@solidxai/core 0.1.12-beta.2 → 0.1.12-beta.4

package/src/seeders/module-metadata-seeder.service.ts

@@ -1,4 +1,5 @@
 import { forwardRef, Inject, Injectable, Logger } from '@nestjs/common';
+import { EventEmitter2 } from '@nestjs/event-emitter';
 import * as fs from 'fs';
 import * as os from 'os';
 import * as path from 'path';
@@ -39,7 +40,12 @@ import { User } from '../entities/user.entity';
 import { MENU_ROLE_JOIN_TABLE_NAME, MENU_ROLE_JOIN_TABLE_NAME_MENU_COL, MENU_ROLE_JOIN_TABLE_NAME_ROLE_COL } from '../dtos/create-menu-item-metadata.dto';
 import { DEFAULT_SA_PASSWORD } from '../dtos/create-user.dto';
 import { SignUpDto } from '../dtos/sign-up.dto';
-import { ADMIN_ROLE_NAME, CreateRoleMetadataDto } from 'src/dtos/create-role-metadata.dto';
+import {
+    ADMIN_ROLE_NAME,
+    ALLOWED_TO_EXPORT_ROLE_NAME,
+    ALLOWED_TO_IMPORT_ROLE_NAME,
+    CreateRoleMetadataDto,
+} from 'src/dtos/create-role-metadata.dto';
 import { CreateSavedFiltersDto } from 'src/dtos/create-saved-filters.dto';
 import { CreateScheduledJobDto } from 'src/dtos/create-scheduled-job.dto';
 import { CreateLocaleDto } from 'src/dtos/create-locale.dto';
@@ -60,6 +66,7 @@ import { FieldMetadata } from 'src/entities/field-metadata.entity';
 import { ModelMetadata } from 'src/entities/model-metadata.entity';
 import { PermissionMetadata } from 'src/entities/permission-metadata.entity';
 import { ViewMetadata } from 'src/entities/view-metadata.entity';
+import { EventDetails, EventType, ModuleMetadataSeederEventPayload } from 'src/interfaces';
 
 /**
  * Central metadata seeder for both solid-core and consuming modules.
@@ -79,6 +86,11 @@ import { ViewMetadata } from 'src/entities/view-metadata.entity';
  */
 @Injectable()
 export class ModuleMetadataSeederService {
+    private readonly adminPermissionExclusionPrefixes = [
+        'ImportTransactionController.',
+        'ExportTemplateController.',
+        'ExportTransactionController.',
+    ];
     private readonly logger = new Logger(ModuleMetadataSeederService.name);
     // Stable tag used on all verbose seed timing logs so runs can be grepped quickly.
     private readonly seedTimingTag = 'SEED_TIMING';
@@ -98,6 +110,7 @@ export class ModuleMetadataSeederService {
         private readonly moduleMetadataService: ModuleMetadataService,
         @Inject(forwardRef(() => ModelMetadataService))
         private readonly modelMetadataService: ModelMetadataService,
+        private readonly eventEmitter: EventEmitter2,
         private readonly fieldMetadataService: FieldMetadataService,
         private readonly mediaStorageProviderMetadataService: MediaStorageProviderMetadataService,
         private readonly roleService: RoleMetadataService,
@@ -131,7 +144,26 @@ export class ModuleMetadataSeederService {
         let currentModule = 'global';
         let currentStep = 'bootstrap';
         let modulesToSeed: string[] | null = null;
+        const requestedModulesToSeed = Array.isArray(conf?.modulesToSeed) ? [...conf.modulesToSeed] : null;
         const shouldSeedGlobalMetadata = conf?.seedGlobalMetadata !== false;
+        const seedOptions: ModuleMetadataSeederEventPayload['options'] = {
+            modulesToSeed: requestedModulesToSeed,
+            pruneMetadata: Boolean(conf?.pruneMetadata),
+            seedGlobalMetadata: shouldSeedGlobalMetadata,
+        };
+        const seedRunId = uuidv4();
+        const startedAt = new Date();
+        const seededModuleNames: string[] = [];
+
+        this.emitModuleMetadataSeederEvent(
+            EventType.MODULE_METADATA_SEEDER_STARTED,
+            {
+                seedRunId,
+                options: seedOptions,
+                startedAt: startedAt.toISOString(),
+                currentStep,
+            },
+        );
 
         try {
             this.enablePruning = Boolean(conf?.pruneMetadata);
@@ -190,6 +222,7 @@ export class ModuleMetadataSeederService {
 
                     console.log(`▶ Seeding Metadata for Module: ${moduleMetadata.name}`);
                     this.logger.log(`Seeding Metadata for Module: ${moduleMetadata.name}`);
+                    seededModuleNames.push(moduleMetadata.name);
 
                     await this.timeOperation('module-total', async () => {
                         currentStep = 'seedMediaStorageProviders';
@@ -283,10 +316,37 @@ export class ModuleMetadataSeederService {
             // Add a console log indicating seeding is finished. This needs to be console.log so that it looks proper when this code is run via CLI.
             console.log(`✔ Seeding completed.`);
             //this.logger.log(`All Seeders finished`);
+            await this.emitModuleMetadataSeederFinishedEvent(
+                EventType.MODULE_METADATA_SEEDER_FINISHED,
+                {
+                    seedRunId,
+                    options: seedOptions,
+                    startedAt: startedAt.toISOString(),
+                    finishedAt: new Date().toISOString(),
+                    durationMs: Date.now() - startedAt.getTime(),
+                    success: true,
+                    seededModuleNames,
+                    currentStep,
+                },
+            );
 
             //FIXME: Handle displaying the created users credentials in a better way.
             // this.logger.log(`Newly created username is: ${usersDetail?.length > 0 ? usersDetail[0]?.username : ''} and password is ${usersDetail?.length > 0 ? usersDetail[0]?.password : ''}`);
         } catch (error: any) {
+            await this.emitModuleMetadataSeederFinishedEvent(
+                EventType.MODULE_METADATA_SEEDER_FINISHED,
+                {
+                    seedRunId,
+                    options: seedOptions,
+                    startedAt: startedAt.toISOString(),
+                    finishedAt: new Date().toISOString(),
+                    durationMs: Date.now() - startedAt.getTime(),
+                    success: false,
+                    seededModuleNames,
+                    currentStep,
+                    errorMessage: error?.message,
+                },
+            );
             this.logSeedFailureForCli(error, {
                 moduleName: currentModule,
                 step: currentStep,
@@ -297,6 +357,31 @@ export class ModuleMetadataSeederService {
         }
     }
 
+    private emitModuleMetadataSeederEvent(
+        type: EventType.MODULE_METADATA_SEEDER_STARTED | EventType.MODULE_METADATA_SEEDER_FINISHED,
+        payload: ModuleMetadataSeederEventPayload,
+    ): void {
+        try {
+            this.eventEmitter.emit(type, new EventDetails<ModuleMetadataSeederEventPayload>(type, payload));
+        } catch (error: any) {
+            this.logger.warn(`Failed to emit ${type}: ${error?.message ?? error}`);
+        }
+    }
+
+    private async emitModuleMetadataSeederFinishedEvent(
+        type: EventType.MODULE_METADATA_SEEDER_FINISHED,
+        payload: ModuleMetadataSeederEventPayload,
+    ): Promise<void> {
+        try {
+            console.log(`▶ Running post-seed hooks for runId=${payload.seedRunId}`);
+            await this.eventEmitter.emitAsync(type, new EventDetails<ModuleMetadataSeederEventPayload>(type, payload));
+            console.log(`✔ Post-seed hooks completed for runId=${payload.seedRunId}`);
+        } catch (error: any) {
+            console.log(`✖ Post-seed hooks failed for runId=${payload.seedRunId}: ${error?.message ?? error}`);
+            this.logger.warn(`Failed to emit ${type}: ${error?.message ?? error}`);
+        }
+    }
+
     private buildTimingPrefix(itemTag: string, options?: { moduleName?: string; component?: string; serviceCall?: string }): string {
         const parts = [`[${this.seedTimingTag}]`, `[ITEM:${itemTag}]`];
         if (options?.moduleName) {
@@ -498,10 +583,17 @@ export class ModuleMetadataSeederService {
 
     private async setupDefaultRolesWithPermissions() {
         this.logger.debug(`About to add all permissions to the Admin role`);
-        await this.timeOperation('role-add-all-permissions', () => this.roleService.addAllPermissionsToRole(ADMIN_ROLE_NAME), {
+        await this.timeOperation('role-add-all-permissions', () => this.roleService.addAllPermissionsToRoleExceptPrefixes(ADMIN_ROLE_NAME, this.adminPermissionExclusionPrefixes), {
+            moduleName: 'global',
+            component: 'default-roles',
+            serviceCall: 'roleService.addAllPermissionsToRoleExceptPrefixes',
+            details: `role=${ADMIN_ROLE_NAME}`,
+        });
+
+        await this.timeOperation('attach-capability-roles-to-admin-users', () => this.attachCapabilityRolesToAdminUsers(), {
             moduleName: 'global',
             component: 'default-roles',
-            serviceCall: 'roleService.addAllPermissionsToRole',
+            serviceCall: 'attachCapabilityRolesToAdminUsers',
             details: `role=${ADMIN_ROLE_NAME}`,
         });
 
@@ -514,6 +606,20 @@ export class ModuleMetadataSeederService {
         // await this.roleService.addPermissionToRole(PUBLIC_ROLE_NAME, ['SettingController.wrapSettings', 'AuthenticationController.logout']);
     }
 
+    private async attachCapabilityRolesToAdminUsers(): Promise<void> {
+        const adminUsers = await this.userService.findUsersByRole(ADMIN_ROLE_NAME, {});
+        if (!adminUsers?.length) {
+            return;
+        }
+
+        const capabilityRoles = [ALLOWED_TO_IMPORT_ROLE_NAME, ALLOWED_TO_EXPORT_ROLE_NAME];
+        for (const adminUser of adminUsers) {
+            for (const capabilityRole of capabilityRoles) {
+                await this.userService.addRoleToUser(adminUser.username, capabilityRole);
+            }
+        }
+    }
+
     private async seedSecurityRules(overallMetadata: any): Promise<{ pruned: number; upserted: number }> {
         const securityRules = this.getSeedArray<CreateSecurityRuleDto>(overallMetadata?.securityRules);
         const pruned = this.enablePruning ? await this.timeOperation('prune-security-rules', () => this.pruneSecurityRules(securityRules, overallMetadata?.moduleMetadata?.name), {

package/src/seeders/permission-metadata-seeder.service.ts

@@ -6,6 +6,11 @@ import { RoleMetadataService } from '../services/role-metadata.service';
 @Injectable()
 export class PermissionMetadataSeederService {
   private readonly logger = new Logger(PermissionMetadataSeederService.name);
+  private readonly adminPermissionExclusionPrefixes = [
+    'ImportTransactionController.',
+    'ExportTemplateController.',
+    'ExportTransactionController.',
+  ];
 
   constructor(
     // @InjectRepository(PermissionMetadata)
@@ -58,6 +63,6 @@ export class PermissionMetadataSeederService {
     }
 
     // Associate the Admin role with all existing permissions. 
-    await this.roleService.addAllPermissionsToRole("Admin");
+    await this.roleService.addAllPermissionsToRoleExceptPrefixes("Admin", this.adminPermissionExclusionPrefixes);
   }
 }

package/src/seeders/seed-data/solid-core-metadata.json

@@ -1704,6 +1704,18 @@
             "columnName": "original_file_name",
             "isSystem": true
           },
+          {
+            "name": "isPublic",
+            "displayName": "Is Public",
+            "type": "boolean",
+            "required": false,
+            "unique": false,
+            "index": false,
+            "private": false,
+            "encrypt": false,
+            "columnName": "is_public",
+            "isSystem": true
+          },
           {
             "name": "modelMetadata",
             "displayName": "Model Metadata",
@@ -5306,6 +5318,9 @@
         "FieldMetadataController.getSelectionDynamicValues",
         "FieldMetadataController.getSelectionDynamicValue",
         "FieldMetadataController.findFieldDefaultMetaData",
+        "MediaController.findMany",
+        "MediaController.findOne",
+        "MediaController.download",
         "SavedFiltersController.delete",
         "SavedFiltersController.deleteMany",
         "SavedFiltersController.findOne",
@@ -5321,14 +5336,6 @@
         "ChatterMessageController.findMany",
         "ChatterMessageController.markCompleted",
         "ChatterMessageController.updateCustomNoteMessage",
-        "ImportTransactionController.getImportTemplate",
-        "ImportTransactionController.getImportInstructions",
-        "ImportTransactionController.getImportMappingInfo",
-        "ImportTransactionController.startImportSync",
-        "ImportTransactionController.startImportAsync",
-        "ImportTransactionController.exportFailedImportedImports",
-        "ExportTemplateController.startExportSync",
-        "ExportTemplateController.startExportAsync",
         "ListOfValuesController.findMany",
         "ListOfValuesController.findOne",
         "SettingController.getAllSettings",
@@ -5348,6 +5355,31 @@
         "agent:invoke"
       ]
     },
+    {
+      "name": "Allowed To Import",
+      "permissions": [
+        "ImportTransactionController.create",
+        "ImportTransactionController.delete",
+        "ImportTransactionController.deleteMany",
+        "ImportTransactionController.getImportTemplate",
+        "ImportTransactionController.getImportInstructions",
+        "ImportTransactionController.getImportMappingInfo",
+        "ImportTransactionController.partialUpdate",
+        "ImportTransactionController.startImportSync",
+        "ImportTransactionController.startImportAsync",
+        "ImportTransactionController.exportFailedImportedImports"
+      ]
+    },
+    {
+      "name": "Allowed To Export",
+      "permissions": [
+        "ExportTemplateController.create",
+        "ExportTemplateController.delete",
+        "ExportTemplateController.findMany",
+        "ExportTemplateController.startExportSync",
+        "ExportTemplateController.startExportAsync"
+      ]
+    },
     {
       "name": "Public",
       "permissions": [
@@ -8607,16 +8639,15 @@
                             "attrs": {
                               "name": "roles",
                               "widget": "checkbox",
-                              "inlineCreateAutoSave": "true",
+                              "inlineCreateAutoSave": "false",
                               "renderModeCheckboxPreprocessor": "MenuItemMetadataRolesFormFieldPreprocessor",
-                              "inlineCreate": "true",
+                              "inlineCreate": "false",
                               "inlineCreateLayout": {
                                 "type": "form",
                                 "attrs": {
                                   "name": "form-1",
                                   "label": "User",
-                                  "className": "grid",
-                                  "width": "20vw"
+                                  "className": "grid"
                                 },
                                 "children": [
                                   {
@@ -8758,6 +8789,13 @@
               "sortable": false
             }
           },
+          {
+            "type": "field",
+            "attrs": {
+              "name": "isPublic",
+              "sortable": true
+            }
+          },
           {
             "type": "field",
             "attrs": {
@@ -8853,6 +8891,14 @@
                   "isSearchable": true
                 }
               },
+              {
+                "type": "field",
+                "attrs": {
+                  "name": "isPublic",
+                  "label": "isPublic",
+                  "isSearchable": true
+                }
+              },
               {
                 "type": "field",
                 "attrs": {
@@ -8921,6 +8967,12 @@
                       "name": "mediaStorageProviderMetadata"
                     }
                   },
+                  {
+                    "type": "field",
+                    "attrs": {
+                      "name": "isPublic"
+                    }
+                  },
                   {
                     "type": "field",
                     "attrs": {
@@ -14525,7 +14577,15 @@
   "mediaStorageProviders": [
     {
       "name": "default-filesystem",
-      "type": "filesystem"
+      "type": "filesystem",
+      "isPublic": true,
+      "localPath": "media-files-storage"
+    },
+    {
+      "name": "private-filesystem",
+      "type": "filesystem",
+      "isPublic": false,
+      "localPath": "media-private-files-storage"
     },
     {
       "name": "default-aws-s3",
@@ -14561,6 +14621,47 @@
           }
         }
       }
+    },
+    {
+      "name": "model:Media-role:Internal User-own",
+      "description": "Show Media records owned by the current user",
+      "roleUserKey": "Internal User",
+      "modelMetadataUserKey": "media",
+      "securityRuleConfig": {
+        "filters": {
+          "createdBy": {
+            "$eq": "$activeUserId"
+          }
+        }
+      }
+    },
+    {
+      "name": "model:Media-role:Internal User-public",
+      "description": "Show public Media records",
+      "roleUserKey": "Internal User",
+      "modelMetadataUserKey": "media",
+      "securityRuleConfig": {
+        "filters": {
+          "mediaStorageProviderMetadata": {
+            "isPublic": {
+              "$eq": true
+            }
+          }
+        }
+      }
+    },
+    {
+      "name": "model:Media-role:Admin",
+      "description": "Show All Media records",
+      "roleUserKey": "Admin",
+      "modelMetadataUserKey": "media",
+      "securityRuleConfig": {
+        "filters": {
+          "id": {
+            "$ne": "0"
+          }
+        }
+      }
     }
   ],
   "modelSequences": [],

package/src/services/1.js

@@ -0,0 +1,6 @@
+1. Do i need to create a storeStreams method for aws service too?
+    - Handle later
+2. queues handling -> if queues is enabled by default, i.e triggerExport(exportTransactionEntity.id).
+    - startExport should either return the data or return the transaction id
+3. How to handle scenarios wherein, nested related exist.(do i need to only get the userkey)
+    - show the userKey

package/src/services/authentication.service.ts

@@ -109,6 +109,26 @@ export class AuthenticationService {
     });
   }
 
+  private async resolveUserForPasswordSignIn(username: string, email: string) {
+    const normalizedEmail = email?.trim().toLowerCase();
+    const query = (await this.userRepository
+      .createSecurityRuleAwareQueryBuilder("u"))
+      .leftJoinAndSelect("u.roles", "roles");
+
+    if (username) {
+      query.where("u.username = :username", { username });
+    }
+    if (normalizedEmail) {
+      if (username) {
+        query.orWhere("LOWER(u.email) = :email", { email: normalizedEmail });
+      } else {
+        query.where("LOWER(u.email) = :email", { email: normalizedEmail });
+      }
+    }
+
+    return await query.getOne();
+  }
+
   async updatePasswordDetails(user: User, newPassword: string) {
     user.password = await this.hashingService.hash(newPassword);
     user.passwordScheme = this.hashingService.name();
@@ -985,7 +1005,10 @@ export class AuthenticationService {
   }
 
   async signIn(signInDto: SignInDto) {
-    const user = await this.resolveUser(signInDto.username, signInDto.email);
+    const user = await this.resolveUserForPasswordSignIn(
+      signInDto.username,
+      signInDto.email,
+    );
     if (!user) {
       throw new UnauthorizedException(ERROR_MESSAGES.INVALID_CREDENTIALS);
     }

package/src/services/media-download-url.service.ts

@@ -0,0 +1,67 @@
+import { Injectable, Logger } from '@nestjs/common';
+import { ConfigService } from '@nestjs/config';
+import { JwtService } from '@nestjs/jwt';
+import { MediaStorageProviderType } from 'src/dtos/create-media-storage-provider-metadata.dto';
+import { MediaStorageProviderMetadata } from 'src/entities/media-storage-provider-metadata.entity';
+import { S3FileService } from 'src/services/file';
+import { getEffectiveS3Region } from 'src/services/media-storage.utils';
+import { SettingService } from 'src/services/setting.service';
+import type { SolidCoreSetting } from 'src/services/settings/default-settings-provider.service';
+
+export const MEDIA_DOWNLOAD_TOKEN_AUDIENCE = 'media-download';
+const DEFAULT_SIGNED_URL_EXPIRY_MINUTES = 60;
+
+export interface MediaDownloadTokenPayload {
+  mediaId: number;
+}
+
+@Injectable()
+export class MediaDownloadUrlService {
+  private readonly logger = new Logger(MediaDownloadUrlService.name);
+
+  constructor(
+    private readonly jwtService: JwtService,
+    private readonly s3FileService: S3FileService,
+    private readonly settingService: SettingService,
+    private readonly configService: ConfigService,
+  ) { }
+
+  async resolveDownloadUrl(mediaId: number, relativeUri: string, storageProvider?: MediaStorageProviderMetadata): Promise<string> {
+    const expiryMinutes = storageProvider?.signedUrlExpiry ?? DEFAULT_SIGNED_URL_EXPIRY_MINUTES;
+
+    if ((storageProvider?.type as MediaStorageProviderType) === MediaStorageProviderType.AwsS3) {
+      if (storageProvider?.bucketName) {
+        return this.s3FileService.getUrl(
+          `${storageProvider.bucketName}:${relativeUri}`,
+          { region: getEffectiveS3Region(this.configService, storageProvider.region), expiresIn: expiryMinutes * 60 },
+        );
+      }
+      this.logger.warn(`Media id ${mediaId}: AwsS3 provider missing bucketName; falling back to app-hosted token URL`);
+    }
+
+    // Filesystem (or misconfigured S3) has no native presigned-URL mechanism, so mint our
+    // own short-lived token and embed it in the download URL - the token alone authorizes
+    // the request (see MediaSignedUrlGuard), so it works in a plain <img src> with no
+    // Authorization header needed.
+    const token = await this.mintDownloadToken(mediaId, expiryMinutes);
+    const downloadPath = `/api/media/${mediaId}/download?token=${token}`;
+    const baseUrl = this.settingService.getConfigValue<SolidCoreSetting>('baseUrl');
+    return `${String(baseUrl).replace(/\/+$/, '')}${downloadPath}`;
+  }
+
+  async verifyDownloadToken(token: string): Promise<MediaDownloadTokenPayload> {
+    return this.jwtService.verifyAsync<MediaDownloadTokenPayload>(token, {
+      secret: this.settingService.getConfigValue<SolidCoreSetting>('secret'),
+      audience: MEDIA_DOWNLOAD_TOKEN_AUDIENCE,
+    });
+  }
+
+  private mintDownloadToken(mediaId: number, expiryMinutes: number): Promise<string> {
+    const payload: MediaDownloadTokenPayload = { mediaId };
+    return this.jwtService.signAsync(payload, {
+      secret: this.settingService.getConfigValue<SolidCoreSetting>('secret'),
+      audience: MEDIA_DOWNLOAD_TOKEN_AUDIENCE,
+      expiresIn: expiryMinutes * 60,
+    });
+  }
+}

package/src/services/media-storage.utils.ts

@@ -0,0 +1,79 @@
+import { ConfigService } from '@nestjs/config';
+import * as path from 'path';
+import { FieldMetadata } from 'src/entities/field-metadata.entity';
+import { MediaStorageProviderMetadata } from 'src/entities/media-storage-provider-metadata.entity';
+import { SettingService } from 'src/services/setting.service';
+import { DEFAULT_MEDIA_FILE_STORAGE_DIR } from 'src/services/settings/default-settings-provider.service';
+import type { SolidCoreSetting } from 'src/services/settings/default-settings-provider.service';
+
+export const DEFAULT_PRIVATE_MEDIA_STORAGE_DIR = 'media-private-files-storage';
+
+export interface MediaRecordCreateInput {
+  entityId: number;
+  modelMetadataId: number;
+  mediaStorageProviderMetadataId: number;
+  fieldMetadataId: number;
+  relativeUri: string;
+  mimeType?: string;
+  fileSize?: number;
+  originalFileName?: string;
+  isPublic?: boolean;
+}
+
+// Builds the stored file name format shared by media storage implementations.
+export function buildStoredMediaFileName(file: Pick<Express.Multer.File, 'filename' | 'originalname'>): string {
+  return `${file.filename}-${file.originalname}`;
+}
+
+// Resolves the on-disk path for a media file based on settings and provider visibility.
+export function buildDiskMediaPath(fileName: string,settingService: Pick<SettingService, 'getConfigValue'>,storageProvider?: Pick<MediaStorageProviderMetadata, 'localPath' | 'isPublic'>,): string {
+  const publicBase = settingService.getConfigValue<SolidCoreSetting>('fileStorageDir') || DEFAULT_MEDIA_FILE_STORAGE_DIR;
+  const privateBase = DEFAULT_PRIVATE_MEDIA_STORAGE_DIR;
+  const providerBase = storageProvider?.localPath || (storageProvider?.isPublic === false ? privateBase : publicBase);
+
+  if ( path.isAbsolute(fileName) || fileName.startsWith(`${publicBase}/`) || fileName.startsWith(`${privateBase}/`) || (!!storageProvider?.localPath && fileName.startsWith(`${storageProvider.localPath}/`))) {
+    return fileName;
+  }
+
+  return `${providerBase}/${fileName}`;
+}
+
+// Returns the S3 region from the provider when present, otherwise falls back to app config.
+export function getEffectiveS3Region(configService: Pick<ConfigService, 'get'>,providerRegion?: string,): string | undefined {
+  return providerRegion || configService.get<string>('S3_AWS_REGION_NAME');
+}
+
+// Resolves the effective public/private flag for a media storage provider.
+export function resolveMediaIsPublic(storageProvider?: Pick<MediaStorageProviderMetadata, 'isPublic'>,): boolean | undefined {
+  if (!storageProvider) {
+    return undefined;
+  }
+
+  return storageProvider.isPublic !== false;
+}
+
+// Preserves an explicit media visibility value or derives it from the storage provider.
+export function resolveStoredMediaIsPublic(currentValue: boolean | undefined,storageProvider?:Pick<MediaStorageProviderMetadata, 'isPublic'>,): boolean | undefined {
+  if (typeof currentValue === 'boolean') {
+    return currentValue;
+  }
+
+  return resolveMediaIsPublic(storageProvider);
+}
+
+// Builds the shared media record payload used before saving media metadata to the database.
+export function buildMediaRecordCreateInput(
+  entityId: number,
+  mediaFieldMetadata: Pick<FieldMetadata, 'id' | 'model'> & { model: { id: number } },
+  storageProvider: Pick<MediaStorageProviderMetadata, 'id'>,
+  overrides: Pick<MediaRecordCreateInput, 'relativeUri'>
+    & Partial<Omit<MediaRecordCreateInput, 'entityId' | 'modelMetadataId' | 'mediaStorageProviderMetadataId' | 'fieldMetadataId' | 'relativeUri'>>,
+): MediaRecordCreateInput {
+  return {
+    entityId,
+    modelMetadataId: mediaFieldMetadata.model.id,
+    mediaStorageProviderMetadataId: storageProvider.id,
+    fieldMetadataId: mediaFieldMetadata.id,
+    ...overrides,
+  };
+}