@solidxai/core 0.1.13-beta.13 → 0.1.13-beta.14

package/src/helpers/security.helper.ts

@@ -1,15 +1,39 @@
 import { HelmetOptions } from "helmet";
 import { Environment } from "src/decorators/disallow-in-production.decorator";
 
+export interface SolidSecurityOptions {
+  /**
+   * Origins that may embed this application in an iframe.
+   * Defaults to the local HTTP/HTTPS loopback origins on any port.
+   */
+  frameAncestors?: string[];
+}
+
+export const DEFAULT_FRAME_ANCESTORS = [
+  "'self'",
+  "http://localhost:*",
+  "https://localhost:*",
+  "http://127.0.0.1:*",
+  "https://127.0.0.1:*",
+  "http://[::1]:*",
+  "https://[::1]:*",
+];
+
 /**
  * Default security headers for SolidX apps.
  * - HSTS only in prod over HTTPS
- * - CSP with frame-ancestors 'none' (prevents clickjacking)
- * - X-Frame-Options: DENY (legacy fallback)
+ * - CSP with configurable frame-ancestors
+ * - X-Frame-Options disabled when cross-origin frame ancestors are allowed
  * - No X-XSS-Protection (deprecated)
  */
-export function buildDefaultSecurityHeaderOptions(): Readonly<HelmetOptions> {
+export function buildDefaultSecurityHeaderOptions(
+  options: SolidSecurityOptions = {},
+): Readonly<HelmetOptions> {
   const isProd = process.env.ENV === Environment.Production;
+  const frameAncestors = options.frameAncestors ?? DEFAULT_FRAME_ANCESTORS;
+  const allowsCrossOriginFrames = frameAncestors.some(
+    (source) => source !== "'self'" && source !== "'none'",
+  );
 
   return {
     // Modern CSP. Add more directives as your app needs (script-src, connect-src, etc.)
@@ -23,7 +47,7 @@ export function buildDefaultSecurityHeaderOptions(): Readonly<HelmetOptions> {
         // "form-action": ["'self'"],
 
         // clickjacking defense (modern)
-        "frame-ancestors": ["'none'"],
+        "frame-ancestors": frameAncestors,
         "style-src": ["'self'"],
         // add/adjust as needed for your app:
         // "script-src": ["'self'"],              // add hashes/nonces/CSPRO if needed
@@ -34,9 +58,12 @@ export function buildDefaultSecurityHeaderOptions(): Readonly<HelmetOptions> {
       },
     },
 
-    
-    // Legacy clickjacking defense (kept for older UAs)
-    frameguard: { action: "deny" },
+    // Legacy clickjacking defense for configurations that do not allow
+    // cross-origin parents (kept for older UAs).
+    // X-Frame-Options cannot express an allowlist. It must be omitted when
+    // CSP allows a parent on another origin, otherwise older browsers may
+    // still block the iframe despite the CSP configuration.
+    frameguard: allowsCrossOriginFrames ? false : { action: "deny" },
 
     // Referrer/cross-origin policies
     referrerPolicy: { policy: "strict-origin-when-cross-origin" },
@@ -115,4 +142,4 @@ export function setDefaultCacheControl() {
 //   res.setHeader("Permissions-Policy", buildPermissionsPolicyHeader());
 //   next();
 // });
-// app.use(setDefaultCacheControl());
+// app.use(setDefaultCacheControl());

package/src/seeders/module-metadata-seeder.service.ts

@@ -1049,17 +1049,25 @@ export class ModuleMetadataSeederService {
 
     private async seedModelSequences(overallMetadata: any): Promise<{ pruned: number; upserted: number }> {
         const modelSequences = this.getSeedArray<CreateModelSequenceDto>(overallMetadata?.modelSequences);
-        const pruned = this.enablePruning ? await this.timeOperation('prune-model-sequences', () => this.pruneModelSequences(modelSequences, overallMetadata?.moduleMetadata?.name), {
+
+        // Getting rid of currentValue even if it is present in the seed data. 
+        // This is because we don't want to overwrite the currentValue in the database with the seed data. 
+        // The currentValue should be managed by the application and not by the seed data.
+        const cleanModelSequences = modelSequences.map((sequence) => {
+            const { currentValue, ...cleanModelSequence }: CreateModelSequenceDto = sequence;
+            return cleanModelSequence;
+        });
+        const pruned = this.enablePruning ? await this.timeOperation('prune-model-sequences', () => this.pruneModelSequences(cleanModelSequences, overallMetadata?.moduleMetadata?.name), {
             moduleName: overallMetadata?.moduleMetadata?.name,
             component: 'model-sequences',
             serviceCall: 'pruneModelSequences',
         }) : 0;
-        await this.timeOperation('handle-model-sequences', () => this.handleSeedModelSequences(modelSequences), {
+        await this.timeOperation('handle-model-sequences', () => this.handleSeedModelSequences(cleanModelSequences), {
             moduleName: overallMetadata?.moduleMetadata?.name,
             component: 'model-sequences',
             serviceCall: 'handleSeedModelSequences',
         });
-        return { pruned, upserted: modelSequences.length };
+        return { pruned, upserted: cleanModelSequences.length };
     }
 
     // OK

package/src/services/field-metadata.service.ts

@@ -7,12 +7,13 @@ import { ComputedFieldMetadata, SolidRegistry } from 'src/helpers/solid-registry
 import { FieldMetadataRepository } from 'src/repository/field-metadata.repository';
 import { DataSource, Repository, SelectQueryBuilder } from 'typeorm';
 import { BasicFilterDto } from '../dtos/basic-filters.dto';
-import { CascadeType, ComputedFieldValueType, CreateFieldMetadataDto, DecryptWhenType, EncryptionType, MediaType, MSSQLType, PSQLType, RelationType, SelectionValueType, SolidFieldType } from '../dtos/create-field-metadata.dto';
+import { CascadeType, ComputedFieldValueType, CreateFieldMetadataDto, DecryptWhenType, EncryptionType, MSSQLType, PSQLType, RelationType, SelectionValueType, SolidFieldType } from '../dtos/create-field-metadata.dto';
 import { SelectionDynamicQueryDto } from '../dtos/selection-dynamic-query.dto';
 import { UpdateFieldMetaDataDto } from '../dtos/update-field-metadata.dto';
 import { FieldMetadata } from '../entities/field-metadata.entity';
 import { ModelMetadata } from '../entities/model-metadata.entity';
 import { ISelectionProviderValues, MediaStorageProvider } from '../interfaces';
+import { MEDIA_CATEGORIES } from '../constants/media-file-types';
 import { CrudHelperService } from './crud-helper.service';
 import { ERROR_MESSAGES } from 'src/constants/error-messages';
 import qs from 'qs';
@@ -414,7 +415,7 @@ export class FieldMetadataService implements OnApplicationBootstrap {
             encryptionTypes: enumToResponseArray(EncryptionType),
             ormType: ormFieldTypeForSolid,
             decryptWhenTypes: enumToResponseArray(DecryptWhenType),
-            mediaTypes: enumToResponseArray(MediaType),
+            mediaTypes: MEDIA_CATEGORIES.map((value) => ({ label: value, value })),
             relationTypes: enumToResponseArray(RelationType),
             selectionDynamicProviders: sps,
             computedProviders: cps,