@solidxai/core 0.1.13-beta.2 → 0.1.13-beta.20

package/src/commands/run-tests.command.ts

@@ -3,10 +3,13 @@ import { SubCommand, CommandRunner, Option } from 'nest-commander';
 import * as path from 'path';
 import { ModuleMetadataHelperService } from 'src/helpers/module-metadata-helper.service';
 import { ConsoleReporter } from 'src/testing/reporter/console-reporter';
+import { ProgressReporter } from 'src/testing/reporter/progress-reporter';
 import { WebhookReporter } from 'src/testing/reporter/webhook-reporter';
 import { runFromMetadata } from 'src/testing/runner/run-from-metadata';
 import type { TestingMetadata } from 'src/testing/contracts/testing-metadata.types';
 import { SpecRegistry } from 'src/testing/core/spec-registry';
+import { SettingService } from 'src/services/setting.service';
+import type { SolidCoreSetting } from 'src/services/settings/default-settings-provider.service';
 
 interface TestRunCommandOptions {
   module?: string;
@@ -18,11 +21,14 @@ interface TestRunCommandOptions {
   apiBaseUrl?: string;
   uiBaseUrl?: string;
   headless?: boolean;
+  uiTimeoutMs?: number;
+  uiNavigationTimeoutMs?: number;
   timeoutMs?: number;
   retries?: number;
   listSpecs?: boolean;
   printApiLogs?: boolean;
   runName?: string;
+  progress?: boolean;
 }
 
 @SubCommand({
@@ -34,6 +40,7 @@ export class TestRunCommand extends CommandRunner {
 
   constructor(
     private readonly moduleMetadataHelperService: ModuleMetadataHelperService,
+    private readonly settingService: SettingService,
   ) {
     super();
   }
@@ -89,13 +96,24 @@ export class TestRunCommand extends CommandRunner {
       const apiBaseUrl = options?.apiBaseUrl ?? process.env.BASE_URL;
       const uiBaseUrl = options?.uiBaseUrl ?? process.env.FRONTEND_BASE_URL;
       const headless = options?.headless ?? true;
+      const uiTimeoutMs =
+        options?.uiTimeoutMs
+        ?? toPositiveNumber(process.env.UI_TIMEOUT_MS)
+        ?? toPositiveNumber(this.settingService.getConfigValue<SolidCoreSetting>('uiTestDefaultTimeoutMs'));
+      const uiNavigationTimeoutMs =
+        options?.uiNavigationTimeoutMs
+        ?? toPositiveNumber(process.env.UI_NAVIGATION_TIMEOUT_MS)
+        ?? toPositiveNumber(this.settingService.getConfigValue<SolidCoreSetting>('uiTestNavigationTimeoutMs'));
       const printApiLogs = options?.printApiLogs ?? false;
 
       const webhookUrl = process.env.SOLIDCTL_WEBHOOK_URL;
       const runName = options?.runName ?? `run-${Date.now()}`;
-      const reporter = webhookUrl
+      const baseReporter = webhookUrl
         ? new WebhookReporter(webhookUrl, runName)
         : new ConsoleReporter();
+      const reporter = options?.progress === false
+        ? baseReporter
+        : new ProgressReporter(baseReporter);
 
       try {
         await runFromMetadata({
@@ -105,7 +123,12 @@ export class TestRunCommand extends CommandRunner {
           skipScenarioIds,
           reporter,
           api: apiBaseUrl ? { baseUrl: apiBaseUrl } : undefined,
-          ui: { baseUrl: uiBaseUrl, headless },
+          ui: {
+            baseUrl: uiBaseUrl,
+            headless,
+            defaultTimeoutMs: uiTimeoutMs,
+            navigationTimeoutMs: uiNavigationTimeoutMs,
+          },
           defaults: {
             timeoutMs: options?.timeoutMs,
             retries: options?.retries,
@@ -120,8 +143,8 @@ export class TestRunCommand extends CommandRunner {
         console.error('Run tests command failed');
         process.exitCode = 1;
       } finally {
-        if (reporter instanceof WebhookReporter) {
-          await reporter.flush(Number(process.exitCode ?? 0));
+        if (baseReporter instanceof WebhookReporter) {
+          await baseReporter.flush(Number(process.exitCode ?? 0));
         }
       }
       return;
@@ -225,6 +248,26 @@ export class TestRunCommand extends CommandRunner {
     return val === 'false' ? false : true;
   }
 
+  @Option({
+    flags: '--ui-timeout-ms [number]',
+    description:
+      'Default timeout in ms for UI steps (waits, clicks, fills). Defaults to process.env.UI_TIMEOUT_MS, then the uiTestDefaultTimeoutMs setting, then 30000.',
+    required: false,
+  })
+  parseUiTimeoutMs(val: string): number {
+    return Number(val);
+  }
+
+  @Option({
+    flags: '--ui-navigation-timeout-ms [number]',
+    description:
+      'Default timeout in ms for ui.goto navigation. Defaults to process.env.UI_NAVIGATION_TIMEOUT_MS, then the uiTestNavigationTimeoutMs setting, then --ui-timeout-ms.',
+    required: false,
+  })
+  parseUiNavigationTimeoutMs(val: string): number {
+    return Number(val);
+  }
+
   @Option({
     flags: '--timeout-ms [number]',
     description: 'Default scenario timeout in milliseconds.',
@@ -251,6 +294,15 @@ export class TestRunCommand extends CommandRunner {
   parseRunName(val: string): string {
     return val;
   }
+
+  @Option({
+    flags: '--no-progress',
+    description: 'Disable the interactive test progress footer.',
+    required: false,
+  })
+  parseNoProgress(): boolean {
+    return false;
+  }
 }
 
 function splitCsv(value?: string): string[] | undefined {
@@ -262,6 +314,14 @@ function splitCsv(value?: string): string[] | undefined {
   return items.length ? items : undefined;
 }
 
+// Accepts unknown because settings come back already parsed as numbers, while env
+// vars arrive as strings.
+function toPositiveNumber(value?: unknown): number | undefined {
+  if (value === null || value === undefined || value === '') return undefined;
+  const parsed = Number(value);
+  return Number.isFinite(parsed) && parsed > 0 ? parsed : undefined;
+}
+
 function resolveSpecPath(entry: string, metadataPath: string): string {
   if (path.isAbsolute(entry)) {
     return entry;

package/src/commands/seed.command.ts

@@ -7,6 +7,7 @@ interface SeedCommandOptions {
   seeder?: string;
   modulesToSeed?: string;
   prune?: boolean;
+  skipHooks?: boolean;
 }
 
 @Command({ name: 'seed', description: 'Install seed data for a given module' })
@@ -28,6 +29,7 @@ export class SeedCommand extends CommandRunner {
         modulesToSeed,
         pruneMetadata: false,
         seedGlobalMetadata: true,
+        skipHooks: false,
       };
       this.logger.log(`Modules to seed: ${modulesToSeed.join(', ')}`);
     } else {
@@ -39,10 +41,22 @@ export class SeedCommand extends CommandRunner {
         modulesToSeed: null,
         pruneMetadata: false,
         seedGlobalMetadata: true,
+        skipHooks: false,
       };
       parsedConf.pruneMetadata = true;
     }
 
+    if (options?.skipHooks) {
+      parsedConf = parsedConf ?? {
+        modulesToSeed: null,
+        pruneMetadata: false,
+        seedGlobalMetadata: true,
+        skipHooks: false,
+      };
+      parsedConf.skipHooks = true;
+      this.logger.log('Skipping pre-seed and post-seed hooks.');
+    }
+
     const seeder = this.solidRegistry
       .getSeeders()
       .filter((seeder) => seeder.name === options.seeder)
@@ -74,4 +88,9 @@ export class SeedCommand extends CommandRunner {
   parsePrune(): boolean {
     return true;
   }
+
+  @Option({ flags: '--skip-hooks', description: 'Skip emitting pre-seed and post-seed lifecycle hooks/events.' })
+  parseSkipHooks(): boolean {
+    return true;
+  }
 }

package/src/config/cache.options.ts

@@ -1,6 +1,14 @@
 import { CacheModuleAsyncOptions } from '@nestjs/cache-manager';
 import { ConfigModule, ConfigService } from '@nestjs/config';
-import { redisStore } from 'cache-manager-redis-store';
+// cache-manager-redis-yet, not cache-manager-redis-store. The latter stops at
+// 3.0.1 and implements the cache-manager v4 store contract: it expects an
+// options object and reads `options.ttl` in seconds. cache-manager v5 calls
+// `store.set(key, value, ttl)` with a bare number of milliseconds, so that
+// store found no `.ttl`, fell back to an unset default, and issued a plain
+// `SET` - silently discarding every TTL passed anywhere in the app and leaving
+// Redis keys that never expire. redis-yet implements the v5 contract and
+// writes with `PX`, so millisecond TTLs land correctly.
+import { redisStore } from 'cache-manager-redis-yet';
 import { isRedisConfigured } from 'src/helpers/environment.helper';
 
 export const CacheManagerOptions: CacheModuleAsyncOptions = {

package/src/constants/chatter-message.constants.ts

@@ -1,3 +1,5 @@
+import { USER_SUMMARY_FIELDS } from 'src/constants/user.constants';
+
 export const CHATTER_MESSAGE_TYPE = {
     AUDIT: 'audit',
     CUSTOM: 'custom',
@@ -16,3 +18,13 @@ export const CHATTER_MESSAGE_STATUS = {
     PENDING: 'pending',
     COMPLETED: 'completed',
 } as const;
+
+/**
+ * Columns of the message author exposed by the chatter APIs.
+ *
+ * The chatter panel renders `fullName` (name label + initials avatar) and uses `id`
+ * for the own-note edit check; the admin list/form/tree views display `fullName` via
+ * each view's `coModelFieldToDisplay`. That is exactly the platform-wide summary
+ * shape, so this is an alias rather than a second list to keep in step.
+ */
+export const CHATTER_MESSAGE_USER_FIELDS = USER_SUMMARY_FIELDS;

package/src/constants/draft-publish-fields.ts

@@ -0,0 +1,5 @@
+// The versioning columns CommonEntity adds for draft/publish support. These don't exist on
+// legacy tables (see LegacyCommonEntityWithExistingId) and don't carry over when a new draft
+// version is copied from its source entity, so both of those call sites share this list rather
+// than each hand-enumerating the same four names.
+export const DRAFT_PUBLISH_VERSIONING_FIELD_NAMES = ['isPublished', 'isLatest', 'initialEntityVersionId', 'publishedTracker'] as const;

package/src/constants/error-messages.ts

@@ -127,6 +127,20 @@ export const ERROR_MESSAGES = {
 
     DEFAULT_REGEX_PATTERN_NOT_MATCHING_ERROR_MSG: 'Invalid regex pattern.',
 
+    // MPIN errors.
+    // MPIN_INVALID is deliberately shared by "wrong MPIN" and "unknown handle",
+    // so a failed sign-in never reveals whether the credential handle was real.
+    // MPIN_REVOKED is separate and is returned for any attempt against a
+    // deactivated credential - it discloses nothing useful, since a dead
+    // credential grants no capability, and it lets the client stop retrying.
+    MPIN_INVALID: 'Invalid MPIN.',
+    MPIN_LOCKED: 'MPIN sign-in is temporarily locked due to repeated failed attempts.',
+    MPIN_REVOKED: 'MPIN sign-in has been disabled for this device. Please sign in normally.',
+    MPIN_NOT_ENABLED: 'MPIN sign-in is not enabled.',
+    MPIN_FORMAT_INVALID: 'MPIN does not meet the required format.',
+    MPIN_TOO_PREDICTABLE: 'MPIN is too easy to guess. Avoid repeated or sequential digits.',
+    MPIN_CREDENTIAL_NOT_FOUND: 'MPIN device credential not found.',
+
     PERMISSION_MESSAGES: {
     insertMany: (model?: string) =>
       `You do not have permission to import ${model ?? 'these'} records.`,

package/src/constants/media-file-types.ts

@@ -1,5 +1,7 @@
 export type MediaCategory = 'image' | 'audio' | 'video' | 'file' | 'pdf';
 
+export const MEDIA_CATEGORIES = ['image', 'audio', 'video', 'file', 'pdf'] as const;
+
 const IMAGE_EXTENSIONS = ['png', 'jpg', 'jpeg', 'webp', 'gif', 'bmp', 'tiff', 'heic', 'heif'];
 const AUDIO_EXTENSIONS = ['mp3', 'wav', 'ogg', 'aac', 'm4a', 'flac', 'webm'];
 const VIDEO_EXTENSIONS = ['mp4', 'mov', 'avi', 'mkv', 'mpeg', 'mpg', '3gp', '3g2', 'webm', 'ogg'];
@@ -17,6 +19,131 @@ export const DANGEROUS_EXTENSIONS = new Set([
     'exe', 'sh', 'bat', 'cmd', 'ps1', 'jar', 'dll',
 ]);
 
+
+/**
+ * Mimetypes that are never safe to accept, regardless of extension. These render as active
+ * content in a browser (svg can carry <script>), so they are rejected even when the filename
+ * looks harmless. Kept alongside DANGEROUS_EXTENSIONS so upload paths check both.
+ */
+export const DANGEROUS_MIME_TYPES = new Set([
+    'image/svg+xml', 'text/html', 'application/xhtml+xml',
+]);
+
+/**
+ * Percent-decodes a filename, repeating a bounded number of times so a double-encoded payload
+ * (`%252e` -> `%2e` -> `.`) survives a single pass through a proxy/framework that already
+ * decoded once. Malformed escape sequences are left as-is rather than thrown, since this runs
+ * on attacker-controlled input and a literal `%` in a filename (`100%done.pdf`) is legal.
+ */
+function decodePercentEncodingSafely(name: string): string {
+    let decoded = name;
+    for (let i = 0; i < 3; i++) {
+        let next: string;
+        try {
+            next = decodeURIComponent(decoded);
+        } catch {
+            return decoded;
+        }
+        if (next === decoded) {
+            return decoded;
+        }
+        decoded = next;
+    }
+    return decoded;
+}
+
+/**
+ * Reduces a client-supplied name to the name that will actually be resolved on disk, so
+ * extension checks can't be dodged by decorating it. Each step defends a known bypass:
+ *
+ *  - `evil.exe%2e`         -> percent-encoding a trailing dot (or anything else) hides the real
+ *                             extension from naive string matching; decode before inspecting it.
+ *  - `../../evil.exe`      -> only the final path segment is the file name.
+ *  - `evil.exe\0.png`      -> a NUL truncates the name at the syscall/filesystem layer, so
+ *                             anything after it is invisible to the OS but visible to naive
+ *                             validation.
+ *  - `evil.exe::$DATA`     -> NTFS alternate data stream suffix; the file on disk is evil.exe.
+ *  - `evil.exe.` / `.exe ` -> Windows silently strips trailing dots and spaces when resolving
+ *                             a path, so these land on disk as evil.exe.
+ */
+export function normalizeUploadedFileName(fileName?: string | null): string {
+    if (!fileName) {
+        return '';
+    }
+
+    let name = decodePercentEncodingSafely(String(fileName));
+    name = name.split(/[/\\]/).pop() ?? '';
+
+    const nulIndex = name.indexOf('\0');
+    if (nulIndex >= 0) {
+        name = name.slice(0, nulIndex);
+    }
+
+    const streamIndex = name.indexOf(':');
+    if (streamIndex >= 0) {
+        name = name.slice(0, streamIndex);
+    }
+
+    return name.replace(/[\s.]+$/, '');
+}
+
+/**
+ * The effective extension - what the OS/browser will treat the file as. Used for media
+ * category resolution and inline-safety decisions. Always normalizes first, so
+ * `evil.exe.` resolves to `exe` rather than to nothing.
+ */
+export function getLowercaseFileExtension(fileName?: string | null): string | undefined {
+    const name = normalizeUploadedFileName(fileName);
+
+    const lastDotIndex = name.lastIndexOf('.');
+    if (lastDotIndex < 0 || lastDotIndex === name.length - 1) {
+        return undefined;
+    }
+
+    return name.slice(lastDotIndex + 1).toLowerCase();
+}
+
+/**
+ * Every dot-delimited segment after the stem, lowercased. The danger check uses this rather
+ * than only the effective extension so a dangerous type buried in a double extension
+ * (`evil.exe.png`, `shell.php.jpg`) is still caught - several servers and browsers resolve
+ * such names by an earlier segment than the last one.
+ *
+ * The stem is skipped so an innocuous file that merely starts with a keyword (`exe.png`)
+ * isn't rejected.
+ */
+export function getLowercaseFileExtensionSegments(fileName?: string | null): string[] {
+    const segments = normalizeUploadedFileName(fileName).toLowerCase().split('.');
+    return segments.slice(1).filter(segment => segment.length > 0);
+}
+
+/** Minimal shape of an uploaded file, so this module stays free of framework imports. */
+export interface UploadedFileLike {
+    mimetype?: string;
+    originalname?: string;
+    filename?: string;
+}
+
+/** originalname is the client-supplied name; filename is multer's on-disk name. */
+export function getUploadedFileName(file?: UploadedFileLike | null): string {
+    return file?.originalname ?? file?.filename ?? '';
+}
+
+/**
+ * Single predicate for "must never be stored". Shared by every upload entry point
+ * (MediaFieldCrudManager, chatter attachments) so the rules can't drift between them.
+ * Extensions are checked before mimetype so a spoofed Content-Type (e.g.
+ * application/octet-stream, or image/png, on an .html file) can't bypass it.
+ */
+export function isDangerousMediaFile(file?: UploadedFileLike | null): boolean {
+    const segments = getLowercaseFileExtensionSegments(getUploadedFileName(file));
+    if (segments.some(segment => DANGEROUS_EXTENSIONS.has(segment))) {
+        return true;
+    }
+
+    return DANGEROUS_MIME_TYPES.has((file?.mimetype || '').toLowerCase().trim());
+}
+
 /**
  * Single source of truth for extension -> coarse media category. Shared by upload-time
  * validation (MediaFieldCrudManager) and serve-time header hardening (ServeStaticModule), so

package/src/constants/success-messages.ts

@@ -6,6 +6,11 @@ export const SUCCESS_MESSAGES = {
     LOGOUT_SUCCESS: 'Logged out successfully',
     USER_REGISTERED: 'User registered successfully.',
 
+    // MPIN messages
+    MPIN_SETUP_SUCCESS: 'MPIN set up successfully.',
+    MPIN_CHANGED_SUCCESS: 'MPIN changed successfully.',
+    MPIN_DEVICE_REVOKED: 'MPIN sign-in removed for this device.',
+
     // CRUD service messages
     RECORD_RECOVERED: 'Record successfully recovered',
     SELECTED_RECORDS_RECOVERED: 'Selected records successfully recovered',

package/src/constants/user.constants.ts

@@ -0,0 +1,13 @@
+/**
+ * The columns of a `User` that are safe to embed in another entity's API response.
+ *
+ * Whenever a user is attached to a record the caller asked for - a `createdBy` /
+ * `updatedBy` populate, a chatter message author - the caller wants to display who it
+ * was, not to read their profile. Everything else on `User` is PII (email, mobile),
+ * authz metadata (roles, apiKeys) or secret, and the embedded user is frequently
+ * someone the viewer has no other visibility of.
+ *
+ * `fullName` is nullable; consumers that need a fallback should use the record's own
+ * context rather than widening this list.
+ */
+export const USER_SUMMARY_FIELDS = ['id', 'fullName'] as const;

package/src/controllers/authentication.controller.ts

@@ -107,8 +107,11 @@ export class AuthenticationController {
     @Post('logout')
     @Public()
     @HttpCode(HttpStatus.OK)
-    async logout(@Body('refreshToken') refreshToken: string) {
-        return this.authService.logout(refreshToken);
+    async logout(
+        @Body('refreshToken') refreshToken: string,
+        @Body('allDevices') allDevices?: boolean,
+    ) {
+        return this.authService.logout(refreshToken, allDevices === true);
     }
 
     @ApiBearerAuth("jwt")

package/src/controllers/chatter-message.controller.ts

@@ -95,6 +95,14 @@ export class ChatterMessageController {
     return this.service.find(query);  
   }
 
+  @ApiBearerAuth("jwt")
+  @ApiQuery({ name: 'search', required: false, type: String })
+  @ApiQuery({ name: 'limit', required: false, type: Number })
+  @Get('mentionable-users')
+  async getMentionableUsers(@Query() query: any) {
+    return this.service.getMentionableUsers(query?.search, query?.limit ? +query.limit : undefined);
+  }
+
   @ApiBearerAuth("jwt")
   @Get(':id')
   async findOne(@Param('id') id: string, @Query() query: any) {

package/src/controllers/export-template.controller.ts

@@ -8,6 +8,7 @@ import { Response } from 'express';
 import { StartExportSyncDto } from 'src/dtos/export.dto';
 import { ActiveUser } from 'src/decorators/active-user.decorator';
 import { ActiveUserData } from 'src/interfaces/active-user-data.interface';
+import { setFileDownloadHeaders } from 'src/helpers/file-download.helper';
 
 @ApiTags('Solid Core') 
 @Controller('export-template') //FIXME: Change this to the model plural name 
@@ -91,9 +92,10 @@ export class ExportTemplateController {
       throw new InternalServerErrorException("Export stream is null");
     }
     // ✅ Set response headers for streaming
-    res.setHeader('Content-Disposition', `attachment; filename="${exportFileInfo.fileName}"`);
-    res.setHeader('Content-Type', exportFileInfo.mimeType);
-    res.setHeader('Access-Control-Expose-Headers', 'Content-Disposition, Content-Type');
+    setFileDownloadHeaders(res, {
+      fileName: exportFileInfo.fileName,
+      mimeType: exportFileInfo.mimeType,
+    });
     // Pipe the strea to the response as an excel file
     exportFileInfo.exportStream.pipe(res);
   }

package/src/controllers/import-transaction.controller.ts

@@ -7,6 +7,7 @@ import { UpdateImportTransactionDto } from '../dtos/update-import-transaction.dt
 import { Response } from 'express';
 import { ActiveUser } from 'src/decorators/active-user.decorator';
 import { ActiveUserData } from 'src/interfaces/active-user-data.interface';
+import { setFileDownloadHeaders } from 'src/helpers/file-download.helper';
 
 enum ShowSoftDeleted {
   INCLUSIVE = "inclusive",
@@ -27,9 +28,10 @@ export class ImportTransactionController {
     }
 
     // ✅ Set response headers for streaming
-    res.setHeader('Content-Disposition', `attachment; filename="${importTemplateFileInfo.fileName}"`);
-    res.setHeader('Content-Type', importTemplateFileInfo.mimeType);
-    res.setHeader('Access-Control-Expose-Headers', 'Content-Disposition, Content-Type');
+    setFileDownloadHeaders(res, {
+      fileName: importTemplateFileInfo.fileName,
+      mimeType: importTemplateFileInfo.mimeType,
+    });
     // Pipe the stream to the response as an excel file
     importTemplateFileInfo.stream.pipe(res);
   }
@@ -117,9 +119,7 @@ export class ImportTransactionController {
       throw new InternalServerErrorException("Failed records stream is null");
     }
     // ✅ Set response headers for streaming
-    res.setHeader('Content-Disposition', `attachment; filename="${fileName}"`);
-    res.setHeader('Content-Type', mimeType);
-    res.setHeader('Access-Control-Expose-Headers', 'Content-Disposition, Content-Type');
+    setFileDownloadHeaders(res, { fileName, mimeType });
     // Pipe the strea to the response as an excel file
     stream.pipe(res);
   }

package/src/controllers/media.controller.ts

@@ -9,6 +9,8 @@ import { SolidRequestContextDto } from 'src/dtos/solid-request-context.dto';
 import { UpdateMediaDto } from 'src/dtos/update-media.dto';
 import { MediaService } from 'src/services/media.service';
 import { Response } from 'express';
+import { getLowercaseFileExtension, INLINE_SAFE_EXTENSIONS } from 'src/constants/media-file-types';
+import { setFileDownloadHeaders } from 'src/helpers/file-download.helper';
 
 enum ShowSoftDeleted {
   INCLUSIVE = "inclusive",
@@ -91,17 +93,26 @@ export class MediaController {
 
   @Auth(AuthType.MediaSignedUrl)
   @ApiQuery({ name: 'token', required: true, type: String, description: "Short-lived signed token obtained from a private Media record's URL - not entered manually." })
-  @ApiQuery({ name: 'disposition', required: false, enum: ['inline', 'attachment'], description: "'inline' (default) renders/previews in the browser, matching public media. Pass 'attachment' to force a browser download (e.g. from a download button)." })
+  @ApiQuery({ name: 'disposition', required: false, enum: ['inline', 'attachment'], description: "'inline' (default) renders/previews in the browser, matching public media - it applies only to types safe to render inline (images, audio, video, pdf); anything else is always downloaded. Pass 'attachment' to force a browser download (e.g. from a download button)." })
   @Get(':id/download')
   async download(@Param('id') id: string, @Query('disposition') disposition: string, @Res() res: Response, @SolidRequestContextDecorator() solidRequestContext: SolidRequestContextDto) {
     const media = await this.service.findOne(+id, {}, solidRequestContext);
     const { stream, fileName, mimeType } = await this.service.fileDownloadStream(media);
 
-    const contentDisposition = disposition === 'attachment' ? 'attachment' : 'inline';
-    res.setHeader('Content-Disposition', `${contentDisposition}; filename="${fileName}"`);
-    res.setHeader('Content-Type', mimeType);
-    res.setHeader('Cross-Origin-Resource-Policy', 'cross-origin');
-    res.setHeader('Access-Control-Expose-Headers', 'Content-Disposition, Content-Type');
+    // Mirror the static-serve hardening in SolidCoreModule: only a small allowlist of media
+    // types is ever safe to render inline. Anything else is forced to download rather than be
+    // displayed/executed, regardless of the mimetype the record was stored with - nosniff
+    // alone would not help here, since it faithfully honours a declared text/html.
+    const isInlineSafe = INLINE_SAFE_EXTENSIONS.has(getLowercaseFileExtension(fileName) ?? '');
+    const requestedInline = disposition !== 'attachment';
+
+    setFileDownloadHeaders(res, {
+      fileName,
+      mimeType: isInlineSafe ? mimeType : 'application/octet-stream',
+      disposition: requestedInline && isInlineSafe ? 'inline' : 'attachment',
+      crossOriginResourcePolicy: true,
+    });
+
     stream.pipe(res);
   }
 

package/src/controllers/module-package.controller.ts

@@ -13,6 +13,7 @@ import { ApiBearerAuth, ApiTags } from '@nestjs/swagger';
 import { Response } from 'express';
 import { ConfirmModulePackageImportDto } from 'src/dtos/confirm-module-package-import.dto';
 import { RunModulePackageBuildDto } from 'src/dtos/run-module-package-build.dto';
+import { setFileDownloadHeaders } from 'src/helpers/file-download.helper';
 import { RunModulePackageSeedDto } from 'src/dtos/run-module-package-seed.dto';
 import { ModulePackageService } from 'src/services/module-package.service';
 
@@ -39,9 +40,7 @@ export class ModulePackageController {
         @Res() res: Response,
     ) {
         const archive = await this.modulePackageService.exportModulePackage(moduleName);
-        res.setHeader('Content-Disposition', `attachment; filename="${archive.fileName}"`);
-        res.setHeader('Content-Type', archive.mimeType);
-        res.setHeader('Access-Control-Expose-Headers', 'Content-Disposition, Content-Type');
+        setFileDownloadHeaders(res, { fileName: archive.fileName, mimeType: archive.mimeType });
         res.sendFile(archive.filePath);
     }
 

package/src/controllers/mpin-authentication.controller.ts

@@ -0,0 +1,67 @@
+import { Body, Controller, Delete, Get, HttpCode, HttpStatus, Param, ParseIntPipe, Post } from '@nestjs/common';
+import { ApiBearerAuth, ApiTags } from '@nestjs/swagger';
+import { ActiveUser } from '../decorators/active-user.decorator';
+import { Public } from '../decorators/public.decorator';
+import { ChangeMpinDto } from '../dtos/change-mpin.dto';
+import { MpinLoginDto } from '../dtos/mpin-login.dto';
+import { SetupMpinDto } from '../dtos/setup-mpin.dto';
+import { ActiveUserData } from '../interfaces/active-user-data.interface';
+import { MpinService } from '../services/mpin.service';
+
+/**
+ * There is deliberately no public "is MPIN set up for this identifier" route.
+ * That would reintroduce exactly the user-enumeration oracle the opaque
+ * credential handle removes. The client decides whether to show the MPIN
+ * screen from the presence of its own stored handle.
+ */
+@Controller('iam/mpin')
+@ApiTags('Solid Core')
+export class MpinAuthenticationController {
+    constructor(private readonly mpinService: MpinService) { }
+
+    @ApiBearerAuth('jwt')
+    @Post('setup')
+    @HttpCode(HttpStatus.OK)
+    setup(
+        @Body() setupMpinDto: SetupMpinDto,
+        @ActiveUser() activeUser: ActiveUserData,
+    ) {
+        return this.mpinService.setupMpin(activeUser, setupMpinDto);
+    }
+
+    @ApiBearerAuth('jwt')
+    @Post('change')
+    @HttpCode(HttpStatus.OK)
+    change(
+        @Body() changeMpinDto: ChangeMpinDto,
+        @ActiveUser() activeUser: ActiveUserData,
+    ) {
+        return this.mpinService.changeMpin(activeUser, changeMpinDto);
+    }
+
+    // Public by necessity - the caller has no session yet. The credential
+    // handle is unguessable, so this carries no enumeration surface.
+    @Public()
+    @Post('login')
+    @HttpCode(HttpStatus.OK)
+    login(@Body() mpinLoginDto: MpinLoginDto) {
+        return this.mpinService.loginWithMpin(mpinLoginDto);
+    }
+
+    @ApiBearerAuth('jwt')
+    @Get('devices')
+    listDevices(@ActiveUser() activeUser: ActiveUserData) {
+        return this.mpinService.listDevices(activeUser);
+    }
+
+    // By row id, never by credential handle, so the management UI never has to
+    // hold the secret.
+    @ApiBearerAuth('jwt')
+    @Delete('devices/:id')
+    revokeDevice(
+        @Param('id', ParseIntPipe) id: number,
+        @ActiveUser() activeUser: ActiveUserData,
+    ) {
+        return this.mpinService.revokeDevice(activeUser, id);
+    }
+}

package/src/dtos/basic-filters.dto.ts

@@ -60,10 +60,6 @@ export class BasicFilterDto extends PaginationQueryDto {
     @ApiProperty({ description: "locale" })
     readonly locale?: string;
 
-    @IsOptional()
-    @ApiProperty({ description: "status publish draft" })
-    readonly status?: string;
-
     // @IsOptional()
     // @ApiProperty({ description: "default locale id" })
     // readonly defaultEntityLocaleId?: number;