@solidxai/core 0.1.13-beta.9 → 0.1.14-beta.0

package/src/helpers/field-crud-managers/ShortTextFieldCrudManager.ts

@@ -1,5 +1,6 @@
 import { isEmpty, isNotEmpty, isString, length, matches } from "class-validator";
 import { FieldCrudManager, ValidationError } from "src/interfaces";
+import { normalizeTextFieldInDto, normalizeTextFieldValue } from "./textFieldCrudManagerUtils";
 
 export interface ShortTextFieldOptions {
     length: number | undefined | null;
@@ -16,7 +17,7 @@ export class ShortTextFieldCrudManager implements FieldCrudManager {
     }
 
     validate(dto: any,  _files:Array<Express.Multer.File>): ValidationError[] {
-        const fieldValue: any = dto[this.options.fieldName];
+        const fieldValue: any = normalizeTextFieldValue(dto[this.options.fieldName]);
         return this.applyValidations(fieldValue);
     }
 
@@ -39,7 +40,7 @@ export class ShortTextFieldCrudManager implements FieldCrudManager {
     }
 
     transformForCreate(dto: any): any {
-        return dto;
+        return normalizeTextFieldInDto(dto, this.options.fieldName);
     }
 
     // Validation to be applied

package/src/helpers/field-crud-managers/textFieldCrudManagerUtils.ts

@@ -0,0 +1,14 @@
+import { isString } from "class-validator";
+
+export const normalizeTextFieldValue = (fieldValue: any): any => {
+    return isString(fieldValue) ? fieldValue.trim() : fieldValue;
+};
+
+export const normalizeTextFieldInDto = (dto: any, fieldName?: string | null): any => {
+    if (!fieldName || !Object.prototype.hasOwnProperty.call(dto, fieldName)) {
+        return dto;
+    }
+
+    dto[fieldName] = normalizeTextFieldValue(dto[fieldName]);
+    return dto;
+};

package/src/helpers/file-download.helper.ts

@@ -9,6 +9,20 @@ export interface FileDownloadHeaderOptions {
   crossOriginResourcePolicy?: boolean;
 }
 
+/**
+ * Builds an RFC 6266 Content-Disposition value. The file name is attacker-controlled (it comes
+ * from the uploaded originalFileName), so it can't be interpolated raw: a quote would close the
+ * quoted-string early and let the rest of the name forge further header parameters. The ASCII
+ * fallback is stripped to a safe subset and the real name is carried in the RFC 5987
+ * `filename*` parameter, which is also what preserves non-ASCII names correctly.
+ */
+function buildContentDisposition(disposition: "inline" | "attachment", fileName: string): string {
+  const name = (fileName || "file").replace(/[\r\n]/g, "");
+  const asciiFallback = name.replace(/[^\x20-\x7E]/g, "_").replace(/["\\]/g, "_") || "file";
+
+  return `${disposition}; filename="${asciiFallback}"; filename*=UTF-8''${encodeURIComponent(name)}`;
+}
+
 /**
  * Single place that stamps the response headers for every streamed file download, so the
  * security headers can't be applied to one endpoint and forgotten on the next.
@@ -16,7 +30,7 @@ export interface FileDownloadHeaderOptions {
 export function setFileDownloadHeaders(res: Response, options: FileDownloadHeaderOptions): void {
   const disposition = options.disposition ?? "attachment";
 
-  res.setHeader("Content-Disposition", `${disposition}; filename="${options.fileName}"`);
+  res.setHeader("Content-Disposition", buildContentDisposition(disposition, options.fileName));
   res.setHeader("Content-Type", options.mimeType);
   res.setHeader("Access-Control-Expose-Headers", "Content-Disposition, Content-Type");
 

package/src/helpers/security.helper.ts

@@ -1,15 +1,39 @@
 import { HelmetOptions } from "helmet";
 import { Environment } from "src/decorators/disallow-in-production.decorator";
 
+export interface SolidSecurityOptions {
+  /**
+   * Origins that may embed this application in an iframe.
+   * Defaults to the local HTTP/HTTPS loopback origins on any port.
+   */
+  frameAncestors?: string[];
+}
+
+export const DEFAULT_FRAME_ANCESTORS = [
+  "'self'",
+  "http://localhost:*",
+  "https://localhost:*",
+  "http://127.0.0.1:*",
+  "https://127.0.0.1:*",
+  "http://[::1]:*",
+  "https://[::1]:*",
+];
+
 /**
  * Default security headers for SolidX apps.
  * - HSTS only in prod over HTTPS
- * - CSP with frame-ancestors 'none' (prevents clickjacking)
- * - X-Frame-Options: DENY (legacy fallback)
+ * - CSP with configurable frame-ancestors
+ * - X-Frame-Options disabled when cross-origin frame ancestors are allowed
  * - No X-XSS-Protection (deprecated)
  */
-export function buildDefaultSecurityHeaderOptions(): Readonly<HelmetOptions> {
+export function buildDefaultSecurityHeaderOptions(
+  options: SolidSecurityOptions = {},
+): Readonly<HelmetOptions> {
   const isProd = process.env.ENV === Environment.Production;
+  const frameAncestors = options.frameAncestors ?? DEFAULT_FRAME_ANCESTORS;
+  const allowsCrossOriginFrames = frameAncestors.some(
+    (source) => source !== "'self'" && source !== "'none'",
+  );
 
   return {
     // Modern CSP. Add more directives as your app needs (script-src, connect-src, etc.)
@@ -23,7 +47,7 @@ export function buildDefaultSecurityHeaderOptions(): Readonly<HelmetOptions> {
         // "form-action": ["'self'"],
 
         // clickjacking defense (modern)
-        "frame-ancestors": ["'none'"],
+        "frame-ancestors": frameAncestors,
         "style-src": ["'self'"],
         // add/adjust as needed for your app:
         // "script-src": ["'self'"],              // add hashes/nonces/CSPRO if needed
@@ -34,9 +58,12 @@ export function buildDefaultSecurityHeaderOptions(): Readonly<HelmetOptions> {
       },
     },
 
-    
-    // Legacy clickjacking defense (kept for older UAs)
-    frameguard: { action: "deny" },
+    // Legacy clickjacking defense for configurations that do not allow
+    // cross-origin parents (kept for older UAs).
+    // X-Frame-Options cannot express an allowlist. It must be omitted when
+    // CSP allows a parent on another origin, otherwise older browsers may
+    // still block the iframe despite the CSP configuration.
+    frameguard: allowsCrossOriginFrames ? false : { action: "deny" },
 
     // Referrer/cross-origin policies
     referrerPolicy: { policy: "strict-origin-when-cross-origin" },
@@ -115,4 +142,4 @@ export function setDefaultCacheControl() {
 //   res.setHeader("Permissions-Policy", buildPermissionsPolicyHeader());
 //   next();
 // });
-// app.use(setDefaultCacheControl());
+// app.use(setDefaultCacheControl());

package/src/helpers/solid-core-error-codes-provider.service.ts

@@ -32,6 +32,59 @@ export class SolidCoreErrorCodesProvider implements IErrorCodeProvider {
                     httpStatus: 401,
                 },
             },
+            // MPIN rules sit above the generic session rules so that an MPIN
+            // failure is never reported as a session problem. The three codes
+            // drive three different client behaviours: retry, wait, and
+            // discard-the-handle.
+            {
+                code: 'solidx-mpin-locked',
+                priority: 120,
+                match: (txt) => txt.includes(ERROR_MESSAGES.MPIN_LOCKED.toLowerCase()),
+                meta: {
+                    message: ERROR_MESSAGES.MPIN_LOCKED,
+                    httpStatus: 401,
+                },
+            },
+            {
+                code: 'solidx-mpin-revoked',
+                priority: 120,
+                match: (txt) => txt.includes(ERROR_MESSAGES.MPIN_REVOKED.toLowerCase()),
+                meta: {
+                    message: ERROR_MESSAGES.MPIN_REVOKED,
+                    httpStatus: 401,
+                },
+            },
+            {
+                code: 'solidx-mpin-invalid',
+                priority: 120,
+                match: (txt) => txt.includes(ERROR_MESSAGES.MPIN_INVALID.toLowerCase()),
+                meta: {
+                    message: ERROR_MESSAGES.MPIN_INVALID,
+                    httpStatus: 401,
+                },
+            },
+            // Setup-time rejections. Distinct codes so the client can say
+            // "choose a less predictable PIN" rather than parsing a message.
+            // Safe to distinguish: both occur only on bearer-authenticated
+            // routes, so neither discloses anything.
+            {
+                code: 'solidx-mpin-too-predictable',
+                priority: 120,
+                match: (txt) => txt.includes(ERROR_MESSAGES.MPIN_TOO_PREDICTABLE.toLowerCase()),
+                meta: {
+                    message: ERROR_MESSAGES.MPIN_TOO_PREDICTABLE,
+                    httpStatus: 400,
+                },
+            },
+            {
+                code: 'solidx-mpin-format-invalid',
+                priority: 120,
+                match: (txt) => txt.includes(ERROR_MESSAGES.MPIN_FORMAT_INVALID.toLowerCase()),
+                meta: {
+                    message: ERROR_MESSAGES.MPIN_FORMAT_INVALID,
+                    httpStatus: 400,
+                },
+            },
             {
                 code: 'solidx-mcp-server-unavailable',
                 priority: 100,

package/src/helpers/solid-microservice-adapter.service.ts

@@ -79,7 +79,12 @@ export class SolidMicroserviceAdapter {
     const responseData = response.data as SolidxIamAuthResponse;
     const ttlSeconds = this.getJwtTtlSeconds(responseData?.data?.accessToken);
     if (ttlSeconds && ttlSeconds > 0) {
-      await this.cacheManager.set(cacheKey, responseData, ttlSeconds);
+      // cache-manager v5 expects milliseconds. This previously passed seconds,
+      // which the old Redis store discarded outright - so the entry simply
+      // never expired. Now that TTLs are honoured, passing seconds unconverted
+      // would expire the cached token ~1000x too early and re-authenticate
+      // against IAM on nearly every call.
+      await this.cacheManager.set(cacheKey, responseData, ttlSeconds * 1000);
     }
 
     return responseData;

package/src/helpers/typeorm-db-helper.ts

@@ -40,6 +40,14 @@ const DECIMAL_MAP: Record<DatasourceType, ColumnOptions> = {
     [DatasourceType.oracle]: { type: "float" },
 };
 
+const DATE_TIME_MAP: Record<DatasourceType, ColumnOptions> = {
+    [DatasourceType.postgres]: { type: "timestamp" },
+    [DatasourceType.mssql]: { type: "datetime2" },
+    [DatasourceType.mysql]: { type: "datetime" },
+    [DatasourceType.mariadb]: { type: "datetime" },
+    [DatasourceType.oracle]: { type: "timestamp" },
+};
+
 const solidCoreDbType: DatasourceType =
     Object.values(DatasourceType).includes(process.env.SOLID_CORE_DB_TYPE as DatasourceType)
         ? (process.env.SOLID_CORE_DB_TYPE as DatasourceType)
@@ -72,7 +80,10 @@ export function getColumnType(solidType: string): ColumnOptions {
         case "decimal":
             return DECIMAL_MAP[solidCoreDbType];
 
+        case "datetime":
+            return DATE_TIME_MAP[solidCoreDbType];
+
         default:
             return {};
     }
-}
+}

package/src/index.ts

@@ -160,6 +160,12 @@ export * from './entities/role-metadata.entity'
 export * from './entities/sms-template.entity'
 export * from './entities/user.entity'
 export * from './entities/user-api-key.entity'
+export * from './entities/user-device-credential.entity'
+export * from './repository/user-device-credential.repository'
+export * from './services/mpin.service'
+export * from './dtos/setup-mpin.dto'
+export * from './dtos/change-mpin.dto'
+export * from './dtos/mpin-login.dto'
 export * from './entities/view-metadata.entity'
 export * from './entities/setting.entity'
 export * from './entities/saved-filters.entity'

package/src/interfaces/active-user-data.interface.ts

@@ -22,6 +22,15 @@ export interface ActiveUserData {
    */
   sessionId?: string;
 
+  /**
+   * Identifies which per-device refresh-token bucket this session belongs to.
+   * Present only while concurrent logins are permitted; mutually exclusive with
+   * sessionId, which exists only when they are not. Carried on the access token
+   * so bearer-authenticated endpoints that need this session's refresh token
+   * can find it.
+   */
+  deviceKey?: string;
+
   /**
    * The subject's (user) roles.
    * These are part of the JWT token, we simply decode them.

package/src/repository/user-device-credential.repository.ts

@@ -0,0 +1,17 @@
+import { Injectable } from '@nestjs/common';
+import { UserDeviceCredential } from 'src/entities/user-device-credential.entity';
+import { RequestContextService } from 'src/services/request-context.service';
+import { DataSource } from 'typeorm';
+import { SecurityRuleRepository } from './security-rule.repository';
+import { SolidBaseRepository } from './solid-base.repository';
+
+@Injectable()
+export class UserDeviceCredentialRepository extends SolidBaseRepository<UserDeviceCredential> {
+    constructor(
+        readonly dataSource: DataSource,
+        readonly requestContextService: RequestContextService,
+        readonly securityRuleRepository: SecurityRuleRepository,
+    ) {
+        super(UserDeviceCredential, dataSource, requestContextService, securityRuleRepository);
+    }
+}

package/src/seeders/module-metadata-seeder.service.ts

@@ -1049,17 +1049,25 @@ export class ModuleMetadataSeederService {
 
     private async seedModelSequences(overallMetadata: any): Promise<{ pruned: number; upserted: number }> {
         const modelSequences = this.getSeedArray<CreateModelSequenceDto>(overallMetadata?.modelSequences);
-        const pruned = this.enablePruning ? await this.timeOperation('prune-model-sequences', () => this.pruneModelSequences(modelSequences, overallMetadata?.moduleMetadata?.name), {
+
+        // Getting rid of currentValue even if it is present in the seed data. 
+        // This is because we don't want to overwrite the currentValue in the database with the seed data. 
+        // The currentValue should be managed by the application and not by the seed data.
+        const cleanModelSequences = modelSequences.map((sequence) => {
+            const { currentValue, ...cleanModelSequence }: CreateModelSequenceDto = sequence;
+            return cleanModelSequence;
+        });
+        const pruned = this.enablePruning ? await this.timeOperation('prune-model-sequences', () => this.pruneModelSequences(cleanModelSequences, overallMetadata?.moduleMetadata?.name), {
             moduleName: overallMetadata?.moduleMetadata?.name,
             component: 'model-sequences',
             serviceCall: 'pruneModelSequences',
         }) : 0;
-        await this.timeOperation('handle-model-sequences', () => this.handleSeedModelSequences(modelSequences), {
+        await this.timeOperation('handle-model-sequences', () => this.handleSeedModelSequences(cleanModelSequences), {
             moduleName: overallMetadata?.moduleMetadata?.name,
             component: 'model-sequences',
             serviceCall: 'handleSeedModelSequences',
         });
-        return { pruned, upserted: modelSequences.length };
+        return { pruned, upserted: cleanModelSequences.length };
     }
 
     // OK

package/src/seeders/seed-data/solid-core-metadata.json

@@ -2360,6 +2360,164 @@
           }
         ]
       },
+      {
+        "singularName": "userDeviceCredential",
+        "tableName": "ss_user_device_credential",
+        "pluralName": "userDeviceCredentials",
+        "displayName": "User Device Credential",
+        "description": "Per-device MPIN credentials",
+        "dataSource": "default",
+        "dataSourceType": "postgres",
+        "userKeyFieldUserKey": "credentialKey",
+        "isSystem": true,
+        "fields": [
+          {
+            "name": "credentialKey",
+            "displayName": "Credential Key",
+            "description": "Natural key: <username>-<deviceId>. Populated by MpinService, not by the computed-field pipeline.",
+            "type": "shortText",
+            "length": 512,
+            "required": true,
+            "unique": true,
+            "index": true,
+            "private": false,
+            "encrypt": false,
+            "isUserKey": true,
+            "isSystem": true
+          },
+          {
+            "name": "hashedCredentialRef",
+            "displayName": "Hashed Credential Ref",
+            "type": "shortText",
+            "length": 512,
+            "required": true,
+            "unique": true,
+            "index": true,
+            "private": true,
+            "encrypt": false,
+            "isSystem": true
+          },
+          {
+            "name": "hashedMpin",
+            "displayName": "Hashed MPIN",
+            "type": "shortText",
+            "length": 512,
+            "required": true,
+            "unique": false,
+            "index": false,
+            "private": true,
+            "encrypt": false,
+            "isSystem": true
+          },
+          {
+            "name": "mpinScheme",
+            "displayName": "MPIN Scheme",
+            "type": "selectionStatic",
+            "required": true,
+            "private": false,
+            "encrypt": false,
+            "isSystem": true,
+            "selectionStaticValues": [
+              "bcrypt:bcrypt"
+            ]
+          },
+          {
+            "name": "mpinSchemeVersion",
+            "displayName": "MPIN Scheme Version",
+            "type": "int",
+            "required": true,
+            "private": false,
+            "encrypt": false,
+            "defaultValue": "1",
+            "isSystem": true
+          },
+          {
+            "name": "deviceId",
+            "displayName": "Device Id",
+            "type": "shortText",
+            "length": 512,
+            "required": true,
+            "unique": false,
+            "index": true,
+            "private": false,
+            "encrypt": false,
+            "isSystem": true
+          },
+          {
+            "name": "deviceName",
+            "displayName": "Device Name",
+            "type": "shortText",
+            "length": 512,
+            "required": false,
+            "unique": false,
+            "index": false,
+            "private": false,
+            "encrypt": false,
+            "isSystem": true
+          },
+          {
+            "name": "platform",
+            "displayName": "Platform",
+            "type": "shortText",
+            "length": 512,
+            "required": false,
+            "unique": false,
+            "index": false,
+            "private": false,
+            "encrypt": false,
+            "isSystem": true
+          },
+          {
+            "name": "isActive",
+            "displayName": "Is Active",
+            "type": "boolean",
+            "required": true,
+            "unique": false,
+            "index": false,
+            "private": false,
+            "encrypt": false,
+            "defaultValue": "true",
+            "isSystem": true
+          },
+          {
+            "name": "failedAttempts",
+            "displayName": "Failed Attempts",
+            "type": "int",
+            "required": true,
+            "private": false,
+            "encrypt": false,
+            "defaultValue": "0",
+            "isSystem": true
+          },
+          {
+            "name": "lockedUntil",
+            "displayName": "Locked Until",
+            "type": "datetime",
+            "required": false,
+            "private": false,
+            "encrypt": false,
+            "isSystem": true
+          },
+          {
+            "name": "lastUsedAt",
+            "displayName": "Last Used At",
+            "type": "datetime",
+            "required": false,
+            "private": false,
+            "encrypt": false,
+            "isSystem": true
+          },
+          {
+            "name": "user",
+            "displayName": "User",
+            "type": "relation",
+            "required": true,
+            "private": false,
+            "encrypt": false,
+            "isSystem": true
+          }
+        ]
+      },
       {
         "singularName": "userActivityHistory",
         "tableName": "ss_user_activity_history",
@@ -11642,7 +11800,8 @@
             "type": "field",
             "attrs": {
               "name": "fileSize",
-              "sortable": true
+              "sortable": true,
+              "viewWidget": "MediaFileSizeListWidget"
             }
           }
         ]
@@ -11807,6 +11966,13 @@
                     "attrs": {
                       "name": "fieldMetadata"
                     }
+                  },
+                  {
+                    "type": "field",
+                    "attrs": {
+                      "name": "fileSize",
+                      "viewWidget": "MediaFileSizeFormViewWidget"
+                    }
                   }
                 ]
               }
@@ -12583,7 +12749,7 @@
             50
           ],
           "enableGlobalSearch": true,
-          "create": true,
+          "create": false,
           "edit": true,
           "delete": true,
           "import": true,

package/src/services/api-key.service.ts

@@ -131,7 +131,19 @@ export class ApiKeyService {
 
         const user = apiKeyRecord.user;
 
-        const tokens = await this.authenticationService.generateTokens(user);
+        // Keyed on the API key record so every call for this key reuses one
+        // refresh-token bucket. Without it each call mints a fresh key and
+        // therefore a new bucket with a refreshTokenTtl lifetime - a client
+        // polling this endpoint would accumulate them without bound.
+        //
+        // The consequence is that replicas sharing one API key share one
+        // bucket and invalidate each other, which is exactly the behaviour
+        // before per-device sessions existed, and is benign here: an API key
+        // is a permanent credential, so a failed refresh just re-mints.
+        const tokens = await this.authenticationService.generateTokens(
+            user,
+            `apikey-${apiKeyRecord.id}`,
+        );
 
 
         return {