@solidxai/core 0.1.16 → 0.1.17-beta.1

package/src/constants/media-file-types.ts

@@ -8,8 +8,71 @@ export type MediaFileTypeDefinition = {
     extension: string;
 };
 
-// Single source of truth for every supported media extension, its canonical MIME type,
-// and the coarse media category used across validation and UI metadata.
+/**
+ * Extensions that must never be accepted as media uploads, regardless of declared mimetype or
+ * admin-configured mediaTypes allowlist. Checked before any other resolution so a spoofed
+ * Content-Type (e.g. application/octet-stream on an .html file) can't bypass this.
+ *
+ * The default list below. A deployment can replace it wholesale via AB_DANGEROUS_EXTENSIONS
+ * (comma-separated) - e.g. to accept svg uploads, which some clients legitimately need. This
+ * replaces rather than narrows the list: whatever is set there becomes the entire denylist, so
+ * anything left out of it becomes an accepted upload type. See default-settings-provider.service.ts
+ * for the read-only "dangerousExtensions" setting that surfaces the effective list to admins.
+ */
+const DEFAULT_DANGEROUS_EXTENSIONS = [
+    'html', 'htm', 'xhtml', 'svg', 'xml',
+    'js', 'mjs', 'php', 'phtml', 'jsp', 'asp', 'aspx',
+    'exe', 'sh', 'bat', 'cmd', 'ps1', 'jar', 'dll',
+    'msi', 'msix', 'msp', 'com', 'scr', 'vbs', 'vbe', 'wsf', 'wsh', 'hta', 'cpl', 'pif', 'reg',
+];
+
+const parseExtensionList = (raw: string): string[] =>
+    raw.split(',').map(ext => ext.toLowerCase().trim().replace(/^\./, '')).filter(Boolean);
+
+const configuredDangerousExtensions = parseExtensionList(process.env.AB_DANGEROUS_EXTENSIONS ?? '');
+
+export const DANGEROUS_EXTENSIONS = new Set(
+    configuredDangerousExtensions.length > 0
+        ? configuredDangerousExtensions
+        : DEFAULT_DANGEROUS_EXTENSIONS
+);
+
+/**
+ * The mimetype gate must track the extension gate: a .svg upload arrives as image/svg+xml, so
+ * removing svg from DANGEROUS_EXTENSIONS while image/svg+xml stayed on a separate literal would
+ * still reject the upload at isDangerousMediaFile's second check - with a message pointing at
+ * nothing the operator changed. Deriving from a single mapping keeps the two in sync.
+ *
+ * Only browser-rendered types appear here, which is why the resulting set is short (a handful of
+ * entries against dozens of dangerous extensions): everything else is dangerous once downloaded
+ * and run, and the mimetype sent for those is typically application/octet-stream, which must stay
+ * allowed. When adding a browser-renderable extension to the denylist above, add it here too.
+ */
+const DANGEROUS_MIME_TYPES_BY_EXTENSION: Record<string, string[]> = {
+    html: ['text/html'],
+    htm: ['text/html'],
+    xhtml: ['application/xhtml+xml'],
+    svg: ['image/svg+xml'],
+};
+
+/**
+ * Mimetypes that are never safe to accept, regardless of extension. These render as active
+ * content in a browser (svg can carry <script>), so they are rejected even when the filename
+ * looks harmless. Kept in sync with DANGEROUS_EXTENSIONS via DANGEROUS_MIME_TYPES_BY_EXTENSION
+ * above, rather than maintained separately.
+ */
+export const DANGEROUS_MIME_TYPES = new Set(
+    Object.entries(DANGEROUS_MIME_TYPES_BY_EXTENSION)
+        .filter(([extension]) => DANGEROUS_EXTENSIONS.has(extension))
+        .flatMap(([, mimeTypes]) => mimeTypes)
+);
+
+// The set of media extensions the system currently recognises - its canonical MIME type, and the
+// coarse media category used across validation and UI metadata. Membership here means
+// "resolvable", not "safe": svg is included only when DANGEROUS_EXTENSIONS has been configured to
+// allow it (see below), since accepting it as an upload also makes it eligible for the inline-safe
+// serving path (INLINE_SAFE_EXTENSIONS further down) - safe there only because of the
+// Content-Security-Policy applied when serving it (solid-core.module.ts, media.controller.ts).
 export const MEDIA_FILE_TYPES: MediaFileTypeDefinition[] = [
     { mediaType: 'image', mimeType: 'image/png', extension: 'png' },
     { mediaType: 'image', mimeType: 'image/jpeg', extension: 'jpg' },
@@ -21,6 +84,12 @@ export const MEDIA_FILE_TYPES: MediaFileTypeDefinition[] = [
     { mediaType: 'image', mimeType: 'image/tiff', extension: 'tiff' },
     { mediaType: 'image', mimeType: 'image/heic', extension: 'heic' },
     { mediaType: 'image', mimeType: 'image/heif', extension: 'heif' },
+    // Only a media type when explicitly unblocked via AB_DANGEROUS_EXTENSIONS - see the file
+    // header comment. Hardcoded to svg specifically: unblocking e.g. html must not make html a
+    // media type, since it isn't a format the product supports as an upload.
+    ...(DANGEROUS_EXTENSIONS.has('svg')
+        ? []
+        : [{ mediaType: 'image', mimeType: 'image/svg+xml', extension: 'svg' } as MediaFileTypeDefinition]),
 
     { mediaType: 'audio', mimeType: 'audio/mpeg', extension: 'mp3' },
     { mediaType: 'audio', mimeType: 'audio/mp3', extension: 'mp3' },
@@ -97,28 +166,6 @@ export const MIME_TO_MEDIA_TYPE: Record<string, MediaCategory> = MEDIA_FILE_TYPE
     return acc;
 }, {} as Record<string, MediaCategory>);
 
-/**
- * Extensions that must never be accepted as media uploads, regardless of declared mimetype or
- * admin-configured mediaTypes allowlist. Checked before any other resolution so a spoofed
- * Content-Type (e.g. application/octet-stream on an .html file) can't bypass this.
- */
-export const DANGEROUS_EXTENSIONS = new Set([
-    'html', 'htm', 'xhtml', 'svg', 'xml',
-    'js', 'mjs', 'php', 'phtml', 'jsp', 'asp', 'aspx',
-    'exe', 'sh', 'bat', 'cmd', 'ps1', 'jar', 'dll',
-    'msi', 'msix', 'msp', 'com', 'scr', 'vbs', 'vbe', 'wsf', 'wsh', 'hta', 'cpl', 'pif', 'reg',
-]);
-
-
-/**
- * Mimetypes that are never safe to accept, regardless of extension. These render as active
- * content in a browser (svg can carry <script>), so they are rejected even when the filename
- * looks harmless. Kept alongside DANGEROUS_EXTENSIONS so upload paths check both.
- */
-export const DANGEROUS_MIME_TYPES = new Set([
-    'image/svg+xml', 'text/html', 'application/xhtml+xml',
-]);
-
 /**
  * Percent-decodes a filename, repeating a bounded number of times so a double-encoded payload
  * (`%252e` -> `%2e` -> `.`) survives a single pass through a proxy/framework that already
@@ -264,6 +311,11 @@ export const EXT_TO_MEDIA_TYPE: Record<string, MediaCategory> = {
 /**
  * Extensions safe to serve inline with their natural Content-Type; everything else served from
  * media-files-storage is forced to application/octet-stream + Content-Disposition: attachment.
+ *
+ * svg is included here only when it's an accepted media type (see MEDIA_FILE_TYPES above) - and
+ * even then it's inline-safe only because both serve paths (ServeStaticModule in
+ * solid-core.module.ts, and the signed-URL download in media.controller.ts) attach a
+ * Content-Security-Policy to svg responses that neutralizes any embedded script.
  */
 export const INLINE_SAFE_EXTENSIONS = new Set<string>([
     ...IMAGE_EXTENSIONS,

package/src/controllers/chatter-message-details.controller.ts

@@ -5,10 +5,7 @@ import { ChatterMessageDetailsService } from '../services/chatter-message-detail
 import { CreateChatterMessageDetailsDto } from '../dtos/create-chatter-message-details.dto';
 import { UpdateChatterMessageDetailsDto } from '../dtos/update-chatter-message-details.dto';
 
-enum ShowSoftDeleted {
-  INCLUSIVE = "inclusive",
-  EXCLUSIVE = "exclusive",
-}
+import { ShowSoftDeleted } from '../enums/show-soft-deleted.enum';
 
 @ApiTags('Solid Core')
 @Controller('chatter-message-details')

package/src/controllers/chatter-message.controller.ts

@@ -10,10 +10,7 @@ import { SolidRequestContextDecorator } from 'src/decorators/solid-request-conte
 import { SolidRequestContextDto } from 'src/dtos/solid-request-context.dto';
 import { Public } from 'src/decorators/public.decorator';
 
-enum ShowSoftDeleted {
-  INCLUSIVE = "inclusive",
-  EXCLUSIVE = "exclusive",
-}
+import { ShowSoftDeleted } from '../enums/show-soft-deleted.enum';
 
 @ApiTags('Solid Core')
 @Controller('chatter-message')

package/src/controllers/dashboard-user-layout.controller.ts

@@ -5,10 +5,7 @@ import { DashboardUserLayoutService } from '../services/dashboard-user-layout.se
 import { CreateDashboardUserLayoutDto } from '../dtos/create-dashboard-user-layout.dto';
 import { UpdateDashboardUserLayoutDto } from '../dtos/update-dashboard-user-layout.dto';
 
-enum ShowSoftDeleted {
-  INCLUSIVE = "inclusive",
-  EXCLUSIVE = "exclusive",
-}
+import { ShowSoftDeleted } from '../enums/show-soft-deleted.enum';
 
 @ApiTags('Solid Core')
 @Controller('dashboard-user-layout')

package/src/controllers/import-transaction-error-log.controller.ts

@@ -5,10 +5,7 @@ import { ImportTransactionErrorLogService } from '../services/import-transaction
 import { CreateImportTransactionErrorLogDto } from '../dtos/create-import-transaction-error-log.dto';
 import { UpdateImportTransactionErrorLogDto } from '../dtos/update-import-transaction-error-log.dto';
 
-enum ShowSoftDeleted {
-  INCLUSIVE = "inclusive",
-  EXCLUSIVE = "exclusive",
-}
+import { ShowSoftDeleted } from '../enums/show-soft-deleted.enum';
 
 @ApiTags('Solid Core')
 @Controller('import-transaction-error-log')

package/src/controllers/import-transaction.controller.ts

@@ -9,10 +9,7 @@ import { ActiveUser } from 'src/decorators/active-user.decorator';
 import { ActiveUserData } from 'src/interfaces/active-user-data.interface';
 import { setFileDownloadHeaders } from 'src/helpers/file-download.helper';
 
-enum ShowSoftDeleted {
-  INCLUSIVE = "inclusive",
-  EXCLUSIVE = "exclusive",
-}
+import { ShowSoftDeleted } from '../enums/show-soft-deleted.enum';
 
 @ApiTags('Solid Core')
 @Controller('import-transaction')

package/src/controllers/list-of-values.controller.ts

@@ -5,10 +5,7 @@ import { ListOfValuesService } from '../services/list-of-values.service';
 import { CreateListOfValuesDto } from '../dtos/create-list-of-values.dto';
 import { UpdateListOfValuesDto } from '../dtos/update-list-of-values.dto';
 
-enum ShowSoftDeleted {
-  INCLUSIVE = "inclusive",
-  EXCLUSIVE = "exclusive",
-}
+import { ShowSoftDeleted } from '../enums/show-soft-deleted.enum';
 
 @ApiTags('Solid Core')
 @Controller('list-of-values')

package/src/controllers/locale.controller.ts

@@ -7,10 +7,7 @@ import { LocaleService } from 'src/services/locale.service';
 import { CreateLocaleDto } from 'src/dtos/create-locale.dto';
 import { UpdateLocaleDto } from 'src/dtos/update-locale.dto';
 
-enum ShowSoftDeleted {
-  INCLUSIVE = "inclusive",
-  EXCLUSIVE = "exclusive",
-}
+import { ShowSoftDeleted } from '../enums/show-soft-deleted.enum';
 
 @ApiTags('Solid Core')
 @Controller('locale')

package/src/controllers/media.controller.ts

@@ -9,13 +9,10 @@ import { SolidRequestContextDto } from 'src/dtos/solid-request-context.dto';
 import { UpdateMediaDto } from 'src/dtos/update-media.dto';
 import { MediaService } from 'src/services/media.service';
 import { Response } from 'express';
-import { getLowercaseFileExtension, INLINE_SAFE_EXTENSIONS } from 'src/constants/media-file-types';
+import { EXTENSION_TO_MIME_TYPE, getLowercaseFileExtension, INLINE_SAFE_EXTENSIONS } from 'src/constants/media-file-types';
 import { setFileDownloadHeaders } from 'src/helpers/file-download.helper';
 
-enum ShowSoftDeleted {
-  INCLUSIVE = "inclusive",
-  EXCLUSIVE = "exclusive",
-}
+import { ShowSoftDeleted } from '../enums/show-soft-deleted.enum';
 
 @ApiTags('Solid Core')
 @Controller('media')
@@ -103,16 +100,31 @@ export class MediaController {
     // types is ever safe to render inline. Anything else is forced to download rather than be
     // displayed/executed, regardless of the mimetype the record was stored with - nosniff
     // alone would not help here, since it faithfully honours a declared text/html.
-    const isInlineSafe = INLINE_SAFE_EXTENSIONS.has(getLowercaseFileExtension(fileName) ?? '');
+    const ext = getLowercaseFileExtension(fileName) ?? '';
+    const isInlineSafe = INLINE_SAFE_EXTENSIONS.has(ext);
     const requestedInline = disposition !== 'attachment';
 
+    // The served mimetype is derived from the extension rather than trusting the stored
+    // mimeType (which is the client-declared Content-Type at upload time, and so is spoofable):
+    // a file named logo.png could otherwise have been uploaded with Content-Type: image/svg+xml
+    // and stored that way, which would bypass an extension-only check below.
+    const effectiveMimeType = isInlineSafe ? (EXTENSION_TO_MIME_TYPE[ext] ?? mimeType) : 'application/octet-stream';
+
     setFileDownloadHeaders(res, {
       fileName,
-      mimeType: isInlineSafe ? mimeType : 'application/octet-stream',
+      mimeType: effectiveMimeType,
       disposition: requestedInline && isInlineSafe ? 'inline' : 'attachment',
       crossOriginResourcePolicy: true,
     });
 
+    // See the matching comment in solid-core.module.ts's setHeaders: <img>/CSS never execute
+    // svg script, but a direct navigation to this URL would, so pin it to a locked-down
+    // document. Keyed on the extension (which now drives effectiveMimeType above too), not on
+    // the stored mimeType, so the spoofed-Content-Type case above is covered as well.
+    if (ext === 'svg') {
+      res.setHeader("Content-Security-Policy", "default-src 'none'; style-src 'unsafe-inline'; img-src data:; sandbox");
+    }
+
     stream.pipe(res);
   }
 

package/src/controllers/model-sequence.controller.ts

@@ -5,10 +5,7 @@ import { ModelSequenceService } from '../services/model-sequence.service';
 import { CreateModelSequenceDto } from '../dtos/create-model-sequence.dto';
 import { UpdateModelSequenceDto } from '../dtos/update-model-sequence.dto';
 
-enum ShowSoftDeleted {
-  INCLUSIVE = "inclusive",
-  EXCLUSIVE = "exclusive",
-}
+import { ShowSoftDeleted } from '../enums/show-soft-deleted.enum';
 
 @ApiTags('Solid Core')
 @Controller('model-sequence')

package/src/controllers/saved-filters.controller.ts

@@ -5,10 +5,7 @@ import { SavedFiltersService } from '../services/saved-filters.service';
 import { CreateSavedFiltersDto } from '../dtos/create-saved-filters.dto';
 import { UpdateSavedFiltersDto } from '../dtos/update-saved-filters.dto';
 
-enum ShowSoftDeleted {
-  INCLUSIVE = "inclusive",
-  EXCLUSIVE = "exclusive",
-}
+import { ShowSoftDeleted } from '../enums/show-soft-deleted.enum';
 
 @ApiTags('Solid Core')
 @Controller('saved-filters')

package/src/controllers/scheduled-job.controller.ts

@@ -5,10 +5,7 @@ import { CreateScheduledJobDto } from 'src/dtos/create-scheduled-job.dto';
 import { UpdateScheduledJobDto } from 'src/dtos/update-scheduled-job.dto';
 import { ScheduledJobService } from 'src/services/scheduled-job.service';
 
-enum ShowSoftDeleted {
-  INCLUSIVE = "inclusive",
-  EXCLUSIVE = "exclusive",
-}
+import { ShowSoftDeleted } from '../enums/show-soft-deleted.enum';
 
 @ApiTags('Solid Core')
 @Controller('scheduled-job')

package/src/controllers/security-rule.controller.ts

@@ -5,10 +5,7 @@ import { SecurityRuleService } from '../services/security-rule.service';
 import { CreateSecurityRuleDto } from '../dtos/create-security-rule.dto';
 import { UpdateSecurityRuleDto } from '../dtos/update-security-rule.dto';
 
-enum ShowSoftDeleted {
-  INCLUSIVE = "inclusive",
-  EXCLUSIVE = "exclusive",
-}
+import { ShowSoftDeleted } from '../enums/show-soft-deleted.enum';
 
 @ApiTags('Solid Core')
 @Controller('security-rule')

package/src/controllers/user-activity-history.controller.ts

@@ -5,10 +5,7 @@ import { UserActivityHistoryService } from '../services/user-activity-history.se
 import { CreateUserActivityHistoryDto } from '../dtos/create-user-activity-history.dto';
 import { UpdateUserActivityHistoryDto } from '../dtos/update-user-activity-history.dto';
 
-enum ShowSoftDeleted {
-  INCLUSIVE = "inclusive",
-  EXCLUSIVE = "exclusive",
-}
+import { ShowSoftDeleted } from '../enums/show-soft-deleted.enum';
 
 @ApiTags('Solid Core')
 @Controller('user-activity-history')

package/src/controllers/user-view-metadata.controller.ts

@@ -8,10 +8,7 @@ import { UpsertUserViewMetadataDto } from 'src/dtos/upsert-user-view-metadata.dt
 import { ActiveUser } from 'src/decorators/active-user.decorator';
 import { ActiveUserData } from 'src/interfaces/active-user-data.interface';
 
-enum ShowSoftDeleted {
-  INCLUSIVE = "inclusive",
-  EXCLUSIVE = "exclusive",
-}
+import { ShowSoftDeleted } from '../enums/show-soft-deleted.enum';
 
 @ApiTags('Solid Core')
 @Controller('user-view-metadata')

package/src/controllers/workflow-definition.controller.ts

@@ -8,10 +8,7 @@ import { ExecuteWorkflowDto } from '../dtos/execute-workflow.dto';
 import { WorkflowNodeRegistryService } from '../services/workflow/workflow-node-registry.service';
 import { ValidateWorkflowDefinitionDto } from '../dtos/validate-workflow-definition.dto';
 
-enum ShowSoftDeleted {
-  INCLUSIVE = "inclusive",
-  EXCLUSIVE = "exclusive",
-}
+import { ShowSoftDeleted } from '../enums/show-soft-deleted.enum';
 
 @ApiTags('Solid Core')
 @Controller('workflow-definition')

package/src/controllers/workflow-execution-artifact.controller.ts

@@ -5,10 +5,7 @@ import { WorkflowExecutionArtifactService } from '../services/workflow-execution
 import { CreateWorkflowExecutionArtifactDto } from '../dtos/create-workflow-execution-artifact.dto';
 import { UpdateWorkflowExecutionArtifactDto } from '../dtos/update-workflow-execution-artifact.dto';
 
-enum ShowSoftDeleted {
-  INCLUSIVE = "inclusive",
-  EXCLUSIVE = "exclusive",
-}
+import { ShowSoftDeleted } from '../enums/show-soft-deleted.enum';
 
 @ApiTags('Solid Core')
 @Controller('workflow-execution-artifact')

package/src/controllers/workflow-execution-log.controller.ts

@@ -5,10 +5,7 @@ import { WorkflowExecutionLogService } from '../services/workflow-execution-log.
 import { CreateWorkflowExecutionLogDto } from '../dtos/create-workflow-execution-log.dto';
 import { UpdateWorkflowExecutionLogDto } from '../dtos/update-workflow-execution-log.dto';
 
-enum ShowSoftDeleted {
-  INCLUSIVE = "inclusive",
-  EXCLUSIVE = "exclusive",
-}
+import { ShowSoftDeleted } from '../enums/show-soft-deleted.enum';
 
 @ApiTags('Solid Core')
 @Controller('workflow-execution-log')

package/src/controllers/workflow-execution.controller.ts

@@ -6,10 +6,7 @@ import { CreateWorkflowExecutionDto } from '../dtos/create-workflow-execution.dt
 import { UpdateWorkflowExecutionDto } from '../dtos/update-workflow-execution.dto';
 import { WorkflowRuntimeService } from '../services/workflow/workflow-runtime.service';
 
-enum ShowSoftDeleted {
-  INCLUSIVE = "inclusive",
-  EXCLUSIVE = "exclusive",
-}
+import { ShowSoftDeleted } from '../enums/show-soft-deleted.enum';
 
 @ApiTags('Solid Core')
 @Controller('workflow-execution')

package/src/controllers/workflow-secret.controller.ts

@@ -5,10 +5,7 @@ import { WorkflowSecretService } from '../services/workflow-secret.service';
 import { CreateWorkflowSecretDto } from '../dtos/create-workflow-secret.dto';
 import { UpdateWorkflowSecretDto } from '../dtos/update-workflow-secret.dto';
 
-enum ShowSoftDeleted {
-  INCLUSIVE = "inclusive",
-  EXCLUSIVE = "exclusive",
-}
+import { ShowSoftDeleted } from '../enums/show-soft-deleted.enum';
 
 @ApiTags('Solid Core')
 @Controller('workflow-secret')

package/src/controllers/workflow-step-execution.controller.ts

@@ -5,10 +5,7 @@ import { WorkflowStepExecutionService } from '../services/workflow-step-executio
 import { CreateWorkflowStepExecutionDto } from '../dtos/create-workflow-step-execution.dto';
 import { UpdateWorkflowStepExecutionDto } from '../dtos/update-workflow-step-execution.dto';
 
-enum ShowSoftDeleted {
-  INCLUSIVE = "inclusive",
-  EXCLUSIVE = "exclusive",
-}
+import { ShowSoftDeleted } from '../enums/show-soft-deleted.enum';
 
 @ApiTags('Solid Core')
 @Controller('workflow-step-execution')

package/src/controllers/workflow-trigger-execution.controller.ts

@@ -5,10 +5,7 @@ import { WorkflowTriggerExecutionService } from '../services/workflow-trigger-ex
 import { CreateWorkflowTriggerExecutionDto } from '../dtos/create-workflow-trigger-execution.dto';
 import { UpdateWorkflowTriggerExecutionDto } from '../dtos/update-workflow-trigger-execution.dto';
 
-enum ShowSoftDeleted {
-  INCLUSIVE = "inclusive",
-  EXCLUSIVE = "exclusive",
-}
+import { ShowSoftDeleted } from '../enums/show-soft-deleted.enum';
 
 @ApiTags('Solid Core')
 @Controller('workflow-trigger-execution')

package/src/dtos/basic-filters.dto.ts

@@ -4,11 +4,10 @@ import { IsEnum, IsOptional } from "class-validator";
 import { PaginationQueryDto } from "./pagination-query.dto";
 import { Timestamp } from "typeorm";
 import { BasicGroupFilterDto } from "./basic-group-filters.dto";
+import { ShowSoftDeleted } from "../enums/show-soft-deleted.enum";
 
-export enum SoftDeleteFilter {
-    INCLUSIVE = "inclusive",
-    EXCLUSIVE = "exclusive",
-}
+// Backwards-compatible alias for consumers using the older DTO name.
+export { ShowSoftDeleted as SoftDeleteFilter } from "../enums/show-soft-deleted.enum";
 
 export class BasicFilterDto extends PaginationQueryDto {
 
@@ -41,12 +40,12 @@ export class BasicFilterDto extends PaginationQueryDto {
     // readonly filters: any[];
 
     @IsOptional()
-    @IsEnum(SoftDeleteFilter)
+    @IsEnum(ShowSoftDeleted)
     @ApiProperty({
         description: "showSoftDeleted",
-        enum: SoftDeleteFilter,
+        enum: ShowSoftDeleted,
     })
-    readonly showSoftDeleted?: SoftDeleteFilter;
+    readonly showSoftDeleted?: ShowSoftDeleted;
 
     @IsOptional()
     @ApiProperty({ description: "populateGroup" })

package/src/dtos/otp-sign-up.dto.ts

@@ -1,17 +1,26 @@
-import { IsEmail, IsEnum, IsJSON, IsNotEmpty, IsOptional } from 'class-validator';
+import { IsEmail, IsEnum, IsJSON, IsNotEmpty, IsOptional, IsString } from 'class-validator';
 
 import { PasswordlessRegistrationValidateWhatSources } from "../constants";
+import { ApiProperty } from '@nestjs/swagger';
 
 export class OTPSignUpDto {
+    @IsOptional()
+    @IsString()
+    @ApiProperty()
+    fullName: string;
+
     @IsNotEmpty()
+    @ApiProperty()
     username: string;
 
     @IsOptional()
     @IsEmail()
+    @ApiProperty()
     email: string;
 
     @IsOptional()
     @IsNotEmpty()
+    @ApiProperty()
     mobile: string;
 
     @IsOptional()
@@ -19,5 +28,6 @@ export class OTPSignUpDto {
     validationSources: PasswordlessRegistrationValidateWhatSources[] = [];
 
     @IsOptional()
+    @ApiProperty()
     customPayload: any;
 }

package/src/enums/show-soft-deleted.enum.ts

@@ -0,0 +1,4 @@
+export enum ShowSoftDeleted {
+  INCLUSIVE = "inclusive",
+  EXCLUSIVE = "exclusive",
+}

package/src/index.ts

@@ -194,6 +194,7 @@ export * from './entities/workflow-secret.entity'
 export * from './enums/auth-type.enum'
 export * from './enums/legacy-table-type.enum'
 export * from './enums/signup-intent.enum'
+export * from './enums/show-soft-deleted.enum'
 export * from './decorators/disallow-in-production.decorator'
 
 export * from './filters/http-exception.filter'