@solidxai/core 0.1.12-beta.0 → 0.1.12-beta.10

package/src/services/mediaStorageProviders/file-s3-storage-provider.ts

@@ -9,6 +9,13 @@ import { MediaStorageProvider } from "src/interfaces";
 import { DiskFileService, S3FileService } from "src/services/file";
 import { Readable } from "stream";
 import { MediaRepository } from "src/repository/media.repository";
+import { MediaDownloadUrlService } from "src/services/media-download-url.service";
+import {
+buildMediaRecordCreateInput,
+buildStoredMediaFileName,
+getEffectiveS3Region,
+resolveMediaIsPublic,
+} from "src/services/media-storage.utils";
 
 @Injectable()
 export class FileS3StorageProvider<T> implements MediaStorageProvider<T> {
@@ -19,18 +26,14 @@ export class FileS3StorageProvider<T> implements MediaStorageProvider<T> {
         readonly diskFileService: DiskFileService,
         readonly s3FileService: S3FileService,
         readonly mediaRepository: MediaRepository,
+        private readonly mediaDownloadUrlService: MediaDownloadUrlService,
     ) { }
 
     async storeStreams(streamPairs: [Readable, string][], entity: T, mediaFieldMetadata: FieldMetadata): Promise<Media[]> {
-        const isSupportedEntity = entity instanceof CommonEntity
-            || entity instanceof LegacyCommonEntityWithExistingId
-            || entity instanceof LegacyCommonEntityWithGeneratedId;
-        if (!isSupportedEntity) {
-            throw new Error("Entity must be an instance of CommonEntity, LegacyCommonEntityWithExistingId or LegacyCommonEntityWithGeneratedId");
-        }
+        const entityId = this.getSupportedEntityId(entity);
         const result: Media[] = [];
         const storageProvider = mediaFieldMetadata.mediaStorageProvider;
-        const region = this.getEffectiveRegion(storageProvider.region);
+        const region = getEffectiveS3Region(this.configService, storageProvider.region);
 
         for (const [stream, fileName] of streamPairs) {
             const bucketName = storageProvider.bucketName;
@@ -45,15 +48,12 @@ export class FileS3StorageProvider<T> implements MediaStorageProvider<T> {
 
             await this.s3FileService.write(`${bucketName}:${fileName}`, fileData, { region });
 
-            const mediaEntity = await this.mediaRepository.createMedia({
-                // @ts-ignore
-                entityId: entity.id,
-                modelMetadataId: mediaFieldMetadata.model.id,
-                relativeUri: fileName,
-                fileSize,
-                mediaStorageProviderMetadataId: mediaFieldMetadata.mediaStorageProvider.id,
-                fieldMetadataId: mediaFieldMetadata.id
-            }) as unknown as Media;
+            const mediaEntity = await this.mediaRepository.createMedia(
+                buildMediaRecordCreateInput(entityId, mediaFieldMetadata, storageProvider, {
+                    relativeUri: fileName,
+                    fileSize,
+                })
+            ) as unknown as Media;
             result.push(mediaEntity);
             this.logger.debug(`Stored media with`, mediaEntity);
         }
@@ -61,29 +61,22 @@ export class FileS3StorageProvider<T> implements MediaStorageProvider<T> {
     }
 
     async retrieve(entity: T, mediaFieldMetadata: FieldMetadata): Promise<Media[]> {
-        const isSupportedEntity = entity instanceof CommonEntity
-            || entity instanceof LegacyCommonEntityWithExistingId
-            || entity instanceof LegacyCommonEntityWithGeneratedId;
-        if (!isSupportedEntity) {
-            throw new Error("Entity must be an instance of CommonEntity, LegacyCommonEntityWithExistingId or LegacyCommonEntityWithGeneratedId"); // FIXME This needs to be handled through generics. e.g T extends CommonEntity
-        }
+        const entityId = this.getSupportedEntityId(entity);
         // @ts-ignore
-        const media = await this.mediaRepository.findByEntityIdAndFieldIdAndModelMetadataId(entity.id, mediaFieldMetadata.id, mediaFieldMetadata.model.id, ['mediaStorageProviderMetadata']);
+        const media = await this.mediaRepository.findByEntityIdAndFieldIdAndModelMetadataId(entityId, mediaFieldMetadata.id, mediaFieldMetadata.model.id, ['mediaStorageProviderMetadata']);
 
         // TODO: Check if the mediaStorageProvider (s3 in this case) is configured with a public bucket or not.
         // If private bucket then we need to return a "signed-url", the timeout for the signed url can be configured in the media storage provider entity and modified using the CRUD interface.
         // Add the full URL to the media
         for (const m of media) {
             const storageMeta = m.mediaStorageProviderMetadata;
-            const region = this.getEffectiveRegion(storageMeta.region);
-            if (storageMeta.isPublic === false) {
-                // Generate signed URL
-                const expiryInSeconds = (storageMeta.signedUrlExpiry ?? 60) * 60;
-                m['_full_url'] = await this.s3FileService.getUrl(`${storageMeta?.bucketName}:${m.relativeUri}`, { expiresIn: expiryInSeconds, region });
-            } else {
-                // Public S3 or local filesystem: use normal URL
-                m['_full_url'] = this.getFullFilePath(m);
-            }
+            const isPublic = resolveMediaIsPublic(storageMeta);
+            m['_full_url'] = isPublic === false
+                ? await this.mediaDownloadUrlService.getPrivateUrl(m.id, m.relativeUri, storageMeta)
+                : await this.s3FileService.getUrl(
+                    `${storageMeta.bucketName}:${m.relativeUri}`,
+                    { region: getEffectiveS3Region(this.configService, storageMeta.region), expiresIn: 0 },
+                );
         }
 
         return media;
@@ -94,18 +87,13 @@ export class FileS3StorageProvider<T> implements MediaStorageProvider<T> {
     }
 
     async store(files: Express.Multer.File[], entity: T, mediaFieldMetadata: FieldMetadata): Promise<Media[]> {
-        const isSupportedEntity = entity instanceof CommonEntity
-            || entity instanceof LegacyCommonEntityWithExistingId
-            || entity instanceof LegacyCommonEntityWithGeneratedId;
-        if (!isSupportedEntity) {
-            throw new Error("Entity must be an instance of CommonEntity, LegacyCommonEntityWithExistingId or LegacyCommonEntityWithGeneratedId"); // FIXME This needs to be handled through generics. e.g T extends CommonEntity
-        }
+        const entityId = this.getSupportedEntityId(entity);
         const result: Media[] = [];
         const storageProvider = mediaFieldMetadata.mediaStorageProvider;
-        const region = this.getEffectiveRegion(storageProvider.region);
+        const region = getEffectiveS3Region(this.configService, storageProvider.region);
 
         for (const file of files) {
-            const fileName = this.getFileName(file);
+            const fileName = buildStoredMediaFileName(file);
             const bucketName = storageProvider.bucketName;
 
             // Read file from disk and upload to S3
@@ -118,17 +106,14 @@ export class FileS3StorageProvider<T> implements MediaStorageProvider<T> {
             const awsFileUrl = fileName;
 
             // Create an entry in the media table
-            const mediaEntity = await this.mediaRepository.createMedia({
-                // @ts-ignore
-                entityId: entity.id,
-                modelMetadataId: mediaFieldMetadata.model.id,
-                relativeUri: awsFileUrl,
-                mimeType: file.mimetype,
-                fileSize: file.size,
-                originalFileName: file.originalname,
-                mediaStorageProviderMetadataId: mediaFieldMetadata.mediaStorageProvider.id,
-                fieldMetadataId: mediaFieldMetadata.id
-            }) as unknown as Media;
+            const mediaEntity = await this.mediaRepository.createMedia(
+                buildMediaRecordCreateInput(entityId, mediaFieldMetadata, storageProvider, {
+                    relativeUri: awsFileUrl,
+                    mimeType: file.mimetype,
+                    fileSize: file.size,
+                    originalFileName: file.originalname,
+                })
+            ) as unknown as Media;
             result.push(mediaEntity);
             this.logger.debug(`Stored media with`, mediaEntity);
         };
@@ -136,19 +121,14 @@ export class FileS3StorageProvider<T> implements MediaStorageProvider<T> {
     }
 
     async delete(entity: T, mediaFieldMetadata: FieldMetadata): Promise<void> {
-        const isSupportedEntity = entity instanceof CommonEntity
-            || entity instanceof LegacyCommonEntityWithExistingId
-            || entity instanceof LegacyCommonEntityWithGeneratedId;
-        if (!isSupportedEntity) {
-            throw new Error("Entity must be an instance of CommonEntity, LegacyCommonEntityWithExistingId or LegacyCommonEntityWithGeneratedId"); // FIXME This needs to be handled through generics. e.g T extends CommonEntity
-        }
+        const entityId = this.getSupportedEntityId(entity);
         const storageProvider = mediaFieldMetadata.mediaStorageProvider;
-        const region = this.getEffectiveRegion(storageProvider.region);
+        const region = getEffectiveS3Region(this.configService, storageProvider.region);
 
         // @ts-ignore
-        const existingMedia = await this.mediaRepository.findByEntityIdAndFieldIdAndModelMetadataId(entity.id, mediaFieldMetadata.id, mediaFieldMetadata.model.id, ['mediaStorageProviderMetadata']);
+        const existingMedia = await this.mediaRepository.findByEntityIdAndFieldIdAndModelMetadataId(entityId, mediaFieldMetadata.id, mediaFieldMetadata.model.id, ['mediaStorageProviderMetadata']);
         // @ts-ignore
-        this.mediaRepository.deleteByEntityIdAndFieldIdAndModelMetadataId(entity.id, mediaFieldMetadata.id, mediaFieldMetadata.model.id);
+        this.mediaRepository.deleteByEntityIdAndFieldIdAndModelMetadataId(entityId, mediaFieldMetadata.id, mediaFieldMetadata.model.id);
         for (const media of existingMedia) {
             const bucketName = storageProvider.bucketName;
             await this.s3FileService.delete(`${bucketName}:${media.relativeUri}`, { region });
@@ -163,26 +143,19 @@ export class FileS3StorageProvider<T> implements MediaStorageProvider<T> {
         if (!storageProvider?.bucketName || !media?.relativeUri) {
             return;
         }
-        const region = this.getEffectiveRegion(storageProvider.region);
+        const region = getEffectiveS3Region(this.configService, storageProvider.region);
         await this.s3FileService.delete(`${storageProvider.bucketName}:${media.relativeUri}`, { region });
     }
 
-    /**
-     * Get the effective region to use for S3 operations.
-     * Uses the provider-specific region if configured, otherwise falls back to env variable.
-     */
-    private getEffectiveRegion(providerRegion?: string): string | undefined {
-        return providerRegion || this.configService.get('S3_AWS_REGION_NAME');
-    }
+    private getSupportedEntityId(entity: T): number {
+        const isSupportedEntity = entity instanceof CommonEntity
+            || entity instanceof LegacyCommonEntityWithExistingId
+            || entity instanceof LegacyCommonEntityWithGeneratedId;
 
-    private getFullFilePath(media: Media): string {
-        // Use provider region if available, fallback to env variable
-        const region = this.getEffectiveRegion(media.mediaStorageProviderMetadata.region);
-        // https://lunarismedia.s3.ap-south-1.amazonaws.com/LUNARIS_CP_REGISTRATION_CREATIVE.jpg
-        return `https://${media.mediaStorageProviderMetadata.bucketName}.s3.${region}.amazonaws.com/${media.relativeUri}`;
-    }
+        if (!isSupportedEntity) {
+            throw new Error("Entity must be an instance of CommonEntity, LegacyCommonEntityWithExistingId or LegacyCommonEntityWithGeneratedId");
+        }
 
-    private getFileName(file: Express.Multer.File): string {
-        return `${file.filename}-${file.originalname}`;
+        return (entity as any).id;
     }
 }

package/src/services/mediaStorageProviders/file-storage-provider.ts

@@ -1,29 +1,25 @@
 import { Injectable, Logger } from "@nestjs/common";
-import { ConfigService } from "@nestjs/config";
-import { CommonEntity } from "src/entities/common.entity";
 import { FieldMetadata } from "src/entities/field-metadata.entity";
 import { Media } from "src/entities/media.entity";
+import { MediaStorageProviderMetadata } from "src/entities/media-storage-provider-metadata.entity";
 import { MediaStorageProvider } from "src/interfaces";
 import { MediaRepository } from "src/repository/media.repository";
 import { DiskFileService } from "src/services/file";
 import { Readable } from "stream";
-import * as path from "path";
 import * as fs from "fs";
 import { SettingService } from "../setting.service";
-import { DEFAULT_MEDIA_FILE_STORAGE_DIR } from "src/services/settings/default-settings-provider.service";
-import type { SolidCoreSetting } from "src/services/settings/default-settings-provider.service";
+import { MediaDownloadUrlService } from "src/services/media-download-url.service";
+import {buildDiskMediaPath,buildMediaRecordCreateInput,buildStoredMediaFileName,resolveMediaIsPublic,} from "src/services/media-storage.utils";
 
 @Injectable()
 export class FileStorageProvider<T> implements MediaStorageProvider<T> {
     private logger = new Logger(FileStorageProvider.name);
 
     constructor(
-        // @Inject(appBuilderConfig.KEY)
-        // private readonly appBuilderConfiguration: ConfigType<typeof appBuilderConfig>,
-        private readonly configService: ConfigService,
         readonly fileService: DiskFileService,
         readonly mediaRepository: MediaRepository,
-        private readonly settingService: SettingService
+        private readonly settingService: SettingService,
+        private readonly mediaDownloadUrlService: MediaDownloadUrlService,
 
     ) { }
 
@@ -32,12 +28,16 @@ export class FileStorageProvider<T> implements MediaStorageProvider<T> {
         //     throw new Error("Entity must be an instance of CommonEntity"); //FIXME This needs to be handled through generics. e.g T extends CommonEntity
         // }
         //@ts-ignore
-        const media = await this.mediaRepository.findByEntityIdAndFieldIdAndModelMetadataId(entity.id, mediaFieldMetadata.id, mediaFieldMetadata.model.id, ['mediaStorageProviderMetadata']);
+        const media = await this.mediaRepository.findByEntityIdAndFieldIdAndModelMetadataId(this.getEntityId(entity), mediaFieldMetadata.id, mediaFieldMetadata.model.id, ['mediaStorageProviderMetadata']);
         // Add the full URL to the media
         // media.forEach(m => {
         // });
         for (const m of media) {
-            m['_full_url'] = `${this.settingService.getConfigValue<SolidCoreSetting>("baseUrl")}/${this.getFullFilePath(m.relativeUri)}`;
+            const storageProvider = this.resolveMediaStorageProvider(m, mediaFieldMetadata);
+            const isPublic = resolveMediaIsPublic(storageProvider);
+            m['_full_url'] = isPublic === false
+                ? await this.mediaDownloadUrlService.getPrivateUrl(m.id, m.relativeUri, storageProvider)
+                : await this.fileService.getUrl(buildDiskMediaPath(m.relativeUri, this.settingService, storageProvider));
         }
 
 
@@ -49,24 +49,23 @@ export class FileStorageProvider<T> implements MediaStorageProvider<T> {
         //     throw new Error("Entity must be an instance of CommonEntity"); //FIXME This needs to be handled through generics. e.g T extends CommonEntity
         // }
         const result: Media[] = [];
+        const storageProvider = mediaFieldMetadata.mediaStorageProvider;
         for (const file of files) {
             // Store the file in the configured file storage directory
-            const fileStoragePath = this.getFullFilePath(this.getFileName(file));
+            const fileName = buildStoredMediaFileName(file);
+            const fileStoragePath = buildDiskMediaPath(fileName, this.settingService, storageProvider);
             await this.fileService.copy(file.path, fileStoragePath);
             await this.fileService.delete(file.path);
 
             // Create an entry in the media table
-            const mediaEntity = await this.mediaRepository.createMedia({
-                //@ts-ignore
-                entityId: entity.id,
-                modelMetadataId: mediaFieldMetadata.model.id,
-                relativeUri: this.getFileName(file),
-                mimeType: file.mimetype,
-                fileSize: file.size,
-                originalFileName: file.originalname,
-                mediaStorageProviderMetadataId: mediaFieldMetadata.mediaStorageProvider.id,
-                fieldMetadataId: mediaFieldMetadata.id
-            }) as unknown as Media;
+            const mediaEntity = await this.mediaRepository.createMedia(
+                buildMediaRecordCreateInput(this.getEntityId(entity), mediaFieldMetadata, storageProvider, {
+                    relativeUri: fileName,
+                    mimeType: file.mimetype,
+                    fileSize: file.size,
+                    originalFileName: file.originalname,
+                })
+            ) as unknown as Media;
             result.push(mediaEntity);
             this.logger.debug(`Stored media with`, mediaEntity);
         };
@@ -78,21 +77,20 @@ export class FileStorageProvider<T> implements MediaStorageProvider<T> {
         //     throw new Error("Entity must be an instance of CommonEntity"); //FIXME This needs to be handled through generics. e.g T extends CommonEntity
         // }
         const result: Media[] = [];
+        const storageProvider = mediaFieldMetadata.mediaStorageProvider;
         for (const pair of streamPairs) {
             const stream = pair[0];
             const fileName = pair[1];
-            const fullPath = this.getFullFilePath(fileName);
+            const fullPath = buildDiskMediaPath(fileName, this.settingService, storageProvider);
             await this.fileService.writeStream(fullPath, stream);
             const { size: fileSize } = await fs.promises.stat(fullPath);
-            const mediaEntity = await this.mediaRepository.createMedia({
-                //@ts-ignore
-                entityId: entity.id,
-                modelMetadataId: mediaFieldMetadata.model.id,
-                relativeUri: fileName,
-                fileSize,
-                mediaStorageProviderMetadataId: mediaFieldMetadata.mediaStorageProvider.id,
-                fieldMetadataId: mediaFieldMetadata.id
-            }) as unknown as Media;
+            const mediaEntity = await this.mediaRepository.createMedia(
+                buildMediaRecordCreateInput(this.getEntityId(entity), mediaFieldMetadata, storageProvider, {
+                    relativeUri: fileName,
+                    fileSize,
+                })
+            ) as unknown as Media;
+            result.push(mediaEntity);
             this.logger.debug(`Stored media with`, mediaEntity);
         };
         return result;
@@ -102,13 +100,13 @@ export class FileStorageProvider<T> implements MediaStorageProvider<T> {
         // if (!(entity instanceof CommonEntity)) {
         //     throw new Error("Entity must be an instance of CommonEntity"); //FIXME This needs to be handled through generics. e.g T extends CommonEntity
         // }
-        //@ts-ignore
-        const existingMedia = await this.mediaRepository.findByEntityIdAndFieldIdAndModelMetadataId(entity.id, mediaFieldMetadata.id, mediaFieldMetadata.model.id, ['mediaStorageProviderMetadata']);
-        //@ts-ignore
-        this.mediaRepository.deleteByEntityIdAndFieldIdAndModelMetadataId(entity.id, mediaFieldMetadata.id, mediaFieldMetadata.model.id);
+        const entityId = this.getEntityId(entity);
+        const existingMedia = await this.mediaRepository.findByEntityIdAndFieldIdAndModelMetadataId(entityId, mediaFieldMetadata.id, mediaFieldMetadata.model.id, ['mediaStorageProviderMetadata']);
+        await this.mediaRepository.deleteByEntityIdAndFieldIdAndModelMetadataId(entityId, mediaFieldMetadata.id, mediaFieldMetadata.model.id);
 
         for (const media of existingMedia) {
-            await this.fileService.delete(this.getFullFilePath(media.relativeUri));
+            const storageProvider = this.resolveMediaStorageProvider(media, mediaFieldMetadata);
+            await this.fileService.delete(buildDiskMediaPath(media.relativeUri, this.settingService, storageProvider));
         }
         // existingMedia.forEach(media => {
         // });
@@ -118,19 +116,14 @@ export class FileStorageProvider<T> implements MediaStorageProvider<T> {
         if (!media?.relativeUri) {
             return;
         }
-        await this.fileService.delete(this.getFullFilePath(media.relativeUri));
+        await this.fileService.delete(buildDiskMediaPath(media.relativeUri, this.settingService, media.mediaStorageProviderMetadata));
     }
 
-    private getFullFilePath(fileName: string): string {
-        const base = this.settingService.getConfigValue<SolidCoreSetting>("fileStorageDir")
-            || DEFAULT_MEDIA_FILE_STORAGE_DIR;
-        if (path.isAbsolute(fileName) || fileName.startsWith(`${base}/`)) {
-            return fileName;
-        }
-        return `${base}/${fileName}`;
+    private resolveMediaStorageProvider(media: Media, mediaFieldMetadata?: FieldMetadata): MediaStorageProviderMetadata | undefined {
+        return media.mediaStorageProviderMetadata || mediaFieldMetadata?.mediaStorageProvider;
     }
 
-    private getFileName(file: Express.Multer.File): string {
-        return `${file.filename}-${file.originalname}`;
+    private getEntityId(entity: T): number {
+        return (entity as any).id;
     }
 }

package/src/services/role-metadata.service.ts

@@ -140,6 +140,10 @@ export class RoleMetadataService extends CRUDService<RoleMetadata> {
     return await this._addPermissionsToRole(roleName, null);
   }
 
+  async addAllPermissionsToRoleExceptPrefixes(roleName: string, excludedPermissionPrefixes: string[]): Promise<RoleMetadata> {
+    return await this._addPermissionsToRole(roleName, null, excludedPermissionPrefixes);
+  }
+
   async addPermissionsToRole(roleName: string, permissionNames: string[]): Promise<RoleMetadata> {
     return await this._addPermissionsToRole(roleName, permissionNames);
   }
@@ -148,7 +152,11 @@ export class RoleMetadataService extends CRUDService<RoleMetadata> {
     return await this._addPermissionsToRole(roleName, permissionName);
   }
 
-  private async _addPermissionsToRole(roleName: string, permissionNames: string[]): Promise<RoleMetadata> {
+  private async _addPermissionsToRole(
+    roleName: string,
+    permissionNames: string[],
+    excludedPermissionPrefixes: string[] = [],
+  ): Promise<RoleMetadata> {
     const role = await this.repo.findOne({
       where: { name: roleName },
       select: {
@@ -161,7 +169,7 @@ export class RoleMetadataService extends CRUDService<RoleMetadata> {
     }
 
     const joinInfo = this.getRolePermissionJoinInfo();
-    const targetPermissions = await this.loadTargetPermissions(permissionNames);
+    const targetPermissions = await this.loadTargetPermissions(permissionNames, excludedPermissionPrefixes);
 
     if (!permissionNames || permissionNames.length === 0) {
       await this.entityManager
@@ -226,21 +234,25 @@ export class RoleMetadataService extends CRUDService<RoleMetadata> {
     return existingPermission;
   }
 
-  private async loadTargetPermissions(permissionNames: string[] | null): Promise<PermissionMetadata[]> {
+  private async loadTargetPermissions(permissionNames: string[] | null, excludedPermissionPrefixes: string[] = []): Promise<PermissionMetadata[]> {
     if (permissionNames && permissionNames.length !== 0) {
       const uniquePermissionNames = [...new Set(permissionNames)];
       const permissions = await this.permissionRepository.find({ where: { name: In(uniquePermissionNames) } });
       if (permissions.length !== uniquePermissionNames.length) {
         throw new Error(`One or more permissions not found.`);
       }
-      return permissions;
+      return permissions.filter((permission) =>
+        !excludedPermissionPrefixes.some((prefix) => permission.name.startsWith(prefix)),
+      );
     }
 
     const permissions = await this.permissionRepository.find();
     if (permissions.length === 0) {
       throw new Error(`No permissions configured in the system. Did you forget to run the PermissionSeederService?`);
     }
-    return permissions;
+    return permissions.filter((permission) =>
+      !excludedPermissionPrefixes.some((prefix) => permission.name.startsWith(prefix)),
+    );
   }
 
   private getRolePermissionJoinInfo(): { tableName: string; roleIdColumn: string; permissionIdColumn: string } {

package/src/solid-core.module.ts

@@ -47,6 +47,7 @@ import { ListOfValuesService } from "./services/list-of-values.service";
 // import { MediaStorageProviderMetadataSeederService } from './services/media-storage-provider-metadata-seeder.service';
 import { MediaStorageProviderMetadataService } from "./services/media-storage-provider-metadata.service";
 import { MediaService } from "./services/media.service";
+import { MediaDownloadUrlService } from "./services/media-download-url.service";
 import { ModelMetadataService } from "./services/model-metadata.service";
 import { RemovedFieldMigrationService } from "./services/removed-field-migration.service";
 import { ModuleMetadataExplorerService } from "./services/module-metadata-explorer.service";
@@ -55,9 +56,10 @@ import { ModulePackageService } from "./services/module-package.service";
 import { SolidIntrospectService } from "./services/solid-introspect.service";
 // import { ListOfComputedFieldProvider } from './providers/list-of-computed-field-provider.service';
 import { ServeStaticModule } from "@nestjs/serve-static";
-import { join } from "path";
+import { extname, join } from "path";
 import { RefreshModelCommand } from "./commands/refresh-model.command";
 import { MediaController } from "./controllers/media.controller";
+import { INLINE_SAFE_EXTENSIONS } from "./constants/media-file-types";
 
 import { RefreshModuleCommand } from "./commands/refresh-module.command";
 import { ModelMetadataSubscriber } from "./subscribers/model-metadata.subscriber";
@@ -106,6 +108,7 @@ import { MqMessage } from "./entities/mq-message.entity";
 import { SmsTemplate } from "./entities/sms-template.entity";
 import { AccessTokenGuard } from "./guards/access-token.guard";
 import { ApiKeyGuard } from "./guards/api-key.guard";
+import { MediaSignedUrlGuard } from "./guards/media-signed-url.guard";
 import { AuthenticationGuard } from "./guards/authentication.guard";
 import { PermissionsGuard } from "./guards/permissions.guard";
 import { SolidRegistry } from "./helpers/solid-registry";
@@ -130,10 +133,17 @@ import { ChatterQueuePublisherRabbitmq } from "./jobs/rabbitmq/chatter-queue-pub
 import { ChatterQueueSubscriberRabbitmq } from "./jobs/rabbitmq/chatter-queue-subscriber.service";
 import { ChatterQueuePublisherDatabase } from "./jobs/database/chatter-queue-publisher-database.service";
 import { ChatterQueueSubscriberDatabase } from "./jobs/database/chatter-queue-subscriber-database.service";
+import { ChatterMentionNotificationEmailQueueHandler } from "./jobs/chatter-mention-notification-email-queue-handler.service";
+import { ChatterMentionNotificationEmailQueuePublisherDatabase } from "./jobs/database/chatter-mention-notification-email-publisher-database.service";
+import { ChatterMentionNotificationEmailQueueSubscriberDatabase } from "./jobs/database/chatter-mention-notification-email-subscriber-database.service";
+import { ChatterMentionNotificationEmailQueuePublisherRabbitmq } from "./jobs/rabbitmq/chatter-mention-notification-email-publisher.service";
+import { ChatterMentionNotificationEmailQueueSubscriberRabbitmq } from "./jobs/rabbitmq/chatter-mention-notification-email-subscriber.service";
 import { ApiEmailQueuePublisherRedis } from "./jobs/redis/api-email-publisher-redis.service";
 import { ApiEmailQueueSubscriberRedis } from "./jobs/redis/api-email-subscriber-redis.service";
 import { ChatterQueuePublisherRedis } from "./jobs/redis/chatter-queue-publisher-redis.service";
 import { ChatterQueueSubscriberRedis } from "./jobs/redis/chatter-queue-subscriber-redis.service";
+import { ChatterMentionNotificationEmailQueuePublisherRedis } from "./jobs/redis/chatter-mention-notification-email-publisher-redis.service";
+import { ChatterMentionNotificationEmailQueueSubscriberRedis } from "./jobs/redis/chatter-mention-notification-email-subscriber-redis.service";
 import { ComputedFieldEvaluationPublisherRedis } from "./jobs/redis/computed-field-evaluation-publisher-redis.service";
 import { ComputedFieldEvaluationSubscriberRedis } from "./jobs/redis/computed-field-evaluation-subscriber-redis.service";
 import { GenerateCodePublisherRedis } from "./jobs/redis/generate-code-publisher-redis.service";
@@ -437,7 +447,7 @@ import { PostgresDatasourceIntrospectionProviderService } from "./services/datas
       rootPath: join(process.cwd(), "media-files-storage"),
       serveRoot: "/media-files-storage",
       serveStaticOptions: {
-        setHeaders: (res /*, path, stat*/) => {
+        setHeaders: (res, path) => {
           // Allow use of these files from a different origin (e.g., :3000 UI)
           // Use 'same-site' if both origins are on the same site (localhost:* counts as same-site)
           res.setHeader("Cross-Origin-Resource-Policy", "cross-origin"); // or 'same-site'
@@ -445,6 +455,20 @@ import { PostgresDatasourceIntrospectionProviderService } from "./services/datas
           // If you need to load into <canvas> without tainting or fetch images via XHR,
           // you can also expose CORS here (not needed for simple <img>):
           // res.setHeader('Access-Control-Allow-Origin', 'http://localhost:3000');
+
+          // Prevent the browser from ever content-sniffing a served file into something
+          // more dangerous than its declared Content-Type (e.g. rendering a mislabeled
+          // upload as HTML and executing embedded script).
+          res.setHeader("X-Content-Type-Options", "nosniff");
+
+          // Only a small allowlist of media types is ever safe to render inline. Everything
+          // else (including svg, html, and any other uploaded file) is forced to download
+          // rather than be displayed/executed by the browser, regardless of what mimetype or
+          // extension it was uploaded with.
+          if (!INLINE_SAFE_EXTENSIONS.has(extname(path).toLowerCase().replace(/^\./, ''))) {
+            res.setHeader("Content-Type", "application/octet-stream");
+            res.setHeader("Content-Disposition", "attachment");
+          }
         },
       },
     }),
@@ -563,6 +587,7 @@ import { PostgresDatasourceIntrospectionProviderService } from "./services/datas
     SchematicService,
     MediaStorageProviderMetadataService,
     MediaService,
+    MediaDownloadUrlService,
     // MediaStorageProviderMetadataSeederService,
     ModuleMetadataSeederService,
     ModuleTestDataService,
@@ -647,6 +672,7 @@ import { PostgresDatasourceIntrospectionProviderService } from "./services/datas
     SoftDeleteAwareEventSubscriber,
     AccessTokenGuard,
     ApiKeyGuard,
+    MediaSignedUrlGuard,
     ApiKeyService,
     ActiveSessionStorageService,
     AuthenticationService,
@@ -665,6 +691,11 @@ import { PostgresDatasourceIntrospectionProviderService } from "./services/datas
     ChatterQueueSubscriberRabbitmq,
     ChatterQueuePublisherDatabase,
     ChatterQueueSubscriberDatabase,
+    ChatterMentionNotificationEmailQueueHandler,
+    ChatterMentionNotificationEmailQueuePublisherRabbitmq,
+    ChatterMentionNotificationEmailQueueSubscriberRabbitmq,
+    ChatterMentionNotificationEmailQueuePublisherDatabase,
+    ChatterMentionNotificationEmailQueueSubscriberDatabase,
 
     TestQueuePublisherDatabase,
     TestQueueSubscriberDatabase,
@@ -674,6 +705,8 @@ import { PostgresDatasourceIntrospectionProviderService } from "./services/datas
     ApiEmailQueueSubscriberRedis,
     ChatterQueuePublisherRedis,
     ChatterQueueSubscriberRedis,
+    ChatterMentionNotificationEmailQueuePublisherRedis,
+    ChatterMentionNotificationEmailQueueSubscriberRedis,
     ComputedFieldEvaluationPublisherRedis,
     ComputedFieldEvaluationSubscriberRedis,
     GenerateCodePublisherRedis,

package/src/subscribers/audit.subscriber.ts

@@ -106,7 +106,7 @@ export class AuditSubscriber implements EntitySubscriberInterface {
 
         const relationBefore = event.entity?.[AUDIT_BEFORE_SNAPSHOT] ?? null;
 
-        const relationAfter = await this.dataSource.getRepository(event.metadata.target as any).findOne({
+        const relationAfter = await event.queryRunner.manager.getRepository(event.metadata.target as any).findOne({
             where: { id: entityId } as any,
             relations: relations as any,
         });