@solidxai/core 0.1.13-beta.2 → 0.1.13-beta.21

package/src/helpers/field-crud-managers/MediaFieldCrudManager.ts

@@ -1,5 +1,5 @@
 import { FieldCrudManager, ValidationError } from "src/interfaces";
-import { DANGEROUS_EXTENSIONS, EXT_TO_MEDIA_TYPE, MediaCategory } from "src/constants/media-file-types";
+import { EXT_TO_MEDIA_TYPE, getLowercaseFileExtension, getUploadedFileName, isDangerousMediaFile, MediaCategory } from "src/constants/media-file-types";
 
 export enum SolidMediaType {
     mediaSingle = 'mediaSingle',
@@ -12,6 +12,7 @@ export interface MediaFieldOptions {
     fieldName: string | undefined | null;
     mediaMaxSizeKb: number | undefined | null;
     mediaTypes: string[];
+    mediaAllowedExtensions?: string[] | null;
     isUpdate: boolean | undefined | null;
 }
 
@@ -79,32 +80,35 @@ export class MediaFieldCrudManager implements FieldCrudManager {
     constructor(private readonly options: MediaFieldOptions) {
     }
 
-    private resolveMediaType(mimetype?: string, filename?: string): MediaType | null {
-        const ext = (filename || '').split('.').pop()?.toLowerCase();
-        if (ext && DANGEROUS_EXTENSIONS.has(ext)) {
+    private resolveMediaType(file: Express.Multer.File): MediaType | null {
+        // Belt-and-braces: dangerous files are already rejected outright by
+        // validateDangerousFiles, but never let one resolve to a usable category.
+        if (isDangerousMediaFile(file)) {
             return null;
         }
 
-        const mt = (mimetype || '').toLowerCase().trim();
-        if (mt === 'image/svg+xml' || mt === 'text/html' || mt === 'application/xhtml+xml') {
+        // Extension is authoritative: a declared mimetype is fully attacker-controlled and
+        // proved insufficient on its own (a .msi uploaded as image/png previously resolved to
+        // 'image', since the mimetype match short-circuited before the extension was ever
+        // checked). The extension must independently resolve to a known-safe category before
+        // anything is accepted - not merely "not on the denylist".
+        const ext = getLowercaseFileExtension(getUploadedFileName(file));
+        const extType = ext ? EXT_TO_MEDIA_TYPE[ext] : undefined;
+        if (!extType) {
             return null;
         }
-        if (mt && MIME_TO_MEDIA_TYPE[mt]) {
-            return MIME_TO_MEDIA_TYPE[mt];
-        }
-
-        // Some libs may send "image/*" etc. Treat broad families safely.
-        if (mt.startsWith('image/')) return 'image';
-        if (mt.startsWith('audio/')) return 'audio';
-        if (mt.startsWith('video/')) return 'video';
 
-        // Fallback to extension if provided (also covers generic/unrecognized
-        // mimetypes such as application/octet-stream).
-        if (ext && EXT_TO_MEDIA_TYPE[ext]) {
-            return EXT_TO_MEDIA_TYPE[ext];
+        // The mimetype may only confirm or veto what the extension already established, never
+        // grant a category on its own. A mimetype that doesn't resolve to anything (e.g.
+        // application/octet-stream) has no opinion and is treated as agreeing.
+        const mt = (file.mimetype || '').toLowerCase().trim();
+        const mimeType = MIME_TO_MEDIA_TYPE[mt]
+            ?? (mt.startsWith('image/') ? 'image' : mt.startsWith('audio/') ? 'audio' : mt.startsWith('video/') ? 'video' : undefined);
+        if (mimeType && mimeType !== extType) {
+            return null;
         }
 
-        return null;
+        return extType;
     }
 
     validate(dto: any, files: Array<Express.Multer.File>): ValidationError[] {
@@ -113,17 +117,42 @@ export class MediaFieldCrudManager implements FieldCrudManager {
     }
 
     private applyValidations(fieldFiles: Array<Express.Multer.File>): ValidationError[] {
+        // A dangerous upload is never acceptable, regardless of admin config, so this is the
+        // only check that sits outside validateCommon() and can't be skipped either way below.
+        const dangerousFileErrors = this.validateDangerousFiles(fieldFiles);
+
         switch (this.options.type) {
             case SolidMediaType.mediaSingle:
-                return this.validateMediaSingle(fieldFiles);
+                return [...dangerousFileErrors, ...this.validateMediaSingle(fieldFiles)];
             case SolidMediaType.mediaMultiple:
-                return this.validateMediaMultiple(fieldFiles);
+                return [...dangerousFileErrors, ...this.validateMediaMultiple(fieldFiles)];
             default:
-                return [];
+                return dangerousFileErrors;
         }
     }
 
-    private validateMediaSingle(fieldFiles: Array<Express.Multer.File>): ValidationError[] {
+    private validateDangerousFiles(fieldFiles: Array<Express.Multer.File>): ValidationError[] {
+        return fieldFiles
+            .filter(fieldFile => isDangerousMediaFile(fieldFile))
+            .map(fieldFile => ({
+                field: this.options.fieldName,
+                error: `${this.options.fieldName} file type not allowed. ` +
+                    `${getUploadedFileName(fieldFile) || 'File'} is a potentially dangerous file type.`
+            }));
+    }
+
+    // Every optional, admin-configured, per-field check - no-ops when its setting is unset -
+    // shared between mediaSingle and mediaMultiple so neither can drift out of sync with it.
+    private validateCommon(fieldFiles: Array<Express.Multer.File>): ValidationError[] {
+        return [
+            ...this.validateRequired(fieldFiles),
+            ...this.validateSize(fieldFiles),
+            ...this.validateTypes(fieldFiles),
+            ...this.validateAllowedExtensions(fieldFiles),
+        ];
+    }
+
+    private validateRequired(fieldFiles: Array<Express.Multer.File>): ValidationError[] {
         const errors: ValidationError[] = [];
         if (!this.options.isUpdate && this.options.required && fieldFiles.length === 0) {
             errors.push({
@@ -131,13 +160,11 @@ export class MediaFieldCrudManager implements FieldCrudManager {
                 error: `${this.options.fieldName} is required`
             });
         }
-        if (fieldFiles.length > 1) {
-            errors.push({
-                field: this.options.fieldName,
-                error: `${this.options.fieldName} must be a single file`
-            });
-        }
-        // validate size
+        return errors;
+    }
+
+    private validateSize(fieldFiles: Array<Express.Multer.File>): ValidationError[] {
+        const errors: ValidationError[] = [];
         if (this.options.mediaMaxSizeKb) {
             for (let i = 0; i < fieldFiles.length; i++) {
                 const fieldFile = fieldFiles[i];
@@ -150,14 +177,18 @@ export class MediaFieldCrudManager implements FieldCrudManager {
                 }
             }
         }
-        // validate type
+        return errors;
+    }
+
+    private validateTypes(fieldFiles: Array<Express.Multer.File>): ValidationError[] {
+        const errors: ValidationError[] = [];
         if (this.options.mediaTypes && this.options.mediaTypes.length > 0) {
             const allowedFileTypes = this.options.mediaTypes as MediaType[];
 
             for (let i = 0; i < fieldFiles.length; i++) {
                 const fieldFile = fieldFiles[i];
 
-                const resolvedType = this.resolveMediaType(fieldFile.mimetype, fieldFile.originalname ?? fieldFile.filename ?? '');
+                const resolvedType = this.resolveMediaType(fieldFile);
                 if (!resolvedType || !allowedFileTypes.includes(resolvedType)) {
                     errors.push({
                         field: this.options.fieldName,
@@ -168,21 +199,43 @@ export class MediaFieldCrudManager implements FieldCrudManager {
                 }
             }
         }
-
         return errors;
     }
 
-    private validateMediaMultiple(fieldFiles: Array<Express.Multer.File>): ValidationError[] {
-        const errors: ValidationError[] = [];
-        if (!this.options.isUpdate && this.options.required && fieldFiles.length === 0) {
+    private validateAllowedExtensions(fieldFiles: Array<Express.Multer.File>): ValidationError[] {
+        const allowed = this.options.mediaAllowedExtensions;
+        if (!allowed || allowed.length === 0) {
+            return [];
+        }
+
+        const normalizedAllowed = new Set(allowed.map(ext => ext.toLowerCase().replace(/^\./, '')));
+        return fieldFiles
+            .filter(fieldFile => {
+                const ext = getLowercaseFileExtension(getUploadedFileName(fieldFile));
+                return !ext || !normalizedAllowed.has(ext);
+            })
+            .map(fieldFile => ({
+                field: this.options.fieldName,
+                error: `${this.options.fieldName} file type not allowed. ` +
+                    `Allowed extensions: ${[...normalizedAllowed].join(', ')}.`
+            }));
+    }
+
+    private validateMediaSingle(fieldFiles: Array<Express.Multer.File>): ValidationError[] {
+        const errors = this.validateCommon(fieldFiles);
+        if (fieldFiles.length > 1) {
             errors.push({
                 field: this.options.fieldName,
-                error: `${this.options.fieldName} is required`
+                error: `${this.options.fieldName} must be a single file`
             });
         }
         return errors;
     }
 
+    private validateMediaMultiple(fieldFiles: Array<Express.Multer.File>): ValidationError[] {
+        return this.validateCommon(fieldFiles);
+    }
+
     transformForCreate(dto: any): any {
         return dto;
     }

package/src/helpers/file-download.helper.ts

@@ -0,0 +1,45 @@
+import type { Response } from "express";
+
+export interface FileDownloadHeaderOptions {
+  fileName: string;
+  mimeType: string;
+  /** Defaults to 'attachment'; only pass 'inline' for types known safe to render. */
+  disposition?: "inline" | "attachment";
+  /** Opt in for assets loaded cross-origin by the UI (e.g. media served to :3000). */
+  crossOriginResourcePolicy?: boolean;
+}
+
+/**
+ * Builds an RFC 6266 Content-Disposition value. The file name is attacker-controlled (it comes
+ * from the uploaded originalFileName), so it can't be interpolated raw: a quote would close the
+ * quoted-string early and let the rest of the name forge further header parameters. The ASCII
+ * fallback is stripped to a safe subset and the real name is carried in the RFC 5987
+ * `filename*` parameter, which is also what preserves non-ASCII names correctly.
+ */
+function buildContentDisposition(disposition: "inline" | "attachment", fileName: string): string {
+  const name = (fileName || "file").replace(/[\r\n]/g, "");
+  const asciiFallback = name.replace(/[^\x20-\x7E]/g, "_").replace(/["\\]/g, "_") || "file";
+
+  return `${disposition}; filename="${asciiFallback}"; filename*=UTF-8''${encodeURIComponent(name)}`;
+}
+
+/**
+ * Single place that stamps the response headers for every streamed file download, so the
+ * security headers can't be applied to one endpoint and forgotten on the next.
+ */
+export function setFileDownloadHeaders(res: Response, options: FileDownloadHeaderOptions): void {
+  const disposition = options.disposition ?? "attachment";
+
+  res.setHeader("Content-Disposition", buildContentDisposition(disposition, options.fileName));
+  res.setHeader("Content-Type", options.mimeType);
+  res.setHeader("Access-Control-Expose-Headers", "Content-Disposition, Content-Type");
+
+  // Prevent the browser from ever content-sniffing a served file into something more
+  // dangerous than its declared Content-Type (e.g. rendering a mislabeled upload as HTML
+  // and executing embedded script).
+  res.setHeader("X-Content-Type-Options", "nosniff");
+
+  if (options.crossOriginResourcePolicy) {
+    res.setHeader("Cross-Origin-Resource-Policy", "cross-origin");
+  }
+}

package/src/helpers/model-metadata-helper.service.ts

@@ -2,6 +2,7 @@
 
 import { forwardRef, Inject, Injectable, Logger } from "@nestjs/common";
 import { _ } from "lodash";
+import { DRAFT_PUBLISH_VERSIONING_FIELD_NAMES } from "src/constants/draft-publish-fields";
 import { LEGACY_TABLE_FIELDS_PREFIX } from "src/entities/legacy-common.entity-with-existing-id.entity";
 import { LegacyTableType } from "src/enums/legacy-table-type.enum";
 import { ModelMetadataRepository } from "src/repository/model-metadata.repository";
@@ -87,6 +88,32 @@ export class ModelMetadataHelperService {
                 isSystem: true,
                 enableAuditTracking:true
             },
+            {
+                name: "isPublished",
+                displayName: "Is Published",
+                type: "boolean",
+                isSystem: true,
+                enableAuditTracking: true
+            },
+            {
+                name: "isLatest",
+                displayName: "Is Latest",
+                type: "boolean",
+                isSystem: true,
+                enableAuditTracking: true
+            },
+            {
+                name: "initialEntityVersionId",
+                displayName: "Initial Entity Version Id",
+                type: "int",
+                isSystem: true,
+            },
+            {
+                name: "publishedTracker",
+                displayName: "Published Tracker",
+                type: "shortText",
+                isSystem: true,
+            },
             {
                 name: "localeName",
                 displayName: "Locale",
@@ -117,7 +144,11 @@ export class ModelMetadataHelperService {
     }
 
     private getSystemFieldsMetadataMappingForLegacyTable(withId: boolean=true) {
-        const systemFieldsMetadata = this.getSystemFieldsMetadataMapping();
+        // Legacy tables don't have the draft/publish versioning columns, so exclude
+        // them from the legacy system fields metadata mapping.
+        const legacyExcludedFieldNames: readonly string[] = DRAFT_PUBLISH_VERSIONING_FIELD_NAMES;
+        const systemFieldsMetadata = this.getSystemFieldsMetadataMapping()
+            .filter(field => !legacyExcludedFieldNames.includes(field.name));
         if (!withId) {
             // Remove the id field metadata
             const index = systemFieldsMetadata.findIndex(field => field.name === 'id');

package/src/helpers/security.helper.ts

@@ -1,15 +1,39 @@
 import { HelmetOptions } from "helmet";
 import { Environment } from "src/decorators/disallow-in-production.decorator";
 
+export interface SolidSecurityOptions {
+  /**
+   * Origins that may embed this application in an iframe.
+   * Defaults to the local HTTP/HTTPS loopback origins on any port.
+   */
+  frameAncestors?: string[];
+}
+
+export const DEFAULT_FRAME_ANCESTORS = [
+  "'self'",
+  "http://localhost:*",
+  "https://localhost:*",
+  "http://127.0.0.1:*",
+  "https://127.0.0.1:*",
+  "http://[::1]:*",
+  "https://[::1]:*",
+];
+
 /**
  * Default security headers for SolidX apps.
  * - HSTS only in prod over HTTPS
- * - CSP with frame-ancestors 'none' (prevents clickjacking)
- * - X-Frame-Options: DENY (legacy fallback)
+ * - CSP with configurable frame-ancestors
+ * - X-Frame-Options disabled when cross-origin frame ancestors are allowed
  * - No X-XSS-Protection (deprecated)
  */
-export function buildDefaultSecurityHeaderOptions(): Readonly<HelmetOptions> {
+export function buildDefaultSecurityHeaderOptions(
+  options: SolidSecurityOptions = {},
+): Readonly<HelmetOptions> {
   const isProd = process.env.ENV === Environment.Production;
+  const frameAncestors = options.frameAncestors ?? DEFAULT_FRAME_ANCESTORS;
+  const allowsCrossOriginFrames = frameAncestors.some(
+    (source) => source !== "'self'" && source !== "'none'",
+  );
 
   return {
     // Modern CSP. Add more directives as your app needs (script-src, connect-src, etc.)
@@ -23,7 +47,7 @@ export function buildDefaultSecurityHeaderOptions(): Readonly<HelmetOptions> {
         // "form-action": ["'self'"],
 
         // clickjacking defense (modern)
-        "frame-ancestors": ["'none'"],
+        "frame-ancestors": frameAncestors,
         "style-src": ["'self'"],
         // add/adjust as needed for your app:
         // "script-src": ["'self'"],              // add hashes/nonces/CSPRO if needed
@@ -34,9 +58,12 @@ export function buildDefaultSecurityHeaderOptions(): Readonly<HelmetOptions> {
       },
     },
 
-    
-    // Legacy clickjacking defense (kept for older UAs)
-    frameguard: { action: "deny" },
+    // Legacy clickjacking defense for configurations that do not allow
+    // cross-origin parents (kept for older UAs).
+    // X-Frame-Options cannot express an allowlist. It must be omitted when
+    // CSP allows a parent on another origin, otherwise older browsers may
+    // still block the iframe despite the CSP configuration.
+    frameguard: allowsCrossOriginFrames ? false : { action: "deny" },
 
     // Referrer/cross-origin policies
     referrerPolicy: { policy: "strict-origin-when-cross-origin" },
@@ -115,4 +142,4 @@ export function setDefaultCacheControl() {
 //   res.setHeader("Permissions-Policy", buildPermissionsPolicyHeader());
 //   next();
 // });
-// app.use(setDefaultCacheControl());
+// app.use(setDefaultCacheControl());

package/src/helpers/solid-core-error-codes-provider.service.ts

@@ -32,6 +32,59 @@ export class SolidCoreErrorCodesProvider implements IErrorCodeProvider {
                     httpStatus: 401,
                 },
             },
+            // MPIN rules sit above the generic session rules so that an MPIN
+            // failure is never reported as a session problem. The three codes
+            // drive three different client behaviours: retry, wait, and
+            // discard-the-handle.
+            {
+                code: 'solidx-mpin-locked',
+                priority: 120,
+                match: (txt) => txt.includes(ERROR_MESSAGES.MPIN_LOCKED.toLowerCase()),
+                meta: {
+                    message: ERROR_MESSAGES.MPIN_LOCKED,
+                    httpStatus: 401,
+                },
+            },
+            {
+                code: 'solidx-mpin-revoked',
+                priority: 120,
+                match: (txt) => txt.includes(ERROR_MESSAGES.MPIN_REVOKED.toLowerCase()),
+                meta: {
+                    message: ERROR_MESSAGES.MPIN_REVOKED,
+                    httpStatus: 401,
+                },
+            },
+            {
+                code: 'solidx-mpin-invalid',
+                priority: 120,
+                match: (txt) => txt.includes(ERROR_MESSAGES.MPIN_INVALID.toLowerCase()),
+                meta: {
+                    message: ERROR_MESSAGES.MPIN_INVALID,
+                    httpStatus: 401,
+                },
+            },
+            // Setup-time rejections. Distinct codes so the client can say
+            // "choose a less predictable PIN" rather than parsing a message.
+            // Safe to distinguish: both occur only on bearer-authenticated
+            // routes, so neither discloses anything.
+            {
+                code: 'solidx-mpin-too-predictable',
+                priority: 120,
+                match: (txt) => txt.includes(ERROR_MESSAGES.MPIN_TOO_PREDICTABLE.toLowerCase()),
+                meta: {
+                    message: ERROR_MESSAGES.MPIN_TOO_PREDICTABLE,
+                    httpStatus: 400,
+                },
+            },
+            {
+                code: 'solidx-mpin-format-invalid',
+                priority: 120,
+                match: (txt) => txt.includes(ERROR_MESSAGES.MPIN_FORMAT_INVALID.toLowerCase()),
+                meta: {
+                    message: ERROR_MESSAGES.MPIN_FORMAT_INVALID,
+                    httpStatus: 400,
+                },
+            },
             {
                 code: 'solidx-mcp-server-unavailable',
                 priority: 100,

package/src/helpers/solid-microservice-adapter.service.ts

@@ -79,7 +79,12 @@ export class SolidMicroserviceAdapter {
     const responseData = response.data as SolidxIamAuthResponse;
     const ttlSeconds = this.getJwtTtlSeconds(responseData?.data?.accessToken);
     if (ttlSeconds && ttlSeconds > 0) {
-      await this.cacheManager.set(cacheKey, responseData, ttlSeconds);
+      // cache-manager v5 expects milliseconds. This previously passed seconds,
+      // which the old Redis store discarded outright - so the entry simply
+      // never expired. Now that TTLs are honoured, passing seconds unconverted
+      // would expire the cached token ~1000x too early and re-authenticate
+      // against IAM on nearly every call.
+      await this.cacheManager.set(cacheKey, responseData, ttlSeconds * 1000);
     }
 
     return responseData;

package/src/helpers/solid-registry.ts

@@ -366,7 +366,7 @@ export class SolidRegistry {
   }
 
   getCommonEntityKeys(): (keyof CommonEntity | 'createdBy' | 'updatedBy')[] {
-    return ['id', 'createdAt', 'updatedAt', 'deletedAt', 'createdBy', 'updatedBy', 'deletedTracker', 'localeName', 'defaultEntityLocaleId', 'publishedAt'];
+    return ['id', 'createdAt', 'updatedAt', 'deletedAt', 'createdBy', 'updatedBy', 'deletedTracker', 'localeName', 'defaultEntityLocaleId', 'publishedAt', 'isPublished', 'isLatest', 'initialEntityVersionId', 'publishedTracker'];
     // return Reflect.getMetadataKeys(CommonEntity.prototype) as (keyof CommonEntity)[];
   }
 

package/src/helpers/typeorm-db-helper.ts

@@ -40,6 +40,14 @@ const DECIMAL_MAP: Record<DatasourceType, ColumnOptions> = {
     [DatasourceType.oracle]: { type: "float" },
 };
 
+const DATE_TIME_MAP: Record<DatasourceType, ColumnOptions> = {
+    [DatasourceType.postgres]: { type: "timestamp" },
+    [DatasourceType.mssql]: { type: "datetime2" },
+    [DatasourceType.mysql]: { type: "datetime" },
+    [DatasourceType.mariadb]: { type: "datetime" },
+    [DatasourceType.oracle]: { type: "timestamp" },
+};
+
 const solidCoreDbType: DatasourceType =
     Object.values(DatasourceType).includes(process.env.SOLID_CORE_DB_TYPE as DatasourceType)
         ? (process.env.SOLID_CORE_DB_TYPE as DatasourceType)
@@ -72,7 +80,10 @@ export function getColumnType(solidType: string): ColumnOptions {
         case "decimal":
             return DECIMAL_MAP[solidCoreDbType];
 
+        case "datetime":
+            return DATE_TIME_MAP[solidCoreDbType];
+
         default:
             return {};
     }
-}
+}

package/src/index.ts

@@ -160,6 +160,12 @@ export * from './entities/role-metadata.entity'
 export * from './entities/sms-template.entity'
 export * from './entities/user.entity'
 export * from './entities/user-api-key.entity'
+export * from './entities/user-device-credential.entity'
+export * from './repository/user-device-credential.repository'
+export * from './services/mpin.service'
+export * from './dtos/setup-mpin.dto'
+export * from './dtos/change-mpin.dto'
+export * from './dtos/mpin-login.dto'
 export * from './entities/view-metadata.entity'
 export * from './entities/setting.entity'
 export * from './entities/saved-filters.entity'
@@ -225,6 +231,7 @@ export * from './helpers/environment.helper'
 export * from './helpers/cache.helper'
 export * from './helpers/cors.helper'
 export * from './helpers/security.helper'
+export * from './helpers/file-download.helper'
 export * from './helpers/model-metadata-helper.service'
 export * from './helpers/image-encoding.helper'
 export * from './helpers/solid-microservice-adapter.service'
@@ -248,10 +255,12 @@ export * from './services/workflow/workflow-expression.service'
 export * from './services/workflow/workflow-invocation.service'
 export * from './services/workflow/workflow-node-registry.service'
 export * from './services/workflow/workflow-runtime.service'
+export * from './services/workflow/nodes/execution-fail.node'
 export * from './services/workflow/nodes/for-each.node'
 export * from './services/workflow/nodes/http-request.node'
 export * from './services/workflow/nodes/if.node'
 export * from './services/workflow/nodes/log-write.node'
+export * from './services/workflow/nodes/loop-until.node'
 export * from './services/workflow/nodes/parallel.node'
 export * from './services/workflow/nodes/sequential.node'
 export * from './services/workflow/nodes/solidx-crud.nodes'
@@ -335,6 +344,7 @@ export * from './services/action-metadata.service'
 export * from './services/authentication.service'
 export * from './services/bcrypt.service'
 export * from './services/computed-fields/uuid-external-id-computed-field-provider.service'
+export * from './services/draft-publish-helper.service'
 export * from './services/crud-helper.service'
 export * from './services/crud.service'
 export * from './services/email-template.service'

package/src/interfaces/active-user-data.interface.ts

@@ -22,6 +22,15 @@ export interface ActiveUserData {
    */
   sessionId?: string;
 
+  /**
+   * Identifies which per-device refresh-token bucket this session belongs to.
+   * Present only while concurrent logins are permitted; mutually exclusive with
+   * sessionId, which exists only when they are not. Carried on the access token
+   * so bearer-authenticated endpoints that need this session's refresh token
+   * can find it.
+   */
+  deviceKey?: string;
+
   /**
    * The subject's (user) roles.
    * These are part of the JWT token, we simply decode them.

package/src/interfaces.ts

@@ -272,6 +272,7 @@ export interface ModuleMetadataSeederOptions {
   modulesToSeed: string[] | null;
   pruneMetadata: boolean;
   seedGlobalMetadata: boolean;
+  skipHooks: boolean;
 }
 
 export interface ModuleMetadataSeederEventPayload {

package/src/repository/user-device-credential.repository.ts

@@ -0,0 +1,17 @@
+import { Injectable } from '@nestjs/common';
+import { UserDeviceCredential } from 'src/entities/user-device-credential.entity';
+import { RequestContextService } from 'src/services/request-context.service';
+import { DataSource } from 'typeorm';
+import { SecurityRuleRepository } from './security-rule.repository';
+import { SolidBaseRepository } from './solid-base.repository';
+
+@Injectable()
+export class UserDeviceCredentialRepository extends SolidBaseRepository<UserDeviceCredential> {
+    constructor(
+        readonly dataSource: DataSource,
+        readonly requestContextService: RequestContextService,
+        readonly securityRuleRepository: SecurityRuleRepository,
+    ) {
+        super(UserDeviceCredential, dataSource, requestContextService, securityRuleRepository);
+    }
+}