsFactory.getSmsService();
+        await smsService.sendSMSUsingTemplate(
+          user.mobile,
+          "otp-on-login",
+          templateParams,
+          false,
+        );
+        smsSent = true;
+      } catch (smsError: any) {
+        smsErrorMessage = smsError?.message;
+        this.logger.warn(
+          `OTP LOGIN SMS failed: destination=${user.mobile}, message=${smsErrorMessage}`,
+        );
+      }
+
+      if (whatsappIndependentEnabled) {
+        if (!whatsappDestination) {
+          whatsappErrorMessage = "Normalized WhatsApp destination is empty";
+          this.logger.error(
+            `OTP LOGIN WhatsApp skipped: destination=${user.mobile}, message=${whatsappErrorMessage}`,
+          );
+        } else {
+          this.logger.debug(
+            `OTP LOGIN WhatsApp send attempt: destination=${user.mobile}, whatsappDestination=${whatsappDestination}, templateId=${whatsappTemplateId}`,
+          );
+          try {
+            await this.sendOtpToWhatsappProvider(
+              whatsappDestination,
+              String(whatsappTemplateId),
+              String(gupshupTemplateAppName),
+              String(templateParams.otp || ""),
+            );
+            whatsappSent = true;
+            this.logger.log(
+              `OTP LOGIN WhatsApp success: destination=${user.mobile}, whatsappDestination=${whatsappDestination}, templateId=${whatsappTemplateId}`,
+            );
+          } catch (waError: any) {
+            whatsappErrorMessage = waError?.message;
+            this.logger.error(
+              `OTP LOGIN WhatsApp failed: destination=${user.mobile}, whatsappDestination=${whatsappDestination}, templateId=${whatsappTemplateId}, message=${whatsappErrorMessage}`,
+            );
+          }
+        }
+      }
+
+      if (!smsSent && !whatsappSent) {
+        throw new Error(
+          `OTP LOGIN delivery failed on both channels. smsError=${smsErrorMessage || "unknown"}, whatsappError=${whatsappErrorMessage || "disabled/unknown"}`,
+        );
+      }
     }
   }
 
@@ -1294,7 +1531,7 @@ export class AuthenticationService {
     // Assuming all users do not have mobile as mandatory.
     if (
       forgotPasswordSendVerificationTokenOn ==
-      ForgotPasswordSendVerificationTokenOn.MOBILE &&
+        ForgotPasswordSendVerificationTokenOn.MOBILE &&
       user.mobile
     ) {
       const smsService = this.smsFactory.getSmsService();
@@ -1323,12 +1560,10 @@ export class AuthenticationService {
       const user = await this.resolveUserByVerificationToken(
         confirmForgotPasswordDto.verificationToken,
       );
-      if (!user)
-        throw new UnauthorizedException("Invalid verification token");
+      if (!user) throw new UnauthorizedException("Invalid verification token");
       if (user.lastLoginProvider !== "local")
         throw new UnauthorizedException(ERROR_MESSAGES.INVALID_CREDENTIALS);
-      if (!user.active)
-        throw new UnauthorizedException("User is inactive");
+      if (!user.active) throw new UnauthorizedException("User is inactive");
 
       // 1) Atomically consume the token (only one request can succeed)
       const { affected } = await m
@@ -1420,7 +1655,7 @@ export class AuthenticationService {
     // Assuming all users do not have mobile as mandatory.
     if (
       forgotPasswordSendVerificationTokenOn ==
-      ForgotPasswordSendVerificationTokenOn.MOBILE &&
+        ForgotPasswordSendVerificationTokenOn.MOBILE &&
       user.mobile
     ) {
       const smsService = this.smsFactory.getSmsService();
@@ -1762,6 +1997,84 @@ export class AuthenticationService {
     };
   }
 
+  async validateUserUsingMicrosoftActiveDirectory(user: User) {
+    if (
+      !user.microsoftActiveDirectoryAccessToken ||
+      !user.microsoftActiveDirectoryId
+    ) {
+      throw new UnauthorizedException(ERROR_MESSAGES.USER_NOT_FOUND);
+    }
+
+    try {
+      const response = await this.httpService.axiosRef.get(
+        `https://graph.microsoft.com/v1.0/me?$select=id,displayName,mail,userPrincipalName`,
+        {
+          headers: {
+            Authorization: `Bearer ${user.microsoftActiveDirectoryAccessToken}`,
+          },
+        },
+      );
+      const userProfile = response.data;
+      const profileEmail = (userProfile.mail || userProfile.userPrincipalName)
+        ?.trim()
+        .toLowerCase();
+      const userEmail = user.email?.trim().toLowerCase();
+
+      if (
+        userProfile.id === user.microsoftActiveDirectoryId &&
+        (!userEmail || profileEmail === userEmail)
+      ) {
+        return userProfile;
+      } else {
+        throw new UnauthorizedException(ERROR_MESSAGES.INVALID_USER_PROFILE);
+      }
+    } catch (error: any) {
+      if (error instanceof UnauthorizedException) {
+        throw error;
+      }
+
+      throw new UnauthorizedException(
+        ERROR_MESSAGES.MICROSOFT_ACTIVE_DIRECTORY_OAUTH_PROFILE_FETCH_FAILED,
+      );
+    }
+  }
+
+  async signInUsingMicrosoftActiveDirectory(accessCode: string) {
+    const user = await this.userRepository.findOne({
+      where: {
+        accessCode: accessCode,
+      },
+      relations: {
+        roles: true,
+      },
+    });
+
+    if (!user) {
+      throw new UnauthorizedException(ERROR_MESSAGES.USER_NOT_FOUND);
+    }
+    this.checkAccountBlocked(user);
+
+    try {
+      await this.validateUserUsingMicrosoftActiveDirectory(user);
+    } catch (e) {
+      await this.incrementFailedAttempts(user);
+      throw e;
+    }
+
+    await this.resetFailedAttempts(user);
+    const tokens = await this.generateTokens(user);
+    return {
+      user: {
+        email: user.email,
+        mobile: user.mobile,
+        username: user.username,
+        id: user.id,
+        roles: user.roles.map((role) => role.name),
+      },
+      ...tokens,
+    };
+  }
+
   async signInUsingApple(accessCode: string) {
     const user = await this.userRepository.findOne({
       where: {

package/src/services/chatter-message.service.ts

@@ -1,18 +1,20 @@
 import { LocalDateTimeTransformer, serializeDate } from 'src/transformers/typeorm/local-date-time-transformer';
-import { BadRequestException, forwardRef, Inject, Injectable, NotFoundException } from '@nestjs/common';
+import { BadRequestException, ForbiddenException, forwardRef, Inject, Injectable, NotFoundException } from '@nestjs/common';
 import { ModuleRef } from "@nestjs/core";
 import { InjectEntityManager } from '@nestjs/typeorm';
-import { Brackets, EntityManager, EntityMetadata } from 'typeorm';
+import { Brackets, EntityManager, EntityMetadata, In } from 'typeorm';
 
 import { classify } from '@angular-devkit/core/src/utils/strings';
 import { CHATTER_MESSAGE_STATUS, CHATTER_MESSAGE_SUBTYPE, CHATTER_MESSAGE_TYPE } from 'src/constants/chatter-message.constants';
 import { ERROR_MESSAGES } from 'src/constants/error-messages';
 import { PostChatterMessageDto } from 'src/dtos/post-chatter-message.dto';
+import { UpdateChatterNoteMessageDto } from 'src/dtos/update-chatter-note-message.dto';
 import { ModelMetadataHelperService } from 'src/helpers/model-metadata-helper.service';
 import { lowerFirst } from 'src/helpers/string.helper';
 import { ChatterMessageDetailsRepository } from 'src/repository/chatter-message-details.repository';
 import { ChatterMessageRepository } from 'src/repository/chatter-message.repository';
 import { FieldMetadataRepository } from 'src/repository/field-metadata.repository';
+import { MediaRepository } from 'src/repository/media.repository';
 import { ModelMetadataRepository } from 'src/repository/model-metadata.repository';
 import { CRUDService } from 'src/services/crud.service';
 import { MediaStorageProviderType } from '../dtos/create-media-storage-provider-metadata.dto';
@@ -33,6 +35,7 @@ export class ChatterMessageService extends CRUDService<ChatterMessage> {
         readonly repo: ChatterMessageRepository,
         // @InjectRepository(ChatterMessageDetailsRepository, 'default')
         readonly chatterMessageDetailsRepo: ChatterMessageDetailsRepository,
+        readonly mediaRepository: MediaRepository,
         // @InjectRepository(FieldMetadata, 'default')
         // readonly fieldMetadataRepo: Repository<FieldMetadata>,
         readonly fieldMetadataRepo: FieldMetadataRepository,
@@ -67,6 +70,21 @@ export class ChatterMessageService extends CRUDService<ChatterMessage> {
         chatterMessage.updatedBy = resolvedUserId;
     }
 
+    private isEditableCustomNoteMessage(message: ChatterMessage): boolean {
+        if (message.messageType !== CHATTER_MESSAGE_TYPE.CUSTOM) {
+            return false;
+        }
+        return [CHATTER_MESSAGE_SUBTYPE.CUSTOM, CHATTER_MESSAGE_SUBTYPE.NOTE].includes(message.messageSubType as any);
+    }
+
+    private parseAttachmentIds(value?: string): number[] {
+        if (!value || typeof value !== 'string') return [];
+        return value
+            .split(',')
+            .map(v => Number(v.trim()))
+            .filter(v => Number.isInteger(v) && v > 0);
+    }
+
     async markCompleted(id: number) {
         const activeUser = this.requestContextService.getActiveUser();
         if (!activeUser) {
@@ -82,6 +100,98 @@ export class ChatterMessageService extends CRUDService<ChatterMessage> {
         return this.repo.save(message);
     }
 
+    async updateCustomNoteMessage(id: number, updateDto: UpdateChatterNoteMessageDto, files: Express.Multer.File[] = []) {
+        const activeUser = this.requestContextService.getActiveUser();
+        if (!activeUser) {
+            throw new ForbiddenException(ERROR_MESSAGES.FORBIDDEN);
+        }
+
+        const message = await this.repo.findOne({ where: { id }, relations: { user: true } });
+        if (!message) {
+            throw new NotFoundException(`Entity [solid-core.chatterMessage] with id ${id} not found`);
+        }
+
+        if (!this.isEditableCustomNoteMessage(message)) {
+            throw new BadRequestException('Only custom note messages can be edited.');
+        }
+
+        if (!message.user?.id || message.user.id !== activeUser.sub) {
+            throw new ForbiddenException('You can only edit your own custom note messages.');
+        }
+
+        const removeAttachmentIds = this.parseAttachmentIds(updateDto?.removeAttachmentIds);
+        const hasMessageBody = typeof updateDto?.messageBody === 'string';
+        const trimmedMessageBody = (updateDto?.messageBody ?? '').trim();
+        const hasNewFiles = Array.isArray(files) && files.length > 0;
+
+        if (!hasMessageBody && removeAttachmentIds.length === 0 && !hasNewFiles) {
+            throw new BadRequestException('No note changes submitted.');
+        }
+
+        if (hasMessageBody && trimmedMessageBody.length === 0) {
+            throw new BadRequestException('Message body cannot be empty.');
+        }
+
+        if (hasMessageBody) {
+            message.messageBody = trimmedMessageBody;
+        }
+        message.updatedBy = activeUser.sub;
+        // Ensure updatedAt changes even for attachment-only edits.
+        message.updatedAt = new Date();
+        const savedMessage = await this.repo.save(message);
+
+        if (removeAttachmentIds.length > 0 || hasNewFiles) {
+            const model = await this.modelMetadataService.findOneBySingularName('chatterMessage', {
+                fields: {
+                    model: true,
+                    mediaStorageProvider: true,
+                },
+                module: true,
+            });
+
+            const mediaFields = model.fields.filter(field => field.type === 'mediaSingle' || field.type === 'mediaMultiple');
+            const attachmentFieldIds = mediaFields.map(field => field.id);
+
+            if (removeAttachmentIds.length > 0 && attachmentFieldIds.length > 0) {
+                const mediaToRemove = await this.mediaRepository.find({
+                    where: {
+                        id: In(removeAttachmentIds),
+                        entityId: savedMessage.id,
+                        modelMetadata: { id: model.id },
+                        fieldMetadata: { id: In(attachmentFieldIds) },
+                    },
+                    relations: {
+                        mediaStorageProviderMetadata: true,
+                        fieldMetadata: true,
+                    },
+                });
+
+                for (const media of mediaToRemove) {
+                    const storageType = media.mediaStorageProviderMetadata?.type as MediaStorageProviderType;
+                    const storageProvider = await getMediaStorageProvider(this.moduleRef, storageType);
+                    await storageProvider.deleteByMediaRecord(media);
+                }
+
+                if (mediaToRemove.length > 0) {
+                    await this.mediaRepository.remove(mediaToRemove);
+                }
+            }
+
+            for (const mediaField of mediaFields) {
+                const storageProviderMetadata = mediaField.mediaStorageProvider;
+                const storageProviderType = storageProviderMetadata.type as MediaStorageProviderType;
+                const storageProvider = await getMediaStorageProvider(this.moduleRef, storageProviderType);
+
+                const media = files.filter(multerFile => multerFile.fieldname === mediaField.name);
+                if (media.length > 0) {
+                    await storageProvider.store(media, savedMessage, mediaField);
+                }
+            }
+        }
+
+        return savedMessage;
+    }
+
     async postMessage(postDto: PostChatterMessageDto, files: Express.Multer.File[] = []) {
         const chatterMessage = new ChatterMessage();
         chatterMessage.messageType = CHATTER_MESSAGE_TYPE.CUSTOM;