@solidxai/core 0.1.12-beta.1 → 0.1.12-beta.3

package/src/services/mediaStorageProviders/file-storage-provider.ts

@@ -1,29 +1,25 @@
 import { Injectable, Logger } from "@nestjs/common";
-import { ConfigService } from "@nestjs/config";
-import { CommonEntity } from "src/entities/common.entity";
 import { FieldMetadata } from "src/entities/field-metadata.entity";
 import { Media } from "src/entities/media.entity";
+import { MediaStorageProviderMetadata } from "src/entities/media-storage-provider-metadata.entity";
 import { MediaStorageProvider } from "src/interfaces";
 import { MediaRepository } from "src/repository/media.repository";
 import { DiskFileService } from "src/services/file";
 import { Readable } from "stream";
-import * as path from "path";
 import * as fs from "fs";
 import { SettingService } from "../setting.service";
-import { DEFAULT_MEDIA_FILE_STORAGE_DIR } from "src/services/settings/default-settings-provider.service";
-import type { SolidCoreSetting } from "src/services/settings/default-settings-provider.service";
+import { MediaDownloadUrlService } from "src/services/media-download-url.service";
+import { buildDiskMediaPath, buildMediaRecordCreateInput, buildStoredMediaFileName, resolveStoredMediaIsPublic, } from "src/services/media-storage.utils";
 
 @Injectable()
 export class FileStorageProvider<T> implements MediaStorageProvider<T> {
     private logger = new Logger(FileStorageProvider.name);
 
     constructor(
-        // @Inject(appBuilderConfig.KEY)
-        // private readonly appBuilderConfiguration: ConfigType<typeof appBuilderConfig>,
-        private readonly configService: ConfigService,
         readonly fileService: DiskFileService,
         readonly mediaRepository: MediaRepository,
-        private readonly settingService: SettingService
+        private readonly settingService: SettingService,
+        private readonly mediaDownloadUrlService: MediaDownloadUrlService,
 
     ) { }
 
@@ -32,12 +28,17 @@ export class FileStorageProvider<T> implements MediaStorageProvider<T> {
         //     throw new Error("Entity must be an instance of CommonEntity"); //FIXME This needs to be handled through generics. e.g T extends CommonEntity
         // }
         //@ts-ignore
-        const media = await this.mediaRepository.findByEntityIdAndFieldIdAndModelMetadataId(entity.id, mediaFieldMetadata.id, mediaFieldMetadata.model.id, ['mediaStorageProviderMetadata']);
+        const media = await this.mediaRepository.findByEntityIdAndFieldIdAndModelMetadataId(this.getEntityId(entity), mediaFieldMetadata.id, mediaFieldMetadata.model.id, ['mediaStorageProviderMetadata']);
         // Add the full URL to the media
         // media.forEach(m => {
         // });
         for (const m of media) {
-            m['_full_url'] = `${this.settingService.getConfigValue<SolidCoreSetting>("baseUrl")}/${this.getFullFilePath(m.relativeUri)}`;
+            const storageProvider = this.resolveMediaStorageProvider(m, mediaFieldMetadata);
+            const isPublic = resolveStoredMediaIsPublic(m.isPublic, storageProvider);
+            m.isPublic = isPublic;
+            m['_full_url'] = isPublic === false
+                ? await this.mediaDownloadUrlService.resolveDownloadUrl(m.id, m.relativeUri, storageProvider)
+                : await this.fileService.getUrl(buildDiskMediaPath(m.relativeUri, this.settingService, storageProvider));
         }
 
 
@@ -49,24 +50,24 @@ export class FileStorageProvider<T> implements MediaStorageProvider<T> {
         //     throw new Error("Entity must be an instance of CommonEntity"); //FIXME This needs to be handled through generics. e.g T extends CommonEntity
         // }
         const result: Media[] = [];
+        const storageProvider = mediaFieldMetadata.mediaStorageProvider;
         for (const file of files) {
             // Store the file in the configured file storage directory
-            const fileStoragePath = this.getFullFilePath(this.getFileName(file));
+            const fileName = buildStoredMediaFileName(file);
+            const fileStoragePath = buildDiskMediaPath(fileName, this.settingService, storageProvider);
             await this.fileService.copy(file.path, fileStoragePath);
             await this.fileService.delete(file.path);
 
             // Create an entry in the media table
-            const mediaEntity = await this.mediaRepository.createMedia({
-                //@ts-ignore
-                entityId: entity.id,
-                modelMetadataId: mediaFieldMetadata.model.id,
-                relativeUri: this.getFileName(file),
-                mimeType: file.mimetype,
-                fileSize: file.size,
-                originalFileName: file.originalname,
-                mediaStorageProviderMetadataId: mediaFieldMetadata.mediaStorageProvider.id,
-                fieldMetadataId: mediaFieldMetadata.id
-            }) as unknown as Media;
+            const mediaEntity = await this.mediaRepository.createMedia(
+                buildMediaRecordCreateInput(this.getEntityId(entity), mediaFieldMetadata, storageProvider, {
+                    relativeUri: fileName,
+                    mimeType: file.mimetype,
+                    fileSize: file.size,
+                    originalFileName: file.originalname,
+                })
+            ) as unknown as Media;
+            mediaEntity.isPublic = resolveStoredMediaIsPublic(mediaEntity.isPublic, storageProvider);
             result.push(mediaEntity);
             this.logger.debug(`Stored media with`, mediaEntity);
         };
@@ -78,21 +79,21 @@ export class FileStorageProvider<T> implements MediaStorageProvider<T> {
         //     throw new Error("Entity must be an instance of CommonEntity"); //FIXME This needs to be handled through generics. e.g T extends CommonEntity
         // }
         const result: Media[] = [];
+        const storageProvider = mediaFieldMetadata.mediaStorageProvider;
         for (const pair of streamPairs) {
             const stream = pair[0];
             const fileName = pair[1];
-            const fullPath = this.getFullFilePath(fileName);
+            const fullPath = buildDiskMediaPath(fileName, this.settingService, storageProvider);
             await this.fileService.writeStream(fullPath, stream);
             const { size: fileSize } = await fs.promises.stat(fullPath);
-            const mediaEntity = await this.mediaRepository.createMedia({
-                //@ts-ignore
-                entityId: entity.id,
-                modelMetadataId: mediaFieldMetadata.model.id,
-                relativeUri: fileName,
-                fileSize,
-                mediaStorageProviderMetadataId: mediaFieldMetadata.mediaStorageProvider.id,
-                fieldMetadataId: mediaFieldMetadata.id
-            }) as unknown as Media;
+            const mediaEntity = await this.mediaRepository.createMedia(
+                buildMediaRecordCreateInput(this.getEntityId(entity), mediaFieldMetadata, storageProvider, {
+                    relativeUri: fileName,
+                    fileSize,
+                })
+            ) as unknown as Media;
+            mediaEntity.isPublic = resolveStoredMediaIsPublic(mediaEntity.isPublic, storageProvider);
+            result.push(mediaEntity);
             this.logger.debug(`Stored media with`, mediaEntity);
         };
         return result;
@@ -102,13 +103,13 @@ export class FileStorageProvider<T> implements MediaStorageProvider<T> {
         // if (!(entity instanceof CommonEntity)) {
         //     throw new Error("Entity must be an instance of CommonEntity"); //FIXME This needs to be handled through generics. e.g T extends CommonEntity
         // }
-        //@ts-ignore
-        const existingMedia = await this.mediaRepository.findByEntityIdAndFieldIdAndModelMetadataId(entity.id, mediaFieldMetadata.id, mediaFieldMetadata.model.id, ['mediaStorageProviderMetadata']);
-        //@ts-ignore
-        this.mediaRepository.deleteByEntityIdAndFieldIdAndModelMetadataId(entity.id, mediaFieldMetadata.id, mediaFieldMetadata.model.id);
+        const entityId = this.getEntityId(entity);
+        const existingMedia = await this.mediaRepository.findByEntityIdAndFieldIdAndModelMetadataId(entityId, mediaFieldMetadata.id, mediaFieldMetadata.model.id, ['mediaStorageProviderMetadata']);
+        await this.mediaRepository.deleteByEntityIdAndFieldIdAndModelMetadataId(entityId, mediaFieldMetadata.id, mediaFieldMetadata.model.id);
 
         for (const media of existingMedia) {
-            await this.fileService.delete(this.getFullFilePath(media.relativeUri));
+            const storageProvider = this.resolveMediaStorageProvider(media, mediaFieldMetadata);
+            await this.fileService.delete(buildDiskMediaPath(media.relativeUri, this.settingService, storageProvider));
         }
         // existingMedia.forEach(media => {
         // });
@@ -118,19 +119,14 @@ export class FileStorageProvider<T> implements MediaStorageProvider<T> {
         if (!media?.relativeUri) {
             return;
         }
-        await this.fileService.delete(this.getFullFilePath(media.relativeUri));
+        await this.fileService.delete(buildDiskMediaPath(media.relativeUri, this.settingService, media.mediaStorageProviderMetadata));
     }
 
-    private getFullFilePath(fileName: string): string {
-        const base = this.settingService.getConfigValue<SolidCoreSetting>("fileStorageDir")
-            || DEFAULT_MEDIA_FILE_STORAGE_DIR;
-        if (path.isAbsolute(fileName) || fileName.startsWith(`${base}/`)) {
-            return fileName;
-        }
-        return `${base}/${fileName}`;
+    private resolveMediaStorageProvider(media: Media, mediaFieldMetadata?: FieldMetadata): MediaStorageProviderMetadata | undefined {
+        return media.mediaStorageProviderMetadata || mediaFieldMetadata?.mediaStorageProvider;
     }
 
-    private getFileName(file: Express.Multer.File): string {
-        return `${file.filename}-${file.originalname}`;
+    private getEntityId(entity: T): number {
+        return (entity as any).id;
     }
 }

package/src/solid-core.module.ts

@@ -47,6 +47,7 @@ import { ListOfValuesService } from "./services/list-of-values.service";
 // import { MediaStorageProviderMetadataSeederService } from './services/media-storage-provider-metadata-seeder.service';
 import { MediaStorageProviderMetadataService } from "./services/media-storage-provider-metadata.service";
 import { MediaService } from "./services/media.service";
+import { MediaDownloadUrlService } from "./services/media-download-url.service";
 import { ModelMetadataService } from "./services/model-metadata.service";
 import { RemovedFieldMigrationService } from "./services/removed-field-migration.service";
 import { ModuleMetadataExplorerService } from "./services/module-metadata-explorer.service";
@@ -55,9 +56,10 @@ import { ModulePackageService } from "./services/module-package.service";
 import { SolidIntrospectService } from "./services/solid-introspect.service";
 // import { ListOfComputedFieldProvider } from './providers/list-of-computed-field-provider.service';
 import { ServeStaticModule } from "@nestjs/serve-static";
-import { join } from "path";
+import { extname, join } from "path";
 import { RefreshModelCommand } from "./commands/refresh-model.command";
 import { MediaController } from "./controllers/media.controller";
+import { INLINE_SAFE_EXTENSIONS } from "./constants/media-file-types";
 
 import { RefreshModuleCommand } from "./commands/refresh-module.command";
 import { ModelMetadataSubscriber } from "./subscribers/model-metadata.subscriber";
@@ -106,6 +108,7 @@ import { MqMessage } from "./entities/mq-message.entity";
 import { SmsTemplate } from "./entities/sms-template.entity";
 import { AccessTokenGuard } from "./guards/access-token.guard";
 import { ApiKeyGuard } from "./guards/api-key.guard";
+import { MediaSignedUrlGuard } from "./guards/media-signed-url.guard";
 import { AuthenticationGuard } from "./guards/authentication.guard";
 import { PermissionsGuard } from "./guards/permissions.guard";
 import { SolidRegistry } from "./helpers/solid-registry";
@@ -130,10 +133,17 @@ import { ChatterQueuePublisherRabbitmq } from "./jobs/rabbitmq/chatter-queue-pub
 import { ChatterQueueSubscriberRabbitmq } from "./jobs/rabbitmq/chatter-queue-subscriber.service";
 import { ChatterQueuePublisherDatabase } from "./jobs/database/chatter-queue-publisher-database.service";
 import { ChatterQueueSubscriberDatabase } from "./jobs/database/chatter-queue-subscriber-database.service";
+import { ChatterMentionNotificationEmailQueueHandler } from "./jobs/chatter-mention-notification-email-queue-handler.service";
+import { ChatterMentionNotificationEmailQueuePublisherDatabase } from "./jobs/database/chatter-mention-notification-email-publisher-database.service";
+import { ChatterMentionNotificationEmailQueueSubscriberDatabase } from "./jobs/database/chatter-mention-notification-email-subscriber-database.service";
+import { ChatterMentionNotificationEmailQueuePublisherRabbitmq } from "./jobs/rabbitmq/chatter-mention-notification-email-publisher.service";
+import { ChatterMentionNotificationEmailQueueSubscriberRabbitmq } from "./jobs/rabbitmq/chatter-mention-notification-email-subscriber.service";
 import { ApiEmailQueuePublisherRedis } from "./jobs/redis/api-email-publisher-redis.service";
 import { ApiEmailQueueSubscriberRedis } from "./jobs/redis/api-email-subscriber-redis.service";
 import { ChatterQueuePublisherRedis } from "./jobs/redis/chatter-queue-publisher-redis.service";
 import { ChatterQueueSubscriberRedis } from "./jobs/redis/chatter-queue-subscriber-redis.service";
+import { ChatterMentionNotificationEmailQueuePublisherRedis } from "./jobs/redis/chatter-mention-notification-email-publisher-redis.service";
+import { ChatterMentionNotificationEmailQueueSubscriberRedis } from "./jobs/redis/chatter-mention-notification-email-subscriber-redis.service";
 import { ComputedFieldEvaluationPublisherRedis } from "./jobs/redis/computed-field-evaluation-publisher-redis.service";
 import { ComputedFieldEvaluationSubscriberRedis } from "./jobs/redis/computed-field-evaluation-subscriber-redis.service";
 import { GenerateCodePublisherRedis } from "./jobs/redis/generate-code-publisher-redis.service";
@@ -437,7 +447,7 @@ import { PostgresDatasourceIntrospectionProviderService } from "./services/datas
       rootPath: join(process.cwd(), "media-files-storage"),
       serveRoot: "/media-files-storage",
       serveStaticOptions: {
-        setHeaders: (res /*, path, stat*/) => {
+        setHeaders: (res, path) => {
           // Allow use of these files from a different origin (e.g., :3000 UI)
           // Use 'same-site' if both origins are on the same site (localhost:* counts as same-site)
           res.setHeader("Cross-Origin-Resource-Policy", "cross-origin"); // or 'same-site'
@@ -445,6 +455,20 @@ import { PostgresDatasourceIntrospectionProviderService } from "./services/datas
           // If you need to load into <canvas> without tainting or fetch images via XHR,
           // you can also expose CORS here (not needed for simple <img>):
           // res.setHeader('Access-Control-Allow-Origin', 'http://localhost:3000');
+
+          // Prevent the browser from ever content-sniffing a served file into something
+          // more dangerous than its declared Content-Type (e.g. rendering a mislabeled
+          // upload as HTML and executing embedded script).
+          res.setHeader("X-Content-Type-Options", "nosniff");
+
+          // Only a small allowlist of media types is ever safe to render inline. Everything
+          // else (including svg, html, and any other uploaded file) is forced to download
+          // rather than be displayed/executed by the browser, regardless of what mimetype or
+          // extension it was uploaded with.
+          if (!INLINE_SAFE_EXTENSIONS.has(extname(path).toLowerCase().replace(/^\./, ''))) {
+            res.setHeader("Content-Type", "application/octet-stream");
+            res.setHeader("Content-Disposition", "attachment");
+          }
         },
       },
     }),
@@ -563,6 +587,7 @@ import { PostgresDatasourceIntrospectionProviderService } from "./services/datas
     SchematicService,
     MediaStorageProviderMetadataService,
     MediaService,
+    MediaDownloadUrlService,
     // MediaStorageProviderMetadataSeederService,
     ModuleMetadataSeederService,
     ModuleTestDataService,
@@ -647,6 +672,7 @@ import { PostgresDatasourceIntrospectionProviderService } from "./services/datas
     SoftDeleteAwareEventSubscriber,
     AccessTokenGuard,
     ApiKeyGuard,
+    MediaSignedUrlGuard,
     ApiKeyService,
     ActiveSessionStorageService,
     AuthenticationService,
@@ -665,6 +691,11 @@ import { PostgresDatasourceIntrospectionProviderService } from "./services/datas
     ChatterQueueSubscriberRabbitmq,
     ChatterQueuePublisherDatabase,
     ChatterQueueSubscriberDatabase,
+    ChatterMentionNotificationEmailQueueHandler,
+    ChatterMentionNotificationEmailQueuePublisherRabbitmq,
+    ChatterMentionNotificationEmailQueueSubscriberRabbitmq,
+    ChatterMentionNotificationEmailQueuePublisherDatabase,
+    ChatterMentionNotificationEmailQueueSubscriberDatabase,
 
     TestQueuePublisherDatabase,
     TestQueueSubscriberDatabase,
@@ -674,6 +705,8 @@ import { PostgresDatasourceIntrospectionProviderService } from "./services/datas
     ApiEmailQueueSubscriberRedis,
     ChatterQueuePublisherRedis,
     ChatterQueueSubscriberRedis,
+    ChatterMentionNotificationEmailQueuePublisherRedis,
+    ChatterMentionNotificationEmailQueueSubscriberRedis,
     ComputedFieldEvaluationPublisherRedis,
     ComputedFieldEvaluationSubscriberRedis,
     GenerateCodePublisherRedis,

package/src/subscribers/audit.subscriber.ts

@@ -106,7 +106,7 @@ export class AuditSubscriber implements EntitySubscriberInterface {
 
         const relationBefore = event.entity?.[AUDIT_BEFORE_SNAPSHOT] ?? null;
 
-        const relationAfter = await this.dataSource.getRepository(event.metadata.target as any).findOne({
+        const relationAfter = await event.queryRunner.manager.getRepository(event.metadata.target as any).findOne({
             where: { id: entityId } as any,
             relations: relations as any,
         });