@solidxai/core 0.1.12-beta.2 → 0.1.12-beta.4

package/dist/subscribers/audit.subscriber.js.map

@@ -1 +1 @@
-{"version":3,"file":"audit.subscriber.js","sourceRoot":"","sources":["../../src/subscribers/audit.subscriber.ts"],"names":[],"mappings":";;;;;;;;;;;;;AAAA,2CAA2D;AAC3D,4FAAuF;AACvF,4DAAuD;AACvD,8DAA2D;AAG3D,iFAA6E;AAC7E,4FAAiF;AACjF,MAAM,qBAAqB,GAAG,uBAAuB,CAAC;AAG/C,IAAM,eAAe,uBAArB,MAAM,eAAe;IAGxB,YACqB,gBAAqD,EACrD,aAA4B,EAC5B,qBAA4C,EAC5C,0BAAsD;QAHtD,qBAAgB,GAAhB,gBAAgB,CAAqC;QACrD,kBAAa,GAAb,aAAa,CAAe;QAC5B,0BAAqB,GAArB,qBAAqB,CAAuB;QAC5C,+BAA0B,GAA1B,0BAA0B,CAA4B;QAN1D,WAAM,GAAG,IAAI,eAAM,CAAC,iBAAe,CAAC,IAAI,CAAC,CAAC;QAenD,WAAM,GAAG,IAAI,OAAO,EAA4B,CAAC;IARrD,CAAC;IAEL,gBAAgB,CAAC,UAAsB;QACnC,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;QAC7B,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC3C,CAAC;IAKO,OAAO,CAAC,KAA2B,EAAE,OAA0B;QACnE,MAAM,EAAE,GAAG,KAAK,CAAC,WAAW,CAAC;QAC7B,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC;QACtC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAClB,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;IAC7B,CAAC;IAEO,gBAAgB,CAAC,QAAwB;QAC7C,OAAO,IAAI,CAAC,aAAa,CAAC,gBAAgB,CAAC,IAAA,0BAAU,EAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;IAC1E,CAAC;IAEO,YAAY;QAChB,OAAO,IAAI,CAAC,qBAAqB,CAAC,aAAa,EAAE,EAAE,GAAG,IAAI,IAAI,CAAC;IACnE,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,KAAuB;QACrC,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,QAAQ,CAAC;YAAE,OAAO;QACnD,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE;YAChB,SAAS,EAAE,QAAQ;YACnB,SAAS,EAAE,KAAK,CAAC,QAAQ,CAAC,IAAI;YAC9B,QAAQ,EAAE,KAAK,CAAC,MAAM,EAAE,EAAE,IAAI,IAAI;YAClC,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACpC,KAAK,EAAE,KAAK,CAAC,MAAM,IAAI,IAAI;YAC3B,MAAM,EAAE,IAAI,CAAC,YAAY,EAAE;SAC9B,CAAC,CAAC;IACP,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,KAAuB;QACrC,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,QAAQ,CAAC;YAAE,OAAO;QACnD,MAAM,QAAQ,GAAG,KAAK,CAAC,MAAM,EAAE,EAAE,IAAI,KAAK,CAAC,cAAc,EAAE,EAAE,IAAK,KAAa,CAAC,QAAQ,IAAI,IAAI,CAAC;QACjG,IAAI,MAAM,GAAG,KAAK,CAAC,cAAc,IAAI,IAAI,CAAC;QAC1C,IAAI,KAAK,GAAG,KAAK,CAAC,MAAM,IAAI,IAAI,CAAC;QACjC,MAAM,kBAAkB,GAAG,CAAC,KAAK,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC;QAEjF,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,oCAAoC,CAAC,KAAK,EAAE,QAAQ,EAAE,kBAAkB,CAAC,CAAC;QAEzG,IAAI,WAAW,EAAE,CAAC;YACd,MAAM,GAAG,WAAW,CAAC,MAAM,CAAC;YAC5B,KAAK,GAAG,WAAW,CAAC,KAAK,CAAC;QAC9B,CAAC;QAED,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE;YAChB,SAAS,EAAE,QAAQ;YACnB,SAAS,EAAE,KAAK,CAAC,QAAQ,CAAC,IAAI;YAC9B,QAAQ,EAAE,QAAQ;YAClB,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACpC,KAAK,EAAE,KAAK;YAGZ,MAAM,EAAE,MAAM;YACd,kBAAkB,EAAE,kBAAkB;YACtC,MAAM,EAAE,IAAI,CAAC,YAAY,EAAE;SAC9B,CAAC,CAAC;IACP,CAAC;IAMO,KAAK,CAAC,oCAAoC,CAAC,KAAuB,EAAE,QAAuB,EAAE,kBAA4B;QAE7H,MAAM,mBAAmB,GAAG,CAAC,MAAM,IAAI,CAAC,0BAA0B,CAAC,kBAAkB,CAAC,IAAA,0BAAU,EAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CACnI,KAAK,CAAC,mBAAmB;YACzB,KAAK,CAAC,IAAI,KAAK,UAAU;YACzB,KAAK,CAAC,YAAY,KAAK,aAAa,CACvC,CAAC;QAEF,IAAI,CAAC,QAAQ,IAAI,mBAAmB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAChD,OAAO,IAAI,CAAC;QAChB,CAAC;QAED,MAAM,SAAS,GAA4B,EAAE,CAAC;QAE9C,mBAAmB,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE;YAChC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;QACjC,CAAC,CAAC,CAAC;QAEH,MAAM,cAAc,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,qBAAqB,CAAC,IAAI,IAAI,CAAC;QAErE,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAa,CAAC,CAAC,OAAO,CAAC;YAC5F,KAAK,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAS;YAC9B,SAAS,EAAE,SAAgB;SAC9B,CAAC,CAAC;QAEH,IAAI,cAAc,IAAI,aAAa,EAAE,CAAC;YAClC,mBAAmB,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE;gBAChC,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,cAAc,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;oBACpD,CAAC,CAAC,cAAc,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE;oBACxD,CAAC,CAAC,EAAE,CAAC;gBAET,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;oBACnD,CAAC,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE;oBACvD,CAAC,CAAC,EAAE,CAAC;gBAET,IAAI,CAAC,MAAM,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;uBACnF,CAAC,kBAAkB,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;oBAC9C,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;gBACxC,CAAC;YACL,CAAC,CAAC,CAAC;QACP,CAAC;QACD,OAAO;YACH,MAAM,EAAE,cAAc,IAAI,KAAK,CAAC,cAAc,IAAI,IAAI;YACtD,KAAK,EAAE,aAAa,IAAI,KAAK,CAAC,MAAM,IAAI,IAAI;SAC/C,CAAC;IACN,CAAC;IACD,KAAK,CAAC,WAAW,CAAC,KAAuB;QACrC,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,QAAQ,CAAC;YAAE,OAAO;QACnD,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE;YAChB,SAAS,EAAE,QAAQ;YACnB,SAAS,EAAE,KAAK,CAAC,QAAQ,CAAC,IAAI;YAC9B,QAAQ,EAAE,KAAK,CAAC,cAAc,EAAE,EAAE,IAAI,IAAI;YAC1C,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACpC,MAAM,EAAE,KAAK,CAAC,cAAc;YAC5B,MAAM,EAAE,IAAI,CAAC,YAAY,EAAE;SAC9B,CAAC,CAAC;IACP,CAAC;IAGD,KAAK,CAAC,sBAAsB,CAAC,KAA2B;QACpD,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC;QACvD,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QAEtC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QAE/B,MAAM,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC;IACxC,CAAC;IAED,wBAAwB,CAAC,KAA2B;QAEhD,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IAC1C,CAAC;IAEO,KAAK,CAAC,iBAAiB,CAAC,KAA0B;QACtD,IAAI,CAAC;YAED,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,UAAU,CACpC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,EAAE,uBAAuB,CAAC,CAAC,CAC5F,CAAC;YAEF,OAAO,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE;gBAC1B,IAAI,MAAM,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;oBAC/B,IAAI,CAAC,MAAM,CAAC,KAAK,CACb,qCAAqC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,EAC9E,MAAM,CAAC,MAAM,CAChB,CAAC;gBACN,CAAC;YACL,CAAC,CAAC,CAAC;QACP,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,+BAA+B,EAAE,KAAK,CAAC,CAAC;QAC9D,CAAC;IACL,CAAC;CACJ,CAAA;AAzKY,0CAAe;0BAAf,eAAe;IAD3B,IAAA,mBAAU,EAAC,EAAE,KAAK,EAAE,cAAK,CAAC,SAAS,EAAE,CAAC;qCAKI,4CAAgB;QACnB,8BAAa;QACL,+CAAqB;QAChB,0DAA0B;GAPlE,eAAe,CAyK3B","sourcesContent":["import { Injectable, Logger, Scope } from '@nestjs/common';\nimport { ModelMetadataHelperService } from 'src/helpers/model-metadata-helper.service';\nimport { lowerFirst } from 'src/helpers/string.helper';\nimport { SolidRegistry } from 'src/helpers/solid-registry';\nimport { DataSource, EntityMetadata, EntitySubscriberInterface, InsertEvent, RemoveEvent, UpdateEvent } from 'typeorm';\nimport { AuditQueuePayload } from 'src/interfaces';\nimport { RequestContextService } from 'src/services/request-context.service';\nimport { PublisherFactory } from 'src/services/queues/publisher-factory.service';\nconst AUDIT_BEFORE_SNAPSHOT = '__auditBeforeSnapshot';\n\n@Injectable({ scope: Scope.TRANSIENT })\nexport class AuditSubscriber implements EntitySubscriberInterface {\n    private readonly logger = new Logger(AuditSubscriber.name);\n    private dataSource: DataSource;\n    constructor(\n        private readonly publisherFactory: PublisherFactory<AuditQueuePayload>,\n        private readonly solidRegistry: SolidRegistry,\n        private readonly requestContextService: RequestContextService,\n        private readonly modelMetadataHelperService: ModelMetadataHelperService,\n    ) { }\n\n    bindToDataSource(dataSource: DataSource) {\n        this.dataSource = dataSource;\n        this.dataSource.subscribers.push(this);\n    }\n\n    // Per-transaction buffer (auto-GC when queryRunner is gone)\n    private perTxn = new WeakMap<any, AuditQueuePayload[]>();\n\n    private enqueue(event: { queryRunner: any }, payload: AuditQueuePayload) {\n        const qr = event.queryRunner;\n        const arr = this.perTxn.get(qr) ?? [];\n        arr.push(payload);\n        this.perTxn.set(qr, arr);\n    }\n\n    private shouldTrackAudit(metadata: EntityMetadata): boolean {\n        return this.solidRegistry.isAuditableModel(lowerFirst(metadata.name));\n    }\n\n    private activeUserId(): number | null {\n        return this.requestContextService.getActiveUser()?.sub ?? null;\n    }\n\n    async afterInsert(event: InsertEvent<any>) {\n        if (!this.shouldTrackAudit(event.metadata)) return;\n        this.enqueue(event, {\n            eventType: 'insert',\n            modelName: event.metadata.name,\n            entityId: event.entity?.id ?? null,\n            occurredAt: new Date().toISOString(),\n            after: event.entity ?? null,\n            userId: this.activeUserId(),\n        });\n    }\n\n    async afterUpdate(event: UpdateEvent<any>) {\n        if (!this.shouldTrackAudit(event.metadata)) return;\n        const entityId = event.entity?.id ?? event.databaseEntity?.id ?? (event as any).entityId ?? null;\n        let before = event.databaseEntity ?? null;\n        let after = event.entity ?? null;\n        const updatedColumnNames = (event.updatedColumns ?? []).map(c => c.propertyName);\n\n        const auditResult = await this.prepareManyToManyAuditUpdateSnapshot(event, entityId, updatedColumnNames);\n\n        if (auditResult) {\n            before = auditResult.before;\n            after = auditResult.after;\n        }\n\n        this.enqueue(event, {\n            eventType: 'update',\n            modelName: event.metadata.name,\n            entityId: entityId,\n            occurredAt: new Date().toISOString(),\n            after: after,\n            // databaseEntity is only populated when the entity was fetched first (save() path).\n            // QueryBuilder update() leaves this undefined; postAuditMessageOnUpdate guards for it.\n            before: before,\n            updatedColumnNames: updatedColumnNames,\n            userId: this.activeUserId(),\n        });\n    }\n\n    /**\n     * Resolves before/after snapshots for audit-enabled many-to-many relations\n     * and updates changed relation field names for audit tracking.\n     */\n    private async prepareManyToManyAuditUpdateSnapshot(event: UpdateEvent<any>, entityId: number | null, updatedColumnNames: string[]): Promise<{ before: any; after: any } | null> {\n\n        const auditRelationFields = (await this.modelMetadataHelperService.loadFieldHierarchy(lowerFirst(event.metadata.name))).filter(field =>\n            field.enableAuditTracking &&\n            field.type === 'relation' &&\n            field.relationType !== 'one-to-many'\n        );\n\n        if (!entityId || auditRelationFields.length === 0) {\n            return null;\n        }\n\n        const relations: Record<string, boolean> = {};\n\n        auditRelationFields.forEach(field => {\n            relations[field.name] = true;\n        });\n\n        const relationBefore = event.entity?.[AUDIT_BEFORE_SNAPSHOT] ?? null;\n\n        const relationAfter = await this.dataSource.getRepository(event.metadata.target as any).findOne({\n            where: { id: entityId } as any,\n            relations: relations as any,\n        });\n\n        if (relationBefore && relationAfter) {\n            auditRelationFields.forEach(field => {\n                const oldIds = Array.isArray(relationBefore[field.name])\n                    ? relationBefore[field.name].map(item => item.id).sort()\n                    : [];\n\n                const newIds = Array.isArray(relationAfter[field.name])\n                    ? relationAfter[field.name].map(item => item.id).sort()\n                    : [];\n\n                if ((oldIds.length !== newIds.length || JSON.stringify(oldIds) !== JSON.stringify(newIds))\n                    && !updatedColumnNames.includes(field.name)) {\n                    updatedColumnNames.push(field.name);\n                }\n            });\n        }\n        return {\n            before: relationBefore ?? event.databaseEntity ?? null,\n            after: relationAfter ?? event.entity ?? null,\n        };\n    }\n    async afterRemove(event: RemoveEvent<any>) {\n        if (!this.shouldTrackAudit(event.metadata)) return;\n        this.enqueue(event, {\n            eventType: 'delete',\n            modelName: event.metadata.name,\n            entityId: event.databaseEntity?.id ?? null,\n            occurredAt: new Date().toISOString(),\n            before: event.databaseEntity,\n            userId: this.activeUserId(),\n        });\n    }\n\n    // --------- transaction lifecycle ----------\n    async afterTransactionCommit(event: { queryRunner: any }) {\n        const batch = this.perTxn.get(event.queryRunner) ?? [];\n        this.perTxn.delete(event.queryRunner);\n\n        if (batch.length === 0) return;\n\n        await this.publishAuditBatch(batch);\n    }\n\n    afterTransactionRollback(event: { queryRunner: any }) {\n        // Drop buffered payloads; the write never happened.\n        this.perTxn.delete(event.queryRunner);\n    }\n\n    private async publishAuditBatch(batch: AuditQueuePayload[]) {\n        try {\n            // allSettled: publish in parallel; a single failure does not block the rest.\n            const results = await Promise.allSettled(\n                batch.map(payload => this.publisherFactory.publish({ payload }, 'ChatterQueuePublisher'))\n            );\n\n            results.forEach((result, i) => {\n                if (result.status === 'rejected') {\n                    this.logger.error(\n                        `Failed to publish audit event for ${batch[i].modelName}#${batch[i].entityId}`,\n                        result.reason,\n                    );\n                }\n            });\n        } catch (error) {\n            this.logger.error('Failed to publish audit batch', error);\n        }\n    }\n}\n"]}
+{"version":3,"file":"audit.subscriber.js","sourceRoot":"","sources":["../../src/subscribers/audit.subscriber.ts"],"names":[],"mappings":";;;;;;;;;;;;;AAAA,2CAA2D;AAC3D,4FAAuF;AACvF,4DAAuD;AACvD,8DAA2D;AAG3D,iFAA6E;AAC7E,4FAAiF;AACjF,MAAM,qBAAqB,GAAG,uBAAuB,CAAC;AAG/C,IAAM,eAAe,uBAArB,MAAM,eAAe;IAGxB,YACqB,gBAAqD,EACrD,aAA4B,EAC5B,qBAA4C,EAC5C,0BAAsD;QAHtD,qBAAgB,GAAhB,gBAAgB,CAAqC;QACrD,kBAAa,GAAb,aAAa,CAAe;QAC5B,0BAAqB,GAArB,qBAAqB,CAAuB;QAC5C,+BAA0B,GAA1B,0BAA0B,CAA4B;QAN1D,WAAM,GAAG,IAAI,eAAM,CAAC,iBAAe,CAAC,IAAI,CAAC,CAAC;QAenD,WAAM,GAAG,IAAI,OAAO,EAA4B,CAAC;IARrD,CAAC;IAEL,gBAAgB,CAAC,UAAsB;QACnC,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;QAC7B,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC3C,CAAC;IAKO,OAAO,CAAC,KAA2B,EAAE,OAA0B;QACnE,MAAM,EAAE,GAAG,KAAK,CAAC,WAAW,CAAC;QAC7B,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC;QACtC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAClB,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;IAC7B,CAAC;IAEO,gBAAgB,CAAC,QAAwB;QAC7C,OAAO,IAAI,CAAC,aAAa,CAAC,gBAAgB,CAAC,IAAA,0BAAU,EAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;IAC1E,CAAC;IAEO,YAAY;QAChB,OAAO,IAAI,CAAC,qBAAqB,CAAC,aAAa,EAAE,EAAE,GAAG,IAAI,IAAI,CAAC;IACnE,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,KAAuB;QACrC,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,QAAQ,CAAC;YAAE,OAAO;QACnD,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE;YAChB,SAAS,EAAE,QAAQ;YACnB,SAAS,EAAE,KAAK,CAAC,QAAQ,CAAC,IAAI;YAC9B,QAAQ,EAAE,KAAK,CAAC,MAAM,EAAE,EAAE,IAAI,IAAI;YAClC,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACpC,KAAK,EAAE,KAAK,CAAC,MAAM,IAAI,IAAI;YAC3B,MAAM,EAAE,IAAI,CAAC,YAAY,EAAE;SAC9B,CAAC,CAAC;IACP,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,KAAuB;QACrC,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,QAAQ,CAAC;YAAE,OAAO;QACnD,MAAM,QAAQ,GAAG,KAAK,CAAC,MAAM,EAAE,EAAE,IAAI,KAAK,CAAC,cAAc,EAAE,EAAE,IAAK,KAAa,CAAC,QAAQ,IAAI,IAAI,CAAC;QACjG,IAAI,MAAM,GAAG,KAAK,CAAC,cAAc,IAAI,IAAI,CAAC;QAC1C,IAAI,KAAK,GAAG,KAAK,CAAC,MAAM,IAAI,IAAI,CAAC;QACjC,MAAM,kBAAkB,GAAG,CAAC,KAAK,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC;QAEjF,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,oCAAoC,CAAC,KAAK,EAAE,QAAQ,EAAE,kBAAkB,CAAC,CAAC;QAEzG,IAAI,WAAW,EAAE,CAAC;YACd,MAAM,GAAG,WAAW,CAAC,MAAM,CAAC;YAC5B,KAAK,GAAG,WAAW,CAAC,KAAK,CAAC;QAC9B,CAAC;QAED,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE;YAChB,SAAS,EAAE,QAAQ;YACnB,SAAS,EAAE,KAAK,CAAC,QAAQ,CAAC,IAAI;YAC9B,QAAQ,EAAE,QAAQ;YAClB,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACpC,KAAK,EAAE,KAAK;YAGZ,MAAM,EAAE,MAAM;YACd,kBAAkB,EAAE,kBAAkB;YACtC,MAAM,EAAE,IAAI,CAAC,YAAY,EAAE;SAC9B,CAAC,CAAC;IACP,CAAC;IAMO,KAAK,CAAC,oCAAoC,CAAC,KAAuB,EAAE,QAAuB,EAAE,kBAA4B;QAE7H,MAAM,mBAAmB,GAAG,CAAC,MAAM,IAAI,CAAC,0BAA0B,CAAC,kBAAkB,CAAC,IAAA,0BAAU,EAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CACnI,KAAK,CAAC,mBAAmB;YACzB,KAAK,CAAC,IAAI,KAAK,UAAU;YACzB,KAAK,CAAC,YAAY,KAAK,aAAa,CACvC,CAAC;QAEF,IAAI,CAAC,QAAQ,IAAI,mBAAmB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAChD,OAAO,IAAI,CAAC;QAChB,CAAC;QAED,MAAM,SAAS,GAA4B,EAAE,CAAC;QAE9C,mBAAmB,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE;YAChC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;QACjC,CAAC,CAAC,CAAC;QAEH,MAAM,cAAc,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,qBAAqB,CAAC,IAAI,IAAI,CAAC;QAErE,MAAM,aAAa,GAAG,MAAM,KAAK,CAAC,WAAW,CAAC,OAAO,CAAC,aAAa,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAa,CAAC,CAAC,OAAO,CAAC;YACtG,KAAK,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAS;YAC9B,SAAS,EAAE,SAAgB;SAC9B,CAAC,CAAC;QAEH,IAAI,cAAc,IAAI,aAAa,EAAE,CAAC;YAClC,mBAAmB,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE;gBAChC,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,cAAc,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;oBACpD,CAAC,CAAC,cAAc,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE;oBACxD,CAAC,CAAC,EAAE,CAAC;gBAET,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;oBACnD,CAAC,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE;oBACvD,CAAC,CAAC,EAAE,CAAC;gBAET,IAAI,CAAC,MAAM,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;uBACnF,CAAC,kBAAkB,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;oBAC9C,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;gBACxC,CAAC;YACL,CAAC,CAAC,CAAC;QACP,CAAC;QACD,OAAO;YACH,MAAM,EAAE,cAAc,IAAI,KAAK,CAAC,cAAc,IAAI,IAAI;YACtD,KAAK,EAAE,aAAa,IAAI,KAAK,CAAC,MAAM,IAAI,IAAI;SAC/C,CAAC;IACN,CAAC;IACD,KAAK,CAAC,WAAW,CAAC,KAAuB;QACrC,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,QAAQ,CAAC;YAAE,OAAO;QACnD,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE;YAChB,SAAS,EAAE,QAAQ;YACnB,SAAS,EAAE,KAAK,CAAC,QAAQ,CAAC,IAAI;YAC9B,QAAQ,EAAE,KAAK,CAAC,cAAc,EAAE,EAAE,IAAI,IAAI;YAC1C,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACpC,MAAM,EAAE,KAAK,CAAC,cAAc;YAC5B,MAAM,EAAE,IAAI,CAAC,YAAY,EAAE;SAC9B,CAAC,CAAC;IACP,CAAC;IAGD,KAAK,CAAC,sBAAsB,CAAC,KAA2B;QACpD,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC;QACvD,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QAEtC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QAE/B,MAAM,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC;IACxC,CAAC;IAED,wBAAwB,CAAC,KAA2B;QAEhD,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IAC1C,CAAC;IAEO,KAAK,CAAC,iBAAiB,CAAC,KAA0B;QACtD,IAAI,CAAC;YAED,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,UAAU,CACpC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,EAAE,uBAAuB,CAAC,CAAC,CAC5F,CAAC;YAEF,OAAO,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE;gBAC1B,IAAI,MAAM,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;oBAC/B,IAAI,CAAC,MAAM,CAAC,KAAK,CACb,qCAAqC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,EAC9E,MAAM,CAAC,MAAM,CAChB,CAAC;gBACN,CAAC;YACL,CAAC,CAAC,CAAC;QACP,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,+BAA+B,EAAE,KAAK,CAAC,CAAC;QAC9D,CAAC;IACL,CAAC;CACJ,CAAA;AAzKY,0CAAe;0BAAf,eAAe;IAD3B,IAAA,mBAAU,EAAC,EAAE,KAAK,EAAE,cAAK,CAAC,SAAS,EAAE,CAAC;qCAKI,4CAAgB;QACnB,8BAAa;QACL,+CAAqB;QAChB,0DAA0B;GAPlE,eAAe,CAyK3B","sourcesContent":["import { Injectable, Logger, Scope } from '@nestjs/common';\nimport { ModelMetadataHelperService } from 'src/helpers/model-metadata-helper.service';\nimport { lowerFirst } from 'src/helpers/string.helper';\nimport { SolidRegistry } from 'src/helpers/solid-registry';\nimport { DataSource, EntityMetadata, EntitySubscriberInterface, InsertEvent, RemoveEvent, UpdateEvent } from 'typeorm';\nimport { AuditQueuePayload } from 'src/interfaces';\nimport { RequestContextService } from 'src/services/request-context.service';\nimport { PublisherFactory } from 'src/services/queues/publisher-factory.service';\nconst AUDIT_BEFORE_SNAPSHOT = '__auditBeforeSnapshot';\n\n@Injectable({ scope: Scope.TRANSIENT })\nexport class AuditSubscriber implements EntitySubscriberInterface {\n    private readonly logger = new Logger(AuditSubscriber.name);\n    private dataSource: DataSource;\n    constructor(\n        private readonly publisherFactory: PublisherFactory<AuditQueuePayload>,\n        private readonly solidRegistry: SolidRegistry,\n        private readonly requestContextService: RequestContextService,\n        private readonly modelMetadataHelperService: ModelMetadataHelperService,\n    ) { }\n\n    bindToDataSource(dataSource: DataSource) {\n        this.dataSource = dataSource;\n        this.dataSource.subscribers.push(this);\n    }\n\n    // Per-transaction buffer (auto-GC when queryRunner is gone)\n    private perTxn = new WeakMap<any, AuditQueuePayload[]>();\n\n    private enqueue(event: { queryRunner: any }, payload: AuditQueuePayload) {\n        const qr = event.queryRunner;\n        const arr = this.perTxn.get(qr) ?? [];\n        arr.push(payload);\n        this.perTxn.set(qr, arr);\n    }\n\n    private shouldTrackAudit(metadata: EntityMetadata): boolean {\n        return this.solidRegistry.isAuditableModel(lowerFirst(metadata.name));\n    }\n\n    private activeUserId(): number | null {\n        return this.requestContextService.getActiveUser()?.sub ?? null;\n    }\n\n    async afterInsert(event: InsertEvent<any>) {\n        if (!this.shouldTrackAudit(event.metadata)) return;\n        this.enqueue(event, {\n            eventType: 'insert',\n            modelName: event.metadata.name,\n            entityId: event.entity?.id ?? null,\n            occurredAt: new Date().toISOString(),\n            after: event.entity ?? null,\n            userId: this.activeUserId(),\n        });\n    }\n\n    async afterUpdate(event: UpdateEvent<any>) {\n        if (!this.shouldTrackAudit(event.metadata)) return;\n        const entityId = event.entity?.id ?? event.databaseEntity?.id ?? (event as any).entityId ?? null;\n        let before = event.databaseEntity ?? null;\n        let after = event.entity ?? null;\n        const updatedColumnNames = (event.updatedColumns ?? []).map(c => c.propertyName);\n\n        const auditResult = await this.prepareManyToManyAuditUpdateSnapshot(event, entityId, updatedColumnNames);\n\n        if (auditResult) {\n            before = auditResult.before;\n            after = auditResult.after;\n        }\n\n        this.enqueue(event, {\n            eventType: 'update',\n            modelName: event.metadata.name,\n            entityId: entityId,\n            occurredAt: new Date().toISOString(),\n            after: after,\n            // databaseEntity is only populated when the entity was fetched first (save() path).\n            // QueryBuilder update() leaves this undefined; postAuditMessageOnUpdate guards for it.\n            before: before,\n            updatedColumnNames: updatedColumnNames,\n            userId: this.activeUserId(),\n        });\n    }\n\n    /**\n     * Resolves before/after snapshots for audit-enabled many-to-many relations\n     * and updates changed relation field names for audit tracking.\n     */\n    private async prepareManyToManyAuditUpdateSnapshot(event: UpdateEvent<any>, entityId: number | null, updatedColumnNames: string[]): Promise<{ before: any; after: any } | null> {\n\n        const auditRelationFields = (await this.modelMetadataHelperService.loadFieldHierarchy(lowerFirst(event.metadata.name))).filter(field =>\n            field.enableAuditTracking &&\n            field.type === 'relation' &&\n            field.relationType !== 'one-to-many'\n        );\n\n        if (!entityId || auditRelationFields.length === 0) {\n            return null;\n        }\n\n        const relations: Record<string, boolean> = {};\n\n        auditRelationFields.forEach(field => {\n            relations[field.name] = true;\n        });\n\n        const relationBefore = event.entity?.[AUDIT_BEFORE_SNAPSHOT] ?? null;\n\n        const relationAfter = await event.queryRunner.manager.getRepository(event.metadata.target as any).findOne({\n            where: { id: entityId } as any,\n            relations: relations as any,\n        });\n\n        if (relationBefore && relationAfter) {\n            auditRelationFields.forEach(field => {\n                const oldIds = Array.isArray(relationBefore[field.name])\n                    ? relationBefore[field.name].map(item => item.id).sort()\n                    : [];\n\n                const newIds = Array.isArray(relationAfter[field.name])\n                    ? relationAfter[field.name].map(item => item.id).sort()\n                    : [];\n\n                if ((oldIds.length !== newIds.length || JSON.stringify(oldIds) !== JSON.stringify(newIds))\n                    && !updatedColumnNames.includes(field.name)) {\n                    updatedColumnNames.push(field.name);\n                }\n            });\n        }\n        return {\n            before: relationBefore ?? event.databaseEntity ?? null,\n            after: relationAfter ?? event.entity ?? null,\n        };\n    }\n    async afterRemove(event: RemoveEvent<any>) {\n        if (!this.shouldTrackAudit(event.metadata)) return;\n        this.enqueue(event, {\n            eventType: 'delete',\n            modelName: event.metadata.name,\n            entityId: event.databaseEntity?.id ?? null,\n            occurredAt: new Date().toISOString(),\n            before: event.databaseEntity,\n            userId: this.activeUserId(),\n        });\n    }\n\n    // --------- transaction lifecycle ----------\n    async afterTransactionCommit(event: { queryRunner: any }) {\n        const batch = this.perTxn.get(event.queryRunner) ?? [];\n        this.perTxn.delete(event.queryRunner);\n\n        if (batch.length === 0) return;\n\n        await this.publishAuditBatch(batch);\n    }\n\n    afterTransactionRollback(event: { queryRunner: any }) {\n        // Drop buffered payloads; the write never happened.\n        this.perTxn.delete(event.queryRunner);\n    }\n\n    private async publishAuditBatch(batch: AuditQueuePayload[]) {\n        try {\n            // allSettled: publish in parallel; a single failure does not block the rest.\n            const results = await Promise.allSettled(\n                batch.map(payload => this.publisherFactory.publish({ payload }, 'ChatterQueuePublisher'))\n            );\n\n            results.forEach((result, i) => {\n                if (result.status === 'rejected') {\n                    this.logger.error(\n                        `Failed to publish audit event for ${batch[i].modelName}#${batch[i].entityId}`,\n                        result.reason,\n                    );\n                }\n            });\n        } catch (error) {\n            this.logger.error('Failed to publish audit batch', error);\n        }\n    }\n}\n"]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@solidxai/core",
-  "version": "0.1.12-beta.2",
+  "version": "0.1.12-beta.4",
   "description": "This module is a NestJS module containing all the required core providers required by a Solid application",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",

package/src/commands/seed.command.ts

@@ -1,6 +1,7 @@
 import { Logger } from '@nestjs/common';
 import { Command, CommandRunner, Option } from 'nest-commander';
 import { SolidRegistry } from 'src/helpers/solid-registry';
+import { ModuleMetadataSeederOptions } from 'src/interfaces';
 
 interface SeedCommandOptions {
   seeder?: string;
@@ -17,20 +18,33 @@ export class SeedCommand extends CommandRunner {
   }
 
   async run(passedParam: string[], options?: SeedCommandOptions): Promise<void> {
-    let parsedConf: any = null;
+    let parsedConf: ModuleMetadataSeederOptions | null = null;
     if (options?.modulesToSeed) {
       const modulesToSeed = options.modulesToSeed
         .split(',')
         .map((m) => m.trim())
         .filter(Boolean);
-      parsedConf = { modulesToSeed };
+      parsedConf = {
+        modulesToSeed,
+        pruneMetadata: true,
+        seedGlobalMetadata: true,
+      };
       this.logger.log(`Modules to seed: ${modulesToSeed.join(', ')}`);
     } else {
       this.logger.log('No --modules-to-seed flag provided. Running with default seeder behavior.');
+      parsedConf = {
+        modulesToSeed: null,
+        pruneMetadata: true,
+        seedGlobalMetadata: true,
+      };
     }
 
     if (options?.prune) {
-      parsedConf = parsedConf ?? {};
+      parsedConf = parsedConf ?? {
+        modulesToSeed: null,
+        pruneMetadata: true,
+        seedGlobalMetadata: true,
+      };
       parsedConf.pruneMetadata = true;
     }
 

package/src/constants/media-file-types.ts

@@ -0,0 +1,44 @@
+export type MediaCategory = 'image' | 'audio' | 'video' | 'file' | 'pdf';
+
+const IMAGE_EXTENSIONS = ['png', 'jpg', 'jpeg', 'webp', 'gif', 'bmp', 'tiff', 'heic', 'heif'];
+const AUDIO_EXTENSIONS = ['mp3', 'wav', 'ogg', 'aac', 'm4a', 'flac', 'webm'];
+const VIDEO_EXTENSIONS = ['mp4', 'mov', 'avi', 'mkv', 'mpeg', 'mpg', '3gp', '3g2', 'webm', 'ogg'];
+const DOCUMENT_EXTENSIONS = ['txt', 'md', 'csv', 'json', 'doc', 'docx', 'xls', 'xlsx', 'ppt', 'pptx', 'zip', 'rar', '7z'];
+const PDF_EXTENSION = 'pdf';
+
+/**
+ * Extensions that must never be accepted as media uploads, regardless of declared mimetype or
+ * admin-configured mediaTypes allowlist. Checked before any other resolution so a spoofed
+ * Content-Type (e.g. application/octet-stream on an .html file) can't bypass this.
+ */
+export const DANGEROUS_EXTENSIONS = new Set([
+    'html', 'htm', 'xhtml', 'svg', 'xml',
+    'js', 'mjs', 'php', 'phtml', 'jsp', 'asp', 'aspx',
+    'exe', 'sh', 'bat', 'cmd', 'ps1', 'jar', 'dll',
+]);
+
+/**
+ * Single source of truth for extension -> coarse media category. Shared by upload-time
+ * validation (MediaFieldCrudManager) and serve-time header hardening (ServeStaticModule), so
+ * both agree on which extensions belong to which category and neither drifts out of sync.
+ * webm/ogg are shared between AUDIO_EXTENSIONS and VIDEO_EXTENSIONS - last one wins here, they
+ * default to 'video' since that's the more common upload case.
+ */
+export const EXT_TO_MEDIA_TYPE: Record<string, MediaCategory> = {
+    ...Object.fromEntries(IMAGE_EXTENSIONS.map((ext) => [ext, 'image' as const])),
+    ...Object.fromEntries(AUDIO_EXTENSIONS.map((ext) => [ext, 'audio' as const])),
+    ...Object.fromEntries(VIDEO_EXTENSIONS.map((ext) => [ext, 'video' as const])),
+    ...Object.fromEntries(DOCUMENT_EXTENSIONS.map((ext) => [ext, 'file' as const])),
+    [PDF_EXTENSION]: 'pdf',
+};
+
+/**
+ * Extensions safe to serve inline with their natural Content-Type; everything else served from
+ * media-files-storage is forced to application/octet-stream + Content-Disposition: attachment.
+ */
+export const INLINE_SAFE_EXTENSIONS = new Set<string>([
+    ...IMAGE_EXTENSIONS,
+    ...AUDIO_EXTENSIONS,
+    ...VIDEO_EXTENSIONS,
+    PDF_EXTENSION,
+]);

package/src/controllers/media.controller.ts

@@ -1,10 +1,14 @@
-import { Body, Controller, Delete, Get, Param, Patch, Post, Put, Query, UploadedFiles, UseInterceptors } from '@nestjs/common';
+import { Body, Controller, Delete, Get, Param, Patch, Post, Put, Query, Res, UploadedFiles, UseInterceptors } from '@nestjs/common';
 import { AnyFilesInterceptor } from "@nestjs/platform-express";
 import { ApiBearerAuth, ApiQuery, ApiTags } from '@nestjs/swagger';
-import { Public } from 'src/decorators/public.decorator';
+import { Auth } from 'src/decorators/auth.decorator';
+import { AuthType } from 'src/enums/auth-type.enum';
 import { CreateMediaDto } from 'src/dtos/create-media.dto';
+import { SolidRequestContextDecorator } from 'src/decorators/solid-request-context.decorator';
+import { SolidRequestContextDto } from 'src/dtos/solid-request-context.dto';
 import { UpdateMediaDto } from 'src/dtos/update-media.dto';
 import { MediaService } from 'src/services/media.service';
+import { Response } from 'express';
 
 enum ShowSoftDeleted {
   INCLUSIVE = "inclusive",
@@ -21,30 +25,30 @@ export class MediaController {
   @ApiBearerAuth("jwt")
   @Post()
   @UseInterceptors(AnyFilesInterceptor())
-  create(@Body() createDto: CreateMediaDto, @UploadedFiles() files: Array<Express.Multer.File>) {
-    return this.service.create(createDto, files);
+  create(@Body() createDto: CreateMediaDto, @UploadedFiles() files: Array<Express.Multer.File>, @SolidRequestContextDecorator() solidRequestContext: SolidRequestContextDto) {
+    return this.service.create(createDto, files, solidRequestContext);
   }
 
   @ApiBearerAuth("jwt")
   @Post('/bulk')
   @UseInterceptors(AnyFilesInterceptor())
-  insertMany(@Body() createDtos: CreateMediaDto[], @UploadedFiles() filesArray: Express.Multer.File[][] = []) {
-    return this.service.insertMany(createDtos, filesArray);
+  insertMany(@Body() createDtos: CreateMediaDto[], @UploadedFiles() filesArray: Express.Multer.File[][] = [], @SolidRequestContextDecorator() solidRequestContext: SolidRequestContextDto) {
+    return this.service.insertMany(createDtos, filesArray, solidRequestContext);
   }
 
 
   @ApiBearerAuth("jwt")
   @Put(':id')
   @UseInterceptors(AnyFilesInterceptor())
-  update(@Param('id') id: number, @Body() updateDto: UpdateMediaDto, @UploadedFiles() files: Array<Express.Multer.File>) {
-    return this.service.update(id, updateDto, files);
+  update(@Param('id') id: number, @Body() updateDto: UpdateMediaDto, @UploadedFiles() files: Array<Express.Multer.File>, @SolidRequestContextDecorator() solidRequestContext: SolidRequestContextDto) {
+    return this.service.update(id, updateDto, files, false, solidRequestContext);
   }
 
   @ApiBearerAuth("jwt")
   @Patch(':id')
   @UseInterceptors(AnyFilesInterceptor())
-  partialUpdate(@Param('id') id: number, @Body() updateDto: UpdateMediaDto, @UploadedFiles() files: Array<Express.Multer.File>) {
-    return this.service.update(id, updateDto, files, true);
+  partialUpdate(@Param('id') id: number, @Body() updateDto: UpdateMediaDto, @UploadedFiles() files: Array<Express.Multer.File>, @SolidRequestContextDecorator() solidRequestContext: SolidRequestContextDto) {
+    return this.service.update(id, updateDto, files, true, solidRequestContext);
   }
 
   // @Public()
@@ -52,22 +56,22 @@ export class MediaController {
   @ApiBearerAuth("jwt")
   @Post('/upload')
   @UseInterceptors(AnyFilesInterceptor())
-  upload(@UploadedFiles() files: Array<Express.Multer.File>, @Body() createDto: CreateMediaDto, ) {
+  upload(@UploadedFiles() files: Array<Express.Multer.File>, @Body() createDto: CreateMediaDto, @SolidRequestContextDecorator() solidRequestContext: SolidRequestContextDto) {
       // this.logger.log(`Creating a new model: ${JSON.stringify(createDto)}`);
-      return this.service.upload(createDto, files);
+      return this.service.upload(createDto, files, solidRequestContext);
   }
 
 
   @ApiBearerAuth("jwt")
   @Post('/bulk-recover')
-  async recoverMany(@Body() ids: number[]) {
-    return this.service.recoverMany(ids);
+  async recoverMany(@Body() ids: number[], @SolidRequestContextDecorator() solidRequestContext: SolidRequestContextDto) {
+    return this.service.recoverMany(ids, solidRequestContext);
   }
 
   @ApiBearerAuth("jwt")
   @Get('/recover/:id')
-  async recover(@Param('id') id: number) {
-    return this.service.recover(id);
+  async recover(@Param('id') id: number, @SolidRequestContextDecorator() solidRequestContext: SolidRequestContextDto) {
+    return this.service.recover(id, solidRequestContext);
   }
     
   @ApiBearerAuth("jwt")
@@ -81,26 +85,42 @@ export class MediaController {
   @ApiQuery({ name: 'populateMedia', required: false, type: Array })
   @ApiQuery({ name: 'filters', required: false, type: Array })
   @Get()
-  async findMany(@Query() query: any) { 
-    return this.service.find(query);  
+  async findMany(@Query() query: any, @SolidRequestContextDecorator() solidRequestContext: SolidRequestContextDto) {
+    return this.service.find(query, solidRequestContext);
+  }
+
+  @Auth(AuthType.MediaSignedUrl)
+  @ApiQuery({ name: 'token', required: true, type: String, description: "Short-lived signed token obtained from a private Media record's URL - not entered manually." })
+  @ApiQuery({ name: 'disposition', required: false, enum: ['inline', 'attachment'], description: "'inline' (default) renders/previews in the browser, matching public media. Pass 'attachment' to force a browser download (e.g. from a download button)." })
+  @Get(':id/download')
+  async download(@Param('id') id: string, @Query('disposition') disposition: string, @Res() res: Response, @SolidRequestContextDecorator() solidRequestContext: SolidRequestContextDto) {
+    const media = await this.service.findOne(+id, {}, solidRequestContext);
+    const { stream, fileName, mimeType } = await this.service.fileDownloadStream(media);
+
+    const contentDisposition = disposition === 'attachment' ? 'attachment' : 'inline';
+    res.setHeader('Content-Disposition', `${contentDisposition}; filename="${fileName}"`);
+    res.setHeader('Content-Type', mimeType);
+    res.setHeader('Cross-Origin-Resource-Policy', 'cross-origin');
+    res.setHeader('Access-Control-Expose-Headers', 'Content-Disposition, Content-Type');
+    stream.pipe(res);
   }
 
   @ApiBearerAuth("jwt")
   @Get(':id')
-  async findOne(@Param('id') id: string, @Query() query: any) {
-    return this.service.findOne(+id, query);
+  async findOne(@Param('id') id: string, @Query() query: any, @SolidRequestContextDecorator() solidRequestContext: SolidRequestContextDto) {
+    return this.service.findOne(+id, query, solidRequestContext);
   }
 
   @ApiBearerAuth("jwt")
   @Delete('/bulk')
-  async deleteMany(@Body() ids: number[]) {
-    return this.service.deleteMany(ids);
+  async deleteMany(@Body() ids: number[], @SolidRequestContextDecorator() solidRequestContext: SolidRequestContextDto) {
+    return this.service.deleteMany(ids, solidRequestContext);
   }
 
   @ApiBearerAuth("jwt")
   @Delete(':id')
-  async delete(@Param('id') id: number) {
-    return this.service.delete(id);
+  async delete(@Param('id') id: number, @SolidRequestContextDecorator() solidRequestContext: SolidRequestContextDto) {
+    return this.service.delete(id, solidRequestContext);
   }
 
 

package/src/dtos/create-media.dto.ts

@@ -1,5 +1,5 @@
-import { ApiProperty } from '@nestjs/swagger';
-import { IsInt } from 'class-validator';
+import { ApiProperty, ApiPropertyOptional } from '@nestjs/swagger';
+import { IsBoolean, IsInt } from 'class-validator';
 import { IsNotEmpty, IsString, IsOptional } from 'class-validator';
 export class CreateMediaDto {
 @IsNotEmpty()
@@ -7,6 +7,11 @@ export class CreateMediaDto {
 @ApiProperty()
 entityId: number;
 
+@IsOptional()
+@IsBoolean()
+@ApiPropertyOptional({ default: true })
+isPublic?: boolean;
+
 @IsOptional()
 @IsString()
 @ApiProperty()
@@ -56,4 +61,4 @@ fieldMetadataId: number;
 @IsOptional()
 @ApiProperty()
 fieldMetadataUserKey: string;
-}
+}

package/src/dtos/create-role-metadata.dto.ts

@@ -8,6 +8,8 @@ import { ApiProperty } from '@nestjs/swagger';
 
 export const ADMIN_ROLE_NAME = 'Admin';
 export const INTERNAL_ROLE_NAME = 'Internal User';
+export const ALLOWED_TO_IMPORT_ROLE_NAME = 'Allowed To Import';
+export const ALLOWED_TO_EXPORT_ROLE_NAME = 'Allowed To Export';
 export const PUBLIC_ROLE_NAME = 'Public';
 
 export class CreateRoleMetadataDto {

package/src/dtos/update-media.dto.ts

@@ -1,5 +1,5 @@
-import { IsInt,IsOptional, IsNotEmpty, IsString } from 'class-validator';
-import { ApiProperty } from '@nestjs/swagger';
+import { IsBoolean, IsInt,IsOptional, IsNotEmpty, IsString } from 'class-validator';
+import { ApiProperty, ApiPropertyOptional } from '@nestjs/swagger';
 export class UpdateMediaDto {
     @IsOptional()
     @IsInt()
@@ -11,6 +11,11 @@ export class UpdateMediaDto {
 @ApiProperty()
 entityId: number;
 
+@IsOptional()
+@IsBoolean()
+@ApiPropertyOptional({ default: true })
+isPublic?: boolean;
+
 @IsOptional()
 @IsString()
 @ApiProperty()
@@ -60,4 +65,4 @@ fieldMetadataId: number;
 @IsOptional()
 @ApiProperty()
 fieldMetadataUserKey: string;
-}
+}

package/src/entities/media.entity.ts

@@ -9,6 +9,9 @@ export class Media extends CommonEntity {
     @Column({ type: "integer" })
     entityId: number;
 
+    @Column({ name: "is_public", default: true })
+    isPublic: boolean = true;
+
     @Column({ type: "varchar", nullable: true })
     relativeUri: string;
 
@@ -36,4 +39,4 @@ export class Media extends CommonEntity {
     @ManyToOne(() => FieldMetadata, { nullable: false })
     @JoinColumn()
     fieldMetadata: FieldMetadata;
-}
+}

package/src/enums/auth-type.enum.ts

@@ -2,4 +2,5 @@ export enum AuthType {
     Bearer,
     ApiKey,
     None,
+    MediaSignedUrl,
 }

package/src/guards/authentication.guard.ts

@@ -9,6 +9,7 @@ import { AUTH_TYPE_KEY } from '../decorators/auth.decorator';
 import { AuthType } from '../enums/auth-type.enum';
 import { AccessTokenGuard } from './access-token.guard';
 import { ApiKeyGuard } from './api-key.guard';
+import { MediaSignedUrlGuard } from './media-signed-url.guard';
 import { IS_PUBLIC_KEY } from '../decorators/public.decorator';
 import { PermissionMetadataService } from '../services/permission-metadata.service';
 import { ClsService } from 'nestjs-cls';
@@ -22,12 +23,14 @@ export class AuthenticationGuard implements CanActivate {
       [AuthType.Bearer]: this.accessTokenGuard,
       [AuthType.ApiKey]: this.apiKeyGuard,
       [AuthType.None]: { canActivate: () => true },
+      [AuthType.MediaSignedUrl]: this.mediaSignedUrlGuard,
     };
 
   constructor(
     private readonly reflector: Reflector,
     private readonly accessTokenGuard: AccessTokenGuard,
     private readonly apiKeyGuard: ApiKeyGuard,
+    private readonly mediaSignedUrlGuard: MediaSignedUrlGuard,
     private readonly permissionService: PermissionMetadataService,
     private readonly cls: ClsService,
   ) { }

package/src/guards/media-signed-url.guard.ts

@@ -0,0 +1,41 @@
+import { CanActivate, ExecutionContext, Injectable, UnauthorizedException } from '@nestjs/common';
+import { Request } from 'express';
+import { MediaDownloadUrlService } from 'src/services/media-download-url.service';
+
+@Injectable()
+export class MediaSignedUrlGuard implements CanActivate {
+  constructor(private readonly mediaDownloadUrlService: MediaDownloadUrlService) { }
+
+  async canActivate(context: ExecutionContext): Promise<boolean> {
+    const request = context.switchToHttp().getRequest<Request>();
+    const token = this.extractTokenFromQuery(request);
+    if (!token) {
+      throw new UnauthorizedException();
+    }
+
+    let payload: { mediaId: number };
+    try {
+      payload = await this.mediaDownloadUrlService.verifyDownloadToken(token);
+    } catch {
+      throw new UnauthorizedException();
+    }
+
+    const routeMediaId = Number(request.params?.id);
+    if (!Number.isFinite(routeMediaId) || payload.mediaId !== routeMediaId) {
+      throw new UnauthorizedException();
+    }
+
+    // No REQUEST_USER_KEY is ever set for token auth (only Bearer/ApiKey guards set it), so
+    // the sibling global APP_GUARD PermissionsGuard would otherwise reject this request for
+    // lack of a per-user permission grant. Flag it the same way AuthenticationGuard flags
+    // Public-role-exempt requests - token possession IS the full authorization decision here.
+    request['isListedInPublicRole'] = true;
+
+    return true;
+  }
+
+  private extractTokenFromQuery(request: Request): string | undefined {
+    const token = request.query?.token;
+    return typeof token === 'string' ? token : undefined;
+  }
+}

package/src/helpers/field-crud-managers/MediaFieldCrudManager.ts

@@ -1,4 +1,5 @@
 import { FieldCrudManager, ValidationError } from "src/interfaces";
+import { DANGEROUS_EXTENSIONS, EXT_TO_MEDIA_TYPE, MediaCategory } from "src/constants/media-file-types";
 
 export enum SolidMediaType {
     mediaSingle = 'mediaSingle',
@@ -14,7 +15,7 @@ export interface MediaFieldOptions {
     isUpdate: boolean | undefined | null;
 }
 
-type MediaType = 'image' | 'audio' | 'video' | 'file' | 'pdf';
+type MediaType = MediaCategory;
 
 const MIME_TO_MEDIA_TYPE: Record<string, MediaType> = {
     // Images
@@ -25,7 +26,6 @@ const MIME_TO_MEDIA_TYPE: Record<string, MediaType> = {
     'image/gif': 'image',
     'image/bmp': 'image',
     'image/tiff': 'image',
-    'image/svg+xml': 'image',
     'image/heic': 'image',
     'image/heif': 'image',
 
@@ -72,35 +72,23 @@ const MIME_TO_MEDIA_TYPE: Record<string, MediaType> = {
     'application/x-zip-compressed': 'file',
     'application/x-rar-compressed': 'file',
     'application/x-7z-compressed': 'file',
-
-    // Common binary fallback category
-    'application/octet-stream': 'file',
 };
 
-const EXT_TO_MEDIA_TYPE: Record<string, MediaType> = {
-    // Images
-    png: 'image', jpg: 'image', jpeg: 'image', webp: 'image', gif: 'image', bmp: 'image', tiff: 'image', svg: 'image', heic: 'image', heif: 'image',
-
-    // Audio
-    mp3: 'audio', wav: 'audio', ogg: 'audio', aac: 'audio', m4a: 'audio', flac: 'audio',
-
-    // Video
-    mp4: 'video', mov: 'video', avi: 'video', mkv: 'video', mpeg: 'video', mpg: 'video', '3gp': 'video', '3g2': 'video',
-
-    // Files
-    pdf: 'file', txt: 'file', md: 'file', csv: 'file', json: 'file',
-    doc: 'file', docx: 'file', xls: 'file', xlsx: 'file', ppt: 'file', pptx: 'file',
-    zip: 'file', rar: 'file', '7z': 'file',
-};
-
-
 export class MediaFieldCrudManager implements FieldCrudManager {
 
     constructor(private readonly options: MediaFieldOptions) {
     }
 
     private resolveMediaType(mimetype?: string, filename?: string): MediaType | null {
+        const ext = (filename || '').split('.').pop()?.toLowerCase();
+        if (ext && DANGEROUS_EXTENSIONS.has(ext)) {
+            return null;
+        }
+
         const mt = (mimetype || '').toLowerCase().trim();
+        if (mt === 'image/svg+xml' || mt === 'text/html' || mt === 'application/xhtml+xml') {
+            return null;
+        }
         if (mt && MIME_TO_MEDIA_TYPE[mt]) {
             return MIME_TO_MEDIA_TYPE[mt];
         }
@@ -110,8 +98,8 @@ export class MediaFieldCrudManager implements FieldCrudManager {
         if (mt.startsWith('audio/')) return 'audio';
         if (mt.startsWith('video/')) return 'video';
 
-        // Fallback to extension if provided
-        const ext = (filename || '').split('.').pop()?.toLowerCase();
+        // Fallback to extension if provided (also covers generic/unrecognized
+        // mimetypes such as application/octet-stream).
         if (ext && EXT_TO_MEDIA_TYPE[ext]) {
             return EXT_TO_MEDIA_TYPE[ext];
         }

package/src/interfaces.ts

@@ -228,6 +228,8 @@ export interface ISolidDatabaseModule {
 
 export enum EventType {
   USER_REGISTERED = 'user.registered',
+  MODULE_METADATA_SEEDER_STARTED = 'module-metadata-seeder.started',
+  MODULE_METADATA_SEEDER_FINISHED = 'module-metadata-seeder.finished',
 }
 
 export class EventDetails<T> {
@@ -237,6 +239,24 @@ export class EventDetails<T> {
   ) { }
 }
 
+export interface ModuleMetadataSeederOptions {
+  modulesToSeed: string[] | null;
+  pruneMetadata: boolean;
+  seedGlobalMetadata: boolean;
+}
+
+export interface ModuleMetadataSeederEventPayload {
+  seedRunId: string;
+  options: ModuleMetadataSeederOptions;
+  startedAt: string;
+  finishedAt?: string;
+  durationMs?: number;
+  success?: boolean;
+  seededModuleNames?: string[];
+  currentStep?: string;
+  errorMessage?: string;
+}
+
 export interface IExtensionUserCreationProvider<T extends User = User, TDto extends CreateUserDto = CreateUserDto> {
   readonly repo: Repository<T>;
   buildExtensionEntity(dto: TDto): Promise<T>;

package/src/repository/media.repository.ts

@@ -7,6 +7,7 @@ import { MediaStorageProviderMetadataRepository } from './media-storage-provider
 import { ModelMetadataRepository } from './model-metadata.repository';
 import { SecurityRuleRepository } from './security-rule.repository';
 import { SolidBaseRepository } from './solid-base.repository';
+import { resolveStoredMediaIsPublic } from 'src/services/media-storage.utils';
 
 @Injectable()
 export class MediaRepository extends SolidBaseRepository<Media> {
@@ -44,6 +45,7 @@ export class MediaRepository extends SolidBaseRepository<Media> {
                 id: createDto['mediaStorageProviderMetadataId']
             },
         });
+        createDto['isPublic'] = resolveStoredMediaIsPublic(createDto['isPublic'], createDto['mediaStorageProviderMetadata']);
         const media = this.create(createDto);
         return this.save(media);
     }