@solidxai/core 0.1.13-beta.0 → 0.1.13-beta.11

package/docs/workflow/workflow-solidx-model-field-spec.md

@@ -0,0 +1,284 @@
+# Workflow SolidX Model Field Specification
+
+This document translates the agreed workflow-management domain model into SolidX model and field definitions.
+
+It is intended as the final field-level design pass before using the SolidX model MCP tools.
+
+## SolidX Field Types
+
+The local `@solidxai/core` package defines these field types in `SolidFieldType`:
+
+- `int`
+- `bigint`
+- `decimal`
+- `shortText`
+- `longText`
+- `richText`
+- `json`
+- `boolean`
+- `date`
+- `datetime`
+- `time`
+- `relation`
+- `mediaSingle`
+- `mediaMultiple`
+- `email`
+- `password`
+- `selectionStatic`
+- `selectionDynamic`
+- `computed`
+- `uuid`
+
+Useful relation metadata:
+
+- `relationType`: `many-to-one`, `one-to-many`, `many-to-many`
+- `relationCascade`: `set null`, `restrict`, `cascade`
+
+## Modeling Philosophy
+
+- Workflow definitions store their canonical DSL in YAML text.
+- Workflow definitions are metadata-backed: manually created workflows should also be persisted back to the module metadata JSON so developers can commit and share them.
+- Workflow execution data is normalized enough to support monitoring, filtering, and debugging.
+- Workflow version history is not a separate model in v1.
+- `definitionVersion` and `definitionChecksum` live on both definition and execution records.
+- `WorkflowBlueprint` is intentionally deferred for now.
+
+## Model: `workflowDefinition`
+
+Purpose: stores the current reusable workflow definition.
+
+Suggested table name: `wm_workflow_definition`
+
+| Field | SolidX Type | Required | Notes |
+| --- | --- | --- | --- |
+| `key` | `shortText` | Yes | Stable workflow key. Should be unique. |
+| `moduleMetadata` | `relation` | Yes | Many-to-one to SolidX `moduleMetadata`; identifies the owning module/package for metadata persistence. |
+| `displayName` | `shortText` | Yes | Human-facing name. |
+| `namespace` | `shortText` | No | Dot-path grouping, e.g. `ops.monitoring`. |
+| `description` | `longText` | No | Workflow description. |
+| `status` | `selectionStatic` | Yes | `draft`, `active`, `inactive`, `archived`. |
+| `definitionVersion` | `shortText` | No | Human-managed or seed-managed version string. |
+| `definitionChecksum` | `shortText` | No | Hash of canonical `definitionYaml`. |
+| `definitionYaml` | `longText` | Yes | Canonical workflow DSL YAML used for sharing, seeding, validation, and execution. |
+| `tags` | `json` | No | Array of tags. |
+
+Recommended indexes/search fields:
+
+- `key`
+- `moduleMetadata`
+- `displayName`
+- `namespace`
+- `status`
+- `definitionChecksum`
+
+Recommended user key:
+
+- `key`
+
+Metadata persistence notes:
+
+- `key` acts as the workflow user key and metadata identity.
+- A TypeORM subscriber or workflow persistence service should synchronize workflow definition changes back to the owning module metadata JSON.
+- Since UI-created workflows are also metadata-backed, separate `sourceType`, `seedSource`, `seedKey`, `seedVersion`, and `isSeeded` fields are not needed.
+
+## Model: `workflowExecution`
+
+Purpose: stores one run of a workflow definition.
+
+Suggested table name: `wm_workflow_execution`
+
+| Field | SolidX Type | Required | Notes |
+| --- | --- | --- | --- |
+| `executionIdentifier` | `computed` | Yes | System-generated readable execution id. Recommended provider: `SequenceNumComputedFieldProvider`. |
+| `workflowDefinition` | `relation` | Yes | Many-to-one to `workflowDefinition`. |
+| `workflowKey` | `shortText` | Yes | Snapshot of definition key for easier querying. |
+| `workflowDisplayName` | `shortText` | No | Snapshot of display name. |
+| `status` | `selectionStatic` | Yes | `created`, `running`, `success`, `failed`, `cancelled`. |
+| `triggerType` | `selectionStatic` | Yes | `manual`, `schedule`, `webhook`, `flow`, `polling`, `event`. |
+| `triggerExecution` | `relation` | No | Many-to-one to `workflowTriggerExecution`; nullable for manual runs. |
+| `startedAt` | `datetime` | No | Execution start time. |
+| `finishedAt` | `datetime` | No | Execution end time. |
+| `durationMs` | `bigint` | No | Runtime duration. |
+| `inputPayload` | `json` | No | Runtime inputs supplied to the execution. |
+| `outputPayload` | `json` | No | Flow-level outputs. |
+| `definitionVersion` | `shortText` | No | Version used by this execution. |
+| `definitionChecksum` | `shortText` | No | Checksum used by this execution. |
+| `definitionSnapshot` | `longText` | Yes | Exact workflow YAML used for this run. |
+| `errorSummary` | `longText` | No | Human-readable failure summary. |
+| `errorDetails` | `json` | No | Structured error payload. |
+| `requestedByUserId` | `bigint` | No | User id or actor id if available. |
+
+Recommended indexes/search fields:
+
+- `executionIdentifier`
+- `workflowKey`
+- `status`
+- `triggerType`
+- `startedAt`
+- `finishedAt`
+- `definitionChecksum`
+
+Recommended computed field configuration:
+
+- `type`: `computed`
+- `computedFieldValueProvider`: `SequenceNumComputedFieldProvider`
+- `computedFieldValueProviderCtxt`: `{"sequenceName":"workflowExecution","mode":"counter"}`
+- `computedFieldValueType`: `string`
+- `computedFieldTriggerConfig`: after insert for `workflowExecution`
+
+Recommended model sequence:
+
+- `sequenceName`: `workflowExecution`
+- `prefix`: `WFE`
+- `separator`: `-`
+- `padding`: `8`
+- Example output: `WFE-00000001`
+
+## Model: `workflowStepExecution`
+
+Purpose: stores runtime state for one workflow node execution.
+
+Suggested table name: `wm_workflow_step_execution`
+
+| Field | SolidX Type | Required | Notes |
+| --- | --- | --- | --- |
+| `workflowExecution` | `relation` | Yes | Many-to-one to `workflowExecution`. |
+| `parentStepExecution` | `relation` | No | Self many-to-one for nested/control execution. |
+| `nodeId` | `shortText` | Yes | Node id from workflow YAML. |
+| `nodeName` | `shortText` | No | Snapshot of node name. |
+| `nodeKind` | `selectionStatic` | Yes | `task`, `control`, `subflow`. |
+| `nodeType` | `shortText` | Yes | e.g. `http.request`, `if`. |
+| `status` | `selectionStatic` | Yes | `pending`, `running`, `success`, `failed`, `skipped`. |
+| `attemptNumber` | `int` | Yes | Defaults to 1. |
+| `branchId` | `shortText` | No | For `parallel` branch context. |
+| `iterationIndex` | `int` | No | For `forEach` context. |
+| `startedAt` | `datetime` | No | Step start time. |
+| `finishedAt` | `datetime` | No | Step end time. |
+| `durationMs` | `bigint` | No | Step runtime duration. |
+| `inputContext` | `json` | No | Resolved node input context. |
+| `outputPayload` | `json` | No | Node outputs. |
+| `errorSummary` | `longText` | No | Human-readable failure summary. |
+| `errorDetails` | `json` | No | Structured error payload. |
+
+Recommended indexes/search fields:
+
+- `workflowExecution`
+- `nodeId`
+- `nodeType`
+- `status`
+- `startedAt`
+
+## Model: `workflowExecutionLog`
+
+Purpose: stores execution and step logs as queryable records.
+
+Suggested table name: `wm_workflow_execution_log`
+
+| Field | SolidX Type | Required | Notes |
+| --- | --- | --- | --- |
+| `workflowExecution` | `relation` | Yes | Many-to-one to `workflowExecution`. |
+| `workflowStepExecution` | `relation` | No | Many-to-one to `workflowStepExecution`; nullable for execution-level logs. |
+| `level` | `selectionStatic` | Yes | `debug`, `info`, `warn`, `error`. |
+| `message` | `longText` | Yes | Log message. |
+| `metadata` | `json` | No | Structured log metadata. |
+| `loggedAt` | `datetime` | Yes | Timestamp of log event. |
+
+Recommended indexes/search fields:
+
+- `workflowExecution`
+- `workflowStepExecution`
+- `level`
+- `loggedAt`
+
+## Model: `workflowExecutionArtifact`
+
+Purpose: stores references to files or large artifacts produced during execution.
+
+Suggested table name: `wm_workflow_execution_artifact`
+
+| Field | SolidX Type | Required | Notes |
+| --- | --- | --- | --- |
+| `workflowExecution` | `relation` | Yes | Many-to-one to `workflowExecution`. |
+| `workflowStepExecution` | `relation` | No | Many-to-one to `workflowStepExecution`. |
+| `artifactKey` | `shortText` | Yes | Stable artifact key within the execution. |
+| `displayName` | `shortText` | No | Human-facing name. |
+| `artifactType` | `selectionStatic` | Yes | `file`, `json`, `text`, `binary`, `uri`. |
+| `media` | `mediaSingle` | No | SolidX media attachment for stored file artifacts. |
+| `uri` | `longText` | No | External artifact URI if not stored in media. |
+| `contentType` | `shortText` | No | MIME type if known. |
+| `sizeBytes` | `bigint` | No | Artifact size. |
+| `metadata` | `json` | No | Structured artifact metadata. |
+| `createdAtRuntime` | `datetime` | No | Runtime artifact creation timestamp. |
+
+Recommended indexes/search fields:
+
+- `workflowExecution`
+- `workflowStepExecution`
+- `artifactKey`
+- `artifactType`
+
+## Model: `workflowTriggerExecution`
+
+Purpose: records trigger events that started or attempted to start workflow executions.
+
+Suggested table name: `wm_workflow_trigger_execution`
+
+| Field | SolidX Type | Required | Notes |
+| --- | --- | --- | --- |
+| `workflowDefinition` | `relation` | Yes | Many-to-one to `workflowDefinition`. |
+| `triggerId` | `shortText` | Yes | Trigger id from workflow YAML. |
+| `triggerType` | `selectionStatic` | Yes | `schedule`, `webhook`, `flow`, `polling`, `event`. |
+| `status` | `selectionStatic` | Yes | `received`, `accepted`, `ignored`, `failed`. |
+| `firedAt` | `datetime` | Yes | Trigger fire time. |
+| `inputPayload` | `json` | No | Inputs supplied by trigger. |
+| `triggerPayload` | `json` | No | Raw trigger/event payload. |
+| `workflowExecution` | `relation` | No | Many-to-one to `workflowExecution`; nullable if ignored/failed before execution creation. |
+| `errorSummary` | `longText` | No | Human-readable failure summary. |
+| `errorDetails` | `json` | No | Structured error payload. |
+
+Recommended indexes/search fields:
+
+- `workflowDefinition`
+- `triggerId`
+- `triggerType`
+- `status`
+- `firedAt`
+
+## Deferred Model: `workflowBlueprint`
+
+`WorkflowBlueprint` is intentionally ignored for now.
+
+When reintroduced, it should likely include:
+
+- `key`
+- `displayName`
+- `description`
+- `tags`
+- `definitionYaml`
+- `source`
+- `sourceVersion`
+
+## Relation Summary
+
+- `workflowDefinition` has many `workflowExecution`
+- `workflowDefinition` has many `workflowTriggerExecution`
+- `moduleMetadata` has many `workflowDefinition`
+- `workflowExecution` has many `workflowStepExecution`
+- `workflowExecution` has many `workflowExecutionLog`
+- `workflowExecution` has many `workflowExecutionArtifact`
+- `workflowTriggerExecution` may link to one created `workflowExecution`
+- `workflowStepExecution` may have many child `workflowStepExecution` records via `parentStepExecution`
+- `workflowStepExecution` has many `workflowExecutionLog`
+- `workflowStepExecution` has many `workflowExecutionArtifact`
+
+## MCP Modeling Readiness Checklist
+
+Before calling the SolidX model MCP tools, confirm:
+
+- Use `workflow-builder` as the module key.
+- Use the six active models above.
+- Use `longText` for `definitionYaml` and `definitionSnapshot`; parse them as YAML in the workflow services to keep the workflow engine DB agnostic.
+- Use `selectionStatic` for status/type enum fields.
+- Use `relation` fields for cross-model links.
+- Add a many-to-one relation from `workflowDefinition` to SolidX `moduleMetadata`.
+- Keep `WorkflowBlueprint` deferred.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@solidxai/core",
-  "version": "0.1.13-beta.0",
+  "version": "0.1.13-beta.11",
   "description": "This module is a NestJS module containing all the required core providers required by a Solid application",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -81,7 +81,8 @@
     "ts-morph": "^27.0.2",
     "twilio": "^5.8.0",
     "uuid": "^9.0.1",
-    "xlsx": "^0.18.5"
+    "xlsx": "^0.18.5",
+    "yaml": "^2.9.0"
   },
   "peerDependenciesMeta": {},
   "peerDependencies": {

package/src/commands/run-tests.command.ts

@@ -7,6 +7,8 @@ import { WebhookReporter } from 'src/testing/reporter/webhook-reporter';
 import { runFromMetadata } from 'src/testing/runner/run-from-metadata';
 import type { TestingMetadata } from 'src/testing/contracts/testing-metadata.types';
 import { SpecRegistry } from 'src/testing/core/spec-registry';
+import { SettingService } from 'src/services/setting.service';
+import type { SolidCoreSetting } from 'src/services/settings/default-settings-provider.service';
 
 interface TestRunCommandOptions {
   module?: string;
@@ -18,6 +20,8 @@ interface TestRunCommandOptions {
   apiBaseUrl?: string;
   uiBaseUrl?: string;
   headless?: boolean;
+  uiTimeoutMs?: number;
+  uiNavigationTimeoutMs?: number;
   timeoutMs?: number;
   retries?: number;
   listSpecs?: boolean;
@@ -34,6 +38,7 @@ export class TestRunCommand extends CommandRunner {
 
   constructor(
     private readonly moduleMetadataHelperService: ModuleMetadataHelperService,
+    private readonly settingService: SettingService,
   ) {
     super();
   }
@@ -89,6 +94,14 @@ export class TestRunCommand extends CommandRunner {
       const apiBaseUrl = options?.apiBaseUrl ?? process.env.BASE_URL;
       const uiBaseUrl = options?.uiBaseUrl ?? process.env.FRONTEND_BASE_URL;
       const headless = options?.headless ?? true;
+      const uiTimeoutMs =
+        options?.uiTimeoutMs
+        ?? toPositiveNumber(process.env.UI_TIMEOUT_MS)
+        ?? toPositiveNumber(this.settingService.getConfigValue<SolidCoreSetting>('uiTestDefaultTimeoutMs'));
+      const uiNavigationTimeoutMs =
+        options?.uiNavigationTimeoutMs
+        ?? toPositiveNumber(process.env.UI_NAVIGATION_TIMEOUT_MS)
+        ?? toPositiveNumber(this.settingService.getConfigValue<SolidCoreSetting>('uiTestNavigationTimeoutMs'));
       const printApiLogs = options?.printApiLogs ?? false;
 
       const webhookUrl = process.env.SOLIDCTL_WEBHOOK_URL;
@@ -105,7 +118,12 @@ export class TestRunCommand extends CommandRunner {
           skipScenarioIds,
           reporter,
           api: apiBaseUrl ? { baseUrl: apiBaseUrl } : undefined,
-          ui: { baseUrl: uiBaseUrl, headless },
+          ui: {
+            baseUrl: uiBaseUrl,
+            headless,
+            defaultTimeoutMs: uiTimeoutMs,
+            navigationTimeoutMs: uiNavigationTimeoutMs,
+          },
           defaults: {
             timeoutMs: options?.timeoutMs,
             retries: options?.retries,
@@ -225,6 +243,26 @@ export class TestRunCommand extends CommandRunner {
     return val === 'false' ? false : true;
   }
 
+  @Option({
+    flags: '--ui-timeout-ms [number]',
+    description:
+      'Default timeout in ms for UI steps (waits, clicks, fills). Defaults to process.env.UI_TIMEOUT_MS, then the uiTestDefaultTimeoutMs setting, then 30000.',
+    required: false,
+  })
+  parseUiTimeoutMs(val: string): number {
+    return Number(val);
+  }
+
+  @Option({
+    flags: '--ui-navigation-timeout-ms [number]',
+    description:
+      'Default timeout in ms for ui.goto navigation. Defaults to process.env.UI_NAVIGATION_TIMEOUT_MS, then the uiTestNavigationTimeoutMs setting, then --ui-timeout-ms.',
+    required: false,
+  })
+  parseUiNavigationTimeoutMs(val: string): number {
+    return Number(val);
+  }
+
   @Option({
     flags: '--timeout-ms [number]',
     description: 'Default scenario timeout in milliseconds.',
@@ -262,6 +300,14 @@ function splitCsv(value?: string): string[] | undefined {
   return items.length ? items : undefined;
 }
 
+// Accepts unknown because settings come back already parsed as numbers, while env
+// vars arrive as strings.
+function toPositiveNumber(value?: unknown): number | undefined {
+  if (value === null || value === undefined || value === '') return undefined;
+  const parsed = Number(value);
+  return Number.isFinite(parsed) && parsed > 0 ? parsed : undefined;
+}
+
 function resolveSpecPath(entry: string, metadataPath: string): string {
   if (path.isAbsolute(entry)) {
     return entry;

package/src/commands/seed.command.ts

@@ -7,6 +7,7 @@ interface SeedCommandOptions {
   seeder?: string;
   modulesToSeed?: string;
   prune?: boolean;
+  skipHooks?: boolean;
 }
 
 @Command({ name: 'seed', description: 'Install seed data for a given module' })
@@ -28,6 +29,7 @@ export class SeedCommand extends CommandRunner {
         modulesToSeed,
         pruneMetadata: false,
         seedGlobalMetadata: true,
+        skipHooks: false,
       };
       this.logger.log(`Modules to seed: ${modulesToSeed.join(', ')}`);
     } else {
@@ -39,10 +41,22 @@ export class SeedCommand extends CommandRunner {
         modulesToSeed: null,
         pruneMetadata: false,
         seedGlobalMetadata: true,
+        skipHooks: false,
       };
       parsedConf.pruneMetadata = true;
     }
 
+    if (options?.skipHooks) {
+      parsedConf = parsedConf ?? {
+        modulesToSeed: null,
+        pruneMetadata: false,
+        seedGlobalMetadata: true,
+        skipHooks: false,
+      };
+      parsedConf.skipHooks = true;
+      this.logger.log('Skipping pre-seed and post-seed hooks.');
+    }
+
     const seeder = this.solidRegistry
       .getSeeders()
       .filter((seeder) => seeder.name === options.seeder)
@@ -74,4 +88,9 @@ export class SeedCommand extends CommandRunner {
   parsePrune(): boolean {
     return true;
   }
+
+  @Option({ flags: '--skip-hooks', description: 'Skip emitting pre-seed and post-seed lifecycle hooks/events.' })
+  parseSkipHooks(): boolean {
+    return true;
+  }
 }

package/src/constants/chatter-message.constants.ts

@@ -1,3 +1,5 @@
+import { USER_SUMMARY_FIELDS } from 'src/constants/user.constants';
+
 export const CHATTER_MESSAGE_TYPE = {
     AUDIT: 'audit',
     CUSTOM: 'custom',
@@ -16,3 +18,13 @@ export const CHATTER_MESSAGE_STATUS = {
     PENDING: 'pending',
     COMPLETED: 'completed',
 } as const;
+
+/**
+ * Columns of the message author exposed by the chatter APIs.
+ *
+ * The chatter panel renders `fullName` (name label + initials avatar) and uses `id`
+ * for the own-note edit check; the admin list/form/tree views display `fullName` via
+ * each view's `coModelFieldToDisplay`. That is exactly the platform-wide summary
+ * shape, so this is an alias rather than a second list to keep in step.
+ */
+export const CHATTER_MESSAGE_USER_FIELDS = USER_SUMMARY_FIELDS;

package/src/constants/draft-publish-fields.ts

@@ -0,0 +1,5 @@
+// The versioning columns CommonEntity adds for draft/publish support. These don't exist on
+// legacy tables (see LegacyCommonEntityWithExistingId) and don't carry over when a new draft
+// version is copied from its source entity, so both of those call sites share this list rather
+// than each hand-enumerating the same four names.
+export const DRAFT_PUBLISH_VERSIONING_FIELD_NAMES = ['isPublished', 'isLatest', 'initialEntityVersionId', 'publishedTracker'] as const;

package/src/constants/media-file-types.ts

@@ -17,6 +17,56 @@ export const DANGEROUS_EXTENSIONS = new Set([
     'exe', 'sh', 'bat', 'cmd', 'ps1', 'jar', 'dll',
 ]);
 
+
+/**
+ * Mimetypes that are never safe to accept, regardless of extension. These render as active
+ * content in a browser (svg can carry <script>), so they are rejected even when the filename
+ * looks harmless. Kept alongside DANGEROUS_EXTENSIONS so upload paths check both.
+ */
+export const DANGEROUS_MIME_TYPES = new Set([
+    'image/svg+xml', 'text/html', 'application/xhtml+xml',
+]);
+
+export function getLowercaseFileExtension(fileName?: string | null): string | undefined {
+    if (!fileName) {
+        return undefined;
+    }
+
+    const lastDotIndex = fileName.lastIndexOf('.');
+    if (lastDotIndex < 0 || lastDotIndex === fileName.length - 1) {
+        return undefined;
+    }
+
+    return fileName.slice(lastDotIndex + 1).toLowerCase();
+}
+
+/** Minimal shape of an uploaded file, so this module stays free of framework imports. */
+export interface UploadedFileLike {
+    mimetype?: string;
+    originalname?: string;
+    filename?: string;
+}
+
+/** originalname is the client-supplied name; filename is multer's on-disk name. */
+export function getUploadedFileName(file?: UploadedFileLike | null): string {
+    return file?.originalname ?? file?.filename ?? '';
+}
+
+/**
+ * Single predicate for "must never be stored". Shared by every upload entry point
+ * (MediaFieldCrudManager, chatter attachments) so the rules can't drift between them.
+ * Extension is checked before mimetype so a spoofed Content-Type (e.g.
+ * application/octet-stream on an .html file) can't bypass it.
+ */
+export function isDangerousMediaFile(file?: UploadedFileLike | null): boolean {
+    const ext = getLowercaseFileExtension(getUploadedFileName(file));
+    if (ext && DANGEROUS_EXTENSIONS.has(ext)) {
+        return true;
+    }
+
+    return DANGEROUS_MIME_TYPES.has((file?.mimetype || '').toLowerCase().trim());
+}
+
 /**
  * Single source of truth for extension -> coarse media category. Shared by upload-time
  * validation (MediaFieldCrudManager) and serve-time header hardening (ServeStaticModule), so

package/src/constants/user.constants.ts

@@ -0,0 +1,13 @@
+/**
+ * The columns of a `User` that are safe to embed in another entity's API response.
+ *
+ * Whenever a user is attached to a record the caller asked for - a `createdBy` /
+ * `updatedBy` populate, a chatter message author - the caller wants to display who it
+ * was, not to read their profile. Everything else on `User` is PII (email, mobile),
+ * authz metadata (roles, apiKeys) or secret, and the embedded user is frequently
+ * someone the viewer has no other visibility of.
+ *
+ * `fullName` is nullable; consumers that need a fallback should use the record's own
+ * context rather than widening this list.
+ */
+export const USER_SUMMARY_FIELDS = ['id', 'fullName'] as const;

package/src/controllers/chatter-message.controller.ts

@@ -95,6 +95,14 @@ export class ChatterMessageController {
     return this.service.find(query);  
   }
 
+  @ApiBearerAuth("jwt")
+  @ApiQuery({ name: 'search', required: false, type: String })
+  @ApiQuery({ name: 'limit', required: false, type: Number })
+  @Get('mentionable-users')
+  async getMentionableUsers(@Query() query: any) {
+    return this.service.getMentionableUsers(query?.search, query?.limit ? +query.limit : undefined);
+  }
+
   @ApiBearerAuth("jwt")
   @Get(':id')
   async findOne(@Param('id') id: string, @Query() query: any) {

package/src/controllers/export-template.controller.ts

@@ -8,6 +8,7 @@ import { Response } from 'express';
 import { StartExportSyncDto } from 'src/dtos/export.dto';
 import { ActiveUser } from 'src/decorators/active-user.decorator';
 import { ActiveUserData } from 'src/interfaces/active-user-data.interface';
+import { setFileDownloadHeaders } from 'src/helpers/file-download.helper';
 
 @ApiTags('Solid Core') 
 @Controller('export-template') //FIXME: Change this to the model plural name 
@@ -91,9 +92,10 @@ export class ExportTemplateController {
       throw new InternalServerErrorException("Export stream is null");
     }
     // ✅ Set response headers for streaming
-    res.setHeader('Content-Disposition', `attachment; filename="${exportFileInfo.fileName}"`);
-    res.setHeader('Content-Type', exportFileInfo.mimeType);
-    res.setHeader('Access-Control-Expose-Headers', 'Content-Disposition, Content-Type');
+    setFileDownloadHeaders(res, {
+      fileName: exportFileInfo.fileName,
+      mimeType: exportFileInfo.mimeType,
+    });
     // Pipe the strea to the response as an excel file
     exportFileInfo.exportStream.pipe(res);
   }

package/src/controllers/import-transaction.controller.ts

@@ -7,6 +7,7 @@ import { UpdateImportTransactionDto } from '../dtos/update-import-transaction.dt
 import { Response } from 'express';
 import { ActiveUser } from 'src/decorators/active-user.decorator';
 import { ActiveUserData } from 'src/interfaces/active-user-data.interface';
+import { setFileDownloadHeaders } from 'src/helpers/file-download.helper';
 
 enum ShowSoftDeleted {
   INCLUSIVE = "inclusive",
@@ -27,9 +28,10 @@ export class ImportTransactionController {
     }
 
     // ✅ Set response headers for streaming
-    res.setHeader('Content-Disposition', `attachment; filename="${importTemplateFileInfo.fileName}"`);
-    res.setHeader('Content-Type', importTemplateFileInfo.mimeType);
-    res.setHeader('Access-Control-Expose-Headers', 'Content-Disposition, Content-Type');
+    setFileDownloadHeaders(res, {
+      fileName: importTemplateFileInfo.fileName,
+      mimeType: importTemplateFileInfo.mimeType,
+    });
     // Pipe the stream to the response as an excel file
     importTemplateFileInfo.stream.pipe(res);
   }
@@ -117,9 +119,7 @@ export class ImportTransactionController {
       throw new InternalServerErrorException("Failed records stream is null");
     }
     // ✅ Set response headers for streaming
-    res.setHeader('Content-Disposition', `attachment; filename="${fileName}"`);
-    res.setHeader('Content-Type', mimeType);
-    res.setHeader('Access-Control-Expose-Headers', 'Content-Disposition, Content-Type');
+    setFileDownloadHeaders(res, { fileName, mimeType });
     // Pipe the strea to the response as an excel file
     stream.pipe(res);
   }

package/src/controllers/media.controller.ts

@@ -9,6 +9,8 @@ import { SolidRequestContextDto } from 'src/dtos/solid-request-context.dto';
 import { UpdateMediaDto } from 'src/dtos/update-media.dto';
 import { MediaService } from 'src/services/media.service';
 import { Response } from 'express';
+import { getLowercaseFileExtension, INLINE_SAFE_EXTENSIONS } from 'src/constants/media-file-types';
+import { setFileDownloadHeaders } from 'src/helpers/file-download.helper';
 
 enum ShowSoftDeleted {
   INCLUSIVE = "inclusive",
@@ -91,17 +93,26 @@ export class MediaController {
 
   @Auth(AuthType.MediaSignedUrl)
   @ApiQuery({ name: 'token', required: true, type: String, description: "Short-lived signed token obtained from a private Media record's URL - not entered manually." })
-  @ApiQuery({ name: 'disposition', required: false, enum: ['inline', 'attachment'], description: "'inline' (default) renders/previews in the browser, matching public media. Pass 'attachment' to force a browser download (e.g. from a download button)." })
+  @ApiQuery({ name: 'disposition', required: false, enum: ['inline', 'attachment'], description: "'inline' (default) renders/previews in the browser, matching public media - it applies only to types safe to render inline (images, audio, video, pdf); anything else is always downloaded. Pass 'attachment' to force a browser download (e.g. from a download button)." })
   @Get(':id/download')
   async download(@Param('id') id: string, @Query('disposition') disposition: string, @Res() res: Response, @SolidRequestContextDecorator() solidRequestContext: SolidRequestContextDto) {
     const media = await this.service.findOne(+id, {}, solidRequestContext);
     const { stream, fileName, mimeType } = await this.service.fileDownloadStream(media);
 
-    const contentDisposition = disposition === 'attachment' ? 'attachment' : 'inline';
-    res.setHeader('Content-Disposition', `${contentDisposition}; filename="${fileName}"`);
-    res.setHeader('Content-Type', mimeType);
-    res.setHeader('Cross-Origin-Resource-Policy', 'cross-origin');
-    res.setHeader('Access-Control-Expose-Headers', 'Content-Disposition, Content-Type');
+    // Mirror the static-serve hardening in SolidCoreModule: only a small allowlist of media
+    // types is ever safe to render inline. Anything else is forced to download rather than be
+    // displayed/executed, regardless of the mimetype the record was stored with - nosniff
+    // alone would not help here, since it faithfully honours a declared text/html.
+    const isInlineSafe = INLINE_SAFE_EXTENSIONS.has(getLowercaseFileExtension(fileName) ?? '');
+    const requestedInline = disposition !== 'attachment';
+
+    setFileDownloadHeaders(res, {
+      fileName,
+      mimeType: isInlineSafe ? mimeType : 'application/octet-stream',
+      disposition: requestedInline && isInlineSafe ? 'inline' : 'attachment',
+      crossOriginResourcePolicy: true,
+    });
+
     stream.pipe(res);
   }