@solidxai/core 0.1.13-beta.9 → 0.1.13

package/src/services/api-key.service.ts

@@ -131,7 +131,19 @@ export class ApiKeyService {
 
         const user = apiKeyRecord.user;
 
-        const tokens = await this.authenticationService.generateTokens(user);
+        // Keyed on the API key record so every call for this key reuses one
+        // refresh-token bucket. Without it each call mints a fresh key and
+        // therefore a new bucket with a refreshTokenTtl lifetime - a client
+        // polling this endpoint would accumulate them without bound.
+        //
+        // The consequence is that replicas sharing one API key share one
+        // bucket and invalidate each other, which is exactly the behaviour
+        // before per-device sessions existed, and is benign here: an API key
+        // is a permanent credential, so a failed refresh just re-mints.
+        const tokens = await this.authenticationService.generateTokens(
+            user,
+            `apikey-${apiKeyRecord.id}`,
+        );
 
 
         return {

package/src/services/authentication.service.ts

@@ -1793,7 +1793,13 @@ export class AuthenticationService {
     }
   }
 
-  async generateTokens(user: User) {
+  /**
+   * @param deviceId optional stable per-device identifier. Supplied by callers
+   * that own a device credential; otherwise a key is minted per login so that
+   * clients with no device concept (the web UI) still get their own bucket
+   * instead of sharing - and evicting - one.
+   */
+  async generateTokens(user: User, deviceId?: string) {
     const sessionId = this.shouldPreventConcurrentLogins()
       ? randomUUID()
       : undefined;
@@ -1802,9 +1808,17 @@ export class AuthenticationService {
     } else {
       await this.activeSessionStorage.clearActiveSession(user.id);
     }
+
+    // Mutually exclusive with sessionId by construction: per-device buckets
+    // exist only when preventConcurrentLogins is off, sessionId only when it
+    // is on.
+    const deviceKey = this.refreshTokenIdsStorage.areConcurrentLoginsAllowed()
+      ? deviceId ?? randomUUID()
+      : undefined;
+
     const [accessToken, refreshToken] = await Promise.all([
-      await this.generateAccessToken(user, sessionId),
-      await this.generateRefreshToken(user),
+      await this.generateAccessToken(user, sessionId, deviceKey),
+      await this.generateRefreshToken(user, undefined, deviceKey),
     ]);
 
     return {
@@ -1813,7 +1827,7 @@ export class AuthenticationService {
     };
   }
 
-  async generateAccessToken(user: User, sessionId?: string) {
+  async generateAccessToken(user: User, sessionId?: string, deviceKey?: string) {
     // const userRoleNames = user.roles.map((role) => role.name).join(';')
     const userRoleNames = user.roles.map((role) => role.name);
     const resolvedSessionId = this.shouldPreventConcurrentLogins()
@@ -1830,18 +1844,36 @@ export class AuthenticationService {
         email: user.email,
         roles: userRoleNames,
         ...(resolvedSessionId ? { sessionId: resolvedSessionId } : {}),
+        // Carried so that bearer-authenticated endpoints which need this
+        // session's refresh token - generateSsoCode, me - can locate its
+        // bucket. The refresh token is not available to them.
+        ...(deviceKey ? { deviceKey } : {}),
       },
     );
 
     return accessToken;
   }
 
-  async generateRefreshToken(user: User, previousRefreshToken?: string) {
+  async generateRefreshToken(
+    user: User,
+    previousRefreshToken?: string,
+    deviceKey?: string,
+  ) {
     const refreshTokenId = randomUUID();
     const refreshTokenTtl =
       this.settingService.getConfigValue<SolidCoreSetting>("refreshTokenTtl");
+
+    // Only per-device tokens carry an epoch - it is what makes bulk
+    // invalidation possible without enumerating buckets. Single-slot tokens
+    // are invalidated by deleting their one key.
+    const epoch = deviceKey
+      ? await this.refreshTokenIdsStorage.getEpoch(user.id)
+      : undefined;
+
     const refreshToken = await this.signToken(user.id, refreshTokenTtl, {
       refreshTokenId,
+      ...(deviceKey ? { deviceKey } : {}),
+      ...(epoch !== undefined ? { epoch } : {}),
     });
 
     // store the refresh token id in the redis storage.
@@ -1849,6 +1881,7 @@ export class AuthenticationService {
       user.id,
       refreshToken,
       previousRefreshToken,
+      deviceKey,
     );
 
     return refreshToken;
@@ -1863,8 +1896,16 @@ export class AuthenticationService {
       const issuer =
         this.settingService.getConfigValue<SolidCoreSetting>("issuer");
 
-      const { sub } = await this.jwtService.verifyAsync<
-        Pick<ActiveUserData, "sub"> & { refreshTokenId: string }
+      // deviceKey/epoch are absent on tokens issued before per-device sessions,
+      // and on tokens issued while preventConcurrentLogins is on. That absence
+      // is the signal the storage layer branches on - no request-body change
+      // and no client change is needed to carry it.
+      const { sub, deviceKey, epoch } = await this.jwtService.verifyAsync<
+        Pick<ActiveUserData, "sub"> & {
+          refreshTokenId: string;
+          deviceKey?: string;
+          epoch?: number;
+        }
       >(refreshTokenDto.refreshToken, {
         secret,
         audience,
@@ -1892,17 +1933,24 @@ export class AuthenticationService {
       //     throw new Error('Refresh token is invalid');
       // }
 
-      const currentRefreshToken =
-        await this.refreshTokenIdsStorage.validateAndRotate(
-          user,
-          refreshTokenDto.refreshToken,
-        );
+      const rotated = await this.refreshTokenIdsStorage.validateAndRotate(
+        user,
+        refreshTokenDto.refreshToken,
+        { deviceKey, epoch },
+      );
 
       await this.userActivityHistoryService.logEvent("tokenRefreshed", user);
 
       return {
-        accessToken: await this.generateAccessToken(user),
-        refreshToken: currentRefreshToken,
+        // The rotated key, not the incoming one: a session migrating out of the
+        // pre-deploy single slot is assigned a bucket here, and the new access
+        // token has to name the same one.
+        accessToken: await this.generateAccessToken(
+          user,
+          undefined,
+          rotated.deviceKey,
+        ),
+        refreshToken: rotated.refreshToken,
       };
     } catch (err: any) {
       if (err instanceof InvalidatedRefreshTokenError) {
@@ -2291,28 +2339,31 @@ export class AuthenticationService {
   //     // Invalidate the refresh token
   //     // await this.refreshTokenIdsStorage.invalidate(user.id);
   // }
-  async logout(refreshToken: string) {
+  async logout(refreshToken: string, allDevices = false) {
     try {
-      // const activeUser = this.requestContextService.getActiveUser();
-      // const userId = activeUser?.sub;
-      // const user = await this.userRepository.findOne({
-      //     where: {
-      //         id: userId,
-      //     }
-      // })
-      // // Invalidate refresh token if you store them
-      // await this.refreshTokenIdsStorage.invalidate(userId); // ← Your existing logic
-      // if (!refreshToken) {
-      //     throw new UnauthorizedException('Refresh token is required');
-      // }
-      const payload = this.jwtService.decode(refreshToken) as any;
-
-      if (!payload || !payload.sub) {
-        throw new UnauthorizedException(ERROR_MESSAGES.INVALID_REFRESH_TOKEN);
+      const payload = await this.verifyRefreshTokenForLogout(refreshToken);
+
+      // Nothing verifiable to act on: forged, malformed, or signed with another
+      // secret. Acting on an unauthenticated `sub` is exactly the hole this
+      // closes - the route is @Public(), so a decoded-but-unverified token let
+      // anyone log out an arbitrary user. Report success either way: logout
+      // must be safe to call blindly from a client error path, and a 401/200
+      // split here would leak whether a token string is genuine (RFC 7009 §2.2
+      // takes the same position for revocation endpoints).
+      if (!payload?.sub) {
+        this.logger.warn("logout called with an unverifiable refresh token");
+        return { message: SUCCESS_MESSAGES.LOGOUT_SUCCESS };
       }
 
       const userId = payload.sub;
-      await this.refreshTokenIdsStorage.invalidate(userId);
+      if (allDevices) {
+        await this.refreshTokenIdsStorage.invalidateAll(userId);
+      } else {
+        // Scoped to the bucket this token belongs to, so signing out on one
+        // device leaves the others alive. A token with no deviceKey names the
+        // single slot, which is the same key as before.
+        await this.refreshTokenIdsStorage.invalidate(userId, payload.deviceKey);
+      }
       await this.activeSessionStorage.clearActiveSession(userId);
       const user = await this.userRepository.findOne({
         where: {
@@ -2320,10 +2371,15 @@ export class AuthenticationService {
         },
       });
       // Log logout event
-      await this.userActivityHistoryService.logEvent("logout", user);
+      if (user) {
+        await this.userActivityHistoryService.logEvent("logout", user);
+      }
 
       return { message: SUCCESS_MESSAGES.LOGOUT_SUCCESS };
     } catch (err: any) {
+      // JWT problems no longer reach here - verifyRefreshTokenForLogout
+      // swallows them - so this is left for genuine infrastructure failures
+      // (cache or database unavailable), where a 500 is the correct answer.
       throw err instanceof UnauthorizedException ||
         err instanceof InternalServerErrorException
         ? err
@@ -2331,6 +2387,31 @@ export class AuthenticationService {
     }
   }
 
+  private async verifyRefreshTokenForLogout(
+    refreshToken: string,
+  ): Promise<{ sub: number; deviceKey?: string } | null> {
+    try {
+      const payload = await this.jwtService.verifyAsync(refreshToken, {
+        secret: this.settingService.getConfigValue<SolidCoreSetting>("secret"),
+        audience:
+          this.settingService.getConfigValue<SolidCoreSetting>("audience"),
+        issuer: this.settingService.getConfigValue<SolidCoreSetting>("issuer"),
+        // Signature, audience and issuer are still enforced; only `exp` is
+        // tolerated. An expired session must still be able to log out - the
+        // previous jwtService.decode() allowed that, and a plain verifyAsync
+        // would throw TokenExpiredError, which the catch above would turn into
+        // a 500 on an ordinary sign-out.
+        ignoreExpiration: true,
+      });
+
+      // Access and refresh tokens share secret, audience and issuer, so only
+      // this claim distinguishes them. Reject an access token presented here.
+      return payload?.refreshTokenId ? payload : null;
+    } catch {
+      return null; // bad signature or malformed
+    }
+  }
+
   async activateUser(userId: number) {
     const user = await this.userService.findOne(userId, {});
     if (!user) {
@@ -2352,9 +2433,14 @@ export class AuthenticationService {
 
     // const tokens = await this.generateTokens(user);
 
-    // Get the refresh token for a user from refresh token storage.
+    // Get the refresh token for a user from refresh token storage. The bucket
+    // is named by the access token's own deviceKey claim; absent for
+    // single-slot sessions, which resolves to the same key as before.
     const refreshTokenState =
-      await this.refreshTokenIdsStorage.getCurrentRefreshTokenState(user.id);
+      await this.refreshTokenIdsStorage.getCurrentRefreshTokenState(
+        user.id,
+        activeUser.deviceKey,
+      );
 
     const response = {
       user: {
@@ -2365,7 +2451,11 @@ export class AuthenticationService {
         id: user.id,
         roles: user.roles.map((role) => role.name),
       },
-      refreshToken: refreshTokenState.currentRefreshToken,
+      // Null-guarded because the cache entry now carries a TTL: once it
+      // expires - or after a logout followed by a call with a still-valid
+      // access token - there is no state to read. Matches the existing
+      // handling in generateSsoCode.
+      refreshToken: refreshTokenState?.currentRefreshToken ?? null,
       // ...tokens
     };
     return response;
@@ -2378,6 +2468,7 @@ export class AuthenticationService {
     const refreshTokenState =
       await this.refreshTokenIdsStorage.getCurrentRefreshTokenState(
         activeUser.sub,
+        activeUser.deviceKey,
       );
     if (!refreshTokenState?.currentRefreshToken) {
       throw new UnauthorizedException("No active session found");

package/src/services/chatter-message.service.ts

@@ -8,6 +8,7 @@ import { classify } from '@angular-devkit/core/src/utils/strings';
 import { CHATTER_MESSAGE_STATUS, CHATTER_MESSAGE_SUBTYPE, CHATTER_MESSAGE_TYPE, CHATTER_MESSAGE_USER_FIELDS } from 'src/constants/chatter-message.constants';
 import { isDangerousMediaFile } from 'src/constants/media-file-types';
 import { ERROR_MESSAGES } from 'src/constants/error-messages';
+import { MediaFieldCrudManager, SolidMediaType } from 'src/helpers/field-crud-managers/MediaFieldCrudManager';
 import { PostChatterMessageDto } from 'src/dtos/post-chatter-message.dto';
 import { UpdateChatterNoteMessageDto } from 'src/dtos/update-chatter-note-message.dto';
 import { ModelMetadataHelperService } from 'src/helpers/model-metadata-helper.service';
@@ -37,6 +38,16 @@ interface ChatterMention {
     id?: string | number;
 }
 
+/**
+ * Server-side-only overrides for `postMessage`. Not part of `PostChatterMessageDto`, so
+ * nothing here is settable over HTTP - only in-process callers such as migration or
+ * back-fill services can supply it.
+ */
+export interface PostChatterMessageOptions {
+    /** Backdate the message instead of stamping it with the current time. */
+    createdAt?: Date;
+}
+
 @Injectable()
 export class ChatterMessageService extends CRUDService<ChatterMessage> {
     private readonly _logger = new Logger(ChatterMessageService.name);
@@ -186,6 +197,34 @@ export class ChatterMessageService extends CRUDService<ChatterMessage> {
         }
     }
 
+    /**
+     * Validates newly-uploaded attachments against each declared media field's real config
+     * (mediaTypes/mediaMaxSizeKb/mediaAllowedExtensions), grouped by fieldname - the same rules
+     * MediaFieldCrudManager already enforces everywhere else. Shared between postMessage and
+     * updateCustomNoteMessage so the two entry points can't drift apart; isUpdate is the only
+     * thing that differs between them.
+     */
+    private validateChatterAttachmentsForFields(files: Express.Multer.File[], mediaFields: any[], isUpdate: boolean): void {
+        for (const mediaField of mediaFields) {
+            const media = files.filter(multerFile => multerFile.fieldname === mediaField.name);
+            if (media.length === 0) continue;
+
+            const validator = new MediaFieldCrudManager({
+                type: mediaField.type as SolidMediaType,
+                required: mediaField.required,
+                fieldName: mediaField.name,
+                mediaMaxSizeKb: mediaField.mediaMaxSizeKb,
+                mediaTypes: mediaField.mediaTypes,
+                mediaAllowedExtensions: mediaField.mediaAllowedExtensions,
+                isUpdate,
+            });
+            const validationErrors = validator.validate({}, media);
+            if (validationErrors.length > 0) {
+                throw new BadRequestException(validationErrors.map(error => error.error).join(', '));
+            }
+        }
+    }
+
     private async publishChatterMentionNotifications(message: ChatterMessage, model: any) {
         if (message.messageType !== CHATTER_MESSAGE_TYPE.CUSTOM || message.messageSubType !== CHATTER_MESSAGE_SUBTYPE.NOTE) {
             return;
@@ -319,6 +358,24 @@ export class ChatterMessageService extends CRUDService<ChatterMessage> {
 
         this.validateChatterMediaFiles(files);
 
+        let chatterModel: any = null;
+        let mediaFields: any[] = [];
+        if (removeAttachmentIds.length > 0 || hasNewFiles) {
+            chatterModel = await this.modelMetadataService.findOneBySingularName('chatterMessage', {
+                fields: {
+                    model: true,
+                    mediaStorageProvider: true,
+                },
+                module: true,
+            });
+
+            mediaFields = chatterModel.fields.filter(field => field.type === 'mediaSingle' || field.type === 'mediaMultiple');
+
+            if (hasNewFiles) {
+                this.validateChatterAttachmentsForFields(files, mediaFields, true);
+            }
+        }
+
         if (hasMessageBody) {
             message.messageBody = trimmedMessageBody;
         }
@@ -335,15 +392,6 @@ export class ChatterMessageService extends CRUDService<ChatterMessage> {
         const savedMessage = await this.repo.save(message);
 
         if (removeAttachmentIds.length > 0 || hasNewFiles) {
-            const model = await this.modelMetadataService.findOneBySingularName('chatterMessage', {
-                fields: {
-                    model: true,
-                    mediaStorageProvider: true,
-                },
-                module: true,
-            });
-
-            const mediaFields = model.fields.filter(field => field.type === 'mediaSingle' || field.type === 'mediaMultiple');
             const attachmentFieldIds = mediaFields.map(field => field.id);
 
             if (removeAttachmentIds.length > 0 && attachmentFieldIds.length > 0) {
@@ -351,7 +399,7 @@ export class ChatterMessageService extends CRUDService<ChatterMessage> {
                     where: {
                         id: In(removeAttachmentIds),
                         entityId: savedMessage.id,
-                        modelMetadata: { id: model.id },
+                        modelMetadata: { id: chatterModel.id },
                         fieldMetadata: { id: In(attachmentFieldIds) },
                     },
                     relations: {
@@ -389,7 +437,14 @@ export class ChatterMessageService extends CRUDService<ChatterMessage> {
         return this.trimMessageUser(savedMessage);
     }
 
-    async postMessage(postDto: PostChatterMessageDto, files: Express.Multer.File[] = []) {
+    /**
+     * Post a chatter message.
+     *
+     * `options` is deliberately kept out of `PostChatterMessageDto` so it can only be supplied
+     * by server-side callers (migrations, back-fills). The controller binds the DTO alone, so
+     * an API client has no way to backdate a message.
+     */
+    async postMessage(postDto: PostChatterMessageDto, files: Express.Multer.File[] = [], options: PostChatterMessageOptions = {}) {
         const coModelName = lowerFirst(postDto.coModelName);
         await this.assertRecordAccess(coModelName, postDto.coModelEntityId);
 
@@ -404,6 +459,10 @@ export class ChatterMessageService extends CRUDService<ChatterMessage> {
         chatterMessage.coModelEntityId = postDto.coModelEntityId;
         chatterMessage.coModelName = coModelName;
         chatterMessage.modelUserKey = postDto.modelUserKey ?? null;
+        // Left unset otherwise, so the @CreateDateColumn default still applies.
+        if (options.createdAt) {
+            chatterMessage.createdAt = options.createdAt;
+        }
 
         const model = await this.modelMetadataRepo.findOne({
             where: { singularName: coModelName },
@@ -413,10 +472,9 @@ export class ChatterMessageService extends CRUDService<ChatterMessage> {
 
         this.stampMessageAuditFields(chatterMessage);
 
-        const savedMessage = await this.repo.save(chatterMessage);
-
+        let mediaFields: any[] = [];
         if (files && files.length > 0) {
-            const model = await this.modelMetadataService.findOneBySingularName('chatterMessage', {
+            const chatterModel = await this.modelMetadataService.findOneBySingularName('chatterMessage', {
                 fields: {
                     model: true,
                     mediaStorageProvider: true,
@@ -424,8 +482,13 @@ export class ChatterMessageService extends CRUDService<ChatterMessage> {
                 module: true,
             });
 
-            const mediaFields = model.fields.filter(field => field.type === 'mediaSingle' || field.type === 'mediaMultiple');
+            mediaFields = chatterModel.fields.filter(field => field.type === 'mediaSingle' || field.type === 'mediaMultiple');
+            this.validateChatterAttachmentsForFields(files, mediaFields, false);
+        }
+
+        const savedMessage = await this.repo.save(chatterMessage);
 
+        if (files && files.length > 0) {
             for (const mediaField of mediaFields) {
                 const media = files.filter(multerFile => multerFile.fieldname === mediaField.name);
                 if (media.length > 0) {

package/src/services/crud-helper.service.ts

@@ -889,25 +889,25 @@ export class CrudHelperService {
         };
     }
 
-    async countGroupedRecords(qb: SelectQueryBuilder<any>, basicFilterDto: BasicFilterDto, entityAlias: string) { //TODO : Check how to pass a type to SelectQueryBuilder instead of any
-        const { limit, offset, ...rest } = basicFilterDto;
-        const filteredDto = { ...rest, limit: undefined, offset: undefined };
+    // async countGroupedRecords(qb: SelectQueryBuilder<any>, basicFilterDto: BasicFilterDto, entityAlias: string, internationalisation?: boolean, draftPublishWorkflow?: boolean, moduleRef?: any) { //TODO : Check how to pass a type to SelectQueryBuilder instead of any
+    //     const { limit, offset, ...rest } = basicFilterDto;
+    //     const filteredDto = { ...rest, limit: undefined, offset: undefined };
 
-        const filteredQB = this.buildFilterQuery(qb, filteredDto as BasicFilterDto, entityAlias, undefined, undefined, undefined, FilterCombinator.AND, false, false);
+    //     const filteredQB = this.buildFilterQuery(qb, filteredDto as BasicFilterDto, entityAlias, internationalisation, draftPublishWorkflow, moduleRef, FilterCombinator.AND, false, false);
 
-        const groupByFields = this.normalize(filteredDto.groupBy);
+    //     const groupByFields = this.normalize(filteredDto.groupBy);
 
-        if (!groupByFields || groupByFields.length === 0) {
-            throw new Error(ERROR_MESSAGES.INVALID_GROUP_BY_COUNT);
-        }
+    //     if (!groupByFields || groupByFields.length === 0) {
+    //         throw new Error(ERROR_MESSAGES.INVALID_GROUP_BY_COUNT);
+    //     }
 
-        this.applyGroupBySelections(filteredQB, groupByFields, entityAlias);
-        this.applyAggregates(filteredQB, ['count'], entityAlias);
-        filteredQB.limit(undefined).offset(undefined).take(undefined).skip(undefined);
+    //     this.applyGroupBySelections(filteredQB, groupByFields, entityAlias);
+    //     this.applyAggregates(filteredQB, ['count'], entityAlias);
+    //     filteredQB.limit(undefined).offset(undefined).take(undefined).skip(undefined);
 
-        const rawResults = await filteredQB.getRawMany();
-        return rawResults.length;
-    }
+    //     const rawResults = await filteredQB.getRawMany();
+    //     return rawResults.length;
+    // }
 
     hasReadPermissionOnModel = (activeUser: ActiveUserData, modelName: string) => {
         const permissionNames = [`${classify(modelName)}Controller.findOne`, `${classify(modelName)}Controller.findMany`];
@@ -980,7 +980,10 @@ export class CrudHelperService {
         basicFilterDto: BasicFilterDto,
         alias: string,
         createQbFn: () => Promise<SelectQueryBuilder<T>>,
-        postProcessEntities?: (entities: T[]) => Promise<void>
+        postProcessEntities?: (entities: T[]) => Promise<void>,
+        internationalisation?: boolean,
+        draftPublishWorkflow?: boolean,
+        moduleRef?: any
     ): Promise<{ meta: { totalRecords: number }; groupMeta: any[]; groupRecords: any[] }> {
         const groupByFields = this.normalize(basicFilterDto.groupBy);
         if (!groupByFields.length) throw new BadRequestException(ERROR_MESSAGES.INVALID_GROUP_BY_COUNT);
@@ -1015,7 +1018,7 @@ export class CrudHelperService {
                     aggregates: undefined,
                     sort: basicFilterDto.groupFilter?.sort,
                 };
-                groupQb = this.buildFilterQuery(groupQb, groupFilterDto, alias);
+                groupQb = this.buildFilterQuery(groupQb, groupFilterDto, alias, internationalisation, draftPublishWorkflow, moduleRef);
                 groupQb = this.buildGroupByRecordsQuery(groupQb, group, alias, groupAliasMap, aggregateAliasMap, groupExpressionMap);
                 const [entities, count] = await groupQb.getManyAndCount();
                 if (postProcessEntities) await postProcessEntities(entities);

package/src/services/crud.service.ts

@@ -446,6 +446,7 @@ private async prepareManyToManyAuditSnapshot(entity: T,id: number,modelSingularN
                     ...commonOptions,
                     mediaMaxSizeKb: fieldMetadata.mediaMaxSizeKb,
                     mediaTypes: fieldMetadata.mediaTypes,
+                    mediaAllowedExtensions: fieldMetadata.mediaAllowedExtensions,
                     type: fieldMetadata.type as unknown as SolidMediaType
                 };
                 return new MediaFieldCrudManager(options);
@@ -583,7 +584,8 @@ private async prepareManyToManyAuditSnapshot(entity: T,id: number,modelSingularN
                 async (entities) => {
                     if (populateUserIdFields?.length) await this.handlePopulateUserIdFields(populateUserIdFields, entities);
                     if (populateMedia?.length) await this.handlePopulateMedia(populateMedia, entities);
-                }
+                },
+                internationalisation, draftPublishWorkflow, this.moduleRef
             );
         }
         else {

package/src/services/draft-publish-helper.service.ts

@@ -333,13 +333,65 @@ export class DraftPublishHelperService {
             throw new BadRequestException(`${modelName} with id ${id} is already unpublished`);
         }
 
-        return repo.save({
-            ...entity,
-            isPublished: false,
-            updatedBy: activeUser?.sub ?? entity.updatedBy,
+        const chainId = entity.initialEntityVersionId || entity.id;
+
+        return repo.manager.transaction(async (manager) => {
+            const transactionalRepo = manager.getRepository(repo.metadata.target);
+
+            // Release the "na" published tracker before anything else can claim it, mirroring
+            // publishRecord's archive-others-then-publish ordering in reverse. unpublishRecord
+            // only ever acts on the latest version (see loadLatestEntityForPublishAction), so
+            // this always becomes a Draft rather than an Archived version — clear publishedAt
+            // to match applyCreateDefaults' Draft convention instead of leaving a stale date.
+            const unpublishedEntity = await transactionalRepo.save({
+                ...entity,
+                isPublished: false,
+                publishedAt: null,
+                publishedTracker: this.createPublishedVersionTracker(entity.id),
+                updatedBy: activeUser?.sub ?? entity.updatedBy,
+            } as any) as unknown as T;
+
+            const chainVersions = await transactionalRepo.find({
+                where: [
+                    { initialEntityVersionId: chainId },
+                    { id: chainId },
+                ] as any,
+            }) as unknown as T[];
+
+            const versionToRestore = this.pickMostRecentlyPublishedVersion(
+                chainVersions.filter(version => version.id !== entity.id),
+            );
+
+            if (versionToRestore) {
+                await transactionalRepo.save({
+                    ...versionToRestore,
+                    isPublished: true,
+                    publishedAt: new Date(),
+                    publishedTracker: "na",
+                } as any);
+            }
+
+            return unpublishedEntity;
         });
     }
 
+    /**
+     * Among the other versions in a chain, find the one that was live most recently before
+     * being superseded (i.e. the "Archived" version unpublishRecord should restore). Ties on
+     * publishedAt fall back to the highest id, matching pickCurrentLocaleRecord's ordering.
+     */
+    private pickMostRecentlyPublishedVersion<T extends CommonEntity>(versions: T[]): T | null {
+        const previouslyPublished = versions.filter(version => Boolean(version.publishedAt));
+        if (previouslyPublished.length === 0) return null;
+
+        return previouslyPublished.sort((a, b) => {
+            const aPublishedAt = new Date(a.publishedAt as any).getTime();
+            const bPublishedAt = new Date(b.publishedAt as any).getTime();
+            if (aPublishedAt !== bPublishedAt) return bPublishedAt - aPublishedAt;
+            return Number(b.id) - Number(a.id);
+        })[0];
+    }
+
     /**
      * Load the latest version of a draft/publish-enabled record for a publish/unpublish
      * action, applying the two checks both actions share (workflow enabled, version is latest).

package/src/services/field-metadata.service.ts

@@ -7,12 +7,13 @@ import { ComputedFieldMetadata, SolidRegistry } from 'src/helpers/solid-registry
 import { FieldMetadataRepository } from 'src/repository/field-metadata.repository';
 import { DataSource, Repository, SelectQueryBuilder } from 'typeorm';
 import { BasicFilterDto } from '../dtos/basic-filters.dto';
-import { CascadeType, ComputedFieldValueType, CreateFieldMetadataDto, DecryptWhenType, EncryptionType, MediaType, MSSQLType, PSQLType, RelationType, SelectionValueType, SolidFieldType } from '../dtos/create-field-metadata.dto';
+import { CascadeType, ComputedFieldValueType, CreateFieldMetadataDto, DecryptWhenType, EncryptionType, MSSQLType, PSQLType, RelationType, SelectionValueType, SolidFieldType } from '../dtos/create-field-metadata.dto';
 import { SelectionDynamicQueryDto } from '../dtos/selection-dynamic-query.dto';
 import { UpdateFieldMetaDataDto } from '../dtos/update-field-metadata.dto';
 import { FieldMetadata } from '../entities/field-metadata.entity';
 import { ModelMetadata } from '../entities/model-metadata.entity';
 import { ISelectionProviderValues, MediaStorageProvider } from '../interfaces';
+import { MEDIA_CATEGORIES } from '../constants/media-file-types';
 import { CrudHelperService } from './crud-helper.service';
 import { ERROR_MESSAGES } from 'src/constants/error-messages';
 import qs from 'qs';
@@ -414,7 +415,7 @@ export class FieldMetadataService implements OnApplicationBootstrap {
             encryptionTypes: enumToResponseArray(EncryptionType),
             ormType: ormFieldTypeForSolid,
             decryptWhenTypes: enumToResponseArray(DecryptWhenType),
-            mediaTypes: enumToResponseArray(MediaType),
+            mediaTypes: MEDIA_CATEGORIES.map((value) => ({ label: value, value })),
             relationTypes: enumToResponseArray(RelationType),
             selectionDynamicProviders: sps,
             computedProviders: cps,
@@ -944,6 +945,7 @@ export class FieldMetadataService implements OnApplicationBootstrap {
                     "isSystem",
                     "mediaTypes",
                     "mediaMaxSizeKb",
+                    "mediaAllowedExtensions",
                     "mediaStorageProviderId",
                     "required",
                     "unique",
@@ -965,6 +967,7 @@ export class FieldMetadataService implements OnApplicationBootstrap {
                     "isSystem",
                     "mediaTypes",
                     "mediaMaxSizeKb",
+                    "mediaAllowedExtensions",
                     "mediaStorageProviderId",
                     "required",
                     "unique",