@solidxai/core 0.1.17-beta.0 → 0.1.17-beta.2

package/src/controllers/user.controller.ts

@@ -1,6 +1,6 @@
-import { Controller, Post, Body, Param, UploadedFiles, UseInterceptors, Put, Get, Query, Delete, Patch } from '@nestjs/common';
+import { Controller, Post, Body, Param, UploadedFiles, UseInterceptors, Put, Get, Query, Delete, Patch, Logger } from '@nestjs/common';
 import { AnyFilesInterceptor } from "@nestjs/platform-express";
-import { ApiBearerAuth, ApiForbiddenResponse, ApiQuery, ApiTags } from '@nestjs/swagger';
+import { ApiBearerAuth, ApiForbiddenResponse, ApiOperation, ApiQuery, ApiTags } from '@nestjs/swagger';
 import { UserService } from '../services/user.service';
 import { CreateUserDto } from '../dtos/create-user.dto';
 import { UpdateUserDto } from '../dtos/update-user.dto';
@@ -13,21 +13,55 @@ import { SolidRequestContextDto } from 'src/dtos/solid-request-context.dto';
 import { UpdateUserProfileDto } from 'src/dtos/update-user-profile.dto';
 
 @ApiTags('Solid Core')
-@Controller('user') //FIXME: Change this to the model plural name 
+@Controller('user') //FIXME: Change this to the model plural name
 export class UserController {
+  private readonly logger = new Logger(UserController.name);
+
   constructor(private readonly service: UserService) { }
 
+  /**
+   * @deprecated Bypasses `AuthenticationService.signUp`, so it never runs
+   * `initializeRolesForNewUser` - a user created here gets no role at all, not even
+   * the "Internal User" baseline, and none of the SignupIntent dispatch introduced
+   * alongside the extension-user provider work applies. Use `POST /iam/register-private`
+   * (an authenticated core user, with roles you name) or the extension model's own
+   * generated create endpoint instead.
+   *
+   * A workspace-wide search (frontends and backend callers across every consuming app
+   * in this monorepo) found no caller as of 2026-09-11. Kept for one deprecation cycle
+   * in case an external caller exists outside this workspace - the warning below is
+   * how that would surface - before being removed in a future major version.
+   */
+  @ApiOperation({
+    deprecated: true,
+    description: 'Deprecated: creates a user with no role assignment, not even the default. Use POST /iam/register-private, or the extension model\'s own create endpoint, instead. Scheduled for removal in a future major version.',
+  })
   @ApiBearerAuth("jwt")
   @Post()
   @UseInterceptors(AnyFilesInterceptor())
   create(@Body() createDto: CreateUserDto, @UploadedFiles() files: Array<Express.Multer.File>, @SolidRequestContextDecorator() solidRequestContext: SolidRequestContextDto) {
+    this.logger.warn(
+      `Deprecated endpoint POST /user was called (username="${createDto?.username}"). ` +
+      'This bypasses role assignment entirely and is scheduled for removal. ' +
+      'Use POST /iam/register-private or the extension model\'s own create endpoint.',
+    );
     return this.service.create(createDto, files, solidRequestContext);
   }
 
+  /** @deprecated See {@link create} - same gap, applied per row. */
+  @ApiOperation({
+    deprecated: true,
+    description: 'Deprecated: creates users with no role assignment, not even the default. Use the extension model\'s own bulk-create endpoint, or repeated calls to POST /iam/register-private, instead. Scheduled for removal in a future major version.',
+  })
   @ApiBearerAuth("jwt")
   @Post('/bulk')
   @UseInterceptors(AnyFilesInterceptor())
   insertMany(@Body() createDtos: CreateUserDto[], @UploadedFiles() filesArray: Express.Multer.File[][] = [], @SolidRequestContextDecorator() solidRequestContext: SolidRequestContextDto) {
+    this.logger.warn(
+      `Deprecated endpoint POST /user/bulk was called (count=${createDtos?.length ?? 0}, ` +
+      `usernames=${createDtos?.map(dto => dto.username).join(', ')}). ` +
+      'This bypasses role assignment entirely and is scheduled for removal.',
+    );
     return this.service.insertMany(createDtos, filesArray, solidRequestContext);
   }
 

package/src/services/authentication.service.ts

@@ -55,7 +55,6 @@ import { MetadataValidationService } from "./metadata-validation.service";
 import { UserService } from "./user.service";
 import { SmsFactory } from "src/factories/sms.factory";
 import { WhatsAppFactory } from "src/factories/whatsapp.factory";
-import { SolidRegistry } from "src/helpers/solid-registry";
 
 enum LoginProvider {
   LOCAL = "local",
@@ -150,7 +149,6 @@ export class AuthenticationService {
 
     @InjectDataSource()
     private readonly dataSource: DataSource,
-    private readonly solidRegistry: SolidRegistry,
   ) {
     // this.mailService = this.mailServiceFactory.getMailService();
   }
@@ -281,11 +279,12 @@ export class AuthenticationService {
         // roles(), which is where a provider validates its discriminator, and
         // CreateUserDto types roles as UpdateRoleMetadataDto[] where performSignUp
         // expects role-name strings. [] here falls through to `defaultRole`.
-        return (
-          this.solidRegistry
-            .getExtensionUserCreationProvider()
-            ?.roles(dto as any) ?? []
-        );
+        //
+        // Delegated to UserService.resolveProviderRoles - the one place that calls
+        // provider.roles() - rather than looking up the registry here too, which is
+        // what UserService.resolveSelfRegistrationRoles (the OAuth callers' equivalent
+        // of this switch) also needs and previously duplicated.
+        return this.userService.resolveProviderRoles(dto);
 
       case RolesSource.Caller:
         return dto.roles ?? [];
@@ -730,7 +729,7 @@ export class AuthenticationService {
     }
 
     try {
-      const user = await this.upsertUserWithRegistrationVerificationTokens(
+      const user = await this.resolveUserForOtpRegistration(
         existingUser,
         signUpDto,
         validationSource,
@@ -787,7 +786,7 @@ export class AuthenticationService {
     );
   }
 
-  private async upsertUserWithRegistrationVerificationTokens(
+  private async resolveUserForOtpRegistration(
     existingUser: User,
     signUpDto: OTPSignUpDto,
     validationSource: string,
@@ -808,16 +807,19 @@ export class AuthenticationService {
       await this.assignRegistrationOtp(validationSource, user);
       await repo.save(user);
 
-      if (roles.length) {
-        await this.userService.addRolesToUser(user.username, roles);
-      } else {
-        // The provider named none, or there is no provider: fall back to the configured
-        // default, matching what performSignUp does on the password paths.
-        await this.userService.addRoleToUser(
-          user.username,
-          this.settingService.getConfigValue<SolidCoreSetting>("defaultRole"),
-        );
-      }
+      // The provider named none, or there is no provider: fall back to the configured
+      // default, matching what performSignUp does on the password paths. Built as a
+      // fresh array rather than mutating `roles` - RolesSource.Provider can return
+      // whatever reference the provider's roles() handed back.
+      const defaultRole = this.settingService.getConfigValue<SolidCoreSetting>("defaultRole");
+      const effectiveRoles = roles.length ? roles : [defaultRole].filter(Boolean);
+
+      // initializeRolesForNewUser always grants "Internal User" - the baseline every
+      // other signup path gets via handlePostSignup - which this branch previously
+      // skipped entirely by calling addRolesToUser/addRoleToUser directly. Without it
+      // an OTP-registered user could not even read their own User record: the
+      // "Internal User" role is what carries that security rule.
+      await this.userService.initializeRolesForNewUser(effectiveRoles, user);
       return user;
     }
 

package/src/services/settings/default-settings-provider.service.ts

@@ -7,6 +7,7 @@ import {
   SettingLevel,
 } from "src/interfaces";
 import { getDefaultThemeKey, getThemesByMode } from "src/theme/theme-registry";
+import { DANGEROUS_EXTENSIONS } from "src/constants/media-file-types";
 
 export const DEFAULT_MEDIA_UPLOAD_DIR = "media-uploads";
 export const DEFAULT_MEDIA_FILE_STORAGE_DIR = "media-files-storage";
@@ -546,6 +547,17 @@ const getSolidCoreSettings = (isProd: boolean) =>
       controlType: "numeric",
       helpText: "Global upload size limit enforced by Multer under every per-field mediaMaxSizeKb restriction. Read-only here: it's applied once at process start, so changing AB_MEDIA_MAX_FILE_SIZE_MB requires an app restart to take effect - editing this in the admin UI would not do that.",
     },
+    {
+      moduleName: "solid-core",
+      key: "dangerousExtensions",
+      value: [...DANGEROUS_EXTENSIONS].join(','),
+      level: SettingLevel.SystemAdminReadonly,
+      label: "Blocked Upload Extensions",
+      group: "storage-settings",
+      sortOrder: 46,
+      controlType: "shortText",
+      helpText: "File extensions rejected on every upload path, regardless of field configuration. Read-only here: it's applied once at process start. To change it, copy this value into AB_DANGEROUS_EXTENSIONS, edit it, and restart - note that variable REPLACES this list rather than adding to it, so any extension you leave out becomes an accepted upload type.",
+    },
 
     // aws-s3-settings-provider.service.ts
     {

package/src/services/user.service.ts

@@ -145,6 +145,49 @@ export class UserService extends CRUDService<User> {
     };
   }
 
+  /**
+   * Asks the registered extension-user provider for role names, treating "no provider
+   * registered" and "provider named none for this DTO" identically as [].
+   *
+   * The one place that actually calls `IExtensionUserCreationProvider.roles()`.
+   * `resolveSelfRegistrationRoles` below and `AuthenticationService.resolveSignupRoles`'s
+   * `Provider` branch both delegate here rather than each re-deriving "look up the
+   * registry, call roles(), default to []". Lives on `UserService` - not on
+   * `SolidRegistry`, which stays a pure lookup/storage layer for every provider kind it
+   * holds - because `AuthenticationService` already injects `UserService` directly
+   * (mirrors `buildSignupTarget`, and the DI cycle runs the other way: `UserService`
+   * cannot inject `AuthenticationService` back).
+   */
+  resolveProviderRoles(dto: Record<string, any>): string[] {
+    return (
+      this.moduleRef
+        .get(SolidRegistry, { strict: false })
+        ?.getExtensionUserCreationProvider()
+        ?.roles(dto as any) ?? []
+    );
+  }
+
+  /**
+   * Role names for a self-provisioning user, mirroring SignupIntent.SelfRegistration's
+   * policy on the password/OTP paths: ask the extension-user provider first, and fall
+   * back to the configured `defaultRole` when it names none - either because there is
+   * no provider, or the provider declines to name any for this DTO.
+   *
+   * Safe to call for OAuth even though `OauthUserDto` carries no discriminator field:
+   * a provider whose `roles()` requires one already needs to default it for public
+   * register/OTP to work at all (see the extending-users docs), and once it does,
+   * this resolves the same way automatically - there is no separate obligation OAuth
+   * places on providers beyond what self-registration already requires.
+   */
+  private resolveSelfRegistrationRoles(dto: Record<string, any>): string[] {
+    const roles = this.resolveProviderRoles(dto);
+    if (roles.length) {
+      return roles;
+    }
+    const defaultRole = this.settingService.getConfigValue<SolidCoreSetting>("defaultRole");
+    return defaultRole ? [defaultRole] : [];
+  }
+
   async findOneByEmail(email: string): Promise<User> {
     return await this.repo.findOne({
       where: {
@@ -315,21 +358,26 @@ export class UserService extends CRUDService<User> {
 
     // if we are unable to find a user then we need to create one.
     if (!user) {
-      const user = new User();
-      user.username = oauthUserDto.email;
-      user.email = oauthUserDto.email;
-      user.fullName = oauthUserDto.name;
-      user.lastLoginProvider = oauthUserDto.provider;
-      user.accessCode = oauthUserDto.accessCode;
-      user.googleAccessToken = oauthUserDto.accessToken;
-      user.googleId = oauthUserDto.providerId;
-      user.googleProfilePicture = oauthUserDto.picture;
-
-      const savedUser = await this.repo.save(user);
+      // Social sign-in provisions an app user, so it is built and roled the same way
+      // public signup and OTP registration are: entity through the registered
+      // extension-user provider when there is one (see buildSignupTarget), roles
+      // through resolveSelfRegistrationRoles below, which asks that same provider
+      // first and falls back to `defaultRole`.
+      const { entity, repo } = await this.buildSignupTarget(oauthUserDto, true);
+      entity.username = oauthUserDto.email;
+      entity.email = oauthUserDto.email;
+      entity.fullName = oauthUserDto.name;
+      entity.lastLoginProvider = oauthUserDto.provider;
+      entity.accessCode = oauthUserDto.accessCode;
+      entity.googleAccessToken = oauthUserDto.accessToken;
+      entity.googleId = oauthUserDto.providerId;
+      entity.googleProfilePicture = oauthUserDto.picture;
+
+      const savedUser = await repo.save(entity);
 
       // Initialize the user roles
       await this.initializeRolesForNewUser(
-        [this.settingService.getConfigValue<SolidCoreSetting>("defaultRole")],
+        this.resolveSelfRegistrationRoles(oauthUserDto),
         savedUser,
       );
     }
@@ -390,20 +438,22 @@ export class UserService extends CRUDService<User> {
         // facebookProviderFallback,
       );
 
-      const newUser = new User();
-      newUser.username = username;
-      newUser.email = email;
-      newUser.fullName = oauthUserDto.name;
-      newUser.lastLoginProvider = oauthUserDto.provider;
-      newUser.accessCode = oauthUserDto.accessCode;
-      newUser.facebookAccessToken = oauthUserDto.accessToken;
-      newUser.facebookId = oauthUserDto.providerId;
-      newUser.facebookProfilePicture = oauthUserDto.picture;
+      // See resolveUserOnOauthGoogle for why entity and roles both go through the
+      // extension-user provider first, falling back to a plain User / `defaultRole`.
+      const { entity, repo } = await this.buildSignupTarget(oauthUserDto, true);
+      entity.username = username;
+      entity.email = email;
+      entity.fullName = oauthUserDto.name;
+      entity.lastLoginProvider = oauthUserDto.provider;
+      entity.accessCode = oauthUserDto.accessCode;
+      entity.facebookAccessToken = oauthUserDto.accessToken;
+      entity.facebookId = oauthUserDto.providerId;
+      entity.facebookProfilePicture = oauthUserDto.picture;
 
-      const savedUser = await this.repo.save(newUser);
+      const savedUser = await repo.save(entity);
 
       await this.initializeRolesForNewUser(
-        [this.settingService.getConfigValue<SolidCoreSetting>("defaultRole")],
+        this.resolveSelfRegistrationRoles(oauthUserDto),
         savedUser,
       );
       return savedUser;
@@ -432,20 +482,22 @@ export class UserService extends CRUDService<User> {
     });
 
     if (!user) {
-      const newUser = new User();
-      newUser.username = oauthUserDto.email;
-      newUser.email = oauthUserDto.email;
-      newUser.fullName = oauthUserDto.name;
-      newUser.lastLoginProvider = oauthUserDto.provider;
-      newUser.accessCode = oauthUserDto.accessCode;
-      newUser.microsoftAccessToken = oauthUserDto.accessToken;
-      newUser.microsoftId = oauthUserDto.providerId;
-      newUser.microsoftProfilePicture = oauthUserDto.picture;
-
-      const savedUser = await this.repo.save(newUser);
+      // See resolveUserOnOauthGoogle for why entity and roles both go through the
+      // extension-user provider first, falling back to a plain User / `defaultRole`.
+      const { entity, repo } = await this.buildSignupTarget(oauthUserDto, true);
+      entity.username = oauthUserDto.email;
+      entity.email = oauthUserDto.email;
+      entity.fullName = oauthUserDto.name;
+      entity.lastLoginProvider = oauthUserDto.provider;
+      entity.accessCode = oauthUserDto.accessCode;
+      entity.microsoftAccessToken = oauthUserDto.accessToken;
+      entity.microsoftId = oauthUserDto.providerId;
+      entity.microsoftProfilePicture = oauthUserDto.picture;
+
+      const savedUser = await repo.save(entity);
 
       await this.initializeRolesForNewUser(
-        [this.settingService.getConfigValue<SolidCoreSetting>("defaultRole")],
+        this.resolveSelfRegistrationRoles(oauthUserDto),
         savedUser,
       );
     } else {
@@ -476,20 +528,22 @@ export class UserService extends CRUDService<User> {
     });
 
     if (!user) {
-      const newUser = new User();
-      newUser.username = oauthUserDto.email;
-      newUser.email = oauthUserDto.email;
-      newUser.fullName = oauthUserDto.name;
-      newUser.lastLoginProvider = oauthUserDto.provider;
-      newUser.accessCode = oauthUserDto.accessCode;
-      newUser.microsoftActiveDirectoryAccessToken = oauthUserDto.accessToken;
-      newUser.microsoftActiveDirectoryId = oauthUserDto.providerId;
-      newUser.microsoftActiveDirectoryProfilePicture = oauthUserDto.picture;
-
-      const savedUser = await this.repo.save(newUser);
+      // See resolveUserOnOauthGoogle for why entity and roles both go through the
+      // extension-user provider first, falling back to a plain User / `defaultRole`.
+      const { entity, repo } = await this.buildSignupTarget(oauthUserDto, true);
+      entity.username = oauthUserDto.email;
+      entity.email = oauthUserDto.email;
+      entity.fullName = oauthUserDto.name;
+      entity.lastLoginProvider = oauthUserDto.provider;
+      entity.accessCode = oauthUserDto.accessCode;
+      entity.microsoftActiveDirectoryAccessToken = oauthUserDto.accessToken;
+      entity.microsoftActiveDirectoryId = oauthUserDto.providerId;
+      entity.microsoftActiveDirectoryProfilePicture = oauthUserDto.picture;
+
+      const savedUser = await repo.save(entity);
 
       await this.initializeRolesForNewUser(
-        [this.settingService.getConfigValue<SolidCoreSetting>("defaultRole")],
+        this.resolveSelfRegistrationRoles(oauthUserDto),
         savedUser,
       );
     } else {

package/src/solid-core.module.ts

@@ -541,17 +541,27 @@ import { SwitchNode } from './services/workflow/nodes/switch.node';
           res.setHeader("X-Content-Type-Options", "nosniff");
 
           // Only a small allowlist of media types is ever safe to render inline. Everything
-          // else (including svg, html, and any other uploaded file) is forced to download
+          // else (including html and any other uploaded file) is forced to download
           // rather than be displayed/executed by the browser, regardless of what mimetype or
           // extension it was uploaded with.
           // basename first: getLowercaseFileExtension takes a file name, not a path, so a
           // directory containing a dot must not be mistaken for the extension. An
           // extensionless file yields undefined, which is not inline-safe - so it correctly
           // falls through to the forced-download branch.
-          if (!INLINE_SAFE_EXTENSIONS.has(getLowercaseFileExtension(basename(path)) ?? '')) {
+          const ext = getLowercaseFileExtension(basename(path)) ?? '';
+          if (!INLINE_SAFE_EXTENSIONS.has(ext)) {
             res.setHeader("Content-Type", "application/octet-stream");
             res.setHeader("Content-Disposition", "attachment");
           }
+
+          // svg is only ever inline-safe (see INLINE_SAFE_EXTENSIONS) once it can also render
+          // as an active document (<script>, event handlers). <img>/CSS never execute it, but
+          // a direct navigation to this URL would - so pin it to a locked-down document: no
+          // script, no network, and `sandbox` gives it an opaque origin so even a parser bypass
+          // can't reach app cookies or storage.
+          if (ext === 'svg') {
+            res.setHeader("Content-Security-Policy", "default-src 'none'; style-src 'unsafe-inline'; img-src data:; sandbox");
+          }
         },
       },
     }),