@solidxai/core 0.1.13-beta.9 → 0.1.13

package/src/helpers/field-crud-managers/MediaFieldCrudManager.ts

@@ -12,6 +12,7 @@ export interface MediaFieldOptions {
     fieldName: string | undefined | null;
     mediaMaxSizeKb: number | undefined | null;
     mediaTypes: string[];
+    mediaAllowedExtensions?: string[] | null;
     isUpdate: boolean | undefined | null;
 }
 
@@ -86,24 +87,28 @@ export class MediaFieldCrudManager implements FieldCrudManager {
             return null;
         }
 
+        // Extension is authoritative: a declared mimetype is fully attacker-controlled and
+        // proved insufficient on its own (a .msi uploaded as image/png previously resolved to
+        // 'image', since the mimetype match short-circuited before the extension was ever
+        // checked). The extension must independently resolve to a known-safe category before
+        // anything is accepted - not merely "not on the denylist".
         const ext = getLowercaseFileExtension(getUploadedFileName(file));
-        const mt = (file.mimetype || '').toLowerCase().trim();
-        if (mt && MIME_TO_MEDIA_TYPE[mt]) {
-            return MIME_TO_MEDIA_TYPE[mt];
+        const extType = ext ? EXT_TO_MEDIA_TYPE[ext] : undefined;
+        if (!extType) {
+            return null;
         }
 
-        // Some libs may send "image/*" etc. Treat broad families safely.
-        if (mt.startsWith('image/')) return 'image';
-        if (mt.startsWith('audio/')) return 'audio';
-        if (mt.startsWith('video/')) return 'video';
-
-        // Fallback to extension if provided (also covers generic/unrecognized
-        // mimetypes such as application/octet-stream).
-        if (ext && EXT_TO_MEDIA_TYPE[ext]) {
-            return EXT_TO_MEDIA_TYPE[ext];
+        // The mimetype may only confirm or veto what the extension already established, never
+        // grant a category on its own. A mimetype that doesn't resolve to anything (e.g.
+        // application/octet-stream) has no opinion and is treated as agreeing.
+        const mt = (file.mimetype || '').toLowerCase().trim();
+        const mimeType = MIME_TO_MEDIA_TYPE[mt]
+            ?? (mt.startsWith('image/') ? 'image' : mt.startsWith('audio/') ? 'audio' : mt.startsWith('video/') ? 'video' : undefined);
+        if (mimeType && mimeType !== extType) {
+            return null;
         }
 
-        return null;
+        return extType;
     }
 
     validate(dto: any, files: Array<Express.Multer.File>): ValidationError[] {
@@ -112,18 +117,17 @@ export class MediaFieldCrudManager implements FieldCrudManager {
     }
 
     private applyValidations(fieldFiles: Array<Express.Multer.File>): ValidationError[] {
-        // Runs for every media field type and regardless of the admin-configured mediaTypes
-        // allowlist - a dangerous upload is never acceptable, so this must not sit behind
-        // the optional type checks below.
-        const errors = this.validateDangerousFiles(fieldFiles);
+        // A dangerous upload is never acceptable, regardless of admin config, so this is the
+        // only check that sits outside validateCommon() and can't be skipped either way below.
+        const dangerousFileErrors = this.validateDangerousFiles(fieldFiles);
 
         switch (this.options.type) {
             case SolidMediaType.mediaSingle:
-                return [...errors, ...this.validateMediaSingle(fieldFiles)];
+                return [...dangerousFileErrors, ...this.validateMediaSingle(fieldFiles)];
             case SolidMediaType.mediaMultiple:
-                return [...errors, ...this.validateMediaMultiple(fieldFiles)];
+                return [...dangerousFileErrors, ...this.validateMediaMultiple(fieldFiles)];
             default:
-                return errors;
+                return dangerousFileErrors;
         }
     }
 
@@ -137,7 +141,18 @@ export class MediaFieldCrudManager implements FieldCrudManager {
             }));
     }
 
-    private validateMediaSingle(fieldFiles: Array<Express.Multer.File>): ValidationError[] {
+    // Every optional, admin-configured, per-field check - no-ops when its setting is unset -
+    // shared between mediaSingle and mediaMultiple so neither can drift out of sync with it.
+    private validateCommon(fieldFiles: Array<Express.Multer.File>): ValidationError[] {
+        return [
+            ...this.validateRequired(fieldFiles),
+            ...this.validateSize(fieldFiles),
+            ...this.validateTypes(fieldFiles),
+            ...this.validateAllowedExtensions(fieldFiles),
+        ];
+    }
+
+    private validateRequired(fieldFiles: Array<Express.Multer.File>): ValidationError[] {
         const errors: ValidationError[] = [];
         if (!this.options.isUpdate && this.options.required && fieldFiles.length === 0) {
             errors.push({
@@ -145,13 +160,11 @@ export class MediaFieldCrudManager implements FieldCrudManager {
                 error: `${this.options.fieldName} is required`
             });
         }
-        if (fieldFiles.length > 1) {
-            errors.push({
-                field: this.options.fieldName,
-                error: `${this.options.fieldName} must be a single file`
-            });
-        }
-        // validate size
+        return errors;
+    }
+
+    private validateSize(fieldFiles: Array<Express.Multer.File>): ValidationError[] {
+        const errors: ValidationError[] = [];
         if (this.options.mediaMaxSizeKb) {
             for (let i = 0; i < fieldFiles.length; i++) {
                 const fieldFile = fieldFiles[i];
@@ -164,7 +177,11 @@ export class MediaFieldCrudManager implements FieldCrudManager {
                 }
             }
         }
-        // validate type
+        return errors;
+    }
+
+    private validateTypes(fieldFiles: Array<Express.Multer.File>): ValidationError[] {
+        const errors: ValidationError[] = [];
         if (this.options.mediaTypes && this.options.mediaTypes.length > 0) {
             const allowedFileTypes = this.options.mediaTypes as MediaType[];
 
@@ -182,21 +199,43 @@ export class MediaFieldCrudManager implements FieldCrudManager {
                 }
             }
         }
-
         return errors;
     }
 
-    private validateMediaMultiple(fieldFiles: Array<Express.Multer.File>): ValidationError[] {
-        const errors: ValidationError[] = [];
-        if (!this.options.isUpdate && this.options.required && fieldFiles.length === 0) {
+    private validateAllowedExtensions(fieldFiles: Array<Express.Multer.File>): ValidationError[] {
+        const allowed = this.options.mediaAllowedExtensions;
+        if (!allowed || allowed.length === 0) {
+            return [];
+        }
+
+        const normalizedAllowed = new Set(allowed.map(ext => ext.toLowerCase().replace(/^\./, '')));
+        return fieldFiles
+            .filter(fieldFile => {
+                const ext = getLowercaseFileExtension(getUploadedFileName(fieldFile));
+                return !ext || !normalizedAllowed.has(ext);
+            })
+            .map(fieldFile => ({
+                field: this.options.fieldName,
+                error: `${this.options.fieldName} file type not allowed. ` +
+                    `Allowed extensions: ${[...normalizedAllowed].join(', ')}.`
+            }));
+    }
+
+    private validateMediaSingle(fieldFiles: Array<Express.Multer.File>): ValidationError[] {
+        const errors = this.validateCommon(fieldFiles);
+        if (fieldFiles.length > 1) {
             errors.push({
                 field: this.options.fieldName,
-                error: `${this.options.fieldName} is required`
+                error: `${this.options.fieldName} must be a single file`
             });
         }
         return errors;
     }
 
+    private validateMediaMultiple(fieldFiles: Array<Express.Multer.File>): ValidationError[] {
+        return this.validateCommon(fieldFiles);
+    }
+
     transformForCreate(dto: any): any {
         return dto;
     }

package/src/helpers/file-download.helper.ts

@@ -9,6 +9,20 @@ export interface FileDownloadHeaderOptions {
   crossOriginResourcePolicy?: boolean;
 }
 
+/**
+ * Builds an RFC 6266 Content-Disposition value. The file name is attacker-controlled (it comes
+ * from the uploaded originalFileName), so it can't be interpolated raw: a quote would close the
+ * quoted-string early and let the rest of the name forge further header parameters. The ASCII
+ * fallback is stripped to a safe subset and the real name is carried in the RFC 5987
+ * `filename*` parameter, which is also what preserves non-ASCII names correctly.
+ */
+function buildContentDisposition(disposition: "inline" | "attachment", fileName: string): string {
+  const name = (fileName || "file").replace(/[\r\n]/g, "");
+  const asciiFallback = name.replace(/[^\x20-\x7E]/g, "_").replace(/["\\]/g, "_") || "file";
+
+  return `${disposition}; filename="${asciiFallback}"; filename*=UTF-8''${encodeURIComponent(name)}`;
+}
+
 /**
  * Single place that stamps the response headers for every streamed file download, so the
  * security headers can't be applied to one endpoint and forgotten on the next.
@@ -16,7 +30,7 @@ export interface FileDownloadHeaderOptions {
 export function setFileDownloadHeaders(res: Response, options: FileDownloadHeaderOptions): void {
   const disposition = options.disposition ?? "attachment";
 
-  res.setHeader("Content-Disposition", `${disposition}; filename="${options.fileName}"`);
+  res.setHeader("Content-Disposition", buildContentDisposition(disposition, options.fileName));
   res.setHeader("Content-Type", options.mimeType);
   res.setHeader("Access-Control-Expose-Headers", "Content-Disposition, Content-Type");
 

package/src/helpers/security.helper.ts

@@ -1,15 +1,39 @@
 import { HelmetOptions } from "helmet";
 import { Environment } from "src/decorators/disallow-in-production.decorator";
 
+export interface SolidSecurityOptions {
+  /**
+   * Origins that may embed this application in an iframe.
+   * Defaults to the local HTTP/HTTPS loopback origins on any port.
+   */
+  frameAncestors?: string[];
+}
+
+export const DEFAULT_FRAME_ANCESTORS = [
+  "'self'",
+  "http://localhost:*",
+  "https://localhost:*",
+  "http://127.0.0.1:*",
+  "https://127.0.0.1:*",
+  "http://[::1]:*",
+  "https://[::1]:*",
+];
+
 /**
  * Default security headers for SolidX apps.
  * - HSTS only in prod over HTTPS
- * - CSP with frame-ancestors 'none' (prevents clickjacking)
- * - X-Frame-Options: DENY (legacy fallback)
+ * - CSP with configurable frame-ancestors
+ * - X-Frame-Options disabled when cross-origin frame ancestors are allowed
  * - No X-XSS-Protection (deprecated)
  */
-export function buildDefaultSecurityHeaderOptions(): Readonly<HelmetOptions> {
+export function buildDefaultSecurityHeaderOptions(
+  options: SolidSecurityOptions = {},
+): Readonly<HelmetOptions> {
   const isProd = process.env.ENV === Environment.Production;
+  const frameAncestors = options.frameAncestors ?? DEFAULT_FRAME_ANCESTORS;
+  const allowsCrossOriginFrames = frameAncestors.some(
+    (source) => source !== "'self'" && source !== "'none'",
+  );
 
   return {
     // Modern CSP. Add more directives as your app needs (script-src, connect-src, etc.)
@@ -23,7 +47,7 @@ export function buildDefaultSecurityHeaderOptions(): Readonly<HelmetOptions> {
         // "form-action": ["'self'"],
 
         // clickjacking defense (modern)
-        "frame-ancestors": ["'none'"],
+        "frame-ancestors": frameAncestors,
         "style-src": ["'self'"],
         // add/adjust as needed for your app:
         // "script-src": ["'self'"],              // add hashes/nonces/CSPRO if needed
@@ -34,9 +58,12 @@ export function buildDefaultSecurityHeaderOptions(): Readonly<HelmetOptions> {
       },
     },
 
-    
-    // Legacy clickjacking defense (kept for older UAs)
-    frameguard: { action: "deny" },
+    // Legacy clickjacking defense for configurations that do not allow
+    // cross-origin parents (kept for older UAs).
+    // X-Frame-Options cannot express an allowlist. It must be omitted when
+    // CSP allows a parent on another origin, otherwise older browsers may
+    // still block the iframe despite the CSP configuration.
+    frameguard: allowsCrossOriginFrames ? false : { action: "deny" },
 
     // Referrer/cross-origin policies
     referrerPolicy: { policy: "strict-origin-when-cross-origin" },
@@ -115,4 +142,4 @@ export function setDefaultCacheControl() {
 //   res.setHeader("Permissions-Policy", buildPermissionsPolicyHeader());
 //   next();
 // });
-// app.use(setDefaultCacheControl());
+// app.use(setDefaultCacheControl());

package/src/helpers/solid-core-error-codes-provider.service.ts

@@ -32,6 +32,59 @@ export class SolidCoreErrorCodesProvider implements IErrorCodeProvider {
                     httpStatus: 401,
                 },
             },
+            // MPIN rules sit above the generic session rules so that an MPIN
+            // failure is never reported as a session problem. The three codes
+            // drive three different client behaviours: retry, wait, and
+            // discard-the-handle.
+            {
+                code: 'solidx-mpin-locked',
+                priority: 120,
+                match: (txt) => txt.includes(ERROR_MESSAGES.MPIN_LOCKED.toLowerCase()),
+                meta: {
+                    message: ERROR_MESSAGES.MPIN_LOCKED,
+                    httpStatus: 401,
+                },
+            },
+            {
+                code: 'solidx-mpin-revoked',
+                priority: 120,
+                match: (txt) => txt.includes(ERROR_MESSAGES.MPIN_REVOKED.toLowerCase()),
+                meta: {
+                    message: ERROR_MESSAGES.MPIN_REVOKED,
+                    httpStatus: 401,
+                },
+            },
+            {
+                code: 'solidx-mpin-invalid',
+                priority: 120,
+                match: (txt) => txt.includes(ERROR_MESSAGES.MPIN_INVALID.toLowerCase()),
+                meta: {
+                    message: ERROR_MESSAGES.MPIN_INVALID,
+                    httpStatus: 401,
+                },
+            },
+            // Setup-time rejections. Distinct codes so the client can say
+            // "choose a less predictable PIN" rather than parsing a message.
+            // Safe to distinguish: both occur only on bearer-authenticated
+            // routes, so neither discloses anything.
+            {
+                code: 'solidx-mpin-too-predictable',
+                priority: 120,
+                match: (txt) => txt.includes(ERROR_MESSAGES.MPIN_TOO_PREDICTABLE.toLowerCase()),
+                meta: {
+                    message: ERROR_MESSAGES.MPIN_TOO_PREDICTABLE,
+                    httpStatus: 400,
+                },
+            },
+            {
+                code: 'solidx-mpin-format-invalid',
+                priority: 120,
+                match: (txt) => txt.includes(ERROR_MESSAGES.MPIN_FORMAT_INVALID.toLowerCase()),
+                meta: {
+                    message: ERROR_MESSAGES.MPIN_FORMAT_INVALID,
+                    httpStatus: 400,
+                },
+            },
             {
                 code: 'solidx-mcp-server-unavailable',
                 priority: 100,

package/src/helpers/solid-microservice-adapter.service.ts

@@ -79,7 +79,12 @@ export class SolidMicroserviceAdapter {
     const responseData = response.data as SolidxIamAuthResponse;
     const ttlSeconds = this.getJwtTtlSeconds(responseData?.data?.accessToken);
     if (ttlSeconds && ttlSeconds > 0) {
-      await this.cacheManager.set(cacheKey, responseData, ttlSeconds);
+      // cache-manager v5 expects milliseconds. This previously passed seconds,
+      // which the old Redis store discarded outright - so the entry simply
+      // never expired. Now that TTLs are honoured, passing seconds unconverted
+      // would expire the cached token ~1000x too early and re-authenticate
+      // against IAM on nearly every call.
+      await this.cacheManager.set(cacheKey, responseData, ttlSeconds * 1000);
     }
 
     return responseData;

package/src/helpers/typeorm-db-helper.ts

@@ -40,6 +40,14 @@ const DECIMAL_MAP: Record<DatasourceType, ColumnOptions> = {
     [DatasourceType.oracle]: { type: "float" },
 };
 
+const DATE_TIME_MAP: Record<DatasourceType, ColumnOptions> = {
+    [DatasourceType.postgres]: { type: "timestamp" },
+    [DatasourceType.mssql]: { type: "datetime2" },
+    [DatasourceType.mysql]: { type: "datetime" },
+    [DatasourceType.mariadb]: { type: "datetime" },
+    [DatasourceType.oracle]: { type: "timestamp" },
+};
+
 const solidCoreDbType: DatasourceType =
     Object.values(DatasourceType).includes(process.env.SOLID_CORE_DB_TYPE as DatasourceType)
         ? (process.env.SOLID_CORE_DB_TYPE as DatasourceType)
@@ -72,7 +80,10 @@ export function getColumnType(solidType: string): ColumnOptions {
         case "decimal":
             return DECIMAL_MAP[solidCoreDbType];
 
+        case "datetime":
+            return DATE_TIME_MAP[solidCoreDbType];
+
         default:
             return {};
     }
-}
+}

package/src/index.ts

@@ -160,6 +160,12 @@ export * from './entities/role-metadata.entity'
 export * from './entities/sms-template.entity'
 export * from './entities/user.entity'
 export * from './entities/user-api-key.entity'
+export * from './entities/user-device-credential.entity'
+export * from './repository/user-device-credential.repository'
+export * from './services/mpin.service'
+export * from './dtos/setup-mpin.dto'
+export * from './dtos/change-mpin.dto'
+export * from './dtos/mpin-login.dto'
 export * from './entities/view-metadata.entity'
 export * from './entities/setting.entity'
 export * from './entities/saved-filters.entity'

package/src/interfaces/active-user-data.interface.ts

@@ -22,6 +22,15 @@ export interface ActiveUserData {
    */
   sessionId?: string;
 
+  /**
+   * Identifies which per-device refresh-token bucket this session belongs to.
+   * Present only while concurrent logins are permitted; mutually exclusive with
+   * sessionId, which exists only when they are not. Carried on the access token
+   * so bearer-authenticated endpoints that need this session's refresh token
+   * can find it.
+   */
+  deviceKey?: string;
+
   /**
    * The subject's (user) roles.
    * These are part of the JWT token, we simply decode them.

package/src/repository/user-device-credential.repository.ts

@@ -0,0 +1,17 @@
+import { Injectable } from '@nestjs/common';
+import { UserDeviceCredential } from 'src/entities/user-device-credential.entity';
+import { RequestContextService } from 'src/services/request-context.service';
+import { DataSource } from 'typeorm';
+import { SecurityRuleRepository } from './security-rule.repository';
+import { SolidBaseRepository } from './solid-base.repository';
+
+@Injectable()
+export class UserDeviceCredentialRepository extends SolidBaseRepository<UserDeviceCredential> {
+    constructor(
+        readonly dataSource: DataSource,
+        readonly requestContextService: RequestContextService,
+        readonly securityRuleRepository: SecurityRuleRepository,
+    ) {
+        super(UserDeviceCredential, dataSource, requestContextService, securityRuleRepository);
+    }
+}

package/src/seeders/module-metadata-seeder.service.ts

@@ -1049,17 +1049,25 @@ export class ModuleMetadataSeederService {
 
     private async seedModelSequences(overallMetadata: any): Promise<{ pruned: number; upserted: number }> {
         const modelSequences = this.getSeedArray<CreateModelSequenceDto>(overallMetadata?.modelSequences);
-        const pruned = this.enablePruning ? await this.timeOperation('prune-model-sequences', () => this.pruneModelSequences(modelSequences, overallMetadata?.moduleMetadata?.name), {
+
+        // Getting rid of currentValue even if it is present in the seed data. 
+        // This is because we don't want to overwrite the currentValue in the database with the seed data. 
+        // The currentValue should be managed by the application and not by the seed data.
+        const cleanModelSequences = modelSequences.map((sequence) => {
+            const { currentValue, ...cleanModelSequence }: CreateModelSequenceDto = sequence;
+            return cleanModelSequence;
+        });
+        const pruned = this.enablePruning ? await this.timeOperation('prune-model-sequences', () => this.pruneModelSequences(cleanModelSequences, overallMetadata?.moduleMetadata?.name), {
             moduleName: overallMetadata?.moduleMetadata?.name,
             component: 'model-sequences',
             serviceCall: 'pruneModelSequences',
         }) : 0;
-        await this.timeOperation('handle-model-sequences', () => this.handleSeedModelSequences(modelSequences), {
+        await this.timeOperation('handle-model-sequences', () => this.handleSeedModelSequences(cleanModelSequences), {
             moduleName: overallMetadata?.moduleMetadata?.name,
             component: 'model-sequences',
             serviceCall: 'handleSeedModelSequences',
         });
-        return { pruned, upserted: modelSequences.length };
+        return { pruned, upserted: cleanModelSequences.length };
     }
 
     // OK

package/src/seeders/seed-data/solid-core-metadata.json

@@ -2360,6 +2360,164 @@
           }
         ]
       },
+      {
+        "singularName": "userDeviceCredential",
+        "tableName": "ss_user_device_credential",
+        "pluralName": "userDeviceCredentials",
+        "displayName": "User Device Credential",
+        "description": "Per-device MPIN credentials",
+        "dataSource": "default",
+        "dataSourceType": "postgres",
+        "userKeyFieldUserKey": "credentialKey",
+        "isSystem": true,
+        "fields": [
+          {
+            "name": "credentialKey",
+            "displayName": "Credential Key",
+            "description": "Natural key: <username>-<deviceId>. Populated by MpinService, not by the computed-field pipeline.",
+            "type": "shortText",
+            "length": 512,
+            "required": true,
+            "unique": true,
+            "index": true,
+            "private": false,
+            "encrypt": false,
+            "isUserKey": true,
+            "isSystem": true
+          },
+          {
+            "name": "hashedCredentialRef",
+            "displayName": "Hashed Credential Ref",
+            "type": "shortText",
+            "length": 512,
+            "required": true,
+            "unique": true,
+            "index": true,
+            "private": true,
+            "encrypt": false,
+            "isSystem": true
+          },
+          {
+            "name": "hashedMpin",
+            "displayName": "Hashed MPIN",
+            "type": "shortText",
+            "length": 512,
+            "required": true,
+            "unique": false,
+            "index": false,
+            "private": true,
+            "encrypt": false,
+            "isSystem": true
+          },
+          {
+            "name": "mpinScheme",
+            "displayName": "MPIN Scheme",
+            "type": "selectionStatic",
+            "required": true,
+            "private": false,
+            "encrypt": false,
+            "isSystem": true,
+            "selectionStaticValues": [
+              "bcrypt:bcrypt"
+            ]
+          },
+          {
+            "name": "mpinSchemeVersion",
+            "displayName": "MPIN Scheme Version",
+            "type": "int",
+            "required": true,
+            "private": false,
+            "encrypt": false,
+            "defaultValue": "1",
+            "isSystem": true
+          },
+          {
+            "name": "deviceId",
+            "displayName": "Device Id",
+            "type": "shortText",
+            "length": 512,
+            "required": true,
+            "unique": false,
+            "index": true,
+            "private": false,
+            "encrypt": false,
+            "isSystem": true
+          },
+          {
+            "name": "deviceName",
+            "displayName": "Device Name",
+            "type": "shortText",
+            "length": 512,
+            "required": false,
+            "unique": false,
+            "index": false,
+            "private": false,
+            "encrypt": false,
+            "isSystem": true
+          },
+          {
+            "name": "platform",
+            "displayName": "Platform",
+            "type": "shortText",
+            "length": 512,
+            "required": false,
+            "unique": false,
+            "index": false,
+            "private": false,
+            "encrypt": false,
+            "isSystem": true
+          },
+          {
+            "name": "isActive",
+            "displayName": "Is Active",
+            "type": "boolean",
+            "required": true,
+            "unique": false,
+            "index": false,
+            "private": false,
+            "encrypt": false,
+            "defaultValue": "true",
+            "isSystem": true
+          },
+          {
+            "name": "failedAttempts",
+            "displayName": "Failed Attempts",
+            "type": "int",
+            "required": true,
+            "private": false,
+            "encrypt": false,
+            "defaultValue": "0",
+            "isSystem": true
+          },
+          {
+            "name": "lockedUntil",
+            "displayName": "Locked Until",
+            "type": "datetime",
+            "required": false,
+            "private": false,
+            "encrypt": false,
+            "isSystem": true
+          },
+          {
+            "name": "lastUsedAt",
+            "displayName": "Last Used At",
+            "type": "datetime",
+            "required": false,
+            "private": false,
+            "encrypt": false,
+            "isSystem": true
+          },
+          {
+            "name": "user",
+            "displayName": "User",
+            "type": "relation",
+            "required": true,
+            "private": false,
+            "encrypt": false,
+            "isSystem": true
+          }
+        ]
+      },
       {
         "singularName": "userActivityHistory",
         "tableName": "ss_user_activity_history",
@@ -11642,7 +11800,8 @@
             "type": "field",
             "attrs": {
               "name": "fileSize",
-              "sortable": true
+              "sortable": true,
+              "viewWidget": "MediaFileSizeListWidget"
             }
           }
         ]
@@ -11807,6 +11966,13 @@
                     "attrs": {
                       "name": "fieldMetadata"
                     }
+                  },
+                  {
+                    "type": "field",
+                    "attrs": {
+                      "name": "fileSize",
+                      "viewWidget": "MediaFileSizeFormViewWidget"
+                    }
                   }
                 ]
               }
@@ -12583,7 +12749,7 @@
             50
           ],
           "enableGlobalSearch": true,
-          "create": true,
+          "create": false,
           "edit": true,
           "delete": true,
           "import": true,