@solidxai/core 0.1.12-beta.2 → 0.1.12-beta.3

package/src/dtos/update-media.dto.ts

@@ -1,5 +1,5 @@
-import { IsInt,IsOptional, IsNotEmpty, IsString } from 'class-validator';
-import { ApiProperty } from '@nestjs/swagger';
+import { IsBoolean, IsInt,IsOptional, IsNotEmpty, IsString } from 'class-validator';
+import { ApiProperty, ApiPropertyOptional } from '@nestjs/swagger';
 export class UpdateMediaDto {
     @IsOptional()
     @IsInt()
@@ -11,6 +11,11 @@ export class UpdateMediaDto {
 @ApiProperty()
 entityId: number;
 
+@IsOptional()
+@IsBoolean()
+@ApiPropertyOptional({ default: true })
+isPublic?: boolean;
+
 @IsOptional()
 @IsString()
 @ApiProperty()
@@ -60,4 +65,4 @@ fieldMetadataId: number;
 @IsOptional()
 @ApiProperty()
 fieldMetadataUserKey: string;
-}
+}

package/src/entities/media.entity.ts

@@ -9,6 +9,9 @@ export class Media extends CommonEntity {
     @Column({ type: "integer" })
     entityId: number;
 
+    @Column({ name: "is_public", default: true })
+    isPublic: boolean = true;
+
     @Column({ type: "varchar", nullable: true })
     relativeUri: string;
 
@@ -36,4 +39,4 @@ export class Media extends CommonEntity {
     @ManyToOne(() => FieldMetadata, { nullable: false })
     @JoinColumn()
     fieldMetadata: FieldMetadata;
-}
+}

package/src/enums/auth-type.enum.ts

@@ -2,4 +2,5 @@ export enum AuthType {
     Bearer,
     ApiKey,
     None,
+    MediaSignedUrl,
 }

package/src/guards/authentication.guard.ts

@@ -9,6 +9,7 @@ import { AUTH_TYPE_KEY } from '../decorators/auth.decorator';
 import { AuthType } from '../enums/auth-type.enum';
 import { AccessTokenGuard } from './access-token.guard';
 import { ApiKeyGuard } from './api-key.guard';
+import { MediaSignedUrlGuard } from './media-signed-url.guard';
 import { IS_PUBLIC_KEY } from '../decorators/public.decorator';
 import { PermissionMetadataService } from '../services/permission-metadata.service';
 import { ClsService } from 'nestjs-cls';
@@ -22,12 +23,14 @@ export class AuthenticationGuard implements CanActivate {
       [AuthType.Bearer]: this.accessTokenGuard,
       [AuthType.ApiKey]: this.apiKeyGuard,
       [AuthType.None]: { canActivate: () => true },
+      [AuthType.MediaSignedUrl]: this.mediaSignedUrlGuard,
     };
 
   constructor(
     private readonly reflector: Reflector,
     private readonly accessTokenGuard: AccessTokenGuard,
     private readonly apiKeyGuard: ApiKeyGuard,
+    private readonly mediaSignedUrlGuard: MediaSignedUrlGuard,
     private readonly permissionService: PermissionMetadataService,
     private readonly cls: ClsService,
   ) { }

package/src/guards/media-signed-url.guard.ts

@@ -0,0 +1,41 @@
+import { CanActivate, ExecutionContext, Injectable, UnauthorizedException } from '@nestjs/common';
+import { Request } from 'express';
+import { MediaDownloadUrlService } from 'src/services/media-download-url.service';
+
+@Injectable()
+export class MediaSignedUrlGuard implements CanActivate {
+  constructor(private readonly mediaDownloadUrlService: MediaDownloadUrlService) { }
+
+  async canActivate(context: ExecutionContext): Promise<boolean> {
+    const request = context.switchToHttp().getRequest<Request>();
+    const token = this.extractTokenFromQuery(request);
+    if (!token) {
+      throw new UnauthorizedException();
+    }
+
+    let payload: { mediaId: number };
+    try {
+      payload = await this.mediaDownloadUrlService.verifyDownloadToken(token);
+    } catch {
+      throw new UnauthorizedException();
+    }
+
+    const routeMediaId = Number(request.params?.id);
+    if (!Number.isFinite(routeMediaId) || payload.mediaId !== routeMediaId) {
+      throw new UnauthorizedException();
+    }
+
+    // No REQUEST_USER_KEY is ever set for token auth (only Bearer/ApiKey guards set it), so
+    // the sibling global APP_GUARD PermissionsGuard would otherwise reject this request for
+    // lack of a per-user permission grant. Flag it the same way AuthenticationGuard flags
+    // Public-role-exempt requests - token possession IS the full authorization decision here.
+    request['isListedInPublicRole'] = true;
+
+    return true;
+  }
+
+  private extractTokenFromQuery(request: Request): string | undefined {
+    const token = request.query?.token;
+    return typeof token === 'string' ? token : undefined;
+  }
+}

package/src/helpers/field-crud-managers/MediaFieldCrudManager.ts

@@ -1,4 +1,5 @@
 import { FieldCrudManager, ValidationError } from "src/interfaces";
+import { DANGEROUS_EXTENSIONS, EXT_TO_MEDIA_TYPE, MediaCategory } from "src/constants/media-file-types";
 
 export enum SolidMediaType {
     mediaSingle = 'mediaSingle',
@@ -14,7 +15,7 @@ export interface MediaFieldOptions {
     isUpdate: boolean | undefined | null;
 }
 
-type MediaType = 'image' | 'audio' | 'video' | 'file' | 'pdf';
+type MediaType = MediaCategory;
 
 const MIME_TO_MEDIA_TYPE: Record<string, MediaType> = {
     // Images
@@ -25,7 +26,6 @@ const MIME_TO_MEDIA_TYPE: Record<string, MediaType> = {
     'image/gif': 'image',
     'image/bmp': 'image',
     'image/tiff': 'image',
-    'image/svg+xml': 'image',
     'image/heic': 'image',
     'image/heif': 'image',
 
@@ -72,35 +72,23 @@ const MIME_TO_MEDIA_TYPE: Record<string, MediaType> = {
     'application/x-zip-compressed': 'file',
     'application/x-rar-compressed': 'file',
     'application/x-7z-compressed': 'file',
-
-    // Common binary fallback category
-    'application/octet-stream': 'file',
 };
 
-const EXT_TO_MEDIA_TYPE: Record<string, MediaType> = {
-    // Images
-    png: 'image', jpg: 'image', jpeg: 'image', webp: 'image', gif: 'image', bmp: 'image', tiff: 'image', svg: 'image', heic: 'image', heif: 'image',
-
-    // Audio
-    mp3: 'audio', wav: 'audio', ogg: 'audio', aac: 'audio', m4a: 'audio', flac: 'audio',
-
-    // Video
-    mp4: 'video', mov: 'video', avi: 'video', mkv: 'video', mpeg: 'video', mpg: 'video', '3gp': 'video', '3g2': 'video',
-
-    // Files
-    pdf: 'file', txt: 'file', md: 'file', csv: 'file', json: 'file',
-    doc: 'file', docx: 'file', xls: 'file', xlsx: 'file', ppt: 'file', pptx: 'file',
-    zip: 'file', rar: 'file', '7z': 'file',
-};
-
-
 export class MediaFieldCrudManager implements FieldCrudManager {
 
     constructor(private readonly options: MediaFieldOptions) {
     }
 
     private resolveMediaType(mimetype?: string, filename?: string): MediaType | null {
+        const ext = (filename || '').split('.').pop()?.toLowerCase();
+        if (ext && DANGEROUS_EXTENSIONS.has(ext)) {
+            return null;
+        }
+
         const mt = (mimetype || '').toLowerCase().trim();
+        if (mt === 'image/svg+xml' || mt === 'text/html' || mt === 'application/xhtml+xml') {
+            return null;
+        }
         if (mt && MIME_TO_MEDIA_TYPE[mt]) {
             return MIME_TO_MEDIA_TYPE[mt];
         }
@@ -110,8 +98,8 @@ export class MediaFieldCrudManager implements FieldCrudManager {
         if (mt.startsWith('audio/')) return 'audio';
         if (mt.startsWith('video/')) return 'video';
 
-        // Fallback to extension if provided
-        const ext = (filename || '').split('.').pop()?.toLowerCase();
+        // Fallback to extension if provided (also covers generic/unrecognized
+        // mimetypes such as application/octet-stream).
         if (ext && EXT_TO_MEDIA_TYPE[ext]) {
             return EXT_TO_MEDIA_TYPE[ext];
         }

package/src/repository/media.repository.ts

@@ -7,6 +7,7 @@ import { MediaStorageProviderMetadataRepository } from './media-storage-provider
 import { ModelMetadataRepository } from './model-metadata.repository';
 import { SecurityRuleRepository } from './security-rule.repository';
 import { SolidBaseRepository } from './solid-base.repository';
+import { resolveStoredMediaIsPublic } from 'src/services/media-storage.utils';
 
 @Injectable()
 export class MediaRepository extends SolidBaseRepository<Media> {
@@ -44,6 +45,7 @@ export class MediaRepository extends SolidBaseRepository<Media> {
                 id: createDto['mediaStorageProviderMetadataId']
             },
         });
+        createDto['isPublic'] = resolveStoredMediaIsPublic(createDto['isPublic'], createDto['mediaStorageProviderMetadata']);
         const media = this.create(createDto);
         return this.save(media);
     }

package/src/seeders/seed-data/solid-core-metadata.json

@@ -1704,6 +1704,18 @@
             "columnName": "original_file_name",
             "isSystem": true
           },
+          {
+            "name": "isPublic",
+            "displayName": "Is Public",
+            "type": "boolean",
+            "required": false,
+            "unique": false,
+            "index": false,
+            "private": false,
+            "encrypt": false,
+            "columnName": "is_public",
+            "isSystem": true
+          },
           {
             "name": "modelMetadata",
             "displayName": "Model Metadata",
@@ -5306,6 +5318,9 @@
         "FieldMetadataController.getSelectionDynamicValues",
         "FieldMetadataController.getSelectionDynamicValue",
         "FieldMetadataController.findFieldDefaultMetaData",
+        "MediaController.findMany",
+        "MediaController.findOne",
+        "MediaController.download",
         "SavedFiltersController.delete",
         "SavedFiltersController.deleteMany",
         "SavedFiltersController.findOne",
@@ -8607,9 +8622,9 @@
                             "attrs": {
                               "name": "roles",
                               "widget": "checkbox",
-                              "inlineCreateAutoSave": "true",
+                              "inlineCreateAutoSave": "false",
                               "renderModeCheckboxPreprocessor": "MenuItemMetadataRolesFormFieldPreprocessor",
-                              "inlineCreate": "true",
+                              "inlineCreate": "false",
                               "inlineCreateLayout": {
                                 "type": "form",
                                 "attrs": {
@@ -8758,6 +8773,13 @@
               "sortable": false
             }
           },
+          {
+            "type": "field",
+            "attrs": {
+              "name": "isPublic",
+              "sortable": true
+            }
+          },
           {
             "type": "field",
             "attrs": {
@@ -8853,6 +8875,14 @@
                   "isSearchable": true
                 }
               },
+              {
+                "type": "field",
+                "attrs": {
+                  "name": "isPublic",
+                  "label": "isPublic",
+                  "isSearchable": true
+                }
+              },
               {
                 "type": "field",
                 "attrs": {
@@ -8921,6 +8951,12 @@
                       "name": "mediaStorageProviderMetadata"
                     }
                   },
+                  {
+                    "type": "field",
+                    "attrs": {
+                      "name": "isPublic"
+                    }
+                  },
                   {
                     "type": "field",
                     "attrs": {
@@ -14525,7 +14561,15 @@
   "mediaStorageProviders": [
     {
       "name": "default-filesystem",
-      "type": "filesystem"
+      "type": "filesystem",
+      "isPublic": true,
+      "localPath": "media-files-storage"
+    },
+    {
+      "name": "private-filesystem",
+      "type": "filesystem",
+      "isPublic": false,
+      "localPath": "media-private-files-storage"
     },
     {
       "name": "default-aws-s3",
@@ -14561,6 +14605,47 @@
           }
         }
       }
+    },
+    {
+      "name": "model:Media-role:Internal User-own",
+      "description": "Show Media records owned by the current user",
+      "roleUserKey": "Internal User",
+      "modelMetadataUserKey": "media",
+      "securityRuleConfig": {
+        "filters": {
+          "createdBy": {
+            "$eq": "$activeUserId"
+          }
+        }
+      }
+    },
+    {
+      "name": "model:Media-role:Internal User-public",
+      "description": "Show public Media records",
+      "roleUserKey": "Internal User",
+      "modelMetadataUserKey": "media",
+      "securityRuleConfig": {
+        "filters": {
+          "mediaStorageProviderMetadata": {
+            "isPublic": {
+              "$eq": true
+            }
+          }
+        }
+      }
+    },
+    {
+      "name": "model:Media-role:Admin",
+      "description": "Show All Media records",
+      "roleUserKey": "Admin",
+      "modelMetadataUserKey": "media",
+      "securityRuleConfig": {
+        "filters": {
+          "id": {
+            "$ne": "0"
+          }
+        }
+      }
     }
   ],
   "modelSequences": [],

package/src/services/1.js

@@ -0,0 +1,6 @@
+1. Do i need to create a storeStreams method for aws service too?
+    - Handle later
+2. queues handling -> if queues is enabled by default, i.e triggerExport(exportTransactionEntity.id).
+    - startExport should either return the data or return the transaction id
+3. How to handle scenarios wherein, nested related exist.(do i need to only get the userkey)
+    - show the userKey

package/src/services/media-download-url.service.ts

@@ -0,0 +1,67 @@
+import { Injectable, Logger } from '@nestjs/common';
+import { ConfigService } from '@nestjs/config';
+import { JwtService } from '@nestjs/jwt';
+import { MediaStorageProviderType } from 'src/dtos/create-media-storage-provider-metadata.dto';
+import { MediaStorageProviderMetadata } from 'src/entities/media-storage-provider-metadata.entity';
+import { S3FileService } from 'src/services/file';
+import { getEffectiveS3Region } from 'src/services/media-storage.utils';
+import { SettingService } from 'src/services/setting.service';
+import type { SolidCoreSetting } from 'src/services/settings/default-settings-provider.service';
+
+export const MEDIA_DOWNLOAD_TOKEN_AUDIENCE = 'media-download';
+const DEFAULT_SIGNED_URL_EXPIRY_MINUTES = 60;
+
+export interface MediaDownloadTokenPayload {
+  mediaId: number;
+}
+
+@Injectable()
+export class MediaDownloadUrlService {
+  private readonly logger = new Logger(MediaDownloadUrlService.name);
+
+  constructor(
+    private readonly jwtService: JwtService,
+    private readonly s3FileService: S3FileService,
+    private readonly settingService: SettingService,
+    private readonly configService: ConfigService,
+  ) { }
+
+  async resolveDownloadUrl(mediaId: number, relativeUri: string, storageProvider?: MediaStorageProviderMetadata): Promise<string> {
+    const expiryMinutes = storageProvider?.signedUrlExpiry ?? DEFAULT_SIGNED_URL_EXPIRY_MINUTES;
+
+    if ((storageProvider?.type as MediaStorageProviderType) === MediaStorageProviderType.AwsS3) {
+      if (storageProvider?.bucketName) {
+        return this.s3FileService.getUrl(
+          `${storageProvider.bucketName}:${relativeUri}`,
+          { region: getEffectiveS3Region(this.configService, storageProvider.region), expiresIn: expiryMinutes * 60 },
+        );
+      }
+      this.logger.warn(`Media id ${mediaId}: AwsS3 provider missing bucketName; falling back to app-hosted token URL`);
+    }
+
+    // Filesystem (or misconfigured S3) has no native presigned-URL mechanism, so mint our
+    // own short-lived token and embed it in the download URL - the token alone authorizes
+    // the request (see MediaSignedUrlGuard), so it works in a plain <img src> with no
+    // Authorization header needed.
+    const token = await this.mintDownloadToken(mediaId, expiryMinutes);
+    const downloadPath = `/api/media/${mediaId}/download?token=${token}`;
+    const baseUrl = this.settingService.getConfigValue<SolidCoreSetting>('baseUrl');
+    return `${String(baseUrl).replace(/\/+$/, '')}${downloadPath}`;
+  }
+
+  async verifyDownloadToken(token: string): Promise<MediaDownloadTokenPayload> {
+    return this.jwtService.verifyAsync<MediaDownloadTokenPayload>(token, {
+      secret: this.settingService.getConfigValue<SolidCoreSetting>('secret'),
+      audience: MEDIA_DOWNLOAD_TOKEN_AUDIENCE,
+    });
+  }
+
+  private mintDownloadToken(mediaId: number, expiryMinutes: number): Promise<string> {
+    const payload: MediaDownloadTokenPayload = { mediaId };
+    return this.jwtService.signAsync(payload, {
+      secret: this.settingService.getConfigValue<SolidCoreSetting>('secret'),
+      audience: MEDIA_DOWNLOAD_TOKEN_AUDIENCE,
+      expiresIn: expiryMinutes * 60,
+    });
+  }
+}

package/src/services/media-storage.utils.ts

@@ -0,0 +1,79 @@
+import { ConfigService } from '@nestjs/config';
+import * as path from 'path';
+import { FieldMetadata } from 'src/entities/field-metadata.entity';
+import { MediaStorageProviderMetadata } from 'src/entities/media-storage-provider-metadata.entity';
+import { SettingService } from 'src/services/setting.service';
+import { DEFAULT_MEDIA_FILE_STORAGE_DIR } from 'src/services/settings/default-settings-provider.service';
+import type { SolidCoreSetting } from 'src/services/settings/default-settings-provider.service';
+
+export const DEFAULT_PRIVATE_MEDIA_STORAGE_DIR = 'media-private-files-storage';
+
+export interface MediaRecordCreateInput {
+  entityId: number;
+  modelMetadataId: number;
+  mediaStorageProviderMetadataId: number;
+  fieldMetadataId: number;
+  relativeUri: string;
+  mimeType?: string;
+  fileSize?: number;
+  originalFileName?: string;
+  isPublic?: boolean;
+}
+
+// Builds the stored file name format shared by media storage implementations.
+export function buildStoredMediaFileName(file: Pick<Express.Multer.File, 'filename' | 'originalname'>): string {
+  return `${file.filename}-${file.originalname}`;
+}
+
+// Resolves the on-disk path for a media file based on settings and provider visibility.
+export function buildDiskMediaPath(fileName: string,settingService: Pick<SettingService, 'getConfigValue'>,storageProvider?: Pick<MediaStorageProviderMetadata, 'localPath' | 'isPublic'>,): string {
+  const publicBase = settingService.getConfigValue<SolidCoreSetting>('fileStorageDir') || DEFAULT_MEDIA_FILE_STORAGE_DIR;
+  const privateBase = DEFAULT_PRIVATE_MEDIA_STORAGE_DIR;
+  const providerBase = storageProvider?.localPath || (storageProvider?.isPublic === false ? privateBase : publicBase);
+
+  if ( path.isAbsolute(fileName) || fileName.startsWith(`${publicBase}/`) || fileName.startsWith(`${privateBase}/`) || (!!storageProvider?.localPath && fileName.startsWith(`${storageProvider.localPath}/`))) {
+    return fileName;
+  }
+
+  return `${providerBase}/${fileName}`;
+}
+
+// Returns the S3 region from the provider when present, otherwise falls back to app config.
+export function getEffectiveS3Region(configService: Pick<ConfigService, 'get'>,providerRegion?: string,): string | undefined {
+  return providerRegion || configService.get<string>('S3_AWS_REGION_NAME');
+}
+
+// Resolves the effective public/private flag for a media storage provider.
+export function resolveMediaIsPublic(storageProvider?: Pick<MediaStorageProviderMetadata, 'isPublic'>,): boolean | undefined {
+  if (!storageProvider) {
+    return undefined;
+  }
+
+  return storageProvider.isPublic !== false;
+}
+
+// Preserves an explicit media visibility value or derives it from the storage provider.
+export function resolveStoredMediaIsPublic(currentValue: boolean | undefined,storageProvider?:Pick<MediaStorageProviderMetadata, 'isPublic'>,): boolean | undefined {
+  if (typeof currentValue === 'boolean') {
+    return currentValue;
+  }
+
+  return resolveMediaIsPublic(storageProvider);
+}
+
+// Builds the shared media record payload used before saving media metadata to the database.
+export function buildMediaRecordCreateInput(
+  entityId: number,
+  mediaFieldMetadata: Pick<FieldMetadata, 'id' | 'model'> & { model: { id: number } },
+  storageProvider: Pick<MediaStorageProviderMetadata, 'id'>,
+  overrides: Pick<MediaRecordCreateInput, 'relativeUri'>
+    & Partial<Omit<MediaRecordCreateInput, 'entityId' | 'modelMetadataId' | 'mediaStorageProviderMetadataId' | 'fieldMetadataId' | 'relativeUri'>>,
+): MediaRecordCreateInput {
+  return {
+    entityId,
+    modelMetadataId: mediaFieldMetadata.model.id,
+    mediaStorageProviderMetadataId: storageProvider.id,
+    fieldMetadataId: mediaFieldMetadata.id,
+    ...overrides,
+  };
+}