@solidxai/core 0.1.8-beta.9 → 0.1.8

package/src/services/setting.service.ts

@@ -15,6 +15,7 @@ import { ISettingsProvider, NoInfer, SettingDefinition, SettingLevel } from '../
 import { ModuleMetadataRepository } from 'src/repository/module-metadata.repository';
 import type { SolidCoreSetting } from './settings/default-settings-provider.service';
 import { Logger } from '@nestjs/common';
+import { EncryptionService } from './encryption.service';
 
 
 @Injectable()
@@ -23,6 +24,7 @@ export class SettingService {
 
   private settings: SettingDefinition[] = [];
   private settingsByKey = new Map<string, SettingDefinition>();
+  private readonly encryptionService: EncryptionService | null;
 
   private readonly arrayKeysToSkip = new Set([
     'authenticationPasswordRegex',
@@ -38,7 +40,11 @@ export class SettingService {
     readonly moduleMetadataRepo: ModuleMetadataRepository,
     private readonly requestContextService: RequestContextService,
     @InjectRepository(User) private readonly userRepository: Repository<User>,
-  ) { }
+  ) {
+    const encKey = process.env.APP_ENCRYPTION_KEY;
+    this.encryptionService = encKey ? new EncryptionService(encKey) : null;
+    if (!encKey) this._logger.warn('APP_ENCRYPTION_KEY is not set — encrypted settings will not be decrypted');
+  }
 
   private async getSettingsFromDb(): Promise<Setting[]> {
     const settings = await this.repo.find({ relations: ['user'] });
@@ -112,7 +118,15 @@ export class SettingService {
       const settingFromDb = settingsFromDbByKey.get(setting.key);
       const valueFromDb = settingFromDb?.value;
       if (settingFromDb?.key && valueFromDb !== undefined && valueFromDb !== null) {
-        const parsedValue = typeof valueFromDb === 'string' ? this.parseSettingValue(valueFromDb, settingFromDb.key) : valueFromDb;
+        let rawValue = valueFromDb;
+        if (settingFromDb.encrypted && this.encryptionService) {
+          try {
+            rawValue = this.encryptionService.decrypt(rawValue);
+          } catch {
+            this._logger.warn(`Failed to decrypt setting "${setting.key}" — using raw value`);
+          }
+        }
+        const parsedValue = typeof rawValue === 'string' ? this.parseSettingValue(rawValue, settingFromDb.key) : rawValue;
         return { ...setting, value: parsedValue };
       }
       return setting;
@@ -149,30 +163,38 @@ export class SettingService {
     const settingsToMutate: Setting[] = [];
     // const settingsToUpdate: Setting[] = [];
 
-    for (const { key, value, level, moduleName } of saEditableAndAbove) {
+    for (const { key, value, level, moduleName, encrypted } of saEditableAndAbove) {
       const moduleMetadata = await this.moduleMetadataRepo.findOneBy({ name: moduleName });
       if (!existingSettingsFromDbByKey.has(key)) {
         const setting = new Setting();
         setting.key = key;
         setting.level = level;
+        setting.encrypted = !!encrypted;
         if (moduleMetadata)
           setting.moduleMetadata = moduleMetadata;
 
+        let rawValue: string | null;
         if (typeof value === 'boolean') {
-          setting.value = value.toString();
+          rawValue = value.toString();
         } else if (Array.isArray(value)) {
-          setting.value = value.join(',');
+          rawValue = value.join(',');
         } else if (value === null || value === undefined) {
-          setting.value = null;
+          rawValue = null;
         } else {
-          setting.value = String(value);
+          rawValue = String(value);
         }
 
+        if (encrypted && this.encryptionService && rawValue !== null) {
+          rawValue = this.encryptionService.encrypt(rawValue);
+        }
+        setting.value = rawValue;
+
         settingsToMutate.push(setting);
       }
       else {
         const setting = existingSettingsFromDbByKey.get(key);
         setting.level = level;
+        setting.encrypted = !!encrypted;
         if (moduleMetadata)
           setting.moduleMetadata = moduleMetadata;
         settingsToMutate.push(setting);
@@ -289,22 +311,29 @@ export class SettingService {
       }
 
       const key = settingDto.key;
-      // const value = settingDto.value ?? '';
       const rawValue = settingDto.value;
-      const value = rawValue === null || rawValue === undefined ? null : String(rawValue);
+      let value = rawValue === null || rawValue === undefined ? null : String(rawValue);
 
       const settingType = settingDto.type ?? 'system';
+      const definition = this.settingsByKey.get(key);
+      const shouldEncrypt = !!definition?.encrypted && this.encryptionService !== null && value !== null;
+
+      if (shouldEncrypt) {
+        value = this.encryptionService.encrypt(value);
+      }
 
       const existingSetting = existingSettings.find(s => s.key === key);
       if (existingSetting) {
         existingSetting.value = value;
         existingSetting.type = settingType;
+        existingSetting.encrypted = shouldEncrypt;
         settingsToUpdate.push(existingSetting);
       } else {
         const newSetting = new Setting();
         newSetting.key = key;
         newSetting.value = value;
         newSetting.type = settingType;
+        newSetting.encrypted = shouldEncrypt;
 
         if (settingType === 'user' && user) {
           newSetting.user = user;

package/src/services/settings/default-settings-provider.service.ts

@@ -35,12 +35,13 @@ const getSolidCoreSettings = (isProd: boolean) => ([
   {
     moduleName: "solid-core", key: "solidXGenAiCodeBuilderConfig", value: JSON.stringify({
       models: {
-        default: { providerKey: "", behavior: { streaming: false, custom: "" } },
-        fast: { providerKey: "", behavior: { streaming: false, custom: "" } },
+        default: { providerId: "", model: "", behavior: { streaming: false, custom: "" } },
+        fast: { providerId: "", model: "", behavior: { streaming: false, custom: "" } },
       },
       providers: {},
-    }), level: SettingLevel.SystemAdminEditable
+    }), level: SettingLevel.SystemAdminEditable, encrypted: true
   },
+  { moduleName: "solid-core", key: "appEncryptionKey", value: process.env.APP_ENCRYPTION_KEY, level: SettingLevel.SystemEnv },
   { moduleName: "solid-core", key: "mcpEnabled", value: process.env.MCP_ENABLED || false, level: SettingLevel.SystemAdminReadonly },
   { moduleName: "solid-core", key: "mcpServerUrl", value: process.env.MCP_SERVER_URL, level: SettingLevel.SystemAdminReadonly },
   { moduleName: "solid-core", key: "mcpApiKey", value: process.env.MCP_API_KEY, level: SettingLevel.SystemEnv },

package/src/services/sso-code-storage.service.ts

@@ -0,0 +1,36 @@
+import { CACHE_MANAGER } from '@nestjs/cache-manager';
+import { Inject, Injectable, UnauthorizedException } from '@nestjs/common';
+import { Cache } from 'cache-manager';
+import { randomBytes } from 'crypto';
+
+const SSO_CODE_TTL_MS = 60 * 1000; // 60 seconds
+
+interface SsoCodeEntry {
+    userId: number;
+    accessToken: string;
+    refreshToken: string;
+}
+
+@Injectable()
+export class SsoCodeStorageService {
+    constructor(@Inject(CACHE_MANAGER) private cacheManager: Cache) {}
+
+    async generateCode(userId: number, accessToken: string, refreshToken: string): Promise<string> {
+        const code = randomBytes(32).toString('hex');
+        await this.cacheManager.set(this.getKey(code), { userId, accessToken, refreshToken }, SSO_CODE_TTL_MS);
+        return code;
+    }
+
+    async consumeCode(code: string): Promise<SsoCodeEntry> {
+        const entry = await this.cacheManager.get<SsoCodeEntry>(this.getKey(code));
+        if (!entry) {
+            throw new UnauthorizedException('Invalid or expired SSO code');
+        }
+        await this.cacheManager.del(this.getKey(code));
+        return entry;
+    }
+
+    private getKey(code: string): string {
+        return `sso-code-${code}`;
+    }
+}

package/src/solid-core.module.ts

@@ -78,6 +78,7 @@ import { MqMessageQueue } from './entities/mq-message-queue.entity';
 import { MqMessage } from './entities/mq-message.entity';
 import { SmsTemplate } from './entities/sms-template.entity';
 import { AccessTokenGuard } from './guards/access-token.guard';
+import { ApiKeyGuard } from './guards/api-key.guard';
 import { AuthenticationGuard } from './guards/authentication.guard';
 import { PermissionsGuard } from './guards/permissions.guard';
 import { SolidRegistry } from './helpers/solid-registry';
@@ -126,6 +127,7 @@ import { TwilioSmsQueuePublisherRedis } from './jobs/redis/twilio-sms-publisher-
 import { TwilioSmsQueueSubscriberRedis } from './jobs/redis/twilio-sms-subscriber-redis.service';
 import { UserRegistrationListener } from './listeners/user-registration.listener';
 import { GoogleOauthStrategy } from './passport-strategies/google-oauth.strategy';
+import { ApiKeyService } from './services/api-key.service';
 import { AuthenticationService } from './services/authentication.service';
 import { BcryptService } from './services/bcrypt.service';
 import { UuidExternalIdEntityComputedFieldProvider } from './services/computed-fields/entity/uuid-externalid-entity-computed-field-provider.service';
@@ -140,6 +142,7 @@ import { MqMessageQueueService } from './services/mq-message-queue.service';
 import { MqMessageService } from './services/mq-message.service';
 import { PdfService } from './services/pdf.service';
 import { RefreshTokenIdsStorageService } from './services/refresh-token-ids-storage.service';
+import { SsoCodeStorageService } from './services/sso-code-storage.service';
 import { ListOfModelsSelectionProvider } from './services/selection-providers/list-of-models-selection-provider.service';
 import { TinyUrlService } from './services/short-url/tiny-url.service';
 import { SmsTemplateService } from './services/sms-template.service';
@@ -205,6 +208,7 @@ import { SecurityRule } from './entities/security-rule.entity';
 import { Setting } from './entities/setting.entity';
 import { UserActivityHistory } from './entities/user-activity-history.entity';
 import { UserViewMetadata } from './entities/user-view-metadata.entity';
+import { UserApiKey } from './entities/user-api-key.entity';
 import { User } from './entities/user.entity';
 import { HttpExceptionFilter } from './filters/http-exception.filter';
 import { ModelMetadataHelperService } from './helpers/model-metadata-helper.service';
@@ -284,6 +288,7 @@ import { SettingRepository } from './repository/setting.repository';
 import { SmsTemplateRepository } from './repository/sms-template.repository';
 import { UserActivityHistoryRepository } from './repository/user-activity-history.repository';
 import { UserViewMetadataRepository } from './repository/user-view-metadata.repository';
+import { UserApiKeyRepository } from './repository/user-api-key.repository';
 import { UserRepository } from './repository/user.repository';
 import { ViewMetadataRepository } from './repository/view-metadata.repository';
 import { PermissionMetadataSeederService } from './seeders/permission-metadata-seeder.service';
@@ -415,6 +420,7 @@ import { Entity } from 'typeorm';
       Setting,
       SmsTemplate,
       User,
+      UserApiKey,
       UserActivityHistory,
       UserViewMetadata,
       ViewMetadata,
@@ -627,9 +633,12 @@ import { Entity } from 'typeorm';
     LocaleListSelectionProvider,
     SoftDeleteAwareEventSubscriber,
     AccessTokenGuard,
+    ApiKeyGuard,
+    ApiKeyService,
     AuthenticationService,
     GoogleAuthenticationController,
     RefreshTokenIdsStorageService,
+    SsoCodeStorageService,
     GoogleOauthStrategy,
     UserRegistrationListener,
     TestQueuePublisher,
@@ -679,6 +688,7 @@ import { Entity } from 'typeorm';
     RoleMetadataService,
     PermissionMetadataSeederService,
     UserService,
+    UserApiKeyRepository,
     UserRepository,
     SettingService,
     ConcatComputedFieldProvider,

package/src/subscribers/audit.subscriber.ts

@@ -2,7 +2,7 @@ import { Injectable, Logger, Scope } from '@nestjs/common';
 import { lowerFirst } from 'src/helpers/string.helper';
 import { SolidRegistry } from 'src/helpers/solid-registry';
 import { DataSource, EntityMetadata, EntitySubscriberInterface, InsertEvent, RemoveEvent, UpdateEvent } from 'typeorm';
-import { AuditQueuePayload } from 'src/jobs/rabbitmq/chatter-queue-publisher.service';
+import { AuditQueuePayload } from 'src/interfaces';
 import { RequestContextService } from 'src/services/request-context.service';
 import { PublisherFactory } from 'src/services/queues/publisher-factory.service';