@solidxai/core 0.1.13-beta.2 → 0.1.13-beta.21

package/src/controllers/export-template.controller.ts

@@ -8,6 +8,7 @@ import { Response } from 'express';
 import { StartExportSyncDto } from 'src/dtos/export.dto';
 import { ActiveUser } from 'src/decorators/active-user.decorator';
 import { ActiveUserData } from 'src/interfaces/active-user-data.interface';
+import { setFileDownloadHeaders } from 'src/helpers/file-download.helper';
 
 @ApiTags('Solid Core') 
 @Controller('export-template') //FIXME: Change this to the model plural name 
@@ -91,9 +92,10 @@ export class ExportTemplateController {
       throw new InternalServerErrorException("Export stream is null");
     }
     // ✅ Set response headers for streaming
-    res.setHeader('Content-Disposition', `attachment; filename="${exportFileInfo.fileName}"`);
-    res.setHeader('Content-Type', exportFileInfo.mimeType);
-    res.setHeader('Access-Control-Expose-Headers', 'Content-Disposition, Content-Type');
+    setFileDownloadHeaders(res, {
+      fileName: exportFileInfo.fileName,
+      mimeType: exportFileInfo.mimeType,
+    });
     // Pipe the strea to the response as an excel file
     exportFileInfo.exportStream.pipe(res);
   }

package/src/controllers/import-transaction.controller.ts

@@ -7,6 +7,7 @@ import { UpdateImportTransactionDto } from '../dtos/update-import-transaction.dt
 import { Response } from 'express';
 import { ActiveUser } from 'src/decorators/active-user.decorator';
 import { ActiveUserData } from 'src/interfaces/active-user-data.interface';
+import { setFileDownloadHeaders } from 'src/helpers/file-download.helper';
 
 enum ShowSoftDeleted {
   INCLUSIVE = "inclusive",
@@ -27,9 +28,10 @@ export class ImportTransactionController {
     }
 
     // ✅ Set response headers for streaming
-    res.setHeader('Content-Disposition', `attachment; filename="${importTemplateFileInfo.fileName}"`);
-    res.setHeader('Content-Type', importTemplateFileInfo.mimeType);
-    res.setHeader('Access-Control-Expose-Headers', 'Content-Disposition, Content-Type');
+    setFileDownloadHeaders(res, {
+      fileName: importTemplateFileInfo.fileName,
+      mimeType: importTemplateFileInfo.mimeType,
+    });
     // Pipe the stream to the response as an excel file
     importTemplateFileInfo.stream.pipe(res);
   }
@@ -117,9 +119,7 @@ export class ImportTransactionController {
       throw new InternalServerErrorException("Failed records stream is null");
     }
     // ✅ Set response headers for streaming
-    res.setHeader('Content-Disposition', `attachment; filename="${fileName}"`);
-    res.setHeader('Content-Type', mimeType);
-    res.setHeader('Access-Control-Expose-Headers', 'Content-Disposition, Content-Type');
+    setFileDownloadHeaders(res, { fileName, mimeType });
     // Pipe the strea to the response as an excel file
     stream.pipe(res);
   }

package/src/controllers/media.controller.ts

@@ -9,6 +9,8 @@ import { SolidRequestContextDto } from 'src/dtos/solid-request-context.dto';
 import { UpdateMediaDto } from 'src/dtos/update-media.dto';
 import { MediaService } from 'src/services/media.service';
 import { Response } from 'express';
+import { getLowercaseFileExtension, INLINE_SAFE_EXTENSIONS } from 'src/constants/media-file-types';
+import { setFileDownloadHeaders } from 'src/helpers/file-download.helper';
 
 enum ShowSoftDeleted {
   INCLUSIVE = "inclusive",
@@ -91,17 +93,26 @@ export class MediaController {
 
   @Auth(AuthType.MediaSignedUrl)
   @ApiQuery({ name: 'token', required: true, type: String, description: "Short-lived signed token obtained from a private Media record's URL - not entered manually." })
-  @ApiQuery({ name: 'disposition', required: false, enum: ['inline', 'attachment'], description: "'inline' (default) renders/previews in the browser, matching public media. Pass 'attachment' to force a browser download (e.g. from a download button)." })
+  @ApiQuery({ name: 'disposition', required: false, enum: ['inline', 'attachment'], description: "'inline' (default) renders/previews in the browser, matching public media - it applies only to types safe to render inline (images, audio, video, pdf); anything else is always downloaded. Pass 'attachment' to force a browser download (e.g. from a download button)." })
   @Get(':id/download')
   async download(@Param('id') id: string, @Query('disposition') disposition: string, @Res() res: Response, @SolidRequestContextDecorator() solidRequestContext: SolidRequestContextDto) {
     const media = await this.service.findOne(+id, {}, solidRequestContext);
     const { stream, fileName, mimeType } = await this.service.fileDownloadStream(media);
 
-    const contentDisposition = disposition === 'attachment' ? 'attachment' : 'inline';
-    res.setHeader('Content-Disposition', `${contentDisposition}; filename="${fileName}"`);
-    res.setHeader('Content-Type', mimeType);
-    res.setHeader('Cross-Origin-Resource-Policy', 'cross-origin');
-    res.setHeader('Access-Control-Expose-Headers', 'Content-Disposition, Content-Type');
+    // Mirror the static-serve hardening in SolidCoreModule: only a small allowlist of media
+    // types is ever safe to render inline. Anything else is forced to download rather than be
+    // displayed/executed, regardless of the mimetype the record was stored with - nosniff
+    // alone would not help here, since it faithfully honours a declared text/html.
+    const isInlineSafe = INLINE_SAFE_EXTENSIONS.has(getLowercaseFileExtension(fileName) ?? '');
+    const requestedInline = disposition !== 'attachment';
+
+    setFileDownloadHeaders(res, {
+      fileName,
+      mimeType: isInlineSafe ? mimeType : 'application/octet-stream',
+      disposition: requestedInline && isInlineSafe ? 'inline' : 'attachment',
+      crossOriginResourcePolicy: true,
+    });
+
     stream.pipe(res);
   }
 

package/src/controllers/module-package.controller.ts

@@ -13,6 +13,7 @@ import { ApiBearerAuth, ApiTags } from '@nestjs/swagger';
 import { Response } from 'express';
 import { ConfirmModulePackageImportDto } from 'src/dtos/confirm-module-package-import.dto';
 import { RunModulePackageBuildDto } from 'src/dtos/run-module-package-build.dto';
+import { setFileDownloadHeaders } from 'src/helpers/file-download.helper';
 import { RunModulePackageSeedDto } from 'src/dtos/run-module-package-seed.dto';
 import { ModulePackageService } from 'src/services/module-package.service';
 
@@ -39,9 +40,7 @@ export class ModulePackageController {
         @Res() res: Response,
     ) {
         const archive = await this.modulePackageService.exportModulePackage(moduleName);
-        res.setHeader('Content-Disposition', `attachment; filename="${archive.fileName}"`);
-        res.setHeader('Content-Type', archive.mimeType);
-        res.setHeader('Access-Control-Expose-Headers', 'Content-Disposition, Content-Type');
+        setFileDownloadHeaders(res, { fileName: archive.fileName, mimeType: archive.mimeType });
         res.sendFile(archive.filePath);
     }
 

package/src/controllers/mpin-authentication.controller.ts

@@ -0,0 +1,67 @@
+import { Body, Controller, Delete, Get, HttpCode, HttpStatus, Param, ParseIntPipe, Post } from '@nestjs/common';
+import { ApiBearerAuth, ApiTags } from '@nestjs/swagger';
+import { ActiveUser } from '../decorators/active-user.decorator';
+import { Public } from '../decorators/public.decorator';
+import { ChangeMpinDto } from '../dtos/change-mpin.dto';
+import { MpinLoginDto } from '../dtos/mpin-login.dto';
+import { SetupMpinDto } from '../dtos/setup-mpin.dto';
+import { ActiveUserData } from '../interfaces/active-user-data.interface';
+import { MpinService } from '../services/mpin.service';
+
+/**
+ * There is deliberately no public "is MPIN set up for this identifier" route.
+ * That would reintroduce exactly the user-enumeration oracle the opaque
+ * credential handle removes. The client decides whether to show the MPIN
+ * screen from the presence of its own stored handle.
+ */
+@Controller('iam/mpin')
+@ApiTags('Solid Core')
+export class MpinAuthenticationController {
+    constructor(private readonly mpinService: MpinService) { }
+
+    @ApiBearerAuth('jwt')
+    @Post('setup')
+    @HttpCode(HttpStatus.OK)
+    setup(
+        @Body() setupMpinDto: SetupMpinDto,
+        @ActiveUser() activeUser: ActiveUserData,
+    ) {
+        return this.mpinService.setupMpin(activeUser, setupMpinDto);
+    }
+
+    @ApiBearerAuth('jwt')
+    @Post('change')
+    @HttpCode(HttpStatus.OK)
+    change(
+        @Body() changeMpinDto: ChangeMpinDto,
+        @ActiveUser() activeUser: ActiveUserData,
+    ) {
+        return this.mpinService.changeMpin(activeUser, changeMpinDto);
+    }
+
+    // Public by necessity - the caller has no session yet. The credential
+    // handle is unguessable, so this carries no enumeration surface.
+    @Public()
+    @Post('login')
+    @HttpCode(HttpStatus.OK)
+    login(@Body() mpinLoginDto: MpinLoginDto) {
+        return this.mpinService.loginWithMpin(mpinLoginDto);
+    }
+
+    @ApiBearerAuth('jwt')
+    @Get('devices')
+    listDevices(@ActiveUser() activeUser: ActiveUserData) {
+        return this.mpinService.listDevices(activeUser);
+    }
+
+    // By row id, never by credential handle, so the management UI never has to
+    // hold the secret.
+    @ApiBearerAuth('jwt')
+    @Delete('devices/:id')
+    revokeDevice(
+        @Param('id', ParseIntPipe) id: number,
+        @ActiveUser() activeUser: ActiveUserData,
+    ) {
+        return this.mpinService.revokeDevice(activeUser, id);
+    }
+}

package/src/dtos/basic-filters.dto.ts

@@ -60,10 +60,6 @@ export class BasicFilterDto extends PaginationQueryDto {
     @ApiProperty({ description: "locale" })
     readonly locale?: string;
 
-    @IsOptional()
-    @ApiProperty({ description: "status publish draft" })
-    readonly status?: string;
-
     // @IsOptional()
     // @ApiProperty({ description: "default locale id" })
     // readonly defaultEntityLocaleId?: number;

package/src/dtos/change-mpin.dto.ts

@@ -0,0 +1,18 @@
+import { IsNotEmpty, IsString, MaxLength } from 'class-validator';
+
+export class ChangeMpinDto {
+    @IsNotEmpty()
+    @IsString()
+    @MaxLength(128)
+    credentialRef: string;
+
+    @IsNotEmpty()
+    @IsString()
+    @MaxLength(32)
+    currentMpin: string;
+
+    @IsNotEmpty()
+    @IsString()
+    @MaxLength(32)
+    newMpin: string;
+}

package/src/dtos/create-field-metadata.dto.ts

@@ -1,5 +1,6 @@
 import { ApiProperty } from '@nestjs/swagger';
 import { Transform, Type } from 'class-transformer';
+import { DANGEROUS_EXTENSIONS, MEDIA_CATEGORIES, MediaCategory } from '../constants/media-file-types';
 
 import {
   IsArray,
@@ -7,6 +8,7 @@ import {
   IsEnum,
   IsIn,
   IsInt,
+  IsNotIn,
   IsOptional,
   IsString,
   Matches,
@@ -155,13 +157,7 @@ export enum DecryptWhenType {
   afterTransit = 'after-transit',
 }
 
-export enum MediaType {
-  image = 'image',
-  audio = 'audio',
-  video = 'video',
-  // document = 'document',
-  file = 'file',
-}
+export type MediaType = MediaCategory;
 
 export enum RelationType {
   manyToOne = 'many-to-one',
@@ -308,7 +304,7 @@ export class CreateFieldMetadataDto {
   private: boolean;
 
   @ApiProperty({ description: 'Allowed media types for the field. Only for type=mediaSingle,mediaMultiple', })
-  @IsEnum(MediaType, { each: true })
+  @IsIn([...MEDIA_CATEGORIES], { each: true })
   @IsOptional()
   mediaTypes: MediaType[];
 
@@ -317,6 +313,18 @@ export class CreateFieldMetadataDto {
   @IsOptional()
   mediaMaxSizeKb: number;
 
+  @ApiProperty({ description: 'Explicit allowlist of file extensions (e.g. ["pdf","xlsx","png"]) permitted for this field, checked in addition to any mediaTypes category restriction — both must pass if both are set. For a strict allowlist, leave mediaTypes empty and use this alone. Only for type=mediaSingle,mediaMultiple', })
+  @Transform(({ value }) =>
+    Array.isArray(value)
+      ? value.map((ext: any) => String(ext).toLowerCase().trim().replace(/^\./, ''))
+      : value
+  )
+  @IsArray()
+  @IsString({ each: true })
+  @IsNotIn([...DANGEROUS_EXTENSIONS], { each: true })
+  @IsOptional()
+  mediaAllowedExtensions?: string[];
+
   @ApiProperty({ description: 'Configured Media storage provider. Only for type=mediaSingle,mediaMultiple', })
   @IsInt()
   @IsOptional()
@@ -464,4 +472,4 @@ export class CreateFieldMetadataDto {
   @ApiProperty({ description: 'Is Primary Key Field', })
   @IsBoolean()
   isPrimaryKey?: boolean;
-}
+}

package/src/dtos/create-model-sequence.dto.ts

@@ -35,7 +35,7 @@ export class CreateModelSequenceDto {
     @IsOptional()
     @IsInt()
     @ApiProperty()
-    currentValue: number;
+    currentValue?: number;
     @IsOptional()
     @IsString()
     @ApiProperty()

package/src/dtos/mpin-login.dto.ts

@@ -0,0 +1,24 @@
+import { IsNotEmpty, IsString, MaxLength } from 'class-validator';
+
+/**
+ * Deliberately carries no identifier - no mobile, email or username.
+ *
+ * `credentialRef` is a server-issued 256-bit handle that already points at a
+ * single credential row, and therefore at a single user. That is what removes
+ * the user-enumeration surface a public login route would otherwise have: an
+ * attacker cannot probe "does this phone number have MPIN?" because there is
+ * nowhere to put a phone number.
+ */
+export class MpinLoginDto {
+    // Bounded so a pathological payload never reaches the regex test or the
+    // hash comparison. The handle is always 64 hex characters.
+    @IsNotEmpty()
+    @IsString()
+    @MaxLength(128)
+    credentialRef: string;
+
+    @IsNotEmpty()
+    @IsString()
+    @MaxLength(32)
+    mpin: string;
+}

package/src/dtos/setup-mpin.dto.ts

@@ -0,0 +1,51 @@
+import { IsNotEmpty, IsOptional, IsString, IsUUID, Matches, MaxLength } from 'class-validator';
+
+export class SetupMpinDto {
+    /**
+     * Stable identifier for the physical device, generated once by the client.
+     * Validated as a UUID before it ever reaches a cache key or a bucket name,
+     * so it cannot smuggle delimiters into the keyspace.
+     */
+    @IsUUID()
+    deviceId: string;
+
+    /**
+     * A string, not a number, even though it looks like digits.
+     *
+     * A numeric MPIN cannot carry a leading zero: JSON forbids leading zeros in
+     * number literals, so a client serialising `012345` numerically emits
+     * `12345` and the server stores a five-digit MPIN the user never chose -
+     * which still satisfies the default `^\d{4,6}$` and so raises no error.
+     * `mpinRegex` is also tenant-configurable and may permit non-digits.
+     *
+     * Note this cannot be enforced here: the global ValidationPipe runs with
+     * `enableImplicitConversion`, so a numeric payload is coerced to a string
+     * before @IsString() sees it. Clients must send a quoted JSON string; that
+     * requirement is documented in the mobile integration guide.
+     *
+     * Length and shape are checked server-side against `mpinRegex`, since that
+     * setting is the single authority. This only bounds the input.
+     */
+    @IsNotEmpty()
+    @IsString()
+    @MaxLength(32)
+    mpin: string;
+
+    /**
+     * Rendered in a device-management list, so it is bounded here rather than
+     * trusting every consuming UI to escape it.
+     */
+    @IsOptional()
+    @IsString()
+    @MaxLength(64)
+    @Matches(/^[\w\s.'()-]*$/, {
+        message: 'deviceName may contain only letters, numbers, spaces and . \' ( ) - _',
+    })
+    deviceName?: string;
+
+    @IsOptional()
+    @IsString()
+    @MaxLength(32)
+    @Matches(/^[\w.-]*$/, { message: 'platform may contain only letters, numbers and . - _' })
+    platform?: string;
+}

package/src/entities/common.entity.ts

@@ -25,6 +25,30 @@ export abstract class CommonEntity {
     @Column({ name: 'published_at', default: null, nullable: true, transformer: LocalDateTimeTransformer })
     publishedAt: Date;
 
+    // Optional (not just nullable) because legacy tables (see LegacyCommonEntityWithExistingId)
+    // don't carry these versioning columns at all. CRUDService<T extends CommonEntity> is
+    // otherwise used for both plain and legacy entities, so these must stay structurally
+    // satisfiable by a type that never declares them.
+    @Expose()
+    @Column({ name: 'is_published', default: false })
+    @Index()
+    isPublished?: boolean;
+
+    @Expose()
+    @Column({ name: 'is_latest', default: true })
+    @Index()
+    isLatest?: boolean;
+
+    @Expose()
+    @Column({ type: "int", name: 'initial_entity_version_id', default: null, nullable: true })
+    @Index()
+    initialEntityVersionId?: number;
+
+    @Expose()
+    @Column({ name: 'published_tracker', default: "na" })
+    @Index()
+    publishedTracker?: string;
+
     @Expose()
     @Column({ type: "varchar", name: 'locale_name', default: null })
     localeName: string;

package/src/entities/dashboard-user-layout.entity.ts

@@ -6,12 +6,12 @@ import { ModuleMetadata } from 'src/entities/module-metadata.entity'
 @Entity('ss_dashboard_user_layout')
 export class DashboardUserLayout extends CommonEntity {
     @Index()
-    @ManyToOne(() => User, { onDelete: "CASCADE", nullable: false })
+    @ManyToOne(() => User, { nullable: false })
     @JoinColumn()
     user: User;
 
     @Index()
-    @ManyToOne(() => ModuleMetadata, { onDelete: "CASCADE", nullable: false })
+    @ManyToOne(() => ModuleMetadata, { nullable: false })
     @JoinColumn()
     module: ModuleMetadata;
 

package/src/entities/field-metadata.entity.ts

@@ -77,6 +77,9 @@ export class FieldMetadata extends CommonEntity {
     @Column({ name: 'media_max_size_kb', nullable: true })
     mediaMaxSizeKb: number;
 
+    @Column({ name: 'media_allowed_extensions', nullable: true, type: "simple-json" })
+    mediaAllowedExtensions: string[];
+
     @Index()
     @ManyToOne(() => MediaStorageProviderMetadata, { onDelete: 'SET NULL' })
     @JoinColumn({ name: 'media_storage_provider_id' })

package/src/entities/saved-filters.entity.ts

@@ -18,17 +18,17 @@ export class SavedFilters extends CommonEntity {
     isPrivate: boolean = false;
 
     @Index()
-    @ManyToOne(() => User, { onDelete: "CASCADE", nullable: true })
+    @ManyToOne(() => User, { nullable: true })
     @JoinColumn()
     user: User;
 
     @Index()
-    @ManyToOne(() => ModelMetadata, { onDelete: "CASCADE", nullable: false })
+    @ManyToOne(() => ModelMetadata, { nullable: false })
     @JoinColumn()
     model: ModelMetadata;
 
     @Index()
-    @ManyToOne(() => ViewMetadata, { onDelete: "CASCADE", nullable: false })
+    @ManyToOne(() => ViewMetadata, { nullable: false })
     @JoinColumn()
     view: ViewMetadata;
 

package/src/entities/user-device-credential.entity.ts

@@ -0,0 +1,130 @@
+import { Exclude, Expose } from "class-transformer";
+import { CommonEntity } from "src/entities/common.entity";
+import { Column, Entity, Index, ManyToOne } from "typeorm";
+import { User } from "./user.entity";
+
+/**
+ * A per-device MPIN credential.
+ *
+ * Login presents `credentialRef` (a server-issued opaque handle) plus the MPIN.
+ * The handle - not a mobile number or email - is what identifies the account,
+ * which is why the login route needs no identifier and offers no user
+ * enumeration surface.
+ */
+@Entity("ss_user_device_credential")
+// Non-unique: one physical device may legitimately hold credentials for
+// several accounts, and each account setup mints its own row.
+@Index(["user", "deviceId"])
+@Exclude()
+export class UserDeviceCredential extends CommonEntity {
+
+    // SHA-256 of the opaque handle, and the login lookup key. Never exposed:
+    // the raw handle is returned to the client once at setup and never stored.
+    // SHA-256 rather than bcrypt because the handle is 256 bits of randomness -
+    // there is nothing to brute-force, so a slow hash would only add latency.
+    // Same treatment as UserApiKey.hashedKey.
+    @Index({ unique: true })
+    @Column()
+    hashedCredentialRef: string;
+
+    // bcrypt hash of the MPIN, via HashingService. Never exposed - same
+    // treatment as User.password. Slow hashing is warranted here: a 4-6 digit
+    // secret is exactly the low-entropy case bcrypt exists for.
+    @Column()
+    hashedMpin: string;
+
+    // Mirrors User.passwordScheme / passwordSchemeVersion so
+    // HashingService.needsRehash can upgrade the hash on a successful login.
+    @Column()
+    mpinScheme: string;
+
+    /**
+     * The hashing *policy* version this row was hashed under - not a version of
+     * MPIN itself. It comes from `HashingService.currentVersion()`, which
+     * `BcryptService` currently returns as **2**, so freshly created rows read
+     * 2, exactly as `ss_user.password_scheme_version` does.
+     *
+     * It matters because `BcryptService.normalize` applies the configured
+     * pepper only when `version >= 2`. Storing the version per row means an
+     * older hash still verifies after the policy changes: `compare()` uses the
+     * version the row was written with, and `needsRehash()` upgrades it on the
+     * next successful login.
+     *
+     * The `default: 1` is inherited from the `User` precedent and is never
+     * reached, since every write path sets this explicitly. Note it would be
+     * *wrong* if it ever were: a row hashed at 2 but recorded as 1 would be
+     * compared without the pepper and could never authenticate.
+     */
+    @Column({ default: 1 })
+    mpinSchemeVersion: number;
+
+    // Client-supplied, stable for the physical device. Used for grouping and
+    // the device-management UI only - never a lookup key. Deliberately NOT
+    // unique: several accounts on one device share a deviceId.
+    @Expose()
+    @Column()
+    deviceId: string;
+
+    /**
+     * Human-readable natural key - `<username>-<deviceId>` - unique per row.
+     *
+     * Neither column alone can serve as the model's user key: `deviceId` is
+     * shared by every account on a device, and `deviceName` is nullable.
+     * Combining them is unique in both directions - one user across many
+     * devices, and many users on one device.
+     *
+     * Populated by MpinService rather than declared as a `computed` field in
+     * the metadata manifest. Computed fields are evaluated by
+     * ComputedFieldCrudManager on the generic CRUD path (`crud.service.ts`),
+     * which this service bypasses by writing through the repository directly,
+     * so a computed declaration would silently leave this null. It is also
+     * beyond ConcatComputedFieldProvider, which resolves `dto[field]` flatly
+     * within one model and cannot reach `username` across the user relation.
+     */
+    @Expose()
+    @Index({ unique: true })
+    @Column()
+    credentialKey: string;
+
+    @Expose()
+    @Column({ nullable: true })
+    deviceName: string;
+
+    @Expose()
+    @Column({ nullable: true })
+    platform: string;
+
+    // Revocation is a soft-delete: the row survives so that a correct MPIN can
+    // be answered with "this device was removed" rather than a baffling
+    // "incorrect MPIN". Only active rows count towards mpinMaxDevicesPerUser.
+    @Expose()
+    @Column({ default: true })
+    isActive: boolean;
+
+    // Cumulative, and reset only on a successful login - never when a lockout
+    // expires. That is what makes the second threshold detectable without a
+    // separate lockout counter.
+    @Expose()
+    @Column({ default: 0 })
+    failedAttempts: number;
+
+    @Expose()
+    @Column({ nullable: true })
+    lockedUntil: Date;
+
+    @Expose()
+    @Column({ nullable: true })
+    lastUsedAt: Date;
+
+    // Deliberately no inverse property on User. Nothing needs
+    // `user.deviceCredentials`, and leaving the most widely referenced entity
+    // in the system untouched keeps this feature purely additive.
+    //
+    // `nullable: false` because TypeORM makes relations nullable by default,
+    // which would let a credential exist with no owner. Such a row could never
+    // authenticate - loginWithMpin rejects it - so it would simply be dead
+    // data, but the database should refuse it outright. This also keeps the
+    // column honest against the metadata manifest, which declares it required.
+    @ManyToOne(() => User, { nullable: false })
+    user: User;
+}