@solidxai/core 0.1.13-beta.9 → 0.1.14-beta.0

package/src/constants/media-file-types.ts

@@ -1,10 +1,101 @@
 export type MediaCategory = 'image' | 'audio' | 'video' | 'file' | 'pdf';
 
-const IMAGE_EXTENSIONS = ['png', 'jpg', 'jpeg', 'webp', 'gif', 'bmp', 'tiff', 'heic', 'heif'];
-const AUDIO_EXTENSIONS = ['mp3', 'wav', 'ogg', 'aac', 'm4a', 'flac', 'webm'];
-const VIDEO_EXTENSIONS = ['mp4', 'mov', 'avi', 'mkv', 'mpeg', 'mpg', '3gp', '3g2', 'webm', 'ogg'];
-const DOCUMENT_EXTENSIONS = ['txt', 'md', 'csv', 'json', 'doc', 'docx', 'xls', 'xlsx', 'ppt', 'pptx', 'zip', 'rar', '7z'];
-const PDF_EXTENSION = 'pdf';
+export const MEDIA_CATEGORIES = ['image', 'audio', 'video', 'file', 'pdf'] as const;
+
+export type MediaFileTypeDefinition = {
+    mediaType: MediaCategory;
+    mimeType: string;
+    extension: string;
+};
+
+// Single source of truth for every supported media extension, its canonical MIME type,
+// and the coarse media category used across validation and UI metadata.
+export const MEDIA_FILE_TYPES: MediaFileTypeDefinition[] = [
+    { mediaType: 'image', mimeType: 'image/png', extension: 'png' },
+    { mediaType: 'image', mimeType: 'image/jpeg', extension: 'jpg' },
+    { mediaType: 'image', mimeType: 'image/jpg', extension: 'jpg' },
+    { mediaType: 'image', mimeType: 'image/jpeg', extension: 'jpeg' },
+    { mediaType: 'image', mimeType: 'image/webp', extension: 'webp' },
+    { mediaType: 'image', mimeType: 'image/gif', extension: 'gif' },
+    { mediaType: 'image', mimeType: 'image/bmp', extension: 'bmp' },
+    { mediaType: 'image', mimeType: 'image/tiff', extension: 'tiff' },
+    { mediaType: 'image', mimeType: 'image/heic', extension: 'heic' },
+    { mediaType: 'image', mimeType: 'image/heif', extension: 'heif' },
+
+    { mediaType: 'audio', mimeType: 'audio/mpeg', extension: 'mp3' },
+    { mediaType: 'audio', mimeType: 'audio/mp3', extension: 'mp3' },
+    { mediaType: 'audio', mimeType: 'audio/wav', extension: 'wav' },
+    { mediaType: 'audio', mimeType: 'audio/x-wav', extension: 'wav' },
+    { mediaType: 'audio', mimeType: 'audio/ogg', extension: 'ogg' },
+    { mediaType: 'audio', mimeType: 'audio/aac', extension: 'aac' },
+    { mediaType: 'audio', mimeType: 'audio/mp4', extension: 'm4a' },
+    { mediaType: 'audio', mimeType: 'audio/x-m4a', extension: 'm4a' },
+    { mediaType: 'audio', mimeType: 'audio/flac', extension: 'flac' },
+    { mediaType: 'audio', mimeType: 'audio/webm', extension: 'webm' },
+
+    { mediaType: 'video', mimeType: 'video/mp4', extension: 'mp4' },
+    { mediaType: 'video', mimeType: 'video/quicktime', extension: 'mov' },
+    { mediaType: 'video', mimeType: 'video/x-msvideo', extension: 'avi' },
+    { mediaType: 'video', mimeType: 'video/x-matroska', extension: 'mkv' },
+    { mediaType: 'video', mimeType: 'video/mpeg', extension: 'mpeg' },
+    { mediaType: 'video', mimeType: 'video/mpeg', extension: 'mpg' },
+    { mediaType: 'video', mimeType: 'video/3gpp', extension: '3gp' },
+    { mediaType: 'video', mimeType: 'video/3gpp2', extension: '3g2' },
+    { mediaType: 'video', mimeType: 'video/webm', extension: 'webm' },
+    { mediaType: 'video', mimeType: 'video/ogg', extension: 'ogg' },
+
+    { mediaType: 'file', mimeType: 'text/plain', extension: 'txt' },
+    { mediaType: 'file', mimeType: 'text/markdown', extension: 'md' },
+    { mediaType: 'file', mimeType: 'text/csv', extension: 'csv' },
+    { mediaType: 'file', mimeType: 'application/json', extension: 'json' },
+    { mediaType: 'file', mimeType: 'application/msword', extension: 'doc' },
+    { mediaType: 'file', mimeType: 'application/vnd.openxmlformats-officedocument.wordprocessingml.document', extension: 'docx' },
+    { mediaType: 'file', mimeType: 'application/vnd.ms-excel', extension: 'xls' },
+    { mediaType: 'file', mimeType: 'application/vnd.openxmlformats-officedocument.spreadsheetml.sheet', extension: 'xlsx' },
+    { mediaType: 'file', mimeType: 'application/vnd.ms-powerpoint', extension: 'ppt' },
+    { mediaType: 'file', mimeType: 'application/vnd.openxmlformats-officedocument.presentationml.presentation', extension: 'pptx' },
+    { mediaType: 'file', mimeType: 'application/zip', extension: 'zip' },
+    { mediaType: 'file', mimeType: 'application/x-zip-compressed', extension: 'zip' },
+    { mediaType: 'file', mimeType: 'application/x-rar-compressed', extension: 'rar' },
+    { mediaType: 'file', mimeType: 'application/x-7z-compressed', extension: '7z' },
+
+    { mediaType: 'pdf', mimeType: 'application/pdf', extension: 'pdf' },
+];
+
+const createMediaTypeBuckets = (): Record<MediaCategory, string[]> => ({
+    image: [],
+    audio: [],
+    video: [],
+    file: [],
+    pdf: [],
+});
+
+export const MEDIA_TYPE_TO_EXTENSIONS: Record<MediaCategory, string[]> = MEDIA_FILE_TYPES.reduce((acc, fileType) => {
+    if (!acc[fileType.mediaType].includes(fileType.extension)) {
+        acc[fileType.mediaType].push(fileType.extension);
+    }
+    return acc;
+}, createMediaTypeBuckets());
+
+export const IMAGE_EXTENSIONS = MEDIA_TYPE_TO_EXTENSIONS.image;
+export const AUDIO_EXTENSIONS = MEDIA_TYPE_TO_EXTENSIONS.audio;
+export const VIDEO_EXTENSIONS = MEDIA_TYPE_TO_EXTENSIONS.video;
+export const DOCUMENT_EXTENSIONS = MEDIA_TYPE_TO_EXTENSIONS.file;
+export const PDF_EXTENSION = 'pdf';
+
+export const EXTENSION_TO_MIME_TYPE: Record<string, string> = MEDIA_FILE_TYPES.reduce((acc, fileType) => {
+    if (!(fileType.extension in acc)) {
+        acc[fileType.extension] = fileType.mimeType;
+    }
+    return acc;
+}, {} as Record<string, string>);
+
+export const MIME_TO_MEDIA_TYPE: Record<string, MediaCategory> = MEDIA_FILE_TYPES.reduce((acc, fileType) => {
+    if (!(fileType.mimeType in acc)) {
+        acc[fileType.mimeType] = fileType.mediaType;
+    }
+    return acc;
+}, {} as Record<string, MediaCategory>);
 
 /**
  * Extensions that must never be accepted as media uploads, regardless of declared mimetype or
@@ -15,6 +106,7 @@ export const DANGEROUS_EXTENSIONS = new Set([
     'html', 'htm', 'xhtml', 'svg', 'xml',
     'js', 'mjs', 'php', 'phtml', 'jsp', 'asp', 'aspx',
     'exe', 'sh', 'bat', 'cmd', 'ps1', 'jar', 'dll',
+    'msi', 'msix', 'msp', 'com', 'scr', 'vbs', 'vbe', 'wsf', 'wsh', 'hta', 'cpl', 'pif', 'reg',
 ]);
 
 
@@ -27,17 +119,92 @@ export const DANGEROUS_MIME_TYPES = new Set([
     'image/svg+xml', 'text/html', 'application/xhtml+xml',
 ]);
 
-export function getLowercaseFileExtension(fileName?: string | null): string | undefined {
+/**
+ * Percent-decodes a filename, repeating a bounded number of times so a double-encoded payload
+ * (`%252e` -> `%2e` -> `.`) survives a single pass through a proxy/framework that already
+ * decoded once. Malformed escape sequences are left as-is rather than thrown, since this runs
+ * on attacker-controlled input and a literal `%` in a filename (`100%done.pdf`) is legal.
+ */
+function decodePercentEncodingSafely(name: string): string {
+    let decoded = name;
+    for (let i = 0; i < 3; i++) {
+        let next: string;
+        try {
+            next = decodeURIComponent(decoded);
+        } catch {
+            return decoded;
+        }
+        if (next === decoded) {
+            return decoded;
+        }
+        decoded = next;
+    }
+    return decoded;
+}
+
+/**
+ * Reduces a client-supplied name to the name that will actually be resolved on disk, so
+ * extension checks can't be dodged by decorating it. Each step defends a known bypass:
+ *
+ *  - `evil.exe%2e`         -> percent-encoding a trailing dot (or anything else) hides the real
+ *                             extension from naive string matching; decode before inspecting it.
+ *  - `../../evil.exe`      -> only the final path segment is the file name.
+ *  - `evil.exe\0.png`      -> a NUL truncates the name at the syscall/filesystem layer, so
+ *                             anything after it is invisible to the OS but visible to naive
+ *                             validation.
+ *  - `evil.exe::$DATA`     -> NTFS alternate data stream suffix; the file on disk is evil.exe.
+ *  - `evil.exe.` / `.exe ` -> Windows silently strips trailing dots and spaces when resolving
+ *                             a path, so these land on disk as evil.exe.
+ */
+export function normalizeUploadedFileName(fileName?: string | null): string {
     if (!fileName) {
-        return undefined;
+        return '';
+    }
+
+    let name = decodePercentEncodingSafely(String(fileName));
+    name = name.split(/[/\\]/).pop() ?? '';
+
+    const nulIndex = name.indexOf('\0');
+    if (nulIndex >= 0) {
+        name = name.slice(0, nulIndex);
     }
 
-    const lastDotIndex = fileName.lastIndexOf('.');
-    if (lastDotIndex < 0 || lastDotIndex === fileName.length - 1) {
+    const streamIndex = name.indexOf(':');
+    if (streamIndex >= 0) {
+        name = name.slice(0, streamIndex);
+    }
+
+    return name.replace(/[\s.]+$/, '');
+}
+
+/**
+ * The effective extension - what the OS/browser will treat the file as. Used for media
+ * category resolution and inline-safety decisions. Always normalizes first, so
+ * `evil.exe.` resolves to `exe` rather than to nothing.
+ */
+export function getLowercaseFileExtension(fileName?: string | null): string | undefined {
+    const name = normalizeUploadedFileName(fileName);
+
+    const lastDotIndex = name.lastIndexOf('.');
+    if (lastDotIndex < 0 || lastDotIndex === name.length - 1) {
         return undefined;
     }
 
-    return fileName.slice(lastDotIndex + 1).toLowerCase();
+    return name.slice(lastDotIndex + 1).toLowerCase();
+}
+
+/**
+ * Every dot-delimited segment after the stem, lowercased. The danger check uses this rather
+ * than only the effective extension so a dangerous type buried in a double extension
+ * (`evil.exe.png`, `shell.php.jpg`) is still caught - several servers and browsers resolve
+ * such names by an earlier segment than the last one.
+ *
+ * The stem is skipped so an innocuous file that merely starts with a keyword (`exe.png`)
+ * isn't rejected.
+ */
+export function getLowercaseFileExtensionSegments(fileName?: string | null): string[] {
+    const segments = normalizeUploadedFileName(fileName).toLowerCase().split('.');
+    return segments.slice(1).filter(segment => segment.length > 0);
 }
 
 /** Minimal shape of an uploaded file, so this module stays free of framework imports. */
@@ -55,12 +222,12 @@ export function getUploadedFileName(file?: UploadedFileLike | null): string {
 /**
  * Single predicate for "must never be stored". Shared by every upload entry point
  * (MediaFieldCrudManager, chatter attachments) so the rules can't drift between them.
- * Extension is checked before mimetype so a spoofed Content-Type (e.g.
- * application/octet-stream on an .html file) can't bypass it.
+ * Extensions are checked before mimetype so a spoofed Content-Type (e.g.
+ * application/octet-stream, or image/png, on an .html file) can't bypass it.
  */
 export function isDangerousMediaFile(file?: UploadedFileLike | null): boolean {
-    const ext = getLowercaseFileExtension(getUploadedFileName(file));
-    if (ext && DANGEROUS_EXTENSIONS.has(ext)) {
+    const segments = getLowercaseFileExtensionSegments(getUploadedFileName(file));
+    if (segments.some(segment => DANGEROUS_EXTENSIONS.has(segment))) {
         return true;
     }
 
@@ -75,11 +242,7 @@ export function isDangerousMediaFile(file?: UploadedFileLike | null): boolean {
  * default to 'video' since that's the more common upload case.
  */
 export const EXT_TO_MEDIA_TYPE: Record<string, MediaCategory> = {
-    ...Object.fromEntries(IMAGE_EXTENSIONS.map((ext) => [ext, 'image' as const])),
-    ...Object.fromEntries(AUDIO_EXTENSIONS.map((ext) => [ext, 'audio' as const])),
-    ...Object.fromEntries(VIDEO_EXTENSIONS.map((ext) => [ext, 'video' as const])),
-    ...Object.fromEntries(DOCUMENT_EXTENSIONS.map((ext) => [ext, 'file' as const])),
-    [PDF_EXTENSION]: 'pdf',
+    ...Object.fromEntries(MEDIA_FILE_TYPES.map((fileType) => [fileType.extension, fileType.mediaType])),
 };
 
 /**

package/src/constants/success-messages.ts

@@ -6,6 +6,11 @@ export const SUCCESS_MESSAGES = {
     LOGOUT_SUCCESS: 'Logged out successfully',
     USER_REGISTERED: 'User registered successfully.',
 
+    // MPIN messages
+    MPIN_SETUP_SUCCESS: 'MPIN set up successfully.',
+    MPIN_CHANGED_SUCCESS: 'MPIN changed successfully.',
+    MPIN_DEVICE_REVOKED: 'MPIN sign-in removed for this device.',
+
     // CRUD service messages
     RECORD_RECOVERED: 'Record successfully recovered',
     SELECTED_RECORDS_RECOVERED: 'Selected records successfully recovered',

package/src/controllers/authentication.controller.ts

@@ -107,8 +107,11 @@ export class AuthenticationController {
     @Post('logout')
     @Public()
     @HttpCode(HttpStatus.OK)
-    async logout(@Body('refreshToken') refreshToken: string) {
-        return this.authService.logout(refreshToken);
+    async logout(
+        @Body('refreshToken') refreshToken: string,
+        @Body('allDevices') allDevices?: boolean,
+    ) {
+        return this.authService.logout(refreshToken, allDevices === true);
     }
 
     @ApiBearerAuth("jwt")

package/src/controllers/mpin-authentication.controller.ts

@@ -0,0 +1,67 @@
+import { Body, Controller, Delete, Get, HttpCode, HttpStatus, Param, ParseIntPipe, Post } from '@nestjs/common';
+import { ApiBearerAuth, ApiTags } from '@nestjs/swagger';
+import { ActiveUser } from '../decorators/active-user.decorator';
+import { Public } from '../decorators/public.decorator';
+import { ChangeMpinDto } from '../dtos/change-mpin.dto';
+import { MpinLoginDto } from '../dtos/mpin-login.dto';
+import { SetupMpinDto } from '../dtos/setup-mpin.dto';
+import { ActiveUserData } from '../interfaces/active-user-data.interface';
+import { MpinService } from '../services/mpin.service';
+
+/**
+ * There is deliberately no public "is MPIN set up for this identifier" route.
+ * That would reintroduce exactly the user-enumeration oracle the opaque
+ * credential handle removes. The client decides whether to show the MPIN
+ * screen from the presence of its own stored handle.
+ */
+@Controller('iam/mpin')
+@ApiTags('Solid Core')
+export class MpinAuthenticationController {
+    constructor(private readonly mpinService: MpinService) { }
+
+    @ApiBearerAuth('jwt')
+    @Post('setup')
+    @HttpCode(HttpStatus.OK)
+    setup(
+        @Body() setupMpinDto: SetupMpinDto,
+        @ActiveUser() activeUser: ActiveUserData,
+    ) {
+        return this.mpinService.setupMpin(activeUser, setupMpinDto);
+    }
+
+    @ApiBearerAuth('jwt')
+    @Post('change')
+    @HttpCode(HttpStatus.OK)
+    change(
+        @Body() changeMpinDto: ChangeMpinDto,
+        @ActiveUser() activeUser: ActiveUserData,
+    ) {
+        return this.mpinService.changeMpin(activeUser, changeMpinDto);
+    }
+
+    // Public by necessity - the caller has no session yet. The credential
+    // handle is unguessable, so this carries no enumeration surface.
+    @Public()
+    @Post('login')
+    @HttpCode(HttpStatus.OK)
+    login(@Body() mpinLoginDto: MpinLoginDto) {
+        return this.mpinService.loginWithMpin(mpinLoginDto);
+    }
+
+    @ApiBearerAuth('jwt')
+    @Get('devices')
+    listDevices(@ActiveUser() activeUser: ActiveUserData) {
+        return this.mpinService.listDevices(activeUser);
+    }
+
+    // By row id, never by credential handle, so the management UI never has to
+    // hold the secret.
+    @ApiBearerAuth('jwt')
+    @Delete('devices/:id')
+    revokeDevice(
+        @Param('id', ParseIntPipe) id: number,
+        @ActiveUser() activeUser: ActiveUserData,
+    ) {
+        return this.mpinService.revokeDevice(activeUser, id);
+    }
+}

package/src/dtos/change-mpin.dto.ts

@@ -0,0 +1,18 @@
+import { IsNotEmpty, IsString, MaxLength } from 'class-validator';
+
+export class ChangeMpinDto {
+    @IsNotEmpty()
+    @IsString()
+    @MaxLength(128)
+    credentialRef: string;
+
+    @IsNotEmpty()
+    @IsString()
+    @MaxLength(32)
+    currentMpin: string;
+
+    @IsNotEmpty()
+    @IsString()
+    @MaxLength(32)
+    newMpin: string;
+}

package/src/dtos/create-field-metadata.dto.ts

@@ -1,5 +1,6 @@
 import { ApiProperty } from '@nestjs/swagger';
 import { Transform, Type } from 'class-transformer';
+import { DANGEROUS_EXTENSIONS, MEDIA_CATEGORIES, MediaCategory } from '../constants/media-file-types';
 
 import {
   IsArray,
@@ -7,6 +8,7 @@ import {
   IsEnum,
   IsIn,
   IsInt,
+  IsNotIn,
   IsOptional,
   IsString,
   Matches,
@@ -155,13 +157,7 @@ export enum DecryptWhenType {
   afterTransit = 'after-transit',
 }
 
-export enum MediaType {
-  image = 'image',
-  audio = 'audio',
-  video = 'video',
-  // document = 'document',
-  file = 'file',
-}
+export type MediaType = MediaCategory;
 
 export enum RelationType {
   manyToOne = 'many-to-one',
@@ -308,7 +304,7 @@ export class CreateFieldMetadataDto {
   private: boolean;
 
   @ApiProperty({ description: 'Allowed media types for the field. Only for type=mediaSingle,mediaMultiple', })
-  @IsEnum(MediaType, { each: true })
+  @IsIn([...MEDIA_CATEGORIES], { each: true })
   @IsOptional()
   mediaTypes: MediaType[];
 
@@ -317,6 +313,18 @@ export class CreateFieldMetadataDto {
   @IsOptional()
   mediaMaxSizeKb: number;
 
+  @ApiProperty({ description: 'Explicit allowlist of file extensions (e.g. ["pdf","xlsx","png"]) permitted for this field, checked in addition to any mediaTypes category restriction — both must pass if both are set. For a strict allowlist, leave mediaTypes empty and use this alone. Only for type=mediaSingle,mediaMultiple', })
+  @Transform(({ value }) =>
+    Array.isArray(value)
+      ? value.map((ext: any) => String(ext).toLowerCase().trim().replace(/^\./, ''))
+      : value
+  )
+  @IsArray()
+  @IsString({ each: true })
+  @IsNotIn([...DANGEROUS_EXTENSIONS], { each: true })
+  @IsOptional()
+  mediaAllowedExtensions?: string[];
+
   @ApiProperty({ description: 'Configured Media storage provider. Only for type=mediaSingle,mediaMultiple', })
   @IsInt()
   @IsOptional()
@@ -464,4 +472,4 @@ export class CreateFieldMetadataDto {
   @ApiProperty({ description: 'Is Primary Key Field', })
   @IsBoolean()
   isPrimaryKey?: boolean;
-}
+}

package/src/dtos/create-model-sequence.dto.ts

@@ -35,7 +35,7 @@ export class CreateModelSequenceDto {
     @IsOptional()
     @IsInt()
     @ApiProperty()
-    currentValue: number;
+    currentValue?: number;
     @IsOptional()
     @IsString()
     @ApiProperty()

package/src/dtos/mpin-login.dto.ts

@@ -0,0 +1,24 @@
+import { IsNotEmpty, IsString, MaxLength } from 'class-validator';
+
+/**
+ * Deliberately carries no identifier - no mobile, email or username.
+ *
+ * `credentialRef` is a server-issued 256-bit handle that already points at a
+ * single credential row, and therefore at a single user. That is what removes
+ * the user-enumeration surface a public login route would otherwise have: an
+ * attacker cannot probe "does this phone number have MPIN?" because there is
+ * nowhere to put a phone number.
+ */
+export class MpinLoginDto {
+    // Bounded so a pathological payload never reaches the regex test or the
+    // hash comparison. The handle is always 64 hex characters.
+    @IsNotEmpty()
+    @IsString()
+    @MaxLength(128)
+    credentialRef: string;
+
+    @IsNotEmpty()
+    @IsString()
+    @MaxLength(32)
+    mpin: string;
+}

package/src/dtos/setup-mpin.dto.ts

@@ -0,0 +1,51 @@
+import { IsNotEmpty, IsOptional, IsString, IsUUID, Matches, MaxLength } from 'class-validator';
+
+export class SetupMpinDto {
+    /**
+     * Stable identifier for the physical device, generated once by the client.
+     * Validated as a UUID before it ever reaches a cache key or a bucket name,
+     * so it cannot smuggle delimiters into the keyspace.
+     */
+    @IsUUID()
+    deviceId: string;
+
+    /**
+     * A string, not a number, even though it looks like digits.
+     *
+     * A numeric MPIN cannot carry a leading zero: JSON forbids leading zeros in
+     * number literals, so a client serialising `012345` numerically emits
+     * `12345` and the server stores a five-digit MPIN the user never chose -
+     * which still satisfies the default `^\d{4,6}$` and so raises no error.
+     * `mpinRegex` is also tenant-configurable and may permit non-digits.
+     *
+     * Note this cannot be enforced here: the global ValidationPipe runs with
+     * `enableImplicitConversion`, so a numeric payload is coerced to a string
+     * before @IsString() sees it. Clients must send a quoted JSON string; that
+     * requirement is documented in the mobile integration guide.
+     *
+     * Length and shape are checked server-side against `mpinRegex`, since that
+     * setting is the single authority. This only bounds the input.
+     */
+    @IsNotEmpty()
+    @IsString()
+    @MaxLength(32)
+    mpin: string;
+
+    /**
+     * Rendered in a device-management list, so it is bounded here rather than
+     * trusting every consuming UI to escape it.
+     */
+    @IsOptional()
+    @IsString()
+    @MaxLength(64)
+    @Matches(/^[\w\s.'()-]*$/, {
+        message: 'deviceName may contain only letters, numbers, spaces and . \' ( ) - _',
+    })
+    deviceName?: string;
+
+    @IsOptional()
+    @IsString()
+    @MaxLength(32)
+    @Matches(/^[\w.-]*$/, { message: 'platform may contain only letters, numbers and . - _' })
+    platform?: string;
+}

package/src/entities/dashboard-user-layout.entity.ts

@@ -6,12 +6,12 @@ import { ModuleMetadata } from 'src/entities/module-metadata.entity'
 @Entity('ss_dashboard_user_layout')
 export class DashboardUserLayout extends CommonEntity {
     @Index()
-    @ManyToOne(() => User, { onDelete: "CASCADE", nullable: false })
+    @ManyToOne(() => User, { nullable: false })
     @JoinColumn()
     user: User;
 
     @Index()
-    @ManyToOne(() => ModuleMetadata, { onDelete: "CASCADE", nullable: false })
+    @ManyToOne(() => ModuleMetadata, { nullable: false })
     @JoinColumn()
     module: ModuleMetadata;
 

package/src/entities/field-metadata.entity.ts

@@ -77,6 +77,9 @@ export class FieldMetadata extends CommonEntity {
     @Column({ name: 'media_max_size_kb', nullable: true })
     mediaMaxSizeKb: number;
 
+    @Column({ name: 'media_allowed_extensions', nullable: true, type: "simple-json" })
+    mediaAllowedExtensions: string[];
+
     @Index()
     @ManyToOne(() => MediaStorageProviderMetadata, { onDelete: 'SET NULL' })
     @JoinColumn({ name: 'media_storage_provider_id' })

package/src/entities/user-device-credential.entity.ts

@@ -0,0 +1,130 @@
+import { Exclude, Expose } from "class-transformer";
+import { CommonEntity } from "src/entities/common.entity";
+import { Column, Entity, Index, ManyToOne } from "typeorm";
+import { User } from "./user.entity";
+
+/**
+ * A per-device MPIN credential.
+ *
+ * Login presents `credentialRef` (a server-issued opaque handle) plus the MPIN.
+ * The handle - not a mobile number or email - is what identifies the account,
+ * which is why the login route needs no identifier and offers no user
+ * enumeration surface.
+ */
+@Entity("ss_user_device_credential")
+// Non-unique: one physical device may legitimately hold credentials for
+// several accounts, and each account setup mints its own row.
+@Index(["user", "deviceId"])
+@Exclude()
+export class UserDeviceCredential extends CommonEntity {
+
+    // SHA-256 of the opaque handle, and the login lookup key. Never exposed:
+    // the raw handle is returned to the client once at setup and never stored.
+    // SHA-256 rather than bcrypt because the handle is 256 bits of randomness -
+    // there is nothing to brute-force, so a slow hash would only add latency.
+    // Same treatment as UserApiKey.hashedKey.
+    @Index({ unique: true })
+    @Column()
+    hashedCredentialRef: string;
+
+    // bcrypt hash of the MPIN, via HashingService. Never exposed - same
+    // treatment as User.password. Slow hashing is warranted here: a 4-6 digit
+    // secret is exactly the low-entropy case bcrypt exists for.
+    @Column()
+    hashedMpin: string;
+
+    // Mirrors User.passwordScheme / passwordSchemeVersion so
+    // HashingService.needsRehash can upgrade the hash on a successful login.
+    @Column()
+    mpinScheme: string;
+
+    /**
+     * The hashing *policy* version this row was hashed under - not a version of
+     * MPIN itself. It comes from `HashingService.currentVersion()`, which
+     * `BcryptService` currently returns as **2**, so freshly created rows read
+     * 2, exactly as `ss_user.password_scheme_version` does.
+     *
+     * It matters because `BcryptService.normalize` applies the configured
+     * pepper only when `version >= 2`. Storing the version per row means an
+     * older hash still verifies after the policy changes: `compare()` uses the
+     * version the row was written with, and `needsRehash()` upgrades it on the
+     * next successful login.
+     *
+     * The `default: 1` is inherited from the `User` precedent and is never
+     * reached, since every write path sets this explicitly. Note it would be
+     * *wrong* if it ever were: a row hashed at 2 but recorded as 1 would be
+     * compared without the pepper and could never authenticate.
+     */
+    @Column({ default: 1 })
+    mpinSchemeVersion: number;
+
+    // Client-supplied, stable for the physical device. Used for grouping and
+    // the device-management UI only - never a lookup key. Deliberately NOT
+    // unique: several accounts on one device share a deviceId.
+    @Expose()
+    @Column()
+    deviceId: string;
+
+    /**
+     * Human-readable natural key - `<username>-<deviceId>` - unique per row.
+     *
+     * Neither column alone can serve as the model's user key: `deviceId` is
+     * shared by every account on a device, and `deviceName` is nullable.
+     * Combining them is unique in both directions - one user across many
+     * devices, and many users on one device.
+     *
+     * Populated by MpinService rather than declared as a `computed` field in
+     * the metadata manifest. Computed fields are evaluated by
+     * ComputedFieldCrudManager on the generic CRUD path (`crud.service.ts`),
+     * which this service bypasses by writing through the repository directly,
+     * so a computed declaration would silently leave this null. It is also
+     * beyond ConcatComputedFieldProvider, which resolves `dto[field]` flatly
+     * within one model and cannot reach `username` across the user relation.
+     */
+    @Expose()
+    @Index({ unique: true })
+    @Column()
+    credentialKey: string;
+
+    @Expose()
+    @Column({ nullable: true })
+    deviceName: string;
+
+    @Expose()
+    @Column({ nullable: true })
+    platform: string;
+
+    // Revocation is a soft-delete: the row survives so that a correct MPIN can
+    // be answered with "this device was removed" rather than a baffling
+    // "incorrect MPIN". Only active rows count towards mpinMaxDevicesPerUser.
+    @Expose()
+    @Column({ default: true })
+    isActive: boolean;
+
+    // Cumulative, and reset only on a successful login - never when a lockout
+    // expires. That is what makes the second threshold detectable without a
+    // separate lockout counter.
+    @Expose()
+    @Column({ default: 0 })
+    failedAttempts: number;
+
+    @Expose()
+    @Column({ nullable: true })
+    lockedUntil: Date;
+
+    @Expose()
+    @Column({ nullable: true })
+    lastUsedAt: Date;
+
+    // Deliberately no inverse property on User. Nothing needs
+    // `user.deviceCredentials`, and leaving the most widely referenced entity
+    // in the system untouched keeps this feature purely additive.
+    //
+    // `nullable: false` because TypeORM makes relations nullable by default,
+    // which would let a credential exist with no owner. Such a row could never
+    // authenticate - loginWithMpin rejects it - so it would simply be dead
+    // data, but the database should refuse it outright. This also keeps the
+    // column honest against the metadata manifest, which declares it required.
+    @ManyToOne(() => User, { nullable: false })
+    user: User;
+}