@solidxai/core 0.1.13-beta.2 → 0.1.13-beta.20

package/src/services/authentication.service.ts

@@ -20,7 +20,7 @@ import { SUCCESS_MESSAGES } from "src/constants/success-messages";
 import { CreateUserDto } from "src/dtos/create-user.dto";
 import { MailFactory } from "src/factories/mail.factory";
 import { UserRepository } from "src/repository/user.repository";
-import { DataSource, DeepPartial, Repository } from "typeorm";
+import { DataSource, DeepPartial, FindOptionsWhere, Repository } from "typeorm";
 import { v4 as uuidv4 } from "uuid";
 import {
   ForgotPasswordSendVerificationTokenOn,
@@ -49,6 +49,7 @@ import { SsoCodeStorageService } from "./sso-code-storage.service";
 import { RoleMetadataService } from "./role-metadata.service";
 import { SettingService } from "./setting.service";
 import { UserActivityHistoryService } from "./user-activity-history.service";
+import { MetadataValidationService } from "./metadata-validation.service";
 import { UserService } from "./user.service";
 import { SmsFactory } from "src/factories/sms.factory";
 import { WhatsAppFactory } from "src/factories/whatsapp.factory";
@@ -88,6 +89,7 @@ export class AuthenticationService {
     private readonly roleMetadataService: RoleMetadataService,
     private readonly userActivityHistoryService: UserActivityHistoryService,
     private readonly ssoCodeStorage: SsoCodeStorageService,
+    private readonly metadataValidationService: MetadataValidationService,
 
     @InjectDataSource()
     private readonly dataSource: DataSource,
@@ -225,6 +227,9 @@ export class AuthenticationService {
     preferEntityApiKeyFlag: boolean = false,
   ): Promise<T> {
     try {
+      await this.assertUniqueSignupIdentifiers(signUpDto, repo);
+      await this.metadataValidationService.validateCreateDto("user", signUpDto);
+
       const onForcePasswordChange =
         this.settingService.getConfigValue<SolidCoreSetting>(
           "forceChangePasswordOnFirstLogin",
@@ -276,6 +281,59 @@ export class AuthenticationService {
     }
   }
 
+  private async assertUniqueSignupIdentifiers<T extends User>(
+    signUpDto: SignUpDto,
+    repo: Repository<T>,
+  ): Promise<void> {
+    const username = signUpDto.username?.trim();
+    const email = signUpDto.email?.trim();
+    const mobile = signUpDto.mobile?.trim();
+
+    const where: FindOptionsWhere<T>[] = [];
+
+    if (username) {
+      where.push({ username } as FindOptionsWhere<T>);
+    }
+
+    if (email) {
+      where.push({ email } as FindOptionsWhere<T>);
+    }
+
+    if (mobile) {
+      where.push({ mobile } as FindOptionsWhere<T>);
+    }
+
+    if (where.length === 0) {
+      return;
+    }
+
+    const existingUser = await repo.findOne({ where });
+
+    if (!existingUser) {
+      return;
+    }
+
+    if (email && existingUser.email === email) {
+      throw new ConflictException(
+        `A user with email address "${email}" already exists.`,
+      );
+    }
+
+    if (mobile && existingUser.mobile === mobile) {
+      throw new ConflictException(
+        `A user with mobile number "${mobile}" already exists.`,
+      );
+    }
+
+    if (username && existingUser.username === username) {
+      throw new ConflictException(
+        `A user with username "${username}" already exists.`,
+      );
+    }
+
+    throw new ConflictException(ERROR_MESSAGES.USER_ALREADY_EXISTS);
+  }
+
   private async handlePasswordlessSignupOtp<T extends User>(
     user: T,
     signUpDto: SignUpDto,
@@ -400,11 +458,23 @@ export class AuthenticationService {
     // if forcePasswordChange is true, then we trigger an email to the user to change the password, this needs to be done using a queue.
     // Create a new method like notifyUserOnForcePasswordChange, create a new email template we can call it on-force-password-change this template to include the random password
     if (user.forcePasswordChange && autoGeneratedPwd) {
-      await this.notifyUserOnForcePasswordChange(user, autoGeneratedPwd);
+      try {
+        await this.notifyUserOnForcePasswordChange(user, autoGeneratedPwd);
+      } catch (error: any) {
+        this.logger.error(
+          `Failed to send force-password-change email for user ${user.id}: ${error?.message ?? error}`,
+        );
+      }
     }
 
     // Send welcome notifications (email/SMS) if enabled.
-    await this.notifyUserOnSignup(user);
+    try {
+      await this.notifyUserOnSignup(user);
+    } catch (error: any) {
+      this.logger.error(
+        `Failed to send signup notifications for user ${user.id}: ${error?.message ?? error}`,
+      );
+    }
   }
 
   generatePassword(length: number = 8): string {
@@ -1578,7 +1648,7 @@ export class AuthenticationService {
     // Assuming all users do not have mobile as mandatory.
     if (
       forgotPasswordSendVerificationTokenOn ==
-        ForgotPasswordSendVerificationTokenOn.MOBILE &&
+      ForgotPasswordSendVerificationTokenOn.MOBILE &&
       user.mobile
     ) {
       const smsService = this.smsFactory.getSmsService();
@@ -1702,7 +1772,7 @@ export class AuthenticationService {
     // Assuming all users do not have mobile as mandatory.
     if (
       forgotPasswordSendVerificationTokenOn ==
-        ForgotPasswordSendVerificationTokenOn.MOBILE &&
+      ForgotPasswordSendVerificationTokenOn.MOBILE &&
       user.mobile
     ) {
       const smsService = this.smsFactory.getSmsService();
@@ -1723,7 +1793,13 @@ export class AuthenticationService {
     }
   }
 
-  async generateTokens(user: User) {
+  /**
+   * @param deviceId optional stable per-device identifier. Supplied by callers
+   * that own a device credential; otherwise a key is minted per login so that
+   * clients with no device concept (the web UI) still get their own bucket
+   * instead of sharing - and evicting - one.
+   */
+  async generateTokens(user: User, deviceId?: string) {
     const sessionId = this.shouldPreventConcurrentLogins()
       ? randomUUID()
       : undefined;
@@ -1732,9 +1808,17 @@ export class AuthenticationService {
     } else {
       await this.activeSessionStorage.clearActiveSession(user.id);
     }
+
+    // Mutually exclusive with sessionId by construction: per-device buckets
+    // exist only when preventConcurrentLogins is off, sessionId only when it
+    // is on.
+    const deviceKey = this.refreshTokenIdsStorage.areConcurrentLoginsAllowed()
+      ? deviceId ?? randomUUID()
+      : undefined;
+
     const [accessToken, refreshToken] = await Promise.all([
-      await this.generateAccessToken(user, sessionId),
-      await this.generateRefreshToken(user),
+      await this.generateAccessToken(user, sessionId, deviceKey),
+      await this.generateRefreshToken(user, undefined, deviceKey),
     ]);
 
     return {
@@ -1743,7 +1827,7 @@ export class AuthenticationService {
     };
   }
 
-  async generateAccessToken(user: User, sessionId?: string) {
+  async generateAccessToken(user: User, sessionId?: string, deviceKey?: string) {
     // const userRoleNames = user.roles.map((role) => role.name).join(';')
     const userRoleNames = user.roles.map((role) => role.name);
     const resolvedSessionId = this.shouldPreventConcurrentLogins()
@@ -1760,18 +1844,36 @@ export class AuthenticationService {
         email: user.email,
         roles: userRoleNames,
         ...(resolvedSessionId ? { sessionId: resolvedSessionId } : {}),
+        // Carried so that bearer-authenticated endpoints which need this
+        // session's refresh token - generateSsoCode, me - can locate its
+        // bucket. The refresh token is not available to them.
+        ...(deviceKey ? { deviceKey } : {}),
       },
     );
 
     return accessToken;
   }
 
-  async generateRefreshToken(user: User, previousRefreshToken?: string) {
+  async generateRefreshToken(
+    user: User,
+    previousRefreshToken?: string,
+    deviceKey?: string,
+  ) {
     const refreshTokenId = randomUUID();
     const refreshTokenTtl =
       this.settingService.getConfigValue<SolidCoreSetting>("refreshTokenTtl");
+
+    // Only per-device tokens carry an epoch - it is what makes bulk
+    // invalidation possible without enumerating buckets. Single-slot tokens
+    // are invalidated by deleting their one key.
+    const epoch = deviceKey
+      ? await this.refreshTokenIdsStorage.getEpoch(user.id)
+      : undefined;
+
     const refreshToken = await this.signToken(user.id, refreshTokenTtl, {
       refreshTokenId,
+      ...(deviceKey ? { deviceKey } : {}),
+      ...(epoch !== undefined ? { epoch } : {}),
     });
 
     // store the refresh token id in the redis storage.
@@ -1779,6 +1881,7 @@ export class AuthenticationService {
       user.id,
       refreshToken,
       previousRefreshToken,
+      deviceKey,
     );
 
     return refreshToken;
@@ -1793,8 +1896,16 @@ export class AuthenticationService {
       const issuer =
         this.settingService.getConfigValue<SolidCoreSetting>("issuer");
 
-      const { sub } = await this.jwtService.verifyAsync<
-        Pick<ActiveUserData, "sub"> & { refreshTokenId: string }
+      // deviceKey/epoch are absent on tokens issued before per-device sessions,
+      // and on tokens issued while preventConcurrentLogins is on. That absence
+      // is the signal the storage layer branches on - no request-body change
+      // and no client change is needed to carry it.
+      const { sub, deviceKey, epoch } = await this.jwtService.verifyAsync<
+        Pick<ActiveUserData, "sub"> & {
+          refreshTokenId: string;
+          deviceKey?: string;
+          epoch?: number;
+        }
       >(refreshTokenDto.refreshToken, {
         secret,
         audience,
@@ -1822,17 +1933,24 @@ export class AuthenticationService {
       //     throw new Error('Refresh token is invalid');
       // }
 
-      const currentRefreshToken =
-        await this.refreshTokenIdsStorage.validateAndRotate(
-          user,
-          refreshTokenDto.refreshToken,
-        );
+      const rotated = await this.refreshTokenIdsStorage.validateAndRotate(
+        user,
+        refreshTokenDto.refreshToken,
+        { deviceKey, epoch },
+      );
 
       await this.userActivityHistoryService.logEvent("tokenRefreshed", user);
 
       return {
-        accessToken: await this.generateAccessToken(user),
-        refreshToken: currentRefreshToken,
+        // The rotated key, not the incoming one: a session migrating out of the
+        // pre-deploy single slot is assigned a bucket here, and the new access
+        // token has to name the same one.
+        accessToken: await this.generateAccessToken(
+          user,
+          undefined,
+          rotated.deviceKey,
+        ),
+        refreshToken: rotated.refreshToken,
       };
     } catch (err: any) {
       if (err instanceof InvalidatedRefreshTokenError) {
@@ -2221,28 +2339,31 @@ export class AuthenticationService {
   //     // Invalidate the refresh token
   //     // await this.refreshTokenIdsStorage.invalidate(user.id);
   // }
-  async logout(refreshToken: string) {
+  async logout(refreshToken: string, allDevices = false) {
     try {
-      // const activeUser = this.requestContextService.getActiveUser();
-      // const userId = activeUser?.sub;
-      // const user = await this.userRepository.findOne({
-      //     where: {
-      //         id: userId,
-      //     }
-      // })
-      // // Invalidate refresh token if you store them
-      // await this.refreshTokenIdsStorage.invalidate(userId); // ← Your existing logic
-      // if (!refreshToken) {
-      //     throw new UnauthorizedException('Refresh token is required');
-      // }
-      const payload = this.jwtService.decode(refreshToken) as any;
-
-      if (!payload || !payload.sub) {
-        throw new UnauthorizedException(ERROR_MESSAGES.INVALID_REFRESH_TOKEN);
+      const payload = await this.verifyRefreshTokenForLogout(refreshToken);
+
+      // Nothing verifiable to act on: forged, malformed, or signed with another
+      // secret. Acting on an unauthenticated `sub` is exactly the hole this
+      // closes - the route is @Public(), so a decoded-but-unverified token let
+      // anyone log out an arbitrary user. Report success either way: logout
+      // must be safe to call blindly from a client error path, and a 401/200
+      // split here would leak whether a token string is genuine (RFC 7009 §2.2
+      // takes the same position for revocation endpoints).
+      if (!payload?.sub) {
+        this.logger.warn("logout called with an unverifiable refresh token");
+        return { message: SUCCESS_MESSAGES.LOGOUT_SUCCESS };
       }
 
       const userId = payload.sub;
-      await this.refreshTokenIdsStorage.invalidate(userId);
+      if (allDevices) {
+        await this.refreshTokenIdsStorage.invalidateAll(userId);
+      } else {
+        // Scoped to the bucket this token belongs to, so signing out on one
+        // device leaves the others alive. A token with no deviceKey names the
+        // single slot, which is the same key as before.
+        await this.refreshTokenIdsStorage.invalidate(userId, payload.deviceKey);
+      }
       await this.activeSessionStorage.clearActiveSession(userId);
       const user = await this.userRepository.findOne({
         where: {
@@ -2250,10 +2371,15 @@ export class AuthenticationService {
         },
       });
       // Log logout event
-      await this.userActivityHistoryService.logEvent("logout", user);
+      if (user) {
+        await this.userActivityHistoryService.logEvent("logout", user);
+      }
 
       return { message: SUCCESS_MESSAGES.LOGOUT_SUCCESS };
     } catch (err: any) {
+      // JWT problems no longer reach here - verifyRefreshTokenForLogout
+      // swallows them - so this is left for genuine infrastructure failures
+      // (cache or database unavailable), where a 500 is the correct answer.
       throw err instanceof UnauthorizedException ||
         err instanceof InternalServerErrorException
         ? err
@@ -2261,6 +2387,31 @@ export class AuthenticationService {
     }
   }
 
+  private async verifyRefreshTokenForLogout(
+    refreshToken: string,
+  ): Promise<{ sub: number; deviceKey?: string } | null> {
+    try {
+      const payload = await this.jwtService.verifyAsync(refreshToken, {
+        secret: this.settingService.getConfigValue<SolidCoreSetting>("secret"),
+        audience:
+          this.settingService.getConfigValue<SolidCoreSetting>("audience"),
+        issuer: this.settingService.getConfigValue<SolidCoreSetting>("issuer"),
+        // Signature, audience and issuer are still enforced; only `exp` is
+        // tolerated. An expired session must still be able to log out - the
+        // previous jwtService.decode() allowed that, and a plain verifyAsync
+        // would throw TokenExpiredError, which the catch above would turn into
+        // a 500 on an ordinary sign-out.
+        ignoreExpiration: true,
+      });
+
+      // Access and refresh tokens share secret, audience and issuer, so only
+      // this claim distinguishes them. Reject an access token presented here.
+      return payload?.refreshTokenId ? payload : null;
+    } catch {
+      return null; // bad signature or malformed
+    }
+  }
+
   async activateUser(userId: number) {
     const user = await this.userService.findOne(userId, {});
     if (!user) {
@@ -2282,9 +2433,14 @@ export class AuthenticationService {
 
     // const tokens = await this.generateTokens(user);
 
-    // Get the refresh token for a user from refresh token storage.
+    // Get the refresh token for a user from refresh token storage. The bucket
+    // is named by the access token's own deviceKey claim; absent for
+    // single-slot sessions, which resolves to the same key as before.
     const refreshTokenState =
-      await this.refreshTokenIdsStorage.getCurrentRefreshTokenState(user.id);
+      await this.refreshTokenIdsStorage.getCurrentRefreshTokenState(
+        user.id,
+        activeUser.deviceKey,
+      );
 
     const response = {
       user: {
@@ -2295,7 +2451,11 @@ export class AuthenticationService {
         id: user.id,
         roles: user.roles.map((role) => role.name),
       },
-      refreshToken: refreshTokenState.currentRefreshToken,
+      // Null-guarded because the cache entry now carries a TTL: once it
+      // expires - or after a logout followed by a call with a still-valid
+      // access token - there is no state to read. Matches the existing
+      // handling in generateSsoCode.
+      refreshToken: refreshTokenState?.currentRefreshToken ?? null,
       // ...tokens
     };
     return response;
@@ -2308,6 +2468,7 @@ export class AuthenticationService {
     const refreshTokenState =
       await this.refreshTokenIdsStorage.getCurrentRefreshTokenState(
         activeUser.sub,
+        activeUser.deviceKey,
       );
     if (!refreshTokenState?.currentRefreshToken) {
       throw new UnauthorizedException("No active session found");
@@ -2342,6 +2503,7 @@ function parseUniqueConstraintError(detail: string): string {
     const fieldMap: Record<string, string> = {
       username: "username",
       email: "email address",
+      mobile: "mobile number",
       full_name_user_key: "full name",
     };
     const friendlyField = fieldMap[field] || field;

package/src/services/chatter-message.service.ts

@@ -5,7 +5,8 @@ import { InjectEntityManager } from '@nestjs/typeorm';
 import { Brackets, EntityManager, EntityMetadata, In } from 'typeorm';
 
 import { classify } from '@angular-devkit/core/src/utils/strings';
-import { CHATTER_MESSAGE_STATUS, CHATTER_MESSAGE_SUBTYPE, CHATTER_MESSAGE_TYPE } from 'src/constants/chatter-message.constants';
+import { CHATTER_MESSAGE_STATUS, CHATTER_MESSAGE_SUBTYPE, CHATTER_MESSAGE_TYPE, CHATTER_MESSAGE_USER_FIELDS } from 'src/constants/chatter-message.constants';
+import { isDangerousMediaFile } from 'src/constants/media-file-types';
 import { ERROR_MESSAGES } from 'src/constants/error-messages';
 import { PostChatterMessageDto } from 'src/dtos/post-chatter-message.dto';
 import { UpdateChatterNoteMessageDto } from 'src/dtos/update-chatter-note-message.dto';
@@ -18,9 +19,11 @@ import { FieldMetadataRepository } from 'src/repository/field-metadata.repositor
 import { MediaRepository } from 'src/repository/media.repository';
 import { ModelMetadataRepository } from 'src/repository/model-metadata.repository';
 import { CRUDService } from 'src/services/crud.service';
+import { BasicFilterDto } from '../dtos/basic-filters.dto';
 import { MediaStorageProviderType } from '../dtos/create-media-storage-provider-metadata.dto';
 import { ChatterMessageDetails } from '../entities/chatter-message-details.entity';
 import { ChatterMessage } from '../entities/chatter-message.entity';
+import { User } from '../entities/user.entity';
 import { getMediaStorageProvider } from './mediaStorageProviders';
 import { RequestContextService } from './request-context.service';
 import { Logger } from '@nestjs/common';
@@ -34,6 +37,16 @@ interface ChatterMention {
     id?: string | number;
 }
 
+/**
+ * Server-side-only overrides for `postMessage`. Not part of `PostChatterMessageDto`, so
+ * nothing here is settable over HTTP - only in-process callers such as migration or
+ * back-fill services can supply it.
+ */
+export interface PostChatterMessageOptions {
+    /** Backdate the message instead of stamping it with the current time. */
+    createdAt?: Date;
+}
+
 @Injectable()
 export class ChatterMessageService extends CRUDService<ChatterMessage> {
     private readonly _logger = new Logger(ChatterMessageService.name);
@@ -101,6 +114,44 @@ export class ChatterMessageService extends CRUDService<ChatterMessage> {
         chatterMessage.updatedBy = resolvedUserId;
     }
 
+    /**
+     * Reduce a message's hydrated `user` relation to CHATTER_MESSAGE_USER_FIELDS.
+     *
+     * `getChatterMessages` restricts the columns in the query itself, which is preferable.
+     * The generic CRUD paths below build their query from find-options and hand `populate`
+     * straight to TypeORM, so they are trimmed after the fact instead. (`createdBy` /
+     * `updatedBy` need nothing here - CRUDService.handlePopulateUserIdFields already selects
+     * only USER_SUMMARY_FIELDS when a caller populates them.)
+     */
+    private trimMessageUser<M extends ChatterMessage>(message: M): M {
+        if (message?.user) {
+            message.user = this.toUserSummary(message.user) as User;
+        }
+        return message;
+    }
+
+    private trimMessageUsers(messages: ChatterMessage[] | undefined) {
+        messages?.forEach(message => this.trimMessageUser(message));
+    }
+
+    /**
+     * `GET /chatter-message?populate[]=user` would otherwise be a way around the column
+     * allowlist applied by getChatterMessages.
+     */
+    async find(basicFilterDto: BasicFilterDto, solidRequestContext: any = {}): Promise<any> {
+        const result = await super.find(basicFilterDto, solidRequestContext);
+        this.trimMessageUsers(result?.records);
+        // A grouped find (populateGroup) nests its entities one level deeper.
+        for (const groupRecord of result?.groupRecords ?? []) {
+            this.trimMessageUsers(groupRecord?.groupData?.records);
+        }
+        return result;
+    }
+
+    async findOne(id: number, query: any = {}, solidRequestContext: any = {}) {
+        return this.trimMessageUser(await super.findOne(id, query, solidRequestContext));
+    }
+
     private isEditableCustomNoteMessage(message: ChatterMessage): boolean {
         if (message.messageType !== CHATTER_MESSAGE_TYPE.CUSTOM) {
             return false;
@@ -134,6 +185,17 @@ export class ChatterMessageService extends CRUDService<ChatterMessage> {
         }, messageBody || '');
     }
 
+    /**
+     * Chatter attachments bypass MediaFieldCrudManager - they go straight to
+     * storageProvider.store() - so the shared predicate is applied here directly. The rules
+     * themselves live in media-file-types so upload paths can't drift apart.
+     */
+    private validateChatterMediaFiles(files: Express.Multer.File[] = []) {
+        if (Array.isArray(files) && files.some(file => isDangerousMediaFile(file))) {
+            throw new BadRequestException('Dangerous file types are not allowed in chatter attachments.');
+        }
+    }
+
     private async publishChatterMentionNotifications(message: ChatterMessage, model: any) {
         if (message.messageType !== CHATTER_MESSAGE_TYPE.CUSTOM || message.messageSubType !== CHATTER_MESSAGE_SUBTYPE.NOTE) {
             return;
@@ -188,6 +250,31 @@ export class ChatterMessageService extends CRUDService<ChatterMessage> {
         }
     }
 
+    // Deliberately bypasses UserRepository's security-rule filtering: the mention picker
+    // needs id/username/fullName for any active user regardless of the caller's row-level
+    // access to the User model, same as the getChatterMessages one-to-many lookup below.
+    async getMentionableUsers(search?: string, limit: number = 8): Promise<Array<{ id: number; username: string; fullName: string }>> {
+        const normalizedLimit = Number.isInteger(limit) && limit > 0 && limit <= 50 ? limit : 8;
+        const userRepository = this.entityManager.getRepository(User);
+
+        const qb = userRepository
+            .createQueryBuilder('user')
+            .select(['user.id', 'user.username', 'user.fullName'])
+            .where('user.active = :active', { active: true });
+
+        const trimmedSearch = (search ?? '').trim();
+        if (trimmedSearch) {
+            qb.andWhere('(LOWER(user.username) LIKE :search OR LOWER(user.fullName) LIKE :search)', {
+                search: `%${trimmedSearch.toLowerCase()}%`,
+            });
+        }
+
+        qb.orderBy('user.username', 'ASC').take(normalizedLimit);
+
+        const users = await qb.getMany();
+        return users.map(user => ({ id: user.id, username: user.username, fullName: user.fullName }));
+    }
+
     async markCompleted(id: number) {
         const activeUser = this.requestContextService.getActiveUser();
         if (!activeUser) {
@@ -240,6 +327,8 @@ export class ChatterMessageService extends CRUDService<ChatterMessage> {
             throw new BadRequestException('Message body cannot be empty.');
         }
 
+        this.validateChatterMediaFiles(files);
+
         if (hasMessageBody) {
             message.messageBody = trimmedMessageBody;
         }
@@ -306,13 +395,23 @@ export class ChatterMessageService extends CRUDService<ChatterMessage> {
 
         await this.publishChatterMentionNotifications(savedMessage, model);
 
-        return savedMessage;
+        // The `user` relation was loaded for the ownership check above; don't return all of it.
+        return this.trimMessageUser(savedMessage);
     }
 
-    async postMessage(postDto: PostChatterMessageDto, files: Express.Multer.File[] = []) {
+    /**
+     * Post a chatter message.
+     *
+     * `options` is deliberately kept out of `PostChatterMessageDto` so it can only be supplied
+     * by server-side callers (migrations, back-fills). The controller binds the DTO alone, so
+     * an API client has no way to backdate a message.
+     */
+    async postMessage(postDto: PostChatterMessageDto, files: Express.Multer.File[] = [], options: PostChatterMessageOptions = {}) {
         const coModelName = lowerFirst(postDto.coModelName);
         await this.assertRecordAccess(coModelName, postDto.coModelEntityId);
 
+        this.validateChatterMediaFiles(files);
+
         const chatterMessage = new ChatterMessage();
         chatterMessage.messageType = CHATTER_MESSAGE_TYPE.CUSTOM;
         chatterMessage.messageSubType = postDto.messageSubType || CHATTER_MESSAGE_SUBTYPE.CUSTOM;
@@ -322,6 +421,10 @@ export class ChatterMessageService extends CRUDService<ChatterMessage> {
         chatterMessage.coModelEntityId = postDto.coModelEntityId;
         chatterMessage.coModelName = coModelName;
         chatterMessage.modelUserKey = postDto.modelUserKey ?? null;
+        // Left unset otherwise, so the @CreateDateColumn default still applies.
+        if (options.createdAt) {
+            chatterMessage.createdAt = options.createdAt;
+        }
 
         const model = await this.modelMetadataRepo.findOne({
             where: { singularName: coModelName },
@@ -891,16 +994,25 @@ export class ChatterMessageService extends CRUDService<ChatterMessage> {
             qb.where(orConditions.join(' OR '), parameters);
         }));
 
-        const relations = ['chatterMessageDetails', 'user'];
+        const relations = ['chatterMessageDetails'];
         if (populate && populate.length > 0) {
             const normalizedPopulate = this.crudHelperService.normalize(populate);
-            relations.push(...normalizedPopulate.filter(rel => !relations.includes(rel)));
+            // SECURITY: 'user' is joined below with an explicit column allowlist. A client-supplied
+            // populate[]=user must not be able to turn it back into a full-entity join (the chatter
+            // panel does send exactly that).
+            relations.push(...normalizedPopulate.filter(rel => rel !== 'user' && !relations.includes(rel)));
         }
 
         relations.forEach(relation => {
             qb.leftJoinAndSelect(`entity.${relation}`, relation);
         });
 
+        // Only the author's id and display name leave this endpoint - see CHATTER_MESSAGE_USER_FIELDS.
+        // This join must stay before applyFilters below: it lets filters[user][fullName] reuse this
+        // alias instead of adding a second join of its own.
+        qb.leftJoin('entity.user', 'user');
+        qb.addSelect(CHATTER_MESSAGE_USER_FIELDS.map(field => `user.${field}`));
+
         if (filters) {
             qb.andWhere(new Brackets(whereQb => {
                 this.crudHelperService.applyFilters(whereQb, filters, 'entity', qb);
@@ -914,6 +1026,13 @@ export class ChatterMessageService extends CRUDService<ChatterMessage> {
         const [entities, count] = await qb.getManyAndCount();
         this.logHeapUsed('getChatterMessages-entitiesLoaded');
 
+        // The join above only selects the allowlisted columns, but TypeORM still hydrates the
+        // author with `new User()`, which leaves every initialiser-backed property (active,
+        // forcePasswordChange, ...) sitting on the instance holding its default rather than a
+        // value read from the database. Replace it with a plain object of exactly the
+        // allowlisted keys so the response cannot report fabricated defaults as data.
+        this.trimMessageUsers(entities);
+
         // Convert date strings in message details to ISO format for consistent handling on the frontend
         const DATE_FIELD_TYPES = ['date', 'datetime', 'time'];
         for (const entity of entities) {