@solidxai/core 0.1.13-beta.2 → 0.1.13-beta.21

package/src/services/internationalisation-helper.service.ts

@@ -0,0 +1,148 @@
+import { Logger } from "@nestjs/common";
+import { EntityManager, In } from "typeorm";
+import { CommonEntity } from "../entities/common.entity";
+import { Locale } from "../entities/locale.entity";
+import { ModelMetadata } from "../entities/model-metadata.entity";
+import { classify } from "../helpers/string.helper";
+import { SolidRegistry } from "../helpers/solid-registry";
+import { SolidBaseRepository } from "../repository/solid-base.repository";
+
+export class InternationalisationHelperService {
+    private readonly logger = new Logger(InternationalisationHelperService.name);
+
+    isInternationalisationEnabled(model: ModelMetadata): boolean {
+        return model?.internationalisation === true;
+    }
+
+    /** Defaults `localeName` on a create DTO for internationalised models, so new records stay visible to the default-locale filter in `find()`. */
+    applyCreateDefaults(model: ModelMetadata, createDto: any, solidRegistry: SolidRegistry): void {
+        if (!this.isInternationalisationEnabled(model) || createDto.localeName) return;
+        createDto.localeName = this.resolveDefaultLocaleName(solidRegistry);
+    }
+
+    async deleteChildLocaleEntities<T extends CommonEntity>(
+        repo: SolidBaseRepository<T>,
+        model: ModelMetadata,
+        entityIds: number[],
+    ): Promise<void> {
+        if (!this.isInternationalisationEnabled(model) || entityIds.length === 0) return;
+
+        const childEntities = await repo.find({
+            where: { defaultEntityLocaleId: In(entityIds) } as any,
+        });
+        if (childEntities.length === 0) return;
+
+        if (model.enableSoftDelete === true) {
+            await repo.softRemove(childEntities);
+        } else {
+            await repo.remove(childEntities);
+        }
+    }
+
+    pickCurrentLocaleRecord(records: any[], localeName: string, draftPublishEnabled: boolean): any | null {
+        const localeRecords = records.filter(record => record.localeName === localeName);
+        if (localeRecords.length === 0) return null;
+
+        return localeRecords.sort((a, b) => {
+            // isLatest only exists on draft/publish-enabled models (legacy tables lack the column)
+            if (draftPublishEnabled && Boolean(a.isLatest) !== Boolean(b.isLatest)) return a.isLatest ? -1 : 1;
+
+            return Number(b.id ?? 0) - Number(a.id ?? 0);
+        })[0];
+    }
+
+    /** Resolves the locale name to filter/tag records by: explicit locale, else the registry default, else 'en'. */
+    resolveDefaultLocaleName(solidRegistry: SolidRegistry): string {
+        const defaultLocale = solidRegistry.getDefaultLocale();
+        return defaultLocale?.locale ?? 'en';
+    }
+
+    async getEntityRecordsInAllLocales(
+        entityManager: EntityManager,
+        modelName: string,
+        id: string,
+        defaultEntityLocaleIdFromQuery: string | undefined,
+        draftPublishEnabled: boolean,
+    ): Promise<{ records: any[], defaultEntityLocaleId: string | null }> {
+        const currentEntityRepository = entityManager.getRepository(classify(modelName));
+
+        // Case 1: Creating a new record with no defaultEntityLocaleId to clone
+        if (id === 'new' && !defaultEntityLocaleIdFromQuery) {
+            this.logger.debug(`Creating new record without cloning from any defaultEntityLocaleId.`);
+            return { records: [], defaultEntityLocaleId: null };
+        }
+
+        // Case 2: Creating a new record and cloning from an existing defaultEntityLocaleId
+        if (id === 'new' && defaultEntityLocaleIdFromQuery) {
+            this.logger.debug(`Creating new record by cloning translations from defaultEntityLocaleId: ${defaultEntityLocaleIdFromQuery}`);
+
+            const records = await currentEntityRepository.find({
+                where: [
+                    { defaultEntityLocaleId: defaultEntityLocaleIdFromQuery },
+                    { id: defaultEntityLocaleIdFromQuery },
+                    // initialEntityVersionId only exists on draft/publish-enabled models (legacy tables lack the column)
+                    ...(draftPublishEnabled ? [{ initialEntityVersionId: defaultEntityLocaleIdFromQuery }] : []),
+                ]
+            });
+
+            this.logger.debug(`Found ${records.length} cloned records for new entity.`);
+            return { records, defaultEntityLocaleId: defaultEntityLocaleIdFromQuery };
+        }
+
+        // Case 3: Editing an existing entity
+        const entityRecord = await currentEntityRepository.findOne({ where: { id } });
+
+        if (!entityRecord) {
+            this.logger.warn(`No entity found for id ${id}`);
+            return { records: [], defaultEntityLocaleId: null };
+        }
+
+        const defaultEntityLocaleId = entityRecord.defaultEntityLocaleId
+            || (draftPublishEnabled ? entityRecord.initialEntityVersionId : null)
+            || entityRecord.id;
+        if (entityRecord.defaultEntityLocaleId) {
+            this.logger.debug(`Editing translated locale record. Translation root id: ${defaultEntityLocaleId}`);
+        } else {
+            this.logger.debug(`Editing translation root record with id ${defaultEntityLocaleId}`);
+        }
+
+        const records = await currentEntityRepository.find({
+            where: [
+                { defaultEntityLocaleId: defaultEntityLocaleId },
+                { id: defaultEntityLocaleId },
+                ...(draftPublishEnabled ? [{ initialEntityVersionId: defaultEntityLocaleId }] : []),
+            ]
+        });
+
+        this.logger.debug(`Found ${records.length} records in all locales for existing entity.`);
+
+        return { records, defaultEntityLocaleId };
+    }
+
+    /**
+     * Builds the `applicableLocales` shape for a view layout: one entry per registered locale,
+     * with the matching translation record's id (if any) resolved via pickCurrentLocaleRecord.
+     */
+    async buildApplicableLocales(
+        entityManager: EntityManager,
+        modelName: string,
+        id: string,
+        defaultEntityLocaleIdFromQuery: string | undefined,
+        draftPublishEnabled: boolean,
+    ): Promise<any[]> {
+        const { records: entityRecordsInAllLocales, defaultEntityLocaleId } =
+            await this.getEntityRecordsInAllLocales(entityManager, modelName, id, defaultEntityLocaleIdFromQuery, draftPublishEnabled);
+        const allLocales = await entityManager.getRepository(Locale).find({});
+
+        return allLocales.map(locale => {
+            const matchingRecord = this.pickCurrentLocaleRecord(entityRecordsInAllLocales, locale.locale, draftPublishEnabled);
+            return {
+                locale: locale.locale,
+                displayName: locale.displayName,
+                isDefault: locale.isDefault ? 'yes' : 'no',
+                defaultEntityLocaleId,
+                entityId: matchingRecord ? matchingRecord.id : null,
+            };
+        });
+    }
+}

package/src/services/media-storage.utils.ts

@@ -5,6 +5,11 @@ import { MediaStorageProviderMetadata } from 'src/entities/media-storage-provide
 import { SettingService } from 'src/services/setting.service';
 import { DEFAULT_MEDIA_FILE_STORAGE_DIR } from 'src/services/settings/default-settings-provider.service';
 import type { SolidCoreSetting } from 'src/services/settings/default-settings-provider.service';
+import { normalizeUploadedFileName } from 'src/constants/media-file-types';
+
+// Keeps the joined path well clear of filesystem NAME_MAX (255 on ext4/APFS) once the
+// multer hash prefix and separator are added.
+const MAX_STORED_FILE_NAME_LENGTH = 150;
 
 
 export interface MediaRecordCreateInput {
@@ -18,9 +23,29 @@ export interface MediaRecordCreateInput {
   originalFileName?: string;
 }
 
+/**
+ * Reduces a client-supplied name to something safe to interpolate into a filesystem path.
+ * `originalname` is fully attacker-controlled, so without this a name like
+ * `../../../../tmp/pwned.png` escapes the media storage directory entirely - the multer hash
+ * prefix does not contain it, because the leading `..` simply cancels the prefix segment.
+ *
+ * Everything outside a conservative allowlist becomes `_`; the result can never contain a
+ * path separator, so the joined path always stays inside the storage root.
+ */
+export function sanitizeStoredMediaFileName(originalName?: string | null): string {
+  const sanitized = normalizeUploadedFileName(originalName)
+    .replace(/[^A-Za-z0-9._-]/g, '_')
+    // Collapse any run of dots so no `..` segment can survive.
+    .replace(/\.{2,}/g, '.')
+    .replace(/^[._-]+/, '')
+    .slice(0, MAX_STORED_FILE_NAME_LENGTH);
+
+  return sanitized || 'file';
+}
+
 // Builds the stored file name format shared by media storage implementations.
 export function buildStoredMediaFileName(file: Pick<Express.Multer.File, 'filename' | 'originalname'>): string {
-  return `${file.filename}-${file.originalname}`;
+  return `${file.filename}-${sanitizeStoredMediaFileName(file.originalname)}`;
 }
 
 // Resolves the on-disk path for a media file based on settings and provider visibility.

package/src/services/media.service.ts

@@ -1,13 +1,14 @@
-import { forwardRef, Inject, Injectable, Logger, NotFoundException } from '@nestjs/common';
+import { BadRequestException, forwardRef, Inject, Injectable, Logger, NotFoundException } from '@nestjs/common';
 import { ModuleRef } from "@nestjs/core";
 import { InjectEntityManager } from '@nestjs/typeorm';
-import { EntityManager, In } from 'typeorm';
+import { EntityManager, In, Not } from 'typeorm';
 import * as path from 'path';
 import { Readable } from 'stream';
 
 import { ConfigService } from '@nestjs/config';
 import { CRUDService } from 'src/services/crud.service';
 import { DiskFileService, S3FileService } from 'src/services/file';
+import { classify } from 'src/helpers/string.helper';
 import { MediaDownloadUrlService } from 'src/services/media-download-url.service';
 
 
@@ -16,11 +17,12 @@ import { BasicFilterDto } from 'src/dtos/basic-filters.dto';
 import { MediaStorageProviderType } from 'src/dtos/create-media-storage-provider-metadata.dto';
 import { Media } from 'src/entities/media.entity';
 import { MediaStorageProviderMetadata } from 'src/entities/media-storage-provider-metadata.entity';
+import { MediaFieldCrudManager, SolidMediaType } from 'src/helpers/field-crud-managers/MediaFieldCrudManager';
 import { FieldMetadataRepository } from 'src/repository/field-metadata.repository';
 import { MediaStorageProviderMetadataRepository } from 'src/repository/media-storage-provider-metadata.repository';
 import { MediaRepository } from 'src/repository/media.repository';
 import { ModelMetadataRepository } from 'src/repository/model-metadata.repository';
-import { buildDiskMediaPath, buildStoredMediaFileName, getEffectiveS3Region, resolveMediaIsPublic, } from 'src/services/media-storage.utils';
+import { buildDiskMediaPath, getEffectiveS3Region, resolveMediaIsPublic, } from 'src/services/media-storage.utils';
 import { getMediaStorageProvider } from "./mediaStorageProviders";
 
 @Injectable()
@@ -103,40 +105,26 @@ export class MediaService extends CRUDService<Media> {
       throw new NotFoundException('Media storage provider metadata not found');
     }
 
-    const savedMedias = [];
-    for (let i = 0; i < files.length; i++) {
-      const file = files[i];
-      const storageProvider = createDto.mediaStorageProviderMetadata as MediaStorageProviderMetadata;
-      const fileName = buildStoredMediaFileName(file);
+    createDto['fieldMetadata'].mediaStorageProvider = createDto['mediaStorageProviderMetadata'];
 
-      switch (storageProvider.type) {
-        case MediaStorageProviderType.Filesystem:
-          const fileStoragePath = buildDiskMediaPath(fileName, this.settingService, storageProvider);
-          await this.diskFileService.copy(file.path, fileStoragePath);
-          createDto['relativeUri'] = fileName;
-          break;
-        case MediaStorageProviderType.AwsS3:
-          const bucketName = storageProvider.bucketName;
-          const region = getEffectiveS3Region(this.configService, storageProvider.region);
-
-          // Read file from disk and upload to S3
-          const fileData = await this.diskFileService.read(file.path);
-          await this.s3FileService.write(`${bucketName}:${fileName}`, fileData, { contentType: file.mimetype, region });
+    const validator = new MediaFieldCrudManager({
+      type: createDto['fieldMetadata']?.type as SolidMediaType,
+      required: true,
+      fieldName: 'files',
+      mediaMaxSizeKb: createDto['fieldMetadata']?.mediaMaxSizeKb,
+      mediaTypes: createDto['fieldMetadata']?.mediaTypes || [],
+      mediaAllowedExtensions: createDto['fieldMetadata']?.mediaAllowedExtensions || [],
+      isUpdate: false,
+    });
+    const validationErrors = validator.validate(createDto, files);
+    if (validationErrors.length > 0) {
+      throw new BadRequestException(validationErrors.map(error => error.error).join(', '));
+    }
 
-          createDto['relativeUri'] = fileName;
-          break;
-        default:
-          break;
-      }
-      // Delete temp file from disk
-      await this.diskFileService.delete(file.path);
+    const storageProviderType = createDto['mediaStorageProviderMetadata'].type as MediaStorageProviderType;
+    const storageProvider = await getMediaStorageProvider(this.moduleRef, storageProviderType);
 
-      delete createDto['isPublic'];
-      const media = this.repo.create(createDto as Partial<Media>) as Media;
-      const savedMedia = await this.repo.save(media);
-      savedMedias.push(savedMedia)
-    }
-    return savedMedias
+    return storageProvider.store(files, { id: Number(createDto['entityId']) }, createDto['fieldMetadata']);
   }
 
   async remove(id: number) {
@@ -190,9 +178,13 @@ export class MediaService extends CRUDService<Media> {
   async delete(id: number, solidRequestContext: any = {}) {
     const media = await this.repo.findOne({
       where: { id },
-      relations: ['mediaStorageProviderMetadata'],
+      relations: ['mediaStorageProviderMetadata', 'modelMetadata'],
     });
 
+    if (media) {
+      await this.assertMediaDeletable([media]);
+    }
+
     const result = await super.delete(id, solidRequestContext);
 
     if (media) {
@@ -207,9 +199,11 @@ export class MediaService extends CRUDService<Media> {
       where: {
         id: In(ids),
       },
-      relations: ['mediaStorageProviderMetadata'],
+      relations: ['mediaStorageProviderMetadata', 'modelMetadata'],
     });
 
+    await this.assertMediaDeletable(mediaRecords);
+
     const result = await super.deleteMany(ids, solidRequestContext);
 
     for (const media of mediaRecords) {
@@ -219,6 +213,33 @@ export class MediaService extends CRUDService<Media> {
     return result;
   }
 
+  /**
+   * Media belonging to a published draft/publish-enabled record must survive edits made to
+   * later drafts (see DraftPublishHelperService.cloneMediaForVersion) - deleting it directly
+   * would strip the published version's media out from under it. Mirrors the equivalent
+   * entity-level guard in DraftPublishHelperService.assertDraftPublishDeleteAllowed.
+   */
+  private async assertMediaDeletable(mediaRecords: Media[]): Promise<void> {
+    const blockedIds: number[] = [];
+
+    for (const media of mediaRecords) {
+      if (!media.modelMetadata?.draftPublishWorkflow) continue;
+
+      const entityRepository = this.entityManager.getRepository(classify(media.modelMetadata.singularName));
+      const owningEntity = await entityRepository.findOne({ where: { id: media.entityId } as any });
+
+      if (owningEntity && (owningEntity as any).isPublished === true) {
+        blockedIds.push(media.id);
+      }
+    }
+
+    if (blockedIds.length > 0) {
+      throw new BadRequestException(
+        'Media belonging to a published record cannot be deleted. Edit the record to create a draft first'
+      );
+    }
+  }
+
   private async decorateMediaRecords(medias: Media[]): Promise<void> {
     for (const media of medias) {
       await this.decorateMediaRecord(media);
@@ -258,6 +279,17 @@ export class MediaService extends CRUDService<Media> {
     }
 
     try {
+      // Draft/publish versioning may clone a Media row that reuses the same
+      // relativeUri (see DraftPublishHelperService.cloneMediaForVersion) instead of
+      // duplicating the underlying file. Skip the physical delete if another row
+      // still references it.
+      const stillReferenced = await this.repo.exists({
+        where: { relativeUri: media.relativeUri, id: Not(media.id) },
+      });
+      if (stillReferenced) {
+        return;
+      }
+
       const mediaStorageProvider = await this.resolveMediaStorageProvider(media);
       if (!mediaStorageProvider) {
         return;

package/src/services/metadata-validation.service.ts

@@ -0,0 +1,39 @@
+import { BadRequestException, Injectable } from "@nestjs/common";
+import { isNotEmpty, matches } from "class-validator";
+import { ModelMetadataService } from "./model-metadata.service";
+
+@Injectable()
+export class MetadataValidationService {
+  constructor(
+    private readonly modelMetadataService: ModelMetadataService,
+  ) {}
+
+  async validateCreateDto(
+    modelName: string,
+    dto: object,
+  ): Promise<void> {
+    const model = await this.modelMetadataService.findOneBySingularName(
+      modelName,
+      { fields: true },
+    );
+
+    for (const field of model.fields ?? []) {
+      const value = (dto as Record<string, unknown>)[field.name];
+
+      if (!isNotEmpty(value) || typeof value !== "string") {
+        continue;
+      }
+
+      if (!isNotEmpty(field.regexPattern)) {
+        continue;
+      }
+
+      if (!matches(value, new RegExp(field.regexPattern))) {
+        throw new BadRequestException(
+          field.regexPatternNotMatchingErrorMsg ||
+            `Validation errors in ${field.name} is invalid i.e Field regex pattern is invalid`,
+        );
+      }
+    }
+  }
+}

package/src/services/model-metadata.service.ts

@@ -1729,7 +1729,10 @@ export class ModelMetadataService {
     // --------------------
     // Find record index in page
     // --------------------
-    const index = records.findIndex(r => String(r.id) === String(recordId));
+    const index = records.findIndex(r =>
+      String(r.id) === String(recordId) ||
+      (r.initialEntityVersionId && String(r.initialEntityVersionId) === String(recordId))
+    );
 
     if (index === -1) {
       throw new BadRequestException(`Record not found in current page`);

package/src/services/module-metadata.service.ts

@@ -13,11 +13,13 @@ import { ConfigService } from '@nestjs/config';
 import * as fs from 'fs/promises'; // Use the Promise-based version of fs for async/await
 import * as path from 'path'; // To handle file paths
 import { ERROR_MESSAGES } from 'src/constants/error-messages';
+import { isDangerousMediaFile } from 'src/constants/media-file-types';
 import { DisallowInProduction } from 'src/decorators/disallow-in-production.decorator';
 import { ModuleMetadataHelperService } from 'src/helpers/module-metadata-helper.service';
 import { ModuleMetadataRepository } from 'src/repository/module-metadata.repository';
 import { PermissionMetadataSeederService } from 'src/seeders/permission-metadata-seeder.service';
 import { DiskFileService } from 'src/services/file';
+import { sanitizeStoredMediaFileName } from 'src/services/media-storage.utils';
 import { BasicFilterDto } from '../dtos/basic-filters.dto';
 import { UpdateModuleMetadataDto } from '../dtos/update-module-metadata.dto';
 import {
@@ -136,6 +138,9 @@ export class ModuleMetadataService {
 
   async createInDB(manager: EntityManager, createDto: CreateModuleMetadataDto, files: Express.Multer.File[] = []) {
     if (files.length > 0) {
+      if (isDangerousMediaFile(files[0])) {
+        throw new BadRequestException('Dangerous file types are not allowed for the menu icon.');
+      }
       const fileStoragePath = this.getFullFilePathForDisk(this.getFileName(files[0]));
       this.fileService.copy(files[0].path, fileStoragePath);
       this.fileService.delete(files[0].path);
@@ -240,6 +245,9 @@ export class ModuleMetadataService {
       throw new NotFoundException(ERROR_MESSAGES.MODULE_ID_NOT_FOUND(id));
     }
     if (files.length > 0) {
+      if (isDangerousMediaFile(files[0])) {
+        throw new BadRequestException('Dangerous file types are not allowed for the menu icon.');
+      }
 
       const fileStoragePath = this.getFullFilePathForDisk(this.getFileName(files[0]));
       this.fileService.copy(files[0].path, fileStoragePath);
@@ -609,7 +617,8 @@ export class ModuleMetadataService {
   }
 
   private getFileName(file: Express.Multer.File): string {
-    return `${file.filename}-${file.originalname}`;
+    // originalname is attacker-controlled and feeds straight into a storage path.
+    return `${file.filename}-${sanitizeStoredMediaFileName(file.originalname)}`;
   }
 
 }