@solidxai/core 0.1.16 → 0.1.17-beta.1

package/src/services/authentication.service.ts

@@ -70,9 +70,18 @@ interface otp {
 
 /** Where a signup's role names come from. */
 enum RolesSource {
-  /** None from the caller: performSignUp applies the configured `defaultRole`. */
+  /**
+   * Ask nobody; returning [] lets performSignUp apply the configured `defaultRole`.
+   *
+   * No intent maps here today - it is kept for paths that deliberately bypass the
+   * provider. OAuth is the live example: its DTO can never carry a discriminator, so
+   * it takes `defaultRole` outright (currently inline in UserService).
+   */
   Default,
-  /** `provider.roles(dto)`, unconditionally. */
+  /**
+   * `provider.roles(dto)` - and nothing else. Yields [] when no provider is registered
+   * or when the provider declines to name any, which falls through to `defaultRole`.
+   */
   Provider,
   /** The caller's own `dto.roles`. */
   Caller,
@@ -82,10 +91,18 @@ enum RolesSource {
  * The single place that decides, per intent, which entity a signup builds and where
  * its roles come from.
  *
- * `useProvider` is currently computable from `rolesSource` (`Caller` implies false),
- * but the two answer different questions - "which entity?" and "which roles?" - that
- * merely coincide across these three intents. Keep both, and change behaviour here
- * rather than at a call site.
+ * Where an extension user provider is registered it is the authority on that app's user
+ * roles, so every provider-backed intent asks it. `defaultRole` is the *fallback* for
+ * when it names none - or when there is no provider at all - not the rule.
+ *
+ * SelfRegistration and ExtensionModel resolve identically today. They stay separate
+ * intents because only SelfRegistration is gated on `allowPublicRegistration`, and
+ * because "an anonymous visitor signing themselves up" and "an admin creating a user
+ * from the model's own form" are different things that may yet need to diverge.
+ *
+ * `useProvider` is computable from `rolesSource` today (`Caller` implies false), but the
+ * two answer different questions - "which entity?" and "which roles?" - that merely
+ * coincide across these intents. Keep both, and change behaviour here, not at a call site.
  */
 const SIGNUP_POLICY: Record<
   SignupIntent,
@@ -93,7 +110,7 @@ const SIGNUP_POLICY: Record<
 > = {
   [SignupIntent.SelfRegistration]: {
     useProvider: true,
-    rolesSource: RolesSource.Default,
+    rolesSource: RolesSource.Provider,
   },
   [SignupIntent.ExtensionModel]: {
     useProvider: true,
@@ -246,12 +263,24 @@ export class AuthenticationService {
     dto: Record<string, any>,
     source: RolesSource,
   ): string[] {
+    // Only `Caller` reads dto.roles. Anywhere else, roles in the body are ignored -
+    // which is what keeps an anonymous caller from naming their own on a @Public()
+    // endpoint - so say so rather than dropping them silently.
+    if (source !== RolesSource.Caller && dto.roles?.length) {
+      this.logger.warn(
+        `Ignoring caller-supplied roles for "${dto.username}": roles on this path come from ` +
+          (source === RolesSource.Provider
+            ? "the extension user provider"
+            : "the configured defaultRole"),
+      );
+    }
+
     switch (source) {
       case RolesSource.Provider:
-        // Sole authority. `dto.roles` is deliberately not read - not as a preference,
-        // not as a fallback. Reading it would skip roles(), which is where a provider
-        // validates its discriminator, and CreateUserDto types roles as
-        // UpdateRoleMetadataDto[] where performSignUp expects role-name strings.
+        // Sole authority. Reading dto.roles as a preference or fallback would skip
+        // roles(), which is where a provider validates its discriminator, and
+        // CreateUserDto types roles as UpdateRoleMetadataDto[] where performSignUp
+        // expects role-name strings. [] here falls through to `defaultRole`.
         return (
           this.solidRegistry
             .getExtensionUserCreationProvider()
@@ -262,14 +291,6 @@ export class AuthenticationService {
         return dto.roles ?? [];
 
       case RolesSource.Default:
-        // Public signup: the form has no business naming roles. Returning empty lets
-        // performSignUp apply the configured `defaultRole`, rather than adding a
-        // second mechanism for the same thing.
-        if (dto.roles?.length) {
-          this.logger.warn(
-            `Ignoring caller-supplied roles on public registration for "${dto.username}"`,
-          );
-        }
         return [];
     }
   }
@@ -772,16 +793,31 @@ export class AuthenticationService {
     validationSource: string,
   ): Promise<User> {
     if (isEmpty(existingUser)) {
+      // Resolved before anything is written: where a provider requires its discriminator
+      // roles() throws, and that should surface as a rejected request rather than as a
+      // half-registered user with no roles.
+      const roles = this.resolveSignupRoles(
+        signUpDto,
+        SIGNUP_POLICY[SignupIntent.SelfRegistration].rolesSource,
+      );
+
       // A new registration is saved through whichever repository createUser resolved,
       // which is the provider's when the app registers one.
       const { entity: user, repo } = await this.createUser(signUpDto);
       user.active = false; // User will be activated only after OTP verification, hence setting active to false for new user.
       await this.assignRegistrationOtp(validationSource, user);
       await repo.save(user);
-      await this.userService.addRoleToUser(
-        user.username,
-        this.settingService.getConfigValue<SolidCoreSetting>("defaultRole"),
-      );
+
+      if (roles.length) {
+        await this.userService.addRolesToUser(user.username, roles);
+      } else {
+        // The provider named none, or there is no provider: fall back to the configured
+        // default, matching what performSignUp does on the password paths.
+        await this.userService.addRoleToUser(
+          user.username,
+          this.settingService.getConfigValue<SolidCoreSetting>("defaultRole"),
+        );
+      }
       return user;
     }
 
@@ -812,9 +848,8 @@ export class AuthenticationService {
     entity.username = signUpDto.username;
     entity.email = signUpDto.email;
     entity.mobile = signUpDto.mobile;
-    // OTPSignUpDto declares no `fullName`, so username is the only source here. Mirrors
-    // the fallback in populateForSignup, which this path does not go through.
-    entity.fullName = signUpDto.username;
+    // OTPSignUpDto declares no `fullName`, so username is the only source here. Mirrors the fallback in populateForSignup, which this path does not go through.
+    entity.fullName = signUpDto.fullName?.trim() || signUpDto.username;
     entity.customPayload = signUpDto.customPayload;
     entity.lastLoginProvider = LoginProvider.OTP;
 

package/src/services/chatter-message.service.ts

@@ -771,38 +771,69 @@ export class ChatterMessageService extends CRUDService<ChatterMessage> {
 
         if (field.type === 'relation') {
             if (field.relationType === "many-to-one") {
-                if (value.name) {
-                    return value.name;
-                }
-
-                try {
-                    const relatedModel = await this.modelMetadataRepo.findOne({
-                        where: { singularName: field.relationCoModelSingularName || field.relation },
-                        relations: { userKeyField: true }
-                    });
-
-                    if (relatedModel && relatedModel.userKeyField) {
-                        const userKeyFieldName = relatedModel.userKeyField.name;
-                        return value[userKeyFieldName] ? value[userKeyFieldName].toString() : '';
-                    }
-
-                    if (value.id) {
-                        return value.id.toString();
-                    }
-                } catch (error: any) {
-                    console.error('Error fetching related model metadata:', error);
-                    return value.id ? value.id.toString() : '';
-                }
+                const relatedModel = await this.loadRelatedModelForDisplay(field);
+                return this.resolveRelationDisplayValue(value, relatedModel?.userKeyField?.name);
             }
 
             if (field.relationType === 'many-to-many') {
-                return value.map(item => item.name).join(', ');
+                if (!Array.isArray(value)) {
+                    const relatedModel = await this.loadRelatedModelForDisplay(field);
+                    return this.resolveRelationDisplayValue(value, relatedModel?.userKeyField?.name);
+                }
+
+                const relatedModel = await this.loadRelatedModelForDisplay(field);
+                const userKeyFieldName = relatedModel?.userKeyField?.name;
+                return value
+                    .map(item => this.resolveRelationDisplayValue(item, userKeyFieldName))
+                    .filter(Boolean)
+                    .join(', ');
             }
         }
 
         return value.toString();
     }
 
+    private async loadRelatedModelForDisplay(field: any): Promise<any | null> {
+        try {
+            return await this.modelMetadataRepo.findOne({
+                where: { singularName: field.relationCoModelSingularName || field.relation },
+                relations: { userKeyField: true }
+            });
+        } catch (error: any) {
+            this._logger.warn(`Unable to load related model metadata for audit display: ${error?.message ?? error}`);
+            return null;
+        }
+    }
+
+    private resolveRelationDisplayValue(value: any, userKeyFieldName?: string): string {
+        if (value === null || value === undefined) {
+            return '';
+        }
+
+        if (typeof value !== 'object') {
+            return String(value);
+        }
+
+        const candidateKeys = [
+            userKeyFieldName,
+            'fullName',
+            'displayName',
+            'username',
+            'name',
+            'title',
+            'id',
+        ].filter(Boolean) as string[];
+
+        for (const key of candidateKeys) {
+            const candidate = value[key];
+            if (candidate !== null && candidate !== undefined && String(candidate).trim() !== '') {
+                return String(candidate);
+            }
+        }
+
+        return '';
+    }
+
     private hasValueChanged(newValue: any, oldValue: any): boolean {
         if (newValue === oldValue) {
             return false;

package/src/services/settings/default-settings-provider.service.ts

@@ -7,6 +7,7 @@ import {
   SettingLevel,
 } from "src/interfaces";
 import { getDefaultThemeKey, getThemesByMode } from "src/theme/theme-registry";
+import { DANGEROUS_EXTENSIONS } from "src/constants/media-file-types";
 
 export const DEFAULT_MEDIA_UPLOAD_DIR = "media-uploads";
 export const DEFAULT_MEDIA_FILE_STORAGE_DIR = "media-files-storage";
@@ -546,6 +547,17 @@ const getSolidCoreSettings = (isProd: boolean) =>
       controlType: "numeric",
       helpText: "Global upload size limit enforced by Multer under every per-field mediaMaxSizeKb restriction. Read-only here: it's applied once at process start, so changing AB_MEDIA_MAX_FILE_SIZE_MB requires an app restart to take effect - editing this in the admin UI would not do that.",
     },
+    {
+      moduleName: "solid-core",
+      key: "dangerousExtensions",
+      value: [...DANGEROUS_EXTENSIONS].join(','),
+      level: SettingLevel.SystemAdminReadonly,
+      label: "Blocked Upload Extensions",
+      group: "storage-settings",
+      sortOrder: 46,
+      controlType: "shortText",
+      helpText: "File extensions rejected on every upload path, regardless of field configuration. Read-only here: it's applied once at process start. To change it, copy this value into AB_DANGEROUS_EXTENSIONS, edit it, and restart - note that variable REPLACES this list rather than adding to it, so any extension you leave out becomes an accepted upload type.",
+    },
 
     // aws-s3-settings-provider.service.ts
     {

package/src/solid-core.module.ts

@@ -541,17 +541,27 @@ import { SwitchNode } from './services/workflow/nodes/switch.node';
           res.setHeader("X-Content-Type-Options", "nosniff");
 
           // Only a small allowlist of media types is ever safe to render inline. Everything
-          // else (including svg, html, and any other uploaded file) is forced to download
+          // else (including html and any other uploaded file) is forced to download
           // rather than be displayed/executed by the browser, regardless of what mimetype or
           // extension it was uploaded with.
           // basename first: getLowercaseFileExtension takes a file name, not a path, so a
           // directory containing a dot must not be mistaken for the extension. An
           // extensionless file yields undefined, which is not inline-safe - so it correctly
           // falls through to the forced-download branch.
-          if (!INLINE_SAFE_EXTENSIONS.has(getLowercaseFileExtension(basename(path)) ?? '')) {
+          const ext = getLowercaseFileExtension(basename(path)) ?? '';
+          if (!INLINE_SAFE_EXTENSIONS.has(ext)) {
             res.setHeader("Content-Type", "application/octet-stream");
             res.setHeader("Content-Disposition", "attachment");
           }
+
+          // svg is only ever inline-safe (see INLINE_SAFE_EXTENSIONS) once it can also render
+          // as an active document (<script>, event handlers). <img>/CSS never execute it, but
+          // a direct navigation to this URL would - so pin it to a locked-down document: no
+          // script, no network, and `sandbox` gives it an opaque origin so even a parser bypass
+          // can't reach app cookies or storage.
+          if (ext === 'svg') {
+            res.setHeader("Content-Security-Policy", "default-src 'none'; style-src 'unsafe-inline'; img-src data:; sandbox");
+          }
         },
       },
     }),