@solidxai/core 0.1.13-beta.2 → 0.1.13-beta.21

package/src/entities/user.entity.ts

@@ -5,6 +5,23 @@ import { UserViewMetadata } from 'src/entities/user-view-metadata.entity'
 import { UserApiKey } from 'src/entities/user-api-key.entity'
 import { Exclude, Expose } from "class-transformer";
 
+/**
+ * Serialization is locked down twice over, and both halves are load-bearing:
+ *
+ * - The class-level `@Exclude()` below makes User itself an allowlist: only `@Expose()`d
+ *   properties are serialized.
+ * - Every other property additionally carries its own `@Exclude()`. That looks redundant
+ *   here, and for `User` it is - but class-transformer resolves the *class-level* strategy
+ *   with a direct lookup on the exact constructor (MetadataStorage.getStrategy), so a
+ *   subclass inherits nothing and falls back to `exposeAll`. Since this entity is a
+ *   `@TableInheritance` root that consuming projects extend (see
+ *   IExtensionUserCreationProvider), an extension user that forgets its own `@Exclude()`
+ *   would otherwise serialize the password hash and every OAuth/verification token.
+ *   Property-level metadata *is* walked up the prototype chain, so the per-property
+ *   decorators are what actually protect subclasses.
+ *
+ * Keep both. Adding a new column? Give it `@Expose()` or `@Exclude()` - never neither.
+ */
 @Entity("ss_user")
 @TableInheritance({ column: { type: "varchar", name: "type", default: "User" } })
 @Exclude()
@@ -30,7 +47,7 @@ export class User extends CommonEntity {
     mobile: string;
 
     @Column({ type: "varchar", nullable: true })
-    // don't send to client
+    @Exclude()
     password: string;
 
     @Column({ nullable: true, default: true })
@@ -38,67 +55,67 @@ export class User extends CommonEntity {
     forcePasswordChange: boolean = true;
 
     @Column({ type: "varchar", default: "local" })
-    // don't send to client
+    @Exclude()
     lastLoginProvider: string = "local";
 
     @Column({ type: "varchar", nullable: true })
-    // don't send to client (test)
+    @Exclude()
     accessCode: string;
 
     @Column({ type: "varchar", nullable: true })
-    // don't send to client
+    @Exclude()
     googleAccessToken: string;
 
     @Column({ type: "varchar", nullable: true })
-    // don't send to client
+    @Exclude()
     googleId: string;
 
     @Column({ type: "varchar", nullable: true })
-    // don't send to client
+    @Exclude()
     googleProfilePicture: string;
 
     @Column({ type: "varchar", nullable: true })
-    // don't send to client
+    @Exclude()
     facebookId: string;
 
     @Column({ type: "varchar", nullable: true })
-    // don't send to client
+    @Exclude()
     facebookAccessToken: string;
 
     @Column({ type: "varchar", nullable: true })
-    // don't send to client
+    @Exclude()
     facebookProfilePicture: string;
 
     @Column({ type: "varchar", nullable: true })
-    // don't send to client
+    @Exclude()
     appleId: string;
 
     @Column({ type: "varchar", nullable: true })
-    // don't send to client
+    @Exclude()
     appleAccessToken: string;
 
     @Column({ type: "varchar", nullable: true })
-    // don't send to client
+    @Exclude()
     microsoftId: string;
 
     @Column({ type: "varchar", nullable: true })
-    // don't send to client
+    @Exclude()
     microsoftAccessToken: string;
 
     @Column({ type: "varchar", nullable: true })
-    // don't send to client
+    @Exclude()
     microsoftProfilePicture: string;
 
     @Column({ type: "varchar", nullable: true })
-    // don't send to client
+    @Exclude()
     microsoftActiveDirectoryId: string;
 
     @Column({ type: "varchar", nullable: true })
-    // don't send to client
+    @Exclude()
     microsoftActiveDirectoryAccessToken: string;
 
     @Column({ type: "varchar", nullable: true })
-    // don't send to client
+    @Exclude()
     microsoftActiveDirectoryProfilePicture: string;
 
     @Index()
@@ -107,63 +124,63 @@ export class User extends CommonEntity {
     active: boolean = true;
 
     @Column({ nullable: true })
-    // don't send to client
+    @Exclude()
     forgotPasswordConfirmedAt: Date;
 
     @Column({ type: "varchar", nullable: true })
-    // don't send to client
+    @Exclude()
     verificationTokenOnForgotPassword: string;
 
     @Column({ nullable: true })
-    // don't send to client
+    @Exclude()
     verificationTokenOnForgotPasswordExpiresAt: Date;
 
     @Column({ nullable: true })
-    // don't send to client
+    @Exclude()
     emailVerifiedOnRegistrationAt: Date;
 
     @Column({ type: "varchar", nullable: true })
-    // don't send to client
+    @Exclude()
     emailVerificationTokenOnRegistration: string;
 
     @Column({ nullable: true })
-    // don't send to client
+    @Exclude()
     emailVerificationTokenOnRegistrationExpiresAt: Date;
 
     @Column({ nullable: true })
-    // don't send to client
+    @Exclude()
     mobileVerifiedOnRegistrationAt: Date;
 
     @Column({ type: "varchar", nullable: true })
-    // don't send to client
+    @Exclude()
     mobileVerificationTokenOnRegistration: string;
 
     @Column({ nullable: true })
-    // don't send to client
+    @Exclude()
     mobileVerificationTokenOnRegistrationExpiresAt: Date;
 
     @Column({ nullable: true })
-    // don't send to client
+    @Exclude()
     emailVerifiedOnLoginAt: Date;
 
     @Column({ type: "varchar", nullable: true })
-    // don't send to client
+    @Exclude()
     emailVerificationTokenOnLogin: string;
 
     @Column({ nullable: true })
-    // don't send to client
+    @Exclude()
     emailVerificationTokenOnLoginExpiresAt: Date;
 
     @Column({ nullable: true })
-    // don't send to client
+    @Exclude()
     mobileVerifiedOnLoginAt: Date;
 
     @Column({ type: "varchar", nullable: true })
-    // don't send to client
+    @Exclude()
     mobileVerificationTokenOnLogin: string;
 
     @Column({ nullable: true })
-    // don't send to client
+    @Exclude()
     mobileVerificationTokenOnLoginExpiresAt: Date;
 
     @Column({ type: "varchar", nullable: true })
@@ -176,18 +193,18 @@ export class User extends CommonEntity {
     roles: RoleMetadata[];
 
     @OneToMany(() => UserViewMetadata, userViewMetadata => userViewMetadata.user, { cascade: true })
-    // don't send to client
+    @Exclude()
     userViewMetadata: UserViewMetadata[];
 
-    // dont send to client
+    @Exclude()
     @Column({ type: "varchar", default: "bcrypt" })
     passwordScheme: string;
 
-    // dont send to client
+    @Exclude()
     @Column({ type: "int", default: 1 })
     passwordSchemeVersion: number;
 
-    // dont send to client
+    @Exclude()
     @Column({ nullable: true })
     rehashedAt: Date;
 

package/src/entities/view-metadata.entity.ts

@@ -19,11 +19,11 @@ export class ViewMetadata extends CommonEntity {
     @Column({ name: "type", type: "varchar" })
     type: string;
 
-    //TODO: To make this truly cross db compatible, we should avoid setting a db type
+    // TODO: To make this truly cross db compatible, we should avoid setting a db type  
     @Column({ name: "context", type: "text" })
     context: any = "{}";
 
-    //TODO: To make this truly cross db compatible, we should avoid setting a db type
+    // TODO: To make this truly cross db compatible, we should avoid setting a db type
     @Column({ name: "layout", type: "text" })
     layout: any;
 

package/src/entities/workflow-execution-artifact.entity.ts

@@ -2,6 +2,7 @@ import { CommonEntity } from 'src/entities/common.entity';
 import { Entity, Column, Index, JoinColumn, ManyToOne } from 'typeorm';
 import { WorkflowExecution } from './workflow-execution.entity';
 import { WorkflowStepExecution } from './workflow-step-execution.entity'
+import { getColumnType } from 'src/helpers/typeorm-db-helper';
 
 @Entity('ss_workflow_execution_artifact')
 export class WorkflowExecutionArtifact extends CommonEntity {
@@ -10,12 +11,12 @@ export class WorkflowExecutionArtifact extends CommonEntity {
     artifactKey: string;
 
     @Index()
-    @ManyToOne(() => WorkflowExecution, { onDelete: "CASCADE", nullable: false })
+    @ManyToOne(() => WorkflowExecution, { nullable: false })
     @JoinColumn()
     workflowExecution: WorkflowExecution;
 
     @Index()
-    @ManyToOne(() => WorkflowStepExecution, { onDelete: "CASCADE", nullable: true })
+    @ManyToOne(() => WorkflowStepExecution, { nullable: true })
     @JoinColumn()
     workflowStepExecution: WorkflowStepExecution;
 
@@ -61,7 +62,7 @@ export class WorkflowExecutionArtifact extends CommonEntity {
     checksum: string;
 
     @Index()
-    @Column({ type: "timestamp", nullable: true })
+    @Column({ nullable: true, ...getColumnType('datetime') })
     producedAt: Date;
 
     @Column({ type: "simple-json", nullable: true })

package/src/entities/workflow-execution-log.entity.ts

@@ -2,6 +2,7 @@ import { CommonEntity } from 'src/entities/common.entity';
 import { Entity, Column, Index, JoinColumn, ManyToOne } from 'typeorm';
 import { WorkflowExecution } from './workflow-execution.entity';
 import { WorkflowStepExecution } from './workflow-step-execution.entity'
+import { getColumnType } from 'src/helpers/typeorm-db-helper';
 
 @Entity('ss_workflow_execution_log')
 export class WorkflowExecutionLog extends CommonEntity {
@@ -10,12 +11,12 @@ export class WorkflowExecutionLog extends CommonEntity {
     logKey: string;
 
     @Index()
-    @ManyToOne(() => WorkflowExecution, { onDelete: "CASCADE", nullable: false })
+    @ManyToOne(() => WorkflowExecution, { nullable: false })
     @JoinColumn()
     workflowExecution: WorkflowExecution;
 
     @Index()
-    @ManyToOne(() => WorkflowStepExecution, { onDelete: "CASCADE", nullable: true })
+    @ManyToOne(() => WorkflowStepExecution, { nullable: true })
     @JoinColumn()
     workflowStepExecution: WorkflowStepExecution;
 
@@ -47,7 +48,7 @@ export class WorkflowExecutionLog extends CommonEntity {
     sequenceNumber: number;
 
     @Index()
-    @Column({ type: "timestamp" })
+    @Column({ ...getColumnType('datetime') })
     occurredAt: Date;
 
     @Column({ type: "simple-json", nullable: true })

package/src/entities/workflow-execution.entity.ts

@@ -4,6 +4,7 @@ import { WorkflowDefinition } from './workflow-definition.entity'
 import { WorkflowStepExecution } from './workflow-step-execution.entity';
 import { WorkflowExecutionLog } from './workflow-execution-log.entity';
 import { WorkflowExecutionArtifact } from './workflow-execution-artifact.entity';
+import { getColumnType } from 'src/helpers/typeorm-db-helper';
 
 @Entity('ss_workflow_execution')
 export class WorkflowExecution extends CommonEntity {
@@ -32,11 +33,11 @@ export class WorkflowExecution extends CommonEntity {
     triggerType: string = "manual";
 
     @Index()
-    @Column({ type: "timestamp", nullable: true })
+    @Column({ nullable: true, ...getColumnType('datetime') })
     startedAt: Date;
 
     @Index()
-    @Column({ type: "timestamp", nullable: true })
+    @Column({ nullable: true, ...getColumnType('datetime') })
     finishedAt: Date;
 
     @Column({ type: "bigint", nullable: true })

package/src/entities/workflow-secret.entity.ts

@@ -1,5 +1,6 @@
 import { CommonEntity } from 'src/entities/common.entity';
 import { Entity, Column, Index } from 'typeorm';
+import { getColumnType } from 'src/helpers/typeorm-db-helper';
 
 @Entity('ss_workflow_secret')
 export class WorkflowSecret extends CommonEntity {
@@ -25,9 +26,9 @@ export class WorkflowSecret extends CommonEntity {
     @Column({ type: "varchar", default: "active" })
     status: string = "active";
 
-    @Column({ type: "timestamp", nullable: true })
+    @Column({ nullable: true, ...getColumnType('datetime') })
     lastRotatedAt: Date;
 
-    @Column({ type: "timestamp", nullable: true })
+    @Column({ nullable: true, ...getColumnType('datetime') })
     lastAccessedAt: Date;
 }

package/src/entities/workflow-step-execution.entity.ts

@@ -1,6 +1,7 @@
 import { CommonEntity } from 'src/entities/common.entity';
 import { Entity, Column, Index, JoinColumn, ManyToOne } from 'typeorm';
 import { WorkflowExecution } from './workflow-execution.entity'
+import { getColumnType } from 'src/helpers/typeorm-db-helper';
 
 @Entity('ss_workflow_step_execution')
 export class WorkflowStepExecution extends CommonEntity {
@@ -55,11 +56,11 @@ export class WorkflowStepExecution extends CommonEntity {
     sequenceNumber: number;
 
     @Index()
-    @Column({ type: "timestamp", nullable: true })
+    @Column({ nullable: true, ...getColumnType('datetime') })
     startedAt: Date;
 
     @Index()
-    @Column({ type: "timestamp", nullable: true })
+    @Column({ nullable: true, ...getColumnType('datetime') })
     finishedAt: Date;
 
     @Column({ type: "bigint", nullable: true })

package/src/entities/workflow-trigger-execution.entity.ts

@@ -2,6 +2,7 @@ import { CommonEntity } from 'src/entities/common.entity';
 import { Entity, Column, Index, JoinColumn, ManyToOne } from 'typeorm';
 import { WorkflowDefinition } from './workflow-definition.entity';
 import { WorkflowExecution } from './workflow-execution.entity'
+import { getColumnType } from 'src/helpers/typeorm-db-helper';
 
 @Entity('ss_workflow_trigger_execution')
 export class WorkflowTriggerExecution extends CommonEntity {
@@ -10,12 +11,12 @@ export class WorkflowTriggerExecution extends CommonEntity {
     triggerExecutionKey: string;
 
     @Index()
-    @ManyToOne(() => WorkflowDefinition, { onDelete: "CASCADE", nullable: false })
+    @ManyToOne(() => WorkflowDefinition, { nullable: false })
     @JoinColumn()
     workflowDefinition: WorkflowDefinition;
 
     @Index()
-    @ManyToOne(() => WorkflowExecution, { onDelete: "CASCADE", nullable: true })
+    @ManyToOne(() => WorkflowExecution, { nullable: true })
     @JoinColumn()
     workflowExecution: WorkflowExecution;
 
@@ -35,19 +36,19 @@ export class WorkflowTriggerExecution extends CommonEntity {
     status: string = "received";
 
     @Index()
-    @Column({ type: "boolean", nullable: true, default: false })
+    @Column({ nullable: true, default: false })
     matched: boolean = false;
 
     @Index()
-    @Column({ type: "timestamp" })
+    @Column({ ...getColumnType('datetime') })
     firedAt: Date;
 
     @Index()
-    @Column({ type: "timestamp", nullable: true })
+    @Column({ nullable: true, ...getColumnType('datetime') })
     startedAt: Date;
 
     @Index()
-    @Column({ type: "timestamp", nullable: true })
+    @Column({ nullable: true, ...getColumnType('datetime') })
     finishedAt: Date;
 
     @Column({ type: "bigint", nullable: true })

package/src/factories/mail.factory.ts

@@ -30,8 +30,14 @@ export class MailFactory {
         }
 
         const mailServiceProvider = mailProviders.find(provider => provider.name === mailServiceName);
+        if (!mailServiceProvider?.instance) {
+            const registeredProviders = mailProviders.map((provider) => provider?.name).filter(Boolean).join(", ");
+            throw new Error(
+                `Mail provider "${mailServiceName}" is not registered. Registered providers: ${registeredProviders || "none"}`,
+            );
+        }
 
         return mailServiceProvider.instance as IMail;
     }
 
-}
+}

package/src/filters/http-exception.filter.ts

@@ -30,12 +30,22 @@ export class HttpExceptionFilter implements ExceptionFilter {
         const isHttp = exception instanceof HttpException;
         const explicitStatus = isHttp ? exception.getStatus() : undefined;
 
+        // Errors from http-errors-style libraries (e.g. body-parser's PayloadTooLargeError)
+        // are plain Errors carrying their own status. Honour it rather than collapsing to 500.
+        const rawStatus = exception?.status ?? exception?.statusCode;
+        const derivedStatus =
+            typeof rawStatus === 'number' && rawStatus >= 400 && rawStatus < 600
+                ? rawStatus
+                : undefined;
+
         // Canonical code + static message
         const code: ErrorCode = this.errorMapper.mapException(exception);
         const defaultStatus = this.errorMapper.getHttpStatus(code);
         const message = code === 'solidx-unknown-error' ? `${exception?.message}` : this.errorMapper.getMessage(code);
 
-        const status = explicitStatus ?? defaultStatus ?? 500;
+        // derivedStatus must precede defaultStatus: getHttpStatus() returns a hard 500
+        // for unmatched codes, so it is never undefined and would always win otherwise.
+        const status = explicitStatus ?? derivedStatus ?? defaultStatus ?? 500;
 
         // Logging
         this.logger.error(

package/src/helpers/bootstrap.helper.ts

@@ -1,5 +1,6 @@
 import { ClassSerializerInterceptor, ValidationPipe } from '@nestjs/common';
 import { NestFactory, Reflector } from '@nestjs/core';
+import { NestExpressApplication } from '@nestjs/platform-express';
 import { WsAdapter } from '@nestjs/platform-ws';
 import { DocumentBuilder, SwaggerModule } from '@nestjs/swagger';
 import { NextFunction, Request, Response } from 'express';
@@ -12,7 +13,12 @@ import { CommandFactory } from 'nest-commander';
 import { createWinstonLoggerConfig } from '../winston.logger';
 import { WrapResponseInterceptor } from '../interceptors/wrap-response.interceptor';
 import { buildDefaultCorsOptions } from './cors.helper';
-import { buildDefaultSecurityHeaderOptions, buildPermissionsPolicyHeader, PermissionsPolicyConfig } from './security.helper';
+import {
+  buildDefaultSecurityHeaderOptions,
+  buildPermissionsPolicyHeader,
+  PermissionsPolicyConfig,
+  SolidSecurityOptions,
+} from './security.helper';
 import { parseBooleanEnv } from './environment.helper';
 
 // ---- Shared process handlers ----
@@ -50,8 +56,20 @@ export interface SolidBootstrapOptions {
   swagger?: SolidSwaggerOptions | false;
   /** Permissions-Policy header overrides (merged with defaults). */
   permissionsPolicyOverrides?: Partial<PermissionsPolicyConfig>;
+  /** Security header overrides, including iframe frame-ancestor allowlists. */
+  security?: SolidSecurityOptions;
   /** Show full NestJS init logs during bootstrap (route mapping, module deps, pollers). Defaults to false. */
   verboseBootstrap?: boolean;
+  /**
+   * Max request body size for JSON and urlencoded payloads, as a `bytes`-compatible
+   * string (e.g. '10mb', '512kb'). Defaults to '10mb'.
+   *
+   * Does NOT apply to multipart/form-data uploads: body-parser matches on Content-Type,
+   * so multipart requests skip these parsers entirely and are handled by Multer. Raise
+   * this only for large structured JSON (e.g. /bulk arrays), bearing in mind the parsed
+   * object graph can retain several times the raw byte size.
+   */
+  bodyLimit?: string;
 }
 
 /**
@@ -64,19 +82,30 @@ export interface SolidBootstrapOptions {
  * // main.ts
  * bootstrapSolidApp(() => AppModule.forRoot(), {
  *   swagger: { title: 'My API', description: 'My API description' },
+ *   security: { frameAncestors: ["'self'", 'https://portal.example.com'] },
  * });
  */
 export async function bootstrapSolidApp(
   appModuleFactory: () => Promise<any>,
   options: SolidBootstrapOptions = {},
-): Promise<void> {
+): Promise<NestExpressApplication> {
   registerGlobalProcessHandlers();
 
-  const { globalPrefix = 'api', swagger = {}, permissionsPolicyOverrides = {}, verboseBootstrap = false } = options;
+  const {
+    globalPrefix = 'api',
+    swagger = {},
+    permissionsPolicyOverrides = {},
+    security = {},
+    verboseBootstrap = false,
+    bodyLimit = '10mb',
+  } = options;
 
   const startTime = Date.now();
   const appModule = await appModuleFactory();
-  const app = await NestFactory.create(appModule, {
+  const app = await NestFactory.create<NestExpressApplication>(appModule, {
+    // Nest's default parsers are registered during init() with a 100kb limit, ahead of
+    // any module middleware. Disable them so the parsers below own the limit outright.
+    bodyParser: false,
     logger: WinstonModule.createLogger({ ...createWinstonLoggerConfig(), level: verboseBootstrap ? 'debug' : 'error' }),
   });
 
@@ -87,7 +116,7 @@ export async function bootstrapSolidApp(
     app
       .get(WINSTON_MODULE_NEST_PROVIDER)
       .log('API server disabled via API_ENABLED=false. Skipping HTTP listen.', 'Bootstrap');
-    return;
+    return app;
   }
 
   // Health check at root path
@@ -95,7 +124,7 @@ export async function bootstrapSolidApp(
   server.get('/', (_req, res) => res.status(200).send('SOLID OK'));
 
   // Security headers
-  app.use(helmet(buildDefaultSecurityHeaderOptions()));
+  app.use(helmet(buildDefaultSecurityHeaderOptions(security)));
 
   // Nest's Swagger UI HTML injects inline styles; keep CSP strict elsewhere.
   const isSwaggerPath = (path: string) =>
@@ -136,6 +165,12 @@ export async function bootstrapSolidApp(
     next();
   });
 
+  // Body parsers — replaces Nest's default 100kb parsers (disabled via bodyParser: false).
+  // Registered here so the middleware order Nest applied by default is preserved:
+  // helmet -> CSP -> Permissions-Policy -> qs -> body parsers -> routes.
+  app.useBodyParser('json', { limit: bodyLimit });
+  app.useBodyParser('urlencoded', { limit: bodyLimit, extended: true });
+
   // Global ValidationPipe
   app.useGlobalPipes(
     new ValidationPipe({
@@ -195,6 +230,8 @@ export async function bootstrapSolidApp(
 
   const elapsed = ((Date.now() - startTime) / 1000).toFixed(2);
   process.stdout.write(`\x1b[32mServer started on port ${port} in ${elapsed}s\x1b[0m\n`);
+
+  return app;
 }
 
 // ---- CLI bootstrap ----