WIP:Dev

package.json

@@ -1,6 +1,6 @@
 {
   "name": "@solidxai/core",
-  "version": "0.1.11",
+  "version": "0.1.12-beta.1",
   "description": "This module is a NestJS module containing all the required core providers required by a Solid application",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",

src/constants/error-messages.ts

@@ -56,6 +56,7 @@ export const ERROR_MESSAGES = {
 
     // general errors
     FORBIDDEN: 'Forbidden',
+    RESOURCE_NOT_FOUND: 'The requested resource was not found.',
 
 
     // database errors

src/controllers/chatter-message.controller.ts

@@ -20,12 +20,12 @@ enum ShowSoftDeleted {
 export class ChatterMessageController {
   constructor(private readonly service: ChatterMessageService) {}
 
-  @ApiBearerAuth("jwt")
-  @Post()
-  @UseInterceptors(AnyFilesInterceptor())
-  create(@Body() createDto: CreateChatterMessageDto, @UploadedFiles() files: Array<Express.Multer.File>) {
-    return this.service.create(createDto, files);
-  }
+  // @ApiBearerAuth("jwt")
+  // @Post()
+  // @UseInterceptors(AnyFilesInterceptor())
+  // create(@Body() createDto: CreateChatterMessageDto, @UploadedFiles() files: Array<Express.Multer.File>) {
+  //   return this.service.create(createDto, files);
+  // }
 
   // @ApiBearerAuth("jwt")
   // @Post('/bulk')
@@ -61,7 +61,7 @@ export class ChatterMessageController {
   //   return this.service.recover(id);
   // }
 
-  @Public()
+  @ApiBearerAuth("jwt")
   @Get('/getChatterMessages/:entityId/:entityName')
   @ApiQuery({ name: 'showSoftDeleted', required: false, enum: ShowSoftDeleted })
   @ApiQuery({ name: 'limit', required: false, type: Number })

src/guards/access-token.guard.ts

@@ -2,23 +2,26 @@ import type { SolidCoreSetting } from "src/services/settings/default-settings-pr
 import {
   CanActivate,
   ExecutionContext,
-  Inject,
   Injectable,
   UnauthorizedException,
 } from '@nestjs/common';
 import { JwtService } from '@nestjs/jwt';
 import { Request } from 'express';
+import { ERROR_MESSAGES } from "src/constants/error-messages";
 import { ActiveUserData } from '../interfaces/active-user-data.interface';
 import { REQUEST_USER_KEY } from "../constants";
 import { PermissionMetadataService } from '../services/permission-metadata.service';
 import { ClsService } from 'nestjs-cls';
+import { ActiveSessionStorageService } from "../services/active-session-storage.service";
 import { SettingService } from '../services/setting.service';
+import { createHash } from "crypto";
 
 @Injectable()
 export class AccessTokenGuard implements CanActivate {
   constructor(
     private readonly jwtService: JwtService,
     private readonly permissionsService: PermissionMetadataService,
+    private readonly activeSessionStorage: ActiveSessionStorageService,
     private readonly settingService: SettingService,
     private readonly cls: ClsService
   ) { }
@@ -44,6 +47,9 @@ export class AccessTokenGuard implements CanActivate {
         jwtConfiguration
       );
 
+      // Prevent Concurrent Login Feature
+      await this.validateConcurrentLoginSession(payload, token);
+
       // Load permissions given the user. 
       const permissions = await this.permissionsService.findAllUsingRoles(payload.roles);
       payload.permissions = permissions.map((permission) => permission.name);
@@ -52,8 +58,10 @@ export class AccessTokenGuard implements CanActivate {
       this.cls.set(REQUEST_USER_KEY, payload);
       // console.log(`About to set payload in the request user key:`);
       // console.log(payload);
-    } catch {
-      throw new UnauthorizedException();
+    } catch (err) {
+      throw err instanceof UnauthorizedException
+        ? err
+        : new UnauthorizedException();
     }
     return true;
   }
@@ -64,4 +72,36 @@ export class AccessTokenGuard implements CanActivate {
     const [_, token] = request.headers.authorization?.split(' ') ?? [];
     return token;
   }
+
+  private resolveSessionId(payload: ActiveUserData, token: string): string {
+    if (payload.sessionId) {
+      return payload.sessionId;
+    }
+
+    // Legacy tokens (issued before preventConcurrentLogins was enabled)
+    // have no sessionId claim, so derive a stable fallback from the token.
+    return createHash('sha256').update(token).digest('hex');
+  }
+
+  private async validateConcurrentLoginSession(payload: ActiveUserData, token: string,): Promise<void> {
+    if (!this.settingService.getConfigValue<SolidCoreSetting>("preventConcurrentLogins",)) {
+      return;
+    }
+
+    const activeSessionId = await this.activeSessionStorage.getActiveSession(payload.sub);
+    const currentSessionId = this.resolveSessionId(payload, token);
+
+    if (!activeSessionId) {
+      // No active session recorded yet for this user — this is the first
+      // request we've seen since the feature was enabled (or storage was
+      // cleared). Adopt this request's session as the active one so this
+      // browser stays logged in going forward.
+      await this.activeSessionStorage.setActiveSession(payload.sub, currentSessionId,);
+      return;
+    }
+
+    if (currentSessionId !== activeSessionId) {
+      throw new UnauthorizedException(ERROR_MESSAGES.SESSION_INVALID);
+    }
+  }
 }

src/guards/authentication.guard.ts

@@ -32,6 +32,22 @@ export class AuthenticationGuard implements CanActivate {
     private readonly cls: ClsService,
   ) { }
 
+  private isGenericUnauthorizedError(error: unknown): boolean {
+    if (!(error instanceof UnauthorizedException)) {
+      return false;
+    }
+
+    const response = error.getResponse();
+    const message =
+      typeof response === 'string'
+        ? response
+        : Array.isArray((response as any)?.message)
+          ? (response as any).message[0]
+          : (response as any)?.message;
+
+    return !message || message === 'Unauthorized';
+  }
+
   async canActivate(context: ExecutionContext): Promise<boolean> {
     // If method marked as public, then we return with true, else go ahead and apply the access token guard. 
     const contextLog = context.getHandler();
@@ -72,7 +88,12 @@ export class AuthenticationGuard implements CanActivate {
       const canActivate = await Promise.resolve(
         instance.canActivate(context),
       ).catch((err) => {
-        error = err;
+        if (
+          this.isGenericUnauthorizedError(error) ||
+          !this.isGenericUnauthorizedError(err)
+        ) {
+          error = err;
+        }
       });
 
       if (canActivate) {

src/helpers/bootstrap.helper.ts

@@ -1,5 +1,5 @@
-import { ValidationPipe } from '@nestjs/common';
-import { NestFactory } from '@nestjs/core';
+import { ClassSerializerInterceptor, ValidationPipe } from '@nestjs/common';
+import { NestFactory, Reflector } from '@nestjs/core';
 import { WsAdapter } from '@nestjs/platform-ws';
 import { DocumentBuilder, SwaggerModule } from '@nestjs/swagger';
 import { NextFunction, Request, Response } from 'express';
@@ -169,7 +169,13 @@ export async function bootstrapSolidApp(
   }
 
   // Global interceptor
-  app.useGlobalInterceptors(new WrapResponseInterceptor());
+  app.useGlobalInterceptors(
+    new ClassSerializerInterceptor(app.get(Reflector), {
+      enableImplicitConversion: true, // optional but handy
+      // groups: ['client'], // if you use groups
+    }),
+    new WrapResponseInterceptor()
+  );
 
   // CORS
   app.enableCors(buildDefaultCorsOptions());

src/helpers/solid-core-error-codes-provider.service.ts

@@ -1,5 +1,6 @@
 // src/common/errors/providers/solidcore-error-code.provider.ts
 import { Injectable } from '@nestjs/common';
+import { ERROR_MESSAGES } from 'src/constants/error-messages';
 import { ErrorCodeProvider } from 'src/decorators/error-codes-provider.decorator';
 import { ErrorMeta, ErrorRule, IErrorCodeProvider } from 'src/interfaces';
 
@@ -13,6 +14,24 @@ export class SolidCoreErrorCodesProvider implements IErrorCodeProvider {
 
     rules(): ReadonlyArray<ErrorRule> {
         return [
+            {
+                code: 'solidx-session-invalid',
+                priority: 110,
+                match: (txt) => txt.includes(ERROR_MESSAGES.SESSION_INVALID.toLowerCase()),
+                meta: {
+                    message: ERROR_MESSAGES.SESSION_INVALID,
+                    httpStatus: 401,
+                },
+            },
+            {
+                code: 'solidx-session-expired',
+                priority: 110,
+                match: (txt) => txt.includes(ERROR_MESSAGES.SESSION_EXPIRED.toLowerCase()),
+                meta: {
+                    message: ERROR_MESSAGES.SESSION_EXPIRED,
+                    httpStatus: 401,
+                },
+            },
             {
                 code: 'solidx-mcp-server-unavailable',
                 priority: 100,
@@ -24,6 +43,15 @@ export class SolidCoreErrorCodesProvider implements IErrorCodeProvider {
                     httpStatus: 503,
                 },
             },
+            {
+                code: 'solidx-resource-not-found',
+                priority: 95,
+                match: (txt) => txt.includes('enoent') && txt.includes('no such file or directory'),
+                meta: {
+                    message: ERROR_MESSAGES.RESOURCE_NOT_FOUND,
+                    httpStatus: 404,
+                },
+            },
             {
                 code: 'solidx-db-duplicate-key',
                 priority: 90,
@@ -60,4 +88,4 @@ export class SolidCoreErrorCodesProvider implements IErrorCodeProvider {
         const rule = this.rules().find((r) => r.code === code);
         return rule?.meta;
     }
-}
+}

src/index.ts

@@ -8,6 +8,7 @@ export * from './commands/run-tests.command'
 export * from './commands/test.command'
 
 export * from './config/cache.options'
+export * from './services/active-session-storage.service'
 
 export * from './decorators/active-user.decorator'
 export * from './decorators/solid-request-context.decorator'

src/interfaces/active-user-data.interface.ts

@@ -16,6 +16,12 @@ export interface ActiveUserData {
    */
   email: string;
 
+  /**
+   * Logical login session identifier used to invalidate older sessions when
+   * concurrent logins are disabled.
+   */
+  sessionId?: string;
+
   /**
    * The subject's (user) roles.
    * These are part of the JWT token, we simply decode them.

src/seeders/module-metadata-seeder.service.ts

@@ -1536,8 +1536,9 @@ export class ModuleMetadataSeederService {
             const { fields: fieldsMetadata, ...modelMetaDataWithoutFields } = modelMetadata;
 
             // Load and set the parent model if it exists.
+            let parentModel: ModelMetadata | null = null;
             if (modelMetadata.isChild && modelMetadata.parentModelUserKey) {
-                const parentModel = await this.getModelByUserKeyCached(modelMetadata.parentModelUserKey, {
+                parentModel = await this.getModelByUserKeyCached(modelMetadata.parentModelUserKey, {
                     moduleName: moduleMetadata.name,
                     component: 'module-model-fields',
                     details: `parentModel=${modelMetadata.parentModelUserKey}`,
@@ -1605,7 +1606,27 @@ export class ModuleMetadataSeederService {
                 }
             }
 
-            // Now that we have created fields & model update the model to stamp the userKeyField. 
+            // If userKeyField wasn't found among this model's own fields (e.g. STI "extension" models
+            // whose userKeyField is a column inherited from the parent entity), look it up on the
+            // parent model by the same name.
+            if (!userKeyField && modelMetadata.isChild && parentModel && userKeyFieldName) {
+                const inheritedUserKeyField = await this.timeOperation('field-find-inherited-user-key', () => fieldMetadataRepo.findOne({
+                    where: {
+                        model: { id: parentModel.id },
+                        name: userKeyFieldName,
+                    },
+                }), {
+                    moduleName: moduleMetadata.name,
+                    component: 'module-model-fields',
+                    serviceCall: 'fieldMetadataRepo.findOne',
+                    details: `model=${modelMetadata.singularName} parentModel=${modelMetadata.parentModelUserKey} field=${userKeyFieldName}`,
+                });
+                if (inheritedUserKeyField) {
+                    userKeyField = inheritedUserKeyField;
+                }
+            }
+
+            // Now that we have created fields & model update the model to stamp the userKeyField.
             if (userKeyField) {
                 modelMetaDataWithoutFields['userKeyField'] = userKeyField;
                 await this.timeOperation('model-user-key-field-upsert', () => this.modelMetadataService.upsert(modelMetaDataWithoutFields), {

src/seeders/seed-data/solid-core-metadata.json

@@ -5304,7 +5304,6 @@
         "SavedFiltersController.update",
         "SavedFiltersController.insertMany",
         "SavedFiltersController.create",
-        "ChatterMessageController.create",
         "ChatterMessageController.getChatterMessages",
         "ChatterMessageController.postMessage",
         "ChatterMessageController.findMany",

src/services/active-session-storage.service.ts

@@ -0,0 +1,24 @@
+import { CACHE_MANAGER } from "@nestjs/cache-manager";
+import { Inject, Injectable } from "@nestjs/common";
+import { Cache } from "cache-manager";
+
+@Injectable()
+export class ActiveSessionStorageService {
+  constructor(@Inject(CACHE_MANAGER) private readonly cacheManager: Cache) {}
+
+  async setActiveSession(userId: number, sessionId: string): Promise<void> {
+    await this.cacheManager.set(this.getKey(userId), sessionId);
+  }
+
+  async getActiveSession(userId: number): Promise<string | undefined> {
+    return this.cacheManager.get(this.getKey(userId));
+  }
+
+  async clearActiveSession(userId: number): Promise<void> {
+    await this.cacheManager.del(this.getKey(userId));
+  }
+
+  private getKey(userId: number): string {
+    return `active-session-${userId}`;
+  }
+}