@solidxai/core 0.1.11-beta.9 → 0.1.12-beta.0

package/src/guards/access-token.guard.ts

@@ -2,23 +2,26 @@ import type { SolidCoreSetting } from "src/services/settings/default-settings-pr
 import {
   CanActivate,
   ExecutionContext,
-  Inject,
   Injectable,
   UnauthorizedException,
 } from '@nestjs/common';
 import { JwtService } from '@nestjs/jwt';
 import { Request } from 'express';
+import { ERROR_MESSAGES } from "src/constants/error-messages";
 import { ActiveUserData } from '../interfaces/active-user-data.interface';
 import { REQUEST_USER_KEY } from "../constants";
 import { PermissionMetadataService } from '../services/permission-metadata.service';
 import { ClsService } from 'nestjs-cls';
+import { ActiveSessionStorageService } from "../services/active-session-storage.service";
 import { SettingService } from '../services/setting.service';
+import { createHash } from "crypto";
 
 @Injectable()
 export class AccessTokenGuard implements CanActivate {
   constructor(
     private readonly jwtService: JwtService,
     private readonly permissionsService: PermissionMetadataService,
+    private readonly activeSessionStorage: ActiveSessionStorageService,
     private readonly settingService: SettingService,
     private readonly cls: ClsService
   ) { }
@@ -44,6 +47,9 @@ export class AccessTokenGuard implements CanActivate {
         jwtConfiguration
       );
 
+      // Prevent Concurrent Login Feature
+      await this.validateConcurrentLoginSession(payload, token);
+
       // Load permissions given the user. 
       const permissions = await this.permissionsService.findAllUsingRoles(payload.roles);
       payload.permissions = permissions.map((permission) => permission.name);
@@ -52,8 +58,10 @@ export class AccessTokenGuard implements CanActivate {
       this.cls.set(REQUEST_USER_KEY, payload);
       // console.log(`About to set payload in the request user key:`);
       // console.log(payload);
-    } catch {
-      throw new UnauthorizedException();
+    } catch (err) {
+      throw err instanceof UnauthorizedException
+        ? err
+        : new UnauthorizedException();
     }
     return true;
   }
@@ -64,4 +72,36 @@ export class AccessTokenGuard implements CanActivate {
     const [_, token] = request.headers.authorization?.split(' ') ?? [];
     return token;
   }
+
+  private resolveSessionId(payload: ActiveUserData, token: string): string {
+    if (payload.sessionId) {
+      return payload.sessionId;
+    }
+
+    // Legacy tokens (issued before preventConcurrentLogins was enabled)
+    // have no sessionId claim, so derive a stable fallback from the token.
+    return createHash('sha256').update(token).digest('hex');
+  }
+
+  private async validateConcurrentLoginSession(payload: ActiveUserData, token: string,): Promise<void> {
+    if (!this.settingService.getConfigValue<SolidCoreSetting>("preventConcurrentLogins",)) {
+      return;
+    }
+
+    const activeSessionId = await this.activeSessionStorage.getActiveSession(payload.sub);
+    const currentSessionId = this.resolveSessionId(payload, token);
+
+    if (!activeSessionId) {
+      // No active session recorded yet for this user — this is the first
+      // request we've seen since the feature was enabled (or storage was
+      // cleared). Adopt this request's session as the active one so this
+      // browser stays logged in going forward.
+      await this.activeSessionStorage.setActiveSession(payload.sub, currentSessionId,);
+      return;
+    }
+
+    if (currentSessionId !== activeSessionId) {
+      throw new UnauthorizedException(ERROR_MESSAGES.SESSION_INVALID);
+    }
+  }
 }

package/src/guards/authentication.guard.ts

@@ -32,6 +32,22 @@ export class AuthenticationGuard implements CanActivate {
     private readonly cls: ClsService,
   ) { }
 
+  private isGenericUnauthorizedError(error: unknown): boolean {
+    if (!(error instanceof UnauthorizedException)) {
+      return false;
+    }
+
+    const response = error.getResponse();
+    const message =
+      typeof response === 'string'
+        ? response
+        : Array.isArray((response as any)?.message)
+          ? (response as any).message[0]
+          : (response as any)?.message;
+
+    return !message || message === 'Unauthorized';
+  }
+
   async canActivate(context: ExecutionContext): Promise<boolean> {
     // If method marked as public, then we return with true, else go ahead and apply the access token guard. 
     const contextLog = context.getHandler();
@@ -72,7 +88,12 @@ export class AuthenticationGuard implements CanActivate {
       const canActivate = await Promise.resolve(
         instance.canActivate(context),
       ).catch((err) => {
-        error = err;
+        if (
+          this.isGenericUnauthorizedError(error) ||
+          !this.isGenericUnauthorizedError(err)
+        ) {
+          error = err;
+        }
       });
 
       if (canActivate) {

package/src/helpers/bootstrap.helper.ts

@@ -1,5 +1,5 @@
-import { ValidationPipe } from '@nestjs/common';
-import { NestFactory } from '@nestjs/core';
+import { ClassSerializerInterceptor, ValidationPipe } from '@nestjs/common';
+import { NestFactory, Reflector } from '@nestjs/core';
 import { WsAdapter } from '@nestjs/platform-ws';
 import { DocumentBuilder, SwaggerModule } from '@nestjs/swagger';
 import { NextFunction, Request, Response } from 'express';
@@ -169,7 +169,13 @@ export async function bootstrapSolidApp(
   }
 
   // Global interceptor
-  app.useGlobalInterceptors(new WrapResponseInterceptor());
+  app.useGlobalInterceptors(
+    new ClassSerializerInterceptor(app.get(Reflector), {
+      enableImplicitConversion: true, // optional but handy
+      // groups: ['client'], // if you use groups
+    }),
+    new WrapResponseInterceptor()
+  );
 
   // CORS
   app.enableCors(buildDefaultCorsOptions());

package/src/helpers/environment.helper.ts

@@ -13,15 +13,4 @@ export function isRedisConfigured(configService: ConfigService): boolean {
     const host = configService.get<string>('REDIS_HOST');
     const port = configService.get<string>('REDIS_PORT');
     return host && port && isNumber(parseInt(port));
-}
-
-/**
- * Returns true when the project is configured to use an embedded PGlite
- * database with a single-connection pool. Several TypeORM subscriber and
- * code-generation workarounds are only necessary (and only applied) under
- * this constraint; on a regular multi-connection Postgres pool the original
- * behaviour is preserved.
- */
-export function isEmbeddedDb(): boolean {
-    return process.env.DEFAULT_DATABASE_DRIVER === 'pglite';
 }

package/src/helpers/model-metadata-helper.service.ts

@@ -4,10 +4,8 @@ import { forwardRef, Inject, Injectable, Logger } from "@nestjs/common";
 import { _ } from "lodash";
 import { LEGACY_TABLE_FIELDS_PREFIX } from "src/entities/legacy-common.entity-with-existing-id.entity";
 import { LegacyTableType } from "src/enums/legacy-table-type.enum";
-import { ModelMetadata } from "src/entities/model-metadata.entity";
 import { ModelMetadataRepository } from "src/repository/model-metadata.repository";
 import { SolidRegistry } from "./solid-registry";
-import { EntityManager } from "typeorm";
 
 @Injectable()
 export class ModelMetadataHelperService {
@@ -145,11 +143,8 @@ export class ModelMetadataHelperService {
         return systemFieldsMetadata;
     }
 
-    async loadFieldHierarchy(modelName: any, manager?: EntityManager) {
-        const repo = manager
-            ? manager.getRepository(ModelMetadata)
-            : this.modelMetadataRepo;
-        const model = await repo.findOne({
+    async loadFieldHierarchy(modelName: any) {
+        const model = await this.modelMetadataRepo.findOne({
             where: {
                 singularName: modelName,
             },

package/src/helpers/module-metadata-helper.service.ts

@@ -34,7 +34,7 @@ export class ModuleMetadataHelperService {
         if (!moduleName) {
             return '';
         }
-        return path.resolve(process.cwd(), 'src', moduleName);
+        return path.resolve(process.cwd(), 'src', kebabCase(moduleName));
     }
 
     async getSolidUiModulePath(moduleName: string): Promise<string> {

package/src/helpers/solid-core-error-codes-provider.service.ts

@@ -1,5 +1,6 @@
 // src/common/errors/providers/solidcore-error-code.provider.ts
 import { Injectable } from '@nestjs/common';
+import { ERROR_MESSAGES } from 'src/constants/error-messages';
 import { ErrorCodeProvider } from 'src/decorators/error-codes-provider.decorator';
 import { ErrorMeta, ErrorRule, IErrorCodeProvider } from 'src/interfaces';
 
@@ -13,6 +14,24 @@ export class SolidCoreErrorCodesProvider implements IErrorCodeProvider {
 
     rules(): ReadonlyArray<ErrorRule> {
         return [
+            {
+                code: 'solidx-session-invalid',
+                priority: 110,
+                match: (txt) => txt.includes(ERROR_MESSAGES.SESSION_INVALID.toLowerCase()),
+                meta: {
+                    message: ERROR_MESSAGES.SESSION_INVALID,
+                    httpStatus: 401,
+                },
+            },
+            {
+                code: 'solidx-session-expired',
+                priority: 110,
+                match: (txt) => txt.includes(ERROR_MESSAGES.SESSION_EXPIRED.toLowerCase()),
+                meta: {
+                    message: ERROR_MESSAGES.SESSION_EXPIRED,
+                    httpStatus: 401,
+                },
+            },
             {
                 code: 'solidx-mcp-server-unavailable',
                 priority: 100,
@@ -60,4 +79,4 @@ export class SolidCoreErrorCodesProvider implements IErrorCodeProvider {
         const rule = this.rules().find((r) => r.code === code);
         return rule?.meta;
     }
-}
+}

package/src/helpers/solid-registry.ts

@@ -8,7 +8,7 @@ import { Locale } from 'src/entities/locale.entity';
 import { SecurityRule } from 'src/entities/security-rule.entity';
 import { IScheduledJob } from 'src/services/scheduled-jobs/scheduled-job.interface';
 import { IDashboardWidgetDataProvider, IErrorCodeProvider, ISecurityRuleConfigProvider, ISelectionProvider, ISelectionProviderContext, ISolidDatabaseModule } from "../interfaces";
-import { EntityManager, ObjectLiteral } from 'typeorm';
+import { ObjectLiteral } from 'typeorm';
 
 type ControllerMetadata = {
   name: string;
@@ -49,12 +49,6 @@ export interface TypeOrmEventContext {
   metadataName?: string;
   updatedColumns?: string[];
   updatedRelations?: string[];
-  // Transaction-bound EntityManager from the originating TypeORM event. Providers that
-  // need to query the DB during a pre-compute hook must use this (not an injected
-  // DataSource/EntityManager) so the query runs on the active transaction's connection.
-  // On single-threaded embedded engines (PGlite), a second connection mid-transaction
-  // can deadlock.
-  manager?: EntityManager;
 }
 
 export interface ComputedFieldMetadata<TContext = any> {

package/src/index.ts

@@ -8,6 +8,7 @@ export * from './commands/run-tests.command'
 export * from './commands/test.command'
 
 export * from './config/cache.options'
+export * from './services/active-session-storage.service'
 
 export * from './decorators/active-user.decorator'
 export * from './decorators/solid-request-context.decorator'
@@ -171,7 +172,6 @@ export * from './guards/permissions.guard'
 export * from './guards/roles.guard'
 
 export * from './helpers/command.service'
-export * from './helpers/nodemon-heartbeat'
 export * from './helpers/module.helper'
 export * from './helpers/schematic.service'
 export * from './helpers/solid-registry'

package/src/interfaces/active-user-data.interface.ts

@@ -16,6 +16,12 @@ export interface ActiveUserData {
    */
   email: string;
 
+  /**
+   * Logical login session identifier used to invalidate older sessions when
+   * concurrent logins are disabled.
+   */
+  sessionId?: string;
+
   /**
    * The subject's (user) roles.
    * These are part of the JWT token, we simply decode them.

package/src/interfaces.ts

@@ -89,6 +89,7 @@ export interface SettingDefinition<T = any> {
   encrypted?: boolean;
   label?: string;
   description?: string;
+  helpText?: string;
   placeholder?: string;
   group?: string;
   sortOrder?: number;

package/src/repository/scheduled-job.repository.ts

@@ -3,7 +3,7 @@ import { CreateScheduledJobDto } from "src/dtos/create-scheduled-job.dto";
 import { ModuleMetadata } from "src/entities/module-metadata.entity";
 import { ScheduledJob } from "src/entities/scheduled-job.entity";
 import { RequestContextService } from "src/services/request-context.service";
-import { DataSource, EntityManager } from "typeorm";
+import { DataSource } from "typeorm";
 import { SecurityRuleRepository } from "./security-rule.repository";
 import { SolidBaseRepository } from "./solid-base.repository";
 
@@ -101,25 +101,19 @@ export class ScheduledJobRepository extends SolidBaseRepository<ScheduledJob> {
 
   /**
    * Converts an entity to a plain DTO object.
-   * When manager is provided (e.g. from a TypeORM subscriber event), the
-   * fallback relation load uses it so the query runs on the active
-   * transaction's connection instead of the default DataSource pool.
    */
-  async toDto(scheduledJob: ScheduledJob, manager?: EntityManager): Promise<CreateScheduledJobDto> {
+  async toDto(scheduledJob: ScheduledJob): Promise<CreateScheduledJobDto> {
     let populatedScheduledJob: ScheduledJob = scheduledJob;
     // If the scheduled job does not have the module relation loaded, load it
     if (!scheduledJob.module) {
-        const repo = manager
-            ? manager.getRepository(ScheduledJob)
-            : this;
-        populatedScheduledJob = await repo.findOne({
+        populatedScheduledJob = await this.findOne({
             where: {
                 id: scheduledJob.id,
             },
             relations: {
                 module: true,
             },
-        }) ?? scheduledJob;
+        });
     }
 
     if (!populatedScheduledJob.module) {

package/src/repository/security-rule.repository.ts

@@ -9,7 +9,7 @@ import { SecurityRule } from 'src/entities/security-rule.entity';
 import { SolidRegistry } from 'src/helpers/solid-registry';
 import { ActiveUserData } from 'src/interfaces/active-user-data.interface';
 import { CrudHelperService } from 'src/services/crud-helper.service';
-import { Brackets, DataSource, EntityManager, SelectQueryBuilder } from 'typeorm';
+import { Brackets, DataSource, SelectQueryBuilder } from 'typeorm';
 import { SolidBaseRepository } from './solid-base.repository';
 
 @Injectable()
@@ -84,18 +84,12 @@ export class SecurityRuleRepository extends SolidBaseRepository<SecurityRule> {
         return configString.replace('$activeUserId', activeUser.sub.toString());
     }
 
-    async toDto(securityRule: SecurityRule, manager?: EntityManager): Promise<UpdateSecurityRuleDto> {
+    async toDto(securityRule: SecurityRule): Promise<UpdateSecurityRuleDto> {
         // load the role and model relations for the security rule
         let populatedSecurityRule: SecurityRule = securityRule;
         // If the security rule does not have the role and model relations loaded, load them
         if (!securityRule.role || !securityRule.modelMetadata) {
-            // When a manager is provided (e.g. from a TypeORM subscriber event),
-            // use it so the query runs on the active transaction's connection
-            // instead of trying to acquire a second connection from the pool.
-            const repo = manager
-                ? manager.getRepository(SecurityRule)
-                : this;
-            populatedSecurityRule = await repo.findOne({
+            populatedSecurityRule = await this.findOne({
                 where: {
                     id: securityRule.id,
                 },
@@ -103,7 +97,7 @@ export class SecurityRuleRepository extends SolidBaseRepository<SecurityRule> {
                     role: true,
                     modelMetadata: true,
                 },
-            }) ?? securityRule;
+            });
         }
 
         return {

package/src/seeders/module-metadata-seeder.service.ts

@@ -1536,8 +1536,9 @@ export class ModuleMetadataSeederService {
             const { fields: fieldsMetadata, ...modelMetaDataWithoutFields } = modelMetadata;
 
             // Load and set the parent model if it exists.
+            let parentModel: ModelMetadata | null = null;
             if (modelMetadata.isChild && modelMetadata.parentModelUserKey) {
-                const parentModel = await this.getModelByUserKeyCached(modelMetadata.parentModelUserKey, {
+                parentModel = await this.getModelByUserKeyCached(modelMetadata.parentModelUserKey, {
                     moduleName: moduleMetadata.name,
                     component: 'module-model-fields',
                     details: `parentModel=${modelMetadata.parentModelUserKey}`,
@@ -1605,7 +1606,27 @@ export class ModuleMetadataSeederService {
                 }
             }
 
-            // Now that we have created fields & model update the model to stamp the userKeyField. 
+            // If userKeyField wasn't found among this model's own fields (e.g. STI "extension" models
+            // whose userKeyField is a column inherited from the parent entity), look it up on the
+            // parent model by the same name.
+            if (!userKeyField && modelMetadata.isChild && parentModel && userKeyFieldName) {
+                const inheritedUserKeyField = await this.timeOperation('field-find-inherited-user-key', () => fieldMetadataRepo.findOne({
+                    where: {
+                        model: { id: parentModel.id },
+                        name: userKeyFieldName,
+                    },
+                }), {
+                    moduleName: moduleMetadata.name,
+                    component: 'module-model-fields',
+                    serviceCall: 'fieldMetadataRepo.findOne',
+                    details: `model=${modelMetadata.singularName} parentModel=${modelMetadata.parentModelUserKey} field=${userKeyFieldName}`,
+                });
+                if (inheritedUserKeyField) {
+                    userKeyField = inheritedUserKeyField;
+                }
+            }
+
+            // Now that we have created fields & model update the model to stamp the userKeyField.
             if (userKeyField) {
                 modelMetaDataWithoutFields['userKeyField'] = userKeyField;
                 await this.timeOperation('model-user-key-field-upsert', () => this.modelMetadataService.upsert(modelMetaDataWithoutFields), {