@solidxai/core 0.1.13-beta.2 → 0.1.13-beta.20

package/src/entities/workflow-secret.entity.ts

@@ -1,5 +1,6 @@
 import { CommonEntity } from 'src/entities/common.entity';
 import { Entity, Column, Index } from 'typeorm';
+import { getColumnType } from 'src/helpers/typeorm-db-helper';
 
 @Entity('ss_workflow_secret')
 export class WorkflowSecret extends CommonEntity {
@@ -25,9 +26,9 @@ export class WorkflowSecret extends CommonEntity {
     @Column({ type: "varchar", default: "active" })
     status: string = "active";
 
-    @Column({ type: "timestamp", nullable: true })
+    @Column({ nullable: true, ...getColumnType('datetime') })
     lastRotatedAt: Date;
 
-    @Column({ type: "timestamp", nullable: true })
+    @Column({ nullable: true, ...getColumnType('datetime') })
     lastAccessedAt: Date;
 }

package/src/entities/workflow-step-execution.entity.ts

@@ -1,6 +1,7 @@
 import { CommonEntity } from 'src/entities/common.entity';
 import { Entity, Column, Index, JoinColumn, ManyToOne } from 'typeorm';
 import { WorkflowExecution } from './workflow-execution.entity'
+import { getColumnType } from 'src/helpers/typeorm-db-helper';
 
 @Entity('ss_workflow_step_execution')
 export class WorkflowStepExecution extends CommonEntity {
@@ -55,11 +56,11 @@ export class WorkflowStepExecution extends CommonEntity {
     sequenceNumber: number;
 
     @Index()
-    @Column({ type: "timestamp", nullable: true })
+    @Column({ nullable: true, ...getColumnType('datetime') })
     startedAt: Date;
 
     @Index()
-    @Column({ type: "timestamp", nullable: true })
+    @Column({ nullable: true, ...getColumnType('datetime') })
     finishedAt: Date;
 
     @Column({ type: "bigint", nullable: true })

package/src/entities/workflow-trigger-execution.entity.ts

@@ -2,6 +2,7 @@ import { CommonEntity } from 'src/entities/common.entity';
 import { Entity, Column, Index, JoinColumn, ManyToOne } from 'typeorm';
 import { WorkflowDefinition } from './workflow-definition.entity';
 import { WorkflowExecution } from './workflow-execution.entity'
+import { getColumnType } from 'src/helpers/typeorm-db-helper';
 
 @Entity('ss_workflow_trigger_execution')
 export class WorkflowTriggerExecution extends CommonEntity {
@@ -10,12 +11,12 @@ export class WorkflowTriggerExecution extends CommonEntity {
     triggerExecutionKey: string;
 
     @Index()
-    @ManyToOne(() => WorkflowDefinition, { onDelete: "CASCADE", nullable: false })
+    @ManyToOne(() => WorkflowDefinition, { nullable: false })
     @JoinColumn()
     workflowDefinition: WorkflowDefinition;
 
     @Index()
-    @ManyToOne(() => WorkflowExecution, { onDelete: "CASCADE", nullable: true })
+    @ManyToOne(() => WorkflowExecution, { nullable: true })
     @JoinColumn()
     workflowExecution: WorkflowExecution;
 
@@ -35,19 +36,19 @@ export class WorkflowTriggerExecution extends CommonEntity {
     status: string = "received";
 
     @Index()
-    @Column({ type: "boolean", nullable: true, default: false })
+    @Column({ nullable: true, default: false })
     matched: boolean = false;
 
     @Index()
-    @Column({ type: "timestamp" })
+    @Column({ ...getColumnType('datetime') })
     firedAt: Date;
 
     @Index()
-    @Column({ type: "timestamp", nullable: true })
+    @Column({ nullable: true, ...getColumnType('datetime') })
     startedAt: Date;
 
     @Index()
-    @Column({ type: "timestamp", nullable: true })
+    @Column({ nullable: true, ...getColumnType('datetime') })
     finishedAt: Date;
 
     @Column({ type: "bigint", nullable: true })

package/src/factories/mail.factory.ts

@@ -30,8 +30,14 @@ export class MailFactory {
         }
 
         const mailServiceProvider = mailProviders.find(provider => provider.name === mailServiceName);
+        if (!mailServiceProvider?.instance) {
+            const registeredProviders = mailProviders.map((provider) => provider?.name).filter(Boolean).join(", ");
+            throw new Error(
+                `Mail provider "${mailServiceName}" is not registered. Registered providers: ${registeredProviders || "none"}`,
+            );
+        }
 
         return mailServiceProvider.instance as IMail;
     }
 
-}
+}

package/src/filters/http-exception.filter.ts

@@ -30,12 +30,22 @@ export class HttpExceptionFilter implements ExceptionFilter {
         const isHttp = exception instanceof HttpException;
         const explicitStatus = isHttp ? exception.getStatus() : undefined;
 
+        // Errors from http-errors-style libraries (e.g. body-parser's PayloadTooLargeError)
+        // are plain Errors carrying their own status. Honour it rather than collapsing to 500.
+        const rawStatus = exception?.status ?? exception?.statusCode;
+        const derivedStatus =
+            typeof rawStatus === 'number' && rawStatus >= 400 && rawStatus < 600
+                ? rawStatus
+                : undefined;
+
         // Canonical code + static message
         const code: ErrorCode = this.errorMapper.mapException(exception);
         const defaultStatus = this.errorMapper.getHttpStatus(code);
         const message = code === 'solidx-unknown-error' ? `${exception?.message}` : this.errorMapper.getMessage(code);
 
-        const status = explicitStatus ?? defaultStatus ?? 500;
+        // derivedStatus must precede defaultStatus: getHttpStatus() returns a hard 500
+        // for unmatched codes, so it is never undefined and would always win otherwise.
+        const status = explicitStatus ?? derivedStatus ?? defaultStatus ?? 500;
 
         // Logging
         this.logger.error(

package/src/helpers/bootstrap.helper.ts

@@ -1,5 +1,6 @@
 import { ClassSerializerInterceptor, ValidationPipe } from '@nestjs/common';
 import { NestFactory, Reflector } from '@nestjs/core';
+import { NestExpressApplication } from '@nestjs/platform-express';
 import { WsAdapter } from '@nestjs/platform-ws';
 import { DocumentBuilder, SwaggerModule } from '@nestjs/swagger';
 import { NextFunction, Request, Response } from 'express';
@@ -12,7 +13,12 @@ import { CommandFactory } from 'nest-commander';
 import { createWinstonLoggerConfig } from '../winston.logger';
 import { WrapResponseInterceptor } from '../interceptors/wrap-response.interceptor';
 import { buildDefaultCorsOptions } from './cors.helper';
-import { buildDefaultSecurityHeaderOptions, buildPermissionsPolicyHeader, PermissionsPolicyConfig } from './security.helper';
+import {
+  buildDefaultSecurityHeaderOptions,
+  buildPermissionsPolicyHeader,
+  PermissionsPolicyConfig,
+  SolidSecurityOptions,
+} from './security.helper';
 import { parseBooleanEnv } from './environment.helper';
 
 // ---- Shared process handlers ----
@@ -50,8 +56,20 @@ export interface SolidBootstrapOptions {
   swagger?: SolidSwaggerOptions | false;
   /** Permissions-Policy header overrides (merged with defaults). */
   permissionsPolicyOverrides?: Partial<PermissionsPolicyConfig>;
+  /** Security header overrides, including iframe frame-ancestor allowlists. */
+  security?: SolidSecurityOptions;
   /** Show full NestJS init logs during bootstrap (route mapping, module deps, pollers). Defaults to false. */
   verboseBootstrap?: boolean;
+  /**
+   * Max request body size for JSON and urlencoded payloads, as a `bytes`-compatible
+   * string (e.g. '10mb', '512kb'). Defaults to '10mb'.
+   *
+   * Does NOT apply to multipart/form-data uploads: body-parser matches on Content-Type,
+   * so multipart requests skip these parsers entirely and are handled by Multer. Raise
+   * this only for large structured JSON (e.g. /bulk arrays), bearing in mind the parsed
+   * object graph can retain several times the raw byte size.
+   */
+  bodyLimit?: string;
 }
 
 /**
@@ -64,19 +82,30 @@ export interface SolidBootstrapOptions {
  * // main.ts
  * bootstrapSolidApp(() => AppModule.forRoot(), {
  *   swagger: { title: 'My API', description: 'My API description' },
+ *   security: { frameAncestors: ["'self'", 'https://portal.example.com'] },
  * });
  */
 export async function bootstrapSolidApp(
   appModuleFactory: () => Promise<any>,
   options: SolidBootstrapOptions = {},
-): Promise<void> {
+): Promise<NestExpressApplication> {
   registerGlobalProcessHandlers();
 
-  const { globalPrefix = 'api', swagger = {}, permissionsPolicyOverrides = {}, verboseBootstrap = false } = options;
+  const {
+    globalPrefix = 'api',
+    swagger = {},
+    permissionsPolicyOverrides = {},
+    security = {},
+    verboseBootstrap = false,
+    bodyLimit = '10mb',
+  } = options;
 
   const startTime = Date.now();
   const appModule = await appModuleFactory();
-  const app = await NestFactory.create(appModule, {
+  const app = await NestFactory.create<NestExpressApplication>(appModule, {
+    // Nest's default parsers are registered during init() with a 100kb limit, ahead of
+    // any module middleware. Disable them so the parsers below own the limit outright.
+    bodyParser: false,
     logger: WinstonModule.createLogger({ ...createWinstonLoggerConfig(), level: verboseBootstrap ? 'debug' : 'error' }),
   });
 
@@ -87,7 +116,7 @@ export async function bootstrapSolidApp(
     app
       .get(WINSTON_MODULE_NEST_PROVIDER)
       .log('API server disabled via API_ENABLED=false. Skipping HTTP listen.', 'Bootstrap');
-    return;
+    return app;
   }
 
   // Health check at root path
@@ -95,7 +124,7 @@ export async function bootstrapSolidApp(
   server.get('/', (_req, res) => res.status(200).send('SOLID OK'));
 
   // Security headers
-  app.use(helmet(buildDefaultSecurityHeaderOptions()));
+  app.use(helmet(buildDefaultSecurityHeaderOptions(security)));
 
   // Nest's Swagger UI HTML injects inline styles; keep CSP strict elsewhere.
   const isSwaggerPath = (path: string) =>
@@ -136,6 +165,12 @@ export async function bootstrapSolidApp(
     next();
   });
 
+  // Body parsers — replaces Nest's default 100kb parsers (disabled via bodyParser: false).
+  // Registered here so the middleware order Nest applied by default is preserved:
+  // helmet -> CSP -> Permissions-Policy -> qs -> body parsers -> routes.
+  app.useBodyParser('json', { limit: bodyLimit });
+  app.useBodyParser('urlencoded', { limit: bodyLimit, extended: true });
+
   // Global ValidationPipe
   app.useGlobalPipes(
     new ValidationPipe({
@@ -195,6 +230,8 @@ export async function bootstrapSolidApp(
 
   const elapsed = ((Date.now() - startTime) / 1000).toFixed(2);
   process.stdout.write(`\x1b[32mServer started on port ${port} in ${elapsed}s\x1b[0m\n`);
+
+  return app;
 }
 
 // ---- CLI bootstrap ----

package/src/helpers/field-crud-managers/MediaFieldCrudManager.ts

@@ -1,5 +1,5 @@
 import { FieldCrudManager, ValidationError } from "src/interfaces";
-import { DANGEROUS_EXTENSIONS, EXT_TO_MEDIA_TYPE, MediaCategory } from "src/constants/media-file-types";
+import { EXT_TO_MEDIA_TYPE, getLowercaseFileExtension, getUploadedFileName, isDangerousMediaFile, MediaCategory } from "src/constants/media-file-types";
 
 export enum SolidMediaType {
     mediaSingle = 'mediaSingle',
@@ -79,16 +79,15 @@ export class MediaFieldCrudManager implements FieldCrudManager {
     constructor(private readonly options: MediaFieldOptions) {
     }
 
-    private resolveMediaType(mimetype?: string, filename?: string): MediaType | null {
-        const ext = (filename || '').split('.').pop()?.toLowerCase();
-        if (ext && DANGEROUS_EXTENSIONS.has(ext)) {
+    private resolveMediaType(file: Express.Multer.File): MediaType | null {
+        // Belt-and-braces: dangerous files are already rejected outright by
+        // validateDangerousFiles, but never let one resolve to a usable category.
+        if (isDangerousMediaFile(file)) {
             return null;
         }
 
-        const mt = (mimetype || '').toLowerCase().trim();
-        if (mt === 'image/svg+xml' || mt === 'text/html' || mt === 'application/xhtml+xml') {
-            return null;
-        }
+        const ext = getLowercaseFileExtension(getUploadedFileName(file));
+        const mt = (file.mimetype || '').toLowerCase().trim();
         if (mt && MIME_TO_MEDIA_TYPE[mt]) {
             return MIME_TO_MEDIA_TYPE[mt];
         }
@@ -113,16 +112,31 @@ export class MediaFieldCrudManager implements FieldCrudManager {
     }
 
     private applyValidations(fieldFiles: Array<Express.Multer.File>): ValidationError[] {
+        // Runs for every media field type and regardless of the admin-configured mediaTypes
+        // allowlist - a dangerous upload is never acceptable, so this must not sit behind
+        // the optional type checks below.
+        const errors = this.validateDangerousFiles(fieldFiles);
+
         switch (this.options.type) {
             case SolidMediaType.mediaSingle:
-                return this.validateMediaSingle(fieldFiles);
+                return [...errors, ...this.validateMediaSingle(fieldFiles)];
             case SolidMediaType.mediaMultiple:
-                return this.validateMediaMultiple(fieldFiles);
+                return [...errors, ...this.validateMediaMultiple(fieldFiles)];
             default:
-                return [];
+                return errors;
         }
     }
 
+    private validateDangerousFiles(fieldFiles: Array<Express.Multer.File>): ValidationError[] {
+        return fieldFiles
+            .filter(fieldFile => isDangerousMediaFile(fieldFile))
+            .map(fieldFile => ({
+                field: this.options.fieldName,
+                error: `${this.options.fieldName} file type not allowed. ` +
+                    `${getUploadedFileName(fieldFile) || 'File'} is a potentially dangerous file type.`
+            }));
+    }
+
     private validateMediaSingle(fieldFiles: Array<Express.Multer.File>): ValidationError[] {
         const errors: ValidationError[] = [];
         if (!this.options.isUpdate && this.options.required && fieldFiles.length === 0) {
@@ -157,7 +171,7 @@ export class MediaFieldCrudManager implements FieldCrudManager {
             for (let i = 0; i < fieldFiles.length; i++) {
                 const fieldFile = fieldFiles[i];
 
-                const resolvedType = this.resolveMediaType(fieldFile.mimetype, fieldFile.originalname ?? fieldFile.filename ?? '');
+                const resolvedType = this.resolveMediaType(fieldFile);
                 if (!resolvedType || !allowedFileTypes.includes(resolvedType)) {
                     errors.push({
                         field: this.options.fieldName,

package/src/helpers/file-download.helper.ts

@@ -0,0 +1,45 @@
+import type { Response } from "express";
+
+export interface FileDownloadHeaderOptions {
+  fileName: string;
+  mimeType: string;
+  /** Defaults to 'attachment'; only pass 'inline' for types known safe to render. */
+  disposition?: "inline" | "attachment";
+  /** Opt in for assets loaded cross-origin by the UI (e.g. media served to :3000). */
+  crossOriginResourcePolicy?: boolean;
+}
+
+/**
+ * Builds an RFC 6266 Content-Disposition value. The file name is attacker-controlled (it comes
+ * from the uploaded originalFileName), so it can't be interpolated raw: a quote would close the
+ * quoted-string early and let the rest of the name forge further header parameters. The ASCII
+ * fallback is stripped to a safe subset and the real name is carried in the RFC 5987
+ * `filename*` parameter, which is also what preserves non-ASCII names correctly.
+ */
+function buildContentDisposition(disposition: "inline" | "attachment", fileName: string): string {
+  const name = (fileName || "file").replace(/[\r\n]/g, "");
+  const asciiFallback = name.replace(/[^\x20-\x7E]/g, "_").replace(/["\\]/g, "_") || "file";
+
+  return `${disposition}; filename="${asciiFallback}"; filename*=UTF-8''${encodeURIComponent(name)}`;
+}
+
+/**
+ * Single place that stamps the response headers for every streamed file download, so the
+ * security headers can't be applied to one endpoint and forgotten on the next.
+ */
+export function setFileDownloadHeaders(res: Response, options: FileDownloadHeaderOptions): void {
+  const disposition = options.disposition ?? "attachment";
+
+  res.setHeader("Content-Disposition", buildContentDisposition(disposition, options.fileName));
+  res.setHeader("Content-Type", options.mimeType);
+  res.setHeader("Access-Control-Expose-Headers", "Content-Disposition, Content-Type");
+
+  // Prevent the browser from ever content-sniffing a served file into something more
+  // dangerous than its declared Content-Type (e.g. rendering a mislabeled upload as HTML
+  // and executing embedded script).
+  res.setHeader("X-Content-Type-Options", "nosniff");
+
+  if (options.crossOriginResourcePolicy) {
+    res.setHeader("Cross-Origin-Resource-Policy", "cross-origin");
+  }
+}

package/src/helpers/model-metadata-helper.service.ts

@@ -2,6 +2,7 @@
 
 import { forwardRef, Inject, Injectable, Logger } from "@nestjs/common";
 import { _ } from "lodash";
+import { DRAFT_PUBLISH_VERSIONING_FIELD_NAMES } from "src/constants/draft-publish-fields";
 import { LEGACY_TABLE_FIELDS_PREFIX } from "src/entities/legacy-common.entity-with-existing-id.entity";
 import { LegacyTableType } from "src/enums/legacy-table-type.enum";
 import { ModelMetadataRepository } from "src/repository/model-metadata.repository";
@@ -87,6 +88,32 @@ export class ModelMetadataHelperService {
                 isSystem: true,
                 enableAuditTracking:true
             },
+            {
+                name: "isPublished",
+                displayName: "Is Published",
+                type: "boolean",
+                isSystem: true,
+                enableAuditTracking: true
+            },
+            {
+                name: "isLatest",
+                displayName: "Is Latest",
+                type: "boolean",
+                isSystem: true,
+                enableAuditTracking: true
+            },
+            {
+                name: "initialEntityVersionId",
+                displayName: "Initial Entity Version Id",
+                type: "int",
+                isSystem: true,
+            },
+            {
+                name: "publishedTracker",
+                displayName: "Published Tracker",
+                type: "shortText",
+                isSystem: true,
+            },
             {
                 name: "localeName",
                 displayName: "Locale",
@@ -117,7 +144,11 @@ export class ModelMetadataHelperService {
     }
 
     private getSystemFieldsMetadataMappingForLegacyTable(withId: boolean=true) {
-        const systemFieldsMetadata = this.getSystemFieldsMetadataMapping();
+        // Legacy tables don't have the draft/publish versioning columns, so exclude
+        // them from the legacy system fields metadata mapping.
+        const legacyExcludedFieldNames: readonly string[] = DRAFT_PUBLISH_VERSIONING_FIELD_NAMES;
+        const systemFieldsMetadata = this.getSystemFieldsMetadataMapping()
+            .filter(field => !legacyExcludedFieldNames.includes(field.name));
         if (!withId) {
             // Remove the id field metadata
             const index = systemFieldsMetadata.findIndex(field => field.name === 'id');

package/src/helpers/security.helper.ts

@@ -1,15 +1,39 @@
 import { HelmetOptions } from "helmet";
 import { Environment } from "src/decorators/disallow-in-production.decorator";
 
+export interface SolidSecurityOptions {
+  /**
+   * Origins that may embed this application in an iframe.
+   * Defaults to the local HTTP/HTTPS loopback origins on any port.
+   */
+  frameAncestors?: string[];
+}
+
+export const DEFAULT_FRAME_ANCESTORS = [
+  "'self'",
+  "http://localhost:*",
+  "https://localhost:*",
+  "http://127.0.0.1:*",
+  "https://127.0.0.1:*",
+  "http://[::1]:*",
+  "https://[::1]:*",
+];
+
 /**
  * Default security headers for SolidX apps.
  * - HSTS only in prod over HTTPS
- * - CSP with frame-ancestors 'none' (prevents clickjacking)
- * - X-Frame-Options: DENY (legacy fallback)
+ * - CSP with configurable frame-ancestors
+ * - X-Frame-Options disabled when cross-origin frame ancestors are allowed
  * - No X-XSS-Protection (deprecated)
  */
-export function buildDefaultSecurityHeaderOptions(): Readonly<HelmetOptions> {
+export function buildDefaultSecurityHeaderOptions(
+  options: SolidSecurityOptions = {},
+): Readonly<HelmetOptions> {
   const isProd = process.env.ENV === Environment.Production;
+  const frameAncestors = options.frameAncestors ?? DEFAULT_FRAME_ANCESTORS;
+  const allowsCrossOriginFrames = frameAncestors.some(
+    (source) => source !== "'self'" && source !== "'none'",
+  );
 
   return {
     // Modern CSP. Add more directives as your app needs (script-src, connect-src, etc.)
@@ -23,7 +47,7 @@ export function buildDefaultSecurityHeaderOptions(): Readonly<HelmetOptions> {
         // "form-action": ["'self'"],
 
         // clickjacking defense (modern)
-        "frame-ancestors": ["'none'"],
+        "frame-ancestors": frameAncestors,
         "style-src": ["'self'"],
         // add/adjust as needed for your app:
         // "script-src": ["'self'"],              // add hashes/nonces/CSPRO if needed
@@ -34,9 +58,12 @@ export function buildDefaultSecurityHeaderOptions(): Readonly<HelmetOptions> {
       },
     },
 
-    
-    // Legacy clickjacking defense (kept for older UAs)
-    frameguard: { action: "deny" },
+    // Legacy clickjacking defense for configurations that do not allow
+    // cross-origin parents (kept for older UAs).
+    // X-Frame-Options cannot express an allowlist. It must be omitted when
+    // CSP allows a parent on another origin, otherwise older browsers may
+    // still block the iframe despite the CSP configuration.
+    frameguard: allowsCrossOriginFrames ? false : { action: "deny" },
 
     // Referrer/cross-origin policies
     referrerPolicy: { policy: "strict-origin-when-cross-origin" },
@@ -115,4 +142,4 @@ export function setDefaultCacheControl() {
 //   res.setHeader("Permissions-Policy", buildPermissionsPolicyHeader());
 //   next();
 // });
-// app.use(setDefaultCacheControl());
+// app.use(setDefaultCacheControl());

package/src/helpers/solid-core-error-codes-provider.service.ts

@@ -32,6 +32,59 @@ export class SolidCoreErrorCodesProvider implements IErrorCodeProvider {
                     httpStatus: 401,
                 },
             },
+            // MPIN rules sit above the generic session rules so that an MPIN
+            // failure is never reported as a session problem. The three codes
+            // drive three different client behaviours: retry, wait, and
+            // discard-the-handle.
+            {
+                code: 'solidx-mpin-locked',
+                priority: 120,
+                match: (txt) => txt.includes(ERROR_MESSAGES.MPIN_LOCKED.toLowerCase()),
+                meta: {
+                    message: ERROR_MESSAGES.MPIN_LOCKED,
+                    httpStatus: 401,
+                },
+            },
+            {
+                code: 'solidx-mpin-revoked',
+                priority: 120,
+                match: (txt) => txt.includes(ERROR_MESSAGES.MPIN_REVOKED.toLowerCase()),
+                meta: {
+                    message: ERROR_MESSAGES.MPIN_REVOKED,
+                    httpStatus: 401,
+                },
+            },
+            {
+                code: 'solidx-mpin-invalid',
+                priority: 120,
+                match: (txt) => txt.includes(ERROR_MESSAGES.MPIN_INVALID.toLowerCase()),
+                meta: {
+                    message: ERROR_MESSAGES.MPIN_INVALID,
+                    httpStatus: 401,
+                },
+            },
+            // Setup-time rejections. Distinct codes so the client can say
+            // "choose a less predictable PIN" rather than parsing a message.
+            // Safe to distinguish: both occur only on bearer-authenticated
+            // routes, so neither discloses anything.
+            {
+                code: 'solidx-mpin-too-predictable',
+                priority: 120,
+                match: (txt) => txt.includes(ERROR_MESSAGES.MPIN_TOO_PREDICTABLE.toLowerCase()),
+                meta: {
+                    message: ERROR_MESSAGES.MPIN_TOO_PREDICTABLE,
+                    httpStatus: 400,
+                },
+            },
+            {
+                code: 'solidx-mpin-format-invalid',
+                priority: 120,
+                match: (txt) => txt.includes(ERROR_MESSAGES.MPIN_FORMAT_INVALID.toLowerCase()),
+                meta: {
+                    message: ERROR_MESSAGES.MPIN_FORMAT_INVALID,
+                    httpStatus: 400,
+                },
+            },
             {
                 code: 'solidx-mcp-server-unavailable',
                 priority: 100,

package/src/helpers/solid-microservice-adapter.service.ts

@@ -79,7 +79,12 @@ export class SolidMicroserviceAdapter {
     const responseData = response.data as SolidxIamAuthResponse;
     const ttlSeconds = this.getJwtTtlSeconds(responseData?.data?.accessToken);
     if (ttlSeconds && ttlSeconds > 0) {
-      await this.cacheManager.set(cacheKey, responseData, ttlSeconds);
+      // cache-manager v5 expects milliseconds. This previously passed seconds,
+      // which the old Redis store discarded outright - so the entry simply
+      // never expired. Now that TTLs are honoured, passing seconds unconverted
+      // would expire the cached token ~1000x too early and re-authenticate
+      // against IAM on nearly every call.
+      await this.cacheManager.set(cacheKey, responseData, ttlSeconds * 1000);
     }
 
     return responseData;

package/src/helpers/solid-registry.ts

@@ -366,7 +366,7 @@ export class SolidRegistry {
   }
 
   getCommonEntityKeys(): (keyof CommonEntity | 'createdBy' | 'updatedBy')[] {
-    return ['id', 'createdAt', 'updatedAt', 'deletedAt', 'createdBy', 'updatedBy', 'deletedTracker', 'localeName', 'defaultEntityLocaleId', 'publishedAt'];
+    return ['id', 'createdAt', 'updatedAt', 'deletedAt', 'createdBy', 'updatedBy', 'deletedTracker', 'localeName', 'defaultEntityLocaleId', 'publishedAt', 'isPublished', 'isLatest', 'initialEntityVersionId', 'publishedTracker'];
     // return Reflect.getMetadataKeys(CommonEntity.prototype) as (keyof CommonEntity)[];
   }
 

package/src/helpers/typeorm-db-helper.ts

@@ -40,6 +40,14 @@ const DECIMAL_MAP: Record<DatasourceType, ColumnOptions> = {
     [DatasourceType.oracle]: { type: "float" },
 };
 
+const DATE_TIME_MAP: Record<DatasourceType, ColumnOptions> = {
+    [DatasourceType.postgres]: { type: "timestamp" },
+    [DatasourceType.mssql]: { type: "datetime2" },
+    [DatasourceType.mysql]: { type: "datetime" },
+    [DatasourceType.mariadb]: { type: "datetime" },
+    [DatasourceType.oracle]: { type: "timestamp" },
+};
+
 const solidCoreDbType: DatasourceType =
     Object.values(DatasourceType).includes(process.env.SOLID_CORE_DB_TYPE as DatasourceType)
         ? (process.env.SOLID_CORE_DB_TYPE as DatasourceType)
@@ -72,7 +80,10 @@ export function getColumnType(solidType: string): ColumnOptions {
         case "decimal":
             return DECIMAL_MAP[solidCoreDbType];
 
+        case "datetime":
+            return DATE_TIME_MAP[solidCoreDbType];
+
         default:
             return {};
     }
-}
+}

package/src/index.ts

@@ -160,6 +160,12 @@ export * from './entities/role-metadata.entity'
 export * from './entities/sms-template.entity'
 export * from './entities/user.entity'
 export * from './entities/user-api-key.entity'
+export * from './entities/user-device-credential.entity'
+export * from './repository/user-device-credential.repository'
+export * from './services/mpin.service'
+export * from './dtos/setup-mpin.dto'
+export * from './dtos/change-mpin.dto'
+export * from './dtos/mpin-login.dto'
 export * from './entities/view-metadata.entity'
 export * from './entities/setting.entity'
 export * from './entities/saved-filters.entity'
@@ -225,6 +231,7 @@ export * from './helpers/environment.helper'
 export * from './helpers/cache.helper'
 export * from './helpers/cors.helper'
 export * from './helpers/security.helper'
+export * from './helpers/file-download.helper'
 export * from './helpers/model-metadata-helper.service'
 export * from './helpers/image-encoding.helper'
 export * from './helpers/solid-microservice-adapter.service'
@@ -248,10 +255,12 @@ export * from './services/workflow/workflow-expression.service'
 export * from './services/workflow/workflow-invocation.service'
 export * from './services/workflow/workflow-node-registry.service'
 export * from './services/workflow/workflow-runtime.service'
+export * from './services/workflow/nodes/execution-fail.node'
 export * from './services/workflow/nodes/for-each.node'
 export * from './services/workflow/nodes/http-request.node'
 export * from './services/workflow/nodes/if.node'
 export * from './services/workflow/nodes/log-write.node'
+export * from './services/workflow/nodes/loop-until.node'
 export * from './services/workflow/nodes/parallel.node'
 export * from './services/workflow/nodes/sequential.node'
 export * from './services/workflow/nodes/solidx-crud.nodes'
@@ -335,6 +344,7 @@ export * from './services/action-metadata.service'
 export * from './services/authentication.service'
 export * from './services/bcrypt.service'
 export * from './services/computed-fields/uuid-external-id-computed-field-provider.service'
+export * from './services/draft-publish-helper.service'
 export * from './services/crud-helper.service'
 export * from './services/crud.service'
 export * from './services/email-template.service'