@solidxai/core 0.1.13-beta.9 → 0.1.14-beta.0

package/src/entities/user.entity.ts

@@ -36,12 +36,12 @@ export class User extends CommonEntity {
     @Expose()
     username: string;
 
-    @Index({ unique: true })
+    @Index()
     @Column({ type: "varchar", nullable: true })
     @Expose()
     email: string;
 
-    @Index({ unique: true })
+    @Index()
     @Column({ type: "varchar", nullable: true })
     @Expose()
     mobile: string;

package/src/entities/view-metadata.entity.ts

@@ -19,11 +19,11 @@ export class ViewMetadata extends CommonEntity {
     @Column({ name: "type", type: "varchar" })
     type: string;
 
-    //TODO: To make this truly cross db compatible, we should avoid setting a db type
+    // TODO: To make this truly cross db compatible, we should avoid setting a db type  
     @Column({ name: "context", type: "text" })
     context: any = "{}";
 
-    //TODO: To make this truly cross db compatible, we should avoid setting a db type
+    // TODO: To make this truly cross db compatible, we should avoid setting a db type
     @Column({ name: "layout", type: "text" })
     layout: any;
 

package/src/entities/workflow-execution-artifact.entity.ts

@@ -2,6 +2,7 @@ import { CommonEntity } from 'src/entities/common.entity';
 import { Entity, Column, Index, JoinColumn, ManyToOne } from 'typeorm';
 import { WorkflowExecution } from './workflow-execution.entity';
 import { WorkflowStepExecution } from './workflow-step-execution.entity'
+import { getColumnType } from 'src/helpers/typeorm-db-helper';
 
 @Entity('ss_workflow_execution_artifact')
 export class WorkflowExecutionArtifact extends CommonEntity {
@@ -10,12 +11,12 @@ export class WorkflowExecutionArtifact extends CommonEntity {
     artifactKey: string;
 
     @Index()
-    @ManyToOne(() => WorkflowExecution, { onDelete: "CASCADE", nullable: false })
+    @ManyToOne(() => WorkflowExecution, { nullable: false })
     @JoinColumn()
     workflowExecution: WorkflowExecution;
 
     @Index()
-    @ManyToOne(() => WorkflowStepExecution, { onDelete: "CASCADE", nullable: true })
+    @ManyToOne(() => WorkflowStepExecution, { nullable: true })
     @JoinColumn()
     workflowStepExecution: WorkflowStepExecution;
 
@@ -61,7 +62,7 @@ export class WorkflowExecutionArtifact extends CommonEntity {
     checksum: string;
 
     @Index()
-    @Column({ type: "timestamp", nullable: true })
+    @Column({ nullable: true, ...getColumnType('datetime') })
     producedAt: Date;
 
     @Column({ type: "simple-json", nullable: true })

package/src/entities/workflow-execution-log.entity.ts

@@ -2,6 +2,7 @@ import { CommonEntity } from 'src/entities/common.entity';
 import { Entity, Column, Index, JoinColumn, ManyToOne } from 'typeorm';
 import { WorkflowExecution } from './workflow-execution.entity';
 import { WorkflowStepExecution } from './workflow-step-execution.entity'
+import { getColumnType } from 'src/helpers/typeorm-db-helper';
 
 @Entity('ss_workflow_execution_log')
 export class WorkflowExecutionLog extends CommonEntity {
@@ -10,12 +11,12 @@ export class WorkflowExecutionLog extends CommonEntity {
     logKey: string;
 
     @Index()
-    @ManyToOne(() => WorkflowExecution, { onDelete: "CASCADE", nullable: false })
+    @ManyToOne(() => WorkflowExecution, { nullable: false })
     @JoinColumn()
     workflowExecution: WorkflowExecution;
 
     @Index()
-    @ManyToOne(() => WorkflowStepExecution, { onDelete: "CASCADE", nullable: true })
+    @ManyToOne(() => WorkflowStepExecution, { nullable: true })
     @JoinColumn()
     workflowStepExecution: WorkflowStepExecution;
 
@@ -47,7 +48,7 @@ export class WorkflowExecutionLog extends CommonEntity {
     sequenceNumber: number;
 
     @Index()
-    @Column({ type: "timestamp" })
+    @Column({ ...getColumnType('datetime') })
     occurredAt: Date;
 
     @Column({ type: "simple-json", nullable: true })

package/src/entities/workflow-execution.entity.ts

@@ -4,6 +4,7 @@ import { WorkflowDefinition } from './workflow-definition.entity'
 import { WorkflowStepExecution } from './workflow-step-execution.entity';
 import { WorkflowExecutionLog } from './workflow-execution-log.entity';
 import { WorkflowExecutionArtifact } from './workflow-execution-artifact.entity';
+import { getColumnType } from 'src/helpers/typeorm-db-helper';
 
 @Entity('ss_workflow_execution')
 export class WorkflowExecution extends CommonEntity {
@@ -32,11 +33,11 @@ export class WorkflowExecution extends CommonEntity {
     triggerType: string = "manual";
 
     @Index()
-    @Column({ type: "timestamp", nullable: true })
+    @Column({ nullable: true, ...getColumnType('datetime') })
     startedAt: Date;
 
     @Index()
-    @Column({ type: "timestamp", nullable: true })
+    @Column({ nullable: true, ...getColumnType('datetime') })
     finishedAt: Date;
 
     @Column({ type: "bigint", nullable: true })

package/src/entities/workflow-secret.entity.ts

@@ -1,5 +1,6 @@
 import { CommonEntity } from 'src/entities/common.entity';
 import { Entity, Column, Index } from 'typeorm';
+import { getColumnType } from 'src/helpers/typeorm-db-helper';
 
 @Entity('ss_workflow_secret')
 export class WorkflowSecret extends CommonEntity {
@@ -25,9 +26,9 @@ export class WorkflowSecret extends CommonEntity {
     @Column({ type: "varchar", default: "active" })
     status: string = "active";
 
-    @Column({ type: "timestamp", nullable: true })
+    @Column({ nullable: true, ...getColumnType('datetime') })
     lastRotatedAt: Date;
 
-    @Column({ type: "timestamp", nullable: true })
+    @Column({ nullable: true, ...getColumnType('datetime') })
     lastAccessedAt: Date;
 }

package/src/entities/workflow-step-execution.entity.ts

@@ -1,6 +1,7 @@
 import { CommonEntity } from 'src/entities/common.entity';
 import { Entity, Column, Index, JoinColumn, ManyToOne } from 'typeorm';
 import { WorkflowExecution } from './workflow-execution.entity'
+import { getColumnType } from 'src/helpers/typeorm-db-helper';
 
 @Entity('ss_workflow_step_execution')
 export class WorkflowStepExecution extends CommonEntity {
@@ -55,11 +56,11 @@ export class WorkflowStepExecution extends CommonEntity {
     sequenceNumber: number;
 
     @Index()
-    @Column({ type: "timestamp", nullable: true })
+    @Column({ nullable: true, ...getColumnType('datetime') })
     startedAt: Date;
 
     @Index()
-    @Column({ type: "timestamp", nullable: true })
+    @Column({ nullable: true, ...getColumnType('datetime') })
     finishedAt: Date;
 
     @Column({ type: "bigint", nullable: true })

package/src/entities/workflow-trigger-execution.entity.ts

@@ -2,6 +2,7 @@ import { CommonEntity } from 'src/entities/common.entity';
 import { Entity, Column, Index, JoinColumn, ManyToOne } from 'typeorm';
 import { WorkflowDefinition } from './workflow-definition.entity';
 import { WorkflowExecution } from './workflow-execution.entity'
+import { getColumnType } from 'src/helpers/typeorm-db-helper';
 
 @Entity('ss_workflow_trigger_execution')
 export class WorkflowTriggerExecution extends CommonEntity {
@@ -10,12 +11,12 @@ export class WorkflowTriggerExecution extends CommonEntity {
     triggerExecutionKey: string;
 
     @Index()
-    @ManyToOne(() => WorkflowDefinition, { onDelete: "CASCADE", nullable: false })
+    @ManyToOne(() => WorkflowDefinition, { nullable: false })
     @JoinColumn()
     workflowDefinition: WorkflowDefinition;
 
     @Index()
-    @ManyToOne(() => WorkflowExecution, { onDelete: "CASCADE", nullable: true })
+    @ManyToOne(() => WorkflowExecution, { nullable: true })
     @JoinColumn()
     workflowExecution: WorkflowExecution;
 
@@ -39,15 +40,15 @@ export class WorkflowTriggerExecution extends CommonEntity {
     matched: boolean = false;
 
     @Index()
-    @Column({ type: "timestamp" })
+    @Column({ ...getColumnType('datetime') })
     firedAt: Date;
 
     @Index()
-    @Column({ type: "timestamp", nullable: true })
+    @Column({ nullable: true, ...getColumnType('datetime') })
     startedAt: Date;
 
     @Index()
-    @Column({ type: "timestamp", nullable: true })
+    @Column({ nullable: true, ...getColumnType('datetime') })
     finishedAt: Date;
 
     @Column({ type: "bigint", nullable: true })

package/src/filters/http-exception.filter.ts

@@ -30,12 +30,22 @@ export class HttpExceptionFilter implements ExceptionFilter {
         const isHttp = exception instanceof HttpException;
         const explicitStatus = isHttp ? exception.getStatus() : undefined;
 
+        // Errors from http-errors-style libraries (e.g. body-parser's PayloadTooLargeError)
+        // are plain Errors carrying their own status. Honour it rather than collapsing to 500.
+        const rawStatus = exception?.status ?? exception?.statusCode;
+        const derivedStatus =
+            typeof rawStatus === 'number' && rawStatus >= 400 && rawStatus < 600
+                ? rawStatus
+                : undefined;
+
         // Canonical code + static message
         const code: ErrorCode = this.errorMapper.mapException(exception);
         const defaultStatus = this.errorMapper.getHttpStatus(code);
         const message = code === 'solidx-unknown-error' ? `${exception?.message}` : this.errorMapper.getMessage(code);
 
-        const status = explicitStatus ?? defaultStatus ?? 500;
+        // derivedStatus must precede defaultStatus: getHttpStatus() returns a hard 500
+        // for unmatched codes, so it is never undefined and would always win otherwise.
+        const status = explicitStatus ?? derivedStatus ?? defaultStatus ?? 500;
 
         // Logging
         this.logger.error(

package/src/helpers/bootstrap.helper.ts

@@ -1,5 +1,6 @@
 import { ClassSerializerInterceptor, ValidationPipe } from '@nestjs/common';
 import { NestFactory, Reflector } from '@nestjs/core';
+import { NestExpressApplication } from '@nestjs/platform-express';
 import { WsAdapter } from '@nestjs/platform-ws';
 import { DocumentBuilder, SwaggerModule } from '@nestjs/swagger';
 import { NextFunction, Request, Response } from 'express';
@@ -12,7 +13,12 @@ import { CommandFactory } from 'nest-commander';
 import { createWinstonLoggerConfig } from '../winston.logger';
 import { WrapResponseInterceptor } from '../interceptors/wrap-response.interceptor';
 import { buildDefaultCorsOptions } from './cors.helper';
-import { buildDefaultSecurityHeaderOptions, buildPermissionsPolicyHeader, PermissionsPolicyConfig } from './security.helper';
+import {
+  buildDefaultSecurityHeaderOptions,
+  buildPermissionsPolicyHeader,
+  PermissionsPolicyConfig,
+  SolidSecurityOptions,
+} from './security.helper';
 import { parseBooleanEnv } from './environment.helper';
 
 // ---- Shared process handlers ----
@@ -50,8 +56,20 @@ export interface SolidBootstrapOptions {
   swagger?: SolidSwaggerOptions | false;
   /** Permissions-Policy header overrides (merged with defaults). */
   permissionsPolicyOverrides?: Partial<PermissionsPolicyConfig>;
+  /** Security header overrides, including iframe frame-ancestor allowlists. */
+  security?: SolidSecurityOptions;
   /** Show full NestJS init logs during bootstrap (route mapping, module deps, pollers). Defaults to false. */
   verboseBootstrap?: boolean;
+  /**
+   * Max request body size for JSON and urlencoded payloads, as a `bytes`-compatible
+   * string (e.g. '10mb', '512kb'). Defaults to '10mb'.
+   *
+   * Does NOT apply to multipart/form-data uploads: body-parser matches on Content-Type,
+   * so multipart requests skip these parsers entirely and are handled by Multer. Raise
+   * this only for large structured JSON (e.g. /bulk arrays), bearing in mind the parsed
+   * object graph can retain several times the raw byte size.
+   */
+  bodyLimit?: string;
 }
 
 /**
@@ -64,19 +82,30 @@ export interface SolidBootstrapOptions {
  * // main.ts
  * bootstrapSolidApp(() => AppModule.forRoot(), {
  *   swagger: { title: 'My API', description: 'My API description' },
+ *   security: { frameAncestors: ["'self'", 'https://portal.example.com'] },
  * });
  */
 export async function bootstrapSolidApp(
   appModuleFactory: () => Promise<any>,
   options: SolidBootstrapOptions = {},
-): Promise<void> {
+): Promise<NestExpressApplication> {
   registerGlobalProcessHandlers();
 
-  const { globalPrefix = 'api', swagger = {}, permissionsPolicyOverrides = {}, verboseBootstrap = false } = options;
+  const {
+    globalPrefix = 'api',
+    swagger = {},
+    permissionsPolicyOverrides = {},
+    security = {},
+    verboseBootstrap = false,
+    bodyLimit = '10mb',
+  } = options;
 
   const startTime = Date.now();
   const appModule = await appModuleFactory();
-  const app = await NestFactory.create(appModule, {
+  const app = await NestFactory.create<NestExpressApplication>(appModule, {
+    // Nest's default parsers are registered during init() with a 100kb limit, ahead of
+    // any module middleware. Disable them so the parsers below own the limit outright.
+    bodyParser: false,
     logger: WinstonModule.createLogger({ ...createWinstonLoggerConfig(), level: verboseBootstrap ? 'debug' : 'error' }),
   });
 
@@ -87,7 +116,7 @@ export async function bootstrapSolidApp(
     app
       .get(WINSTON_MODULE_NEST_PROVIDER)
       .log('API server disabled via API_ENABLED=false. Skipping HTTP listen.', 'Bootstrap');
-    return;
+    return app;
   }
 
   // Health check at root path
@@ -95,7 +124,7 @@ export async function bootstrapSolidApp(
   server.get('/', (_req, res) => res.status(200).send('SOLID OK'));
 
   // Security headers
-  app.use(helmet(buildDefaultSecurityHeaderOptions()));
+  app.use(helmet(buildDefaultSecurityHeaderOptions(security)));
 
   // Nest's Swagger UI HTML injects inline styles; keep CSP strict elsewhere.
   const isSwaggerPath = (path: string) =>
@@ -136,6 +165,12 @@ export async function bootstrapSolidApp(
     next();
   });
 
+  // Body parsers — replaces Nest's default 100kb parsers (disabled via bodyParser: false).
+  // Registered here so the middleware order Nest applied by default is preserved:
+  // helmet -> CSP -> Permissions-Policy -> qs -> body parsers -> routes.
+  app.useBodyParser('json', { limit: bodyLimit });
+  app.useBodyParser('urlencoded', { limit: bodyLimit, extended: true });
+
   // Global ValidationPipe
   app.useGlobalPipes(
     new ValidationPipe({
@@ -195,6 +230,8 @@ export async function bootstrapSolidApp(
 
   const elapsed = ((Date.now() - startTime) / 1000).toFixed(2);
   process.stdout.write(`\x1b[32mServer started on port ${port} in ${elapsed}s\x1b[0m\n`);
+
+  return app;
 }
 
 // ---- CLI bootstrap ----

package/src/helpers/field-crud-managers/LongTextFieldCrudManager.ts

@@ -1,5 +1,6 @@
 import { isEmpty, isNotEmpty, isString, matches } from "class-validator";
 import { FieldCrudManager, ValidationError } from "src/interfaces";
+import { normalizeTextFieldInDto, normalizeTextFieldValue } from "./textFieldCrudManagerUtils";
 
 export interface LongTextFieldOptions {
     regexPattern: string | undefined | null;
@@ -15,7 +16,7 @@ export class LongTextFieldCrudManager implements FieldCrudManager {
     }
 
     validate(dto: any): ValidationError[] {
-        const fieldValue: any = dto[this.options.fieldName];
+        const fieldValue: any = normalizeTextFieldValue(dto[this.options.fieldName]);
         return this.applyValidations(fieldValue);
     }
 
@@ -36,7 +37,7 @@ export class LongTextFieldCrudManager implements FieldCrudManager {
     }
 
     transformForCreate(dto: any): any {
-        return dto;
+        return normalizeTextFieldInDto(dto, this.options.fieldName);
     }
 
     // Validation to be applied

package/src/helpers/field-crud-managers/MediaFieldCrudManager.ts

@@ -1,5 +1,5 @@
 import { FieldCrudManager, ValidationError } from "src/interfaces";
-import { EXT_TO_MEDIA_TYPE, getLowercaseFileExtension, getUploadedFileName, isDangerousMediaFile, MediaCategory } from "src/constants/media-file-types";
+import { EXT_TO_MEDIA_TYPE, getLowercaseFileExtension, getUploadedFileName, isDangerousMediaFile, MediaCategory, MIME_TO_MEDIA_TYPE } from "src/constants/media-file-types";
 
 export enum SolidMediaType {
     mediaSingle = 'mediaSingle',
@@ -10,75 +10,24 @@ export interface MediaFieldOptions {
     type: SolidMediaType;
     required: boolean | undefined | null;
     fieldName: string | undefined | null;
+    fieldLabel?: string | undefined | null;
     mediaMaxSizeKb: number | undefined | null;
     mediaTypes: string[];
+    mediaAllowedExtensions?: string[] | null;
     isUpdate: boolean | undefined | null;
 }
 
 type MediaType = MediaCategory;
 
-const MIME_TO_MEDIA_TYPE: Record<string, MediaType> = {
-    // Images
-    'image/png': 'image',
-    'image/jpeg': 'image',
-    'image/jpg': 'image',
-    'image/webp': 'image',
-    'image/gif': 'image',
-    'image/bmp': 'image',
-    'image/tiff': 'image',
-    'image/heic': 'image',
-    'image/heif': 'image',
-
-    // Audio
-    'audio/mpeg': 'audio',      // mp3
-    'audio/mp3': 'audio',
-    'audio/wav': 'audio',
-    'audio/x-wav': 'audio',
-    'audio/webm': 'audio',
-    'audio/ogg': 'audio',
-    'audio/aac': 'audio',
-    'audio/mp4': 'audio',       // m4a often shows as audio/mp4
-    'audio/x-m4a': 'audio',
-    'audio/flac': 'audio',
-
-    // Video
-    'video/mp4': 'video',
-    'video/mpeg': 'video',
-    'video/webm': 'video',
-    'video/ogg': 'video',
-    'video/quicktime': 'video', // mov
-    'video/x-msvideo': 'video', // avi
-    'video/x-matroska': 'video',// mkv
-    'video/3gpp': 'video',
-    'video/3gpp2': 'video',
-
-    // Documents / files (treat as "file")
-    'application/pdf': 'pdf',
-    'text/plain': 'file',
-    'text/markdown': 'file',
-    'application/json': 'file',
-    'text/csv': 'file',
-
-    // Office
-    'application/msword': 'file', // doc
-    'application/vnd.openxmlformats-officedocument.wordprocessingml.document': 'file', // docx
-    'application/vnd.ms-excel': 'file', // xls
-    'application/vnd.openxmlformats-officedocument.spreadsheetml.sheet': 'file', // xlsx
-    'application/vnd.ms-powerpoint': 'file', // ppt
-    'application/vnd.openxmlformats-officedocument.presentationml.presentation': 'file', // pptx,
-
-    // Archives (optional)
-    'application/zip': 'file',
-    'application/x-zip-compressed': 'file',
-    'application/x-rar-compressed': 'file',
-    'application/x-7z-compressed': 'file',
-};
-
 export class MediaFieldCrudManager implements FieldCrudManager {
 
     constructor(private readonly options: MediaFieldOptions) {
     }
 
+    private getFieldLabel(): string {
+        return this.options.fieldLabel || this.options.fieldName || 'File';
+    }
+
     private resolveMediaType(file: Express.Multer.File): MediaType | null {
         // Belt-and-braces: dangerous files are already rejected outright by
         // validateDangerousFiles, but never let one resolve to a usable category.
@@ -86,24 +35,28 @@ export class MediaFieldCrudManager implements FieldCrudManager {
             return null;
         }
 
+        // Extension is authoritative: a declared mimetype is fully attacker-controlled and
+        // proved insufficient on its own (a .msi uploaded as image/png previously resolved to
+        // 'image', since the mimetype match short-circuited before the extension was ever
+        // checked). The extension must independently resolve to a known-safe category before
+        // anything is accepted - not merely "not on the denylist".
         const ext = getLowercaseFileExtension(getUploadedFileName(file));
-        const mt = (file.mimetype || '').toLowerCase().trim();
-        if (mt && MIME_TO_MEDIA_TYPE[mt]) {
-            return MIME_TO_MEDIA_TYPE[mt];
+        const extType = ext ? EXT_TO_MEDIA_TYPE[ext] : undefined;
+        if (!extType) {
+            return null;
         }
 
-        // Some libs may send "image/*" etc. Treat broad families safely.
-        if (mt.startsWith('image/')) return 'image';
-        if (mt.startsWith('audio/')) return 'audio';
-        if (mt.startsWith('video/')) return 'video';
-
-        // Fallback to extension if provided (also covers generic/unrecognized
-        // mimetypes such as application/octet-stream).
-        if (ext && EXT_TO_MEDIA_TYPE[ext]) {
-            return EXT_TO_MEDIA_TYPE[ext];
+        // The mimetype may only confirm or veto what the extension already established, never
+        // grant a category on its own. A mimetype that doesn't resolve to anything (e.g.
+        // application/octet-stream) has no opinion and is treated as agreeing.
+        const mt = (file.mimetype || '').toLowerCase().trim();
+        const mimeType = MIME_TO_MEDIA_TYPE[mt]
+            ?? (mt.startsWith('image/') ? 'image' : mt.startsWith('audio/') ? 'audio' : mt.startsWith('video/') ? 'video' : undefined);
+        if (mimeType && mimeType !== extType) {
+            return null;
         }
 
-        return null;
+        return extType;
     }
 
     validate(dto: any, files: Array<Express.Multer.File>): ValidationError[] {
@@ -112,18 +65,17 @@ export class MediaFieldCrudManager implements FieldCrudManager {
     }
 
     private applyValidations(fieldFiles: Array<Express.Multer.File>): ValidationError[] {
-        // Runs for every media field type and regardless of the admin-configured mediaTypes
-        // allowlist - a dangerous upload is never acceptable, so this must not sit behind
-        // the optional type checks below.
-        const errors = this.validateDangerousFiles(fieldFiles);
+        // A dangerous upload is never acceptable, regardless of admin config, so this is the
+        // only check that sits outside validateCommon() and can't be skipped either way below.
+        const dangerousFileErrors = this.validateDangerousFiles(fieldFiles);
 
         switch (this.options.type) {
             case SolidMediaType.mediaSingle:
-                return [...errors, ...this.validateMediaSingle(fieldFiles)];
+                return [...dangerousFileErrors, ...this.validateMediaSingle(fieldFiles)];
             case SolidMediaType.mediaMultiple:
-                return [...errors, ...this.validateMediaMultiple(fieldFiles)];
+                return [...dangerousFileErrors, ...this.validateMediaMultiple(fieldFiles)];
             default:
-                return errors;
+                return dangerousFileErrors;
         }
     }
 
@@ -132,26 +84,35 @@ export class MediaFieldCrudManager implements FieldCrudManager {
             .filter(fieldFile => isDangerousMediaFile(fieldFile))
             .map(fieldFile => ({
                 field: this.options.fieldName,
-                error: `${this.options.fieldName} file type not allowed. ` +
+                error: `${this.getFieldLabel()} file type not allowed. ` +
                     `${getUploadedFileName(fieldFile) || 'File'} is a potentially dangerous file type.`
             }));
     }
 
-    private validateMediaSingle(fieldFiles: Array<Express.Multer.File>): ValidationError[] {
+    // Every optional, admin-configured, per-field check - no-ops when its setting is unset -
+    // shared between mediaSingle and mediaMultiple so neither can drift out of sync with it.
+    private validateCommon(fieldFiles: Array<Express.Multer.File>): ValidationError[] {
+        return [
+            ...this.validateRequired(fieldFiles),
+            ...this.validateSize(fieldFiles),
+            ...this.validateTypes(fieldFiles),
+            ...this.validateAllowedExtensions(fieldFiles),
+        ];
+    }
+
+    private validateRequired(fieldFiles: Array<Express.Multer.File>): ValidationError[] {
         const errors: ValidationError[] = [];
         if (!this.options.isUpdate && this.options.required && fieldFiles.length === 0) {
             errors.push({
                 field: this.options.fieldName,
-                error: `${this.options.fieldName} is required`
+                error: `${this.getFieldLabel()} is required`
             });
         }
-        if (fieldFiles.length > 1) {
-            errors.push({
-                field: this.options.fieldName,
-                error: `${this.options.fieldName} must be a single file`
-            });
-        }
-        // validate size
+        return errors;
+    }
+
+    private validateSize(fieldFiles: Array<Express.Multer.File>): ValidationError[] {
+        const errors: ValidationError[] = [];
         if (this.options.mediaMaxSizeKb) {
             for (let i = 0; i < fieldFiles.length; i++) {
                 const fieldFile = fieldFiles[i];
@@ -159,12 +120,16 @@ export class MediaFieldCrudManager implements FieldCrudManager {
                 if (fieldFileSizeInBytes > this.options.mediaMaxSizeKb) {
                     errors.push({
                         field: this.options.fieldName,
-                        error: `${this.options.fieldName} with size ${fieldFileSizeInBytes} KB exceeds max size limit of ${this.options.mediaMaxSizeKb} KB`
+                        error: `${this.getFieldLabel()} with size ${fieldFileSizeInBytes} KB exceeds max size limit of ${this.options.mediaMaxSizeKb} KB`
                     });
                 }
             }
         }
-        // validate type
+        return errors;
+    }
+
+    private validateTypes(fieldFiles: Array<Express.Multer.File>): ValidationError[] {
+        const errors: ValidationError[] = [];
         if (this.options.mediaTypes && this.options.mediaTypes.length > 0) {
             const allowedFileTypes = this.options.mediaTypes as MediaType[];
 
@@ -175,28 +140,50 @@ export class MediaFieldCrudManager implements FieldCrudManager {
                 if (!resolvedType || !allowedFileTypes.includes(resolvedType)) {
                     errors.push({
                         field: this.options.fieldName,
-                        error: `${this.options.fieldName} file type not allowed. ` +
+                        error: `${this.getFieldLabel()} file type not allowed. ` +
                             `Allowed: ${allowedFileTypes.join(', ')}. ` +
                             `Received mimetype: ${fieldFile.mimetype}${resolvedType ? ` (mapped to ${resolvedType})` : ''}`
                     });
                 }
             }
         }
-
         return errors;
     }
 
-    private validateMediaMultiple(fieldFiles: Array<Express.Multer.File>): ValidationError[] {
-        const errors: ValidationError[] = [];
-        if (!this.options.isUpdate && this.options.required && fieldFiles.length === 0) {
+    private validateAllowedExtensions(fieldFiles: Array<Express.Multer.File>): ValidationError[] {
+        const allowed = this.options.mediaAllowedExtensions;
+        if (!allowed || allowed.length === 0) {
+            return [];
+        }
+
+        const normalizedAllowed = new Set(allowed.map(ext => ext.toLowerCase().replace(/^\./, '')));
+        return fieldFiles
+            .filter(fieldFile => {
+                const ext = getLowercaseFileExtension(getUploadedFileName(fieldFile));
+                return !ext || !normalizedAllowed.has(ext);
+            })
+            .map(fieldFile => ({
+                field: this.options.fieldName,
+                error: `${this.getFieldLabel()} file type not allowed. ` +
+                    `Allowed extensions: ${[...normalizedAllowed].join(', ')}.`
+            }));
+    }
+
+    private validateMediaSingle(fieldFiles: Array<Express.Multer.File>): ValidationError[] {
+        const errors = this.validateCommon(fieldFiles);
+        if (fieldFiles.length > 1) {
             errors.push({
                 field: this.options.fieldName,
-                error: `${this.options.fieldName} is required`
+                error: `${this.getFieldLabel()} must be a single file`
             });
         }
         return errors;
     }
 
+    private validateMediaMultiple(fieldFiles: Array<Express.Multer.File>): ValidationError[] {
+        return this.validateCommon(fieldFiles);
+    }
+
     transformForCreate(dto: any): any {
         return dto;
     }