Feat/attachments extra attrs

api/src/attachment/attachment.module.ts

@@ -13,6 +13,7 @@ import { MongooseModule } from '@nestjs/mongoose';
 import { PassportModule } from '@nestjs/passport';
 
 import { config } from '@/config';
+import { UserModule } from '@/user/user.module';
 
 import { AttachmentController } from './controllers/attachment.controller';
 import { AttachmentRepository } from './repositories/attachment.repository';
@@ -25,6 +26,7 @@ import { AttachmentService } from './services/attachment.service';
     PassportModule.register({
       session: true,
     }),
+    UserModule,
   ],
   providers: [AttachmentRepository, AttachmentService],
   controllers: [AttachmentController],

api/src/attachment/controllers/attachment.controller.spec.ts

@@ -1,19 +1,29 @@
 /*
- * Copyright © 2024 Hexastack. All rights reserved.
+ * Copyright © 2025 Hexastack. All rights reserved.
  *
  * Licensed under the GNU Affero General Public License v3.0 (AGPLv3) with the following additional terms:
  * 1. The name "Hexabot" is a trademark of Hexastack. You may not use this name in derivative works without express written permission.
  * 2. All derivative works must include clear attribution to the original creator and software, Hexastack and Hexabot, in a prominent location (e.g., in the software's "About" section, documentation, and README file).
  */
 
+import fs from 'fs';
+
+import { CACHE_MANAGER } from '@nestjs/cache-manager';
 import { BadRequestException } from '@nestjs/common/exceptions';
 import { NotFoundException } from '@nestjs/common/exceptions/not-found.exception';
 import { EventEmitter2 } from '@nestjs/event-emitter';
 import { MongooseModule } from '@nestjs/mongoose';
 import { Test, TestingModule } from '@nestjs/testing';
+import { Request } from 'express';
 
 import { LoggerService } from '@/logger/logger.service';
 import { PluginService } from '@/plugins/plugins.service';
+import { ModelRepository } from '@/user/repositories/model.repository';
+import { PermissionRepository } from '@/user/repositories/permission.repository';
+import { ModelModel } from '@/user/schemas/model.schema';
+import { PermissionModel } from '@/user/schemas/permission.schema';
+import { ModelService } from '@/user/services/model.service';
+import { PermissionService } from '@/user/services/permission.service';
 import { NOT_FOUND_ID } from '@/utils/constants/mock';
 import { IGNORED_TEST_FIELDS } from '@/utils/test/constants';
 import {
@@ -29,6 +39,11 @@ import { attachment, attachmentFile } from '../mocks/attachment.mock';
 import { AttachmentRepository } from '../repositories/attachment.repository';
 import { Attachment, AttachmentModel } from '../schemas/attachment.schema';
 import { AttachmentService } from '../services/attachment.service';
+import {
+  AttachmentAccess,
+  AttachmentCreatedByRef,
+  AttachmentResourceRef,
+} from '../types';
 
 import { AttachmentController } from './attachment.controller';
 
@@ -42,14 +57,30 @@ describe('AttachmentController', () => {
       controllers: [AttachmentController],
       imports: [
         rootMongooseTestModule(installAttachmentFixtures),
-        MongooseModule.forFeature([AttachmentModel]),
+        MongooseModule.forFeature([
+          AttachmentModel,
+          PermissionModel,
+          ModelModel,
+        ]),
       ],
       providers: [
         AttachmentService,
         AttachmentRepository,
+        PermissionService,
+        PermissionRepository,
+        ModelService,
+        ModelRepository,
         LoggerService,
         EventEmitter2,
         PluginService,
+        {
+          provide: CACHE_MANAGER,
+          useValue: {
+            del: jest.fn(),
+            get: jest.fn(),
+            set: jest.fn(),
+          },
+        },
       ],
     }).compile();
     attachmentController =
@@ -62,7 +93,10 @@ describe('AttachmentController', () => {
 
   afterAll(closeInMongodConnection);
 
-  afterEach(jest.clearAllMocks);
+  afterEach(() => {
+    jest.clearAllMocks();
+    jest.restoreAllMocks();
+  });
 
   describe('count', () => {
     it('should count attachments', async () => {
@@ -76,29 +110,52 @@ describe('AttachmentController', () => {
 
   describe('Upload', () => {
     it('should throw BadRequestException if no file is selected to be uploaded', async () => {
-      const promiseResult = attachmentController.uploadFile({
-        file: [],
-      });
+      const promiseResult = attachmentController.uploadFile(
+        {
+          file: [],
+        },
+        {} as Request,
+        { resourceRef: AttachmentResourceRef.BlockAttachment },
+      );
       await expect(promiseResult).rejects.toThrow(
         new BadRequestException('No file was selected'),
       );
     });
 
     it('should upload attachment', async () => {
+      jest.spyOn(fs.promises, 'writeFile').mockResolvedValue();
+
       jest.spyOn(attachmentService, 'create');
-      const result = await attachmentController.uploadFile({
-        file: [attachmentFile],
-      });
+      const result = await attachmentController.uploadFile(
+        {
+          file: [attachmentFile],
+        },
+        {
+          session: { passport: { user: { id: '9'.repeat(24) } } },
+        } as unknown as Request,
+        { resourceRef: AttachmentResourceRef.BlockAttachment },
+      );
+      const [name] = attachmentFile.filename.split('.');
       expect(attachmentService.create).toHaveBeenCalledWith({
         size: attachmentFile.size,
         type: attachmentFile.mimetype,
-        name: attachmentFile.filename,
-        channel: {},
-        location: `/${attachmentFile.filename}`,
+        name: attachmentFile.originalname,
+        location: expect.stringMatching(new RegExp(`^/${name}`)),
+        resourceRef: AttachmentResourceRef.BlockAttachment,
+        access: AttachmentAccess.Public,
+        createdByRef: AttachmentCreatedByRef.User,
+        createdBy: '9'.repeat(24),
       });
       expect(result).toEqualPayload(
-        [attachment],
-        [...IGNORED_TEST_FIELDS, 'url'],
+        [
+          {
+            ...attachment,
+            resourceRef: AttachmentResourceRef.BlockAttachment,
+            createdByRef: AttachmentCreatedByRef.User,
+            createdBy: '9'.repeat(24),
+          },
+        ],
+        [...IGNORED_TEST_FIELDS, 'location', 'url'],
       );
     });
   });

api/src/attachment/controllers/attachment.controller.ts

@@ -1,31 +1,32 @@
 /*
- * Copyright © 2024 Hexastack. All rights reserved.
+ * Copyright © 2025 Hexastack. All rights reserved.
  *
  * Licensed under the GNU Affero General Public License v3.0 (AGPLv3) with the following additional terms:
  * 1. The name "Hexabot" is a trademark of Hexastack. You may not use this name in derivative works without express written permission.
  * 2. All derivative works must include clear attribution to the original creator and software, Hexastack and Hexabot, in a prominent location (e.g., in the software's "About" section, documentation, and README file).
  */
 
-import { extname } from 'path';
-
 import {
   BadRequestException,
   Controller,
   Delete,
+  ForbiddenException,
   Get,
   HttpCode,
   NotFoundException,
   Param,
   Post,
   Query,
+  Req,
   StreamableFile,
   UploadedFiles,
+  UseGuards,
   UseInterceptors,
 } from '@nestjs/common';
 import { FileFieldsInterceptor } from '@nestjs/platform-express';
 import { CsrfCheck } from '@tekuconcept/nestjs-csrf';
+import { Request } from 'express';
 import { diskStorage, memoryStorage } from 'multer';
-import { v4 as uuidv4 } from 'uuid';
 
 import { config } from '@/config';
 import { CsrfInterceptor } from '@/interceptors/csrf.interceptor';
@@ -38,12 +39,18 @@ import { PageQueryPipe } from '@/utils/pagination/pagination-query.pipe';
 import { SearchFilterPipe } from '@/utils/pipes/search-filter.pipe';
 import { TFilterQuery } from '@/utils/types/filter.types';
 
-import { AttachmentDownloadDto } from '../dto/attachment.dto';
+import {
+  AttachmentContextParamDto,
+  AttachmentDownloadDto,
+} from '../dto/attachment.dto';
+import { AttachmentGuard } from '../guards/attachment-ability.guard';
 import { Attachment } from '../schemas/attachment.schema';
 import { AttachmentService } from '../services/attachment.service';
+import { AttachmentAccess, AttachmentCreatedByRef } from '../types';
 
 @UseInterceptors(CsrfInterceptor)
 @Controller('attachment')
+@UseGuards(AttachmentGuard)
 export class AttachmentController extends BaseController<Attachment> {
   constructor(
     private readonly attachmentService: AttachmentService,
@@ -61,7 +68,7 @@ export class AttachmentController extends BaseController<Attachment> {
   async filterCount(
     @Query(
       new SearchFilterPipe<Attachment>({
-        allowedFields: ['name', 'type'],
+        allowedFields: ['name', 'type', 'resourceRef'],
       }),
     )
     filters?: TFilterQuery<Attachment>,
@@ -90,7 +97,9 @@ export class AttachmentController extends BaseController<Attachment> {
   async findPage(
     @Query(PageQueryPipe) pageQuery: PageQueryDto<Attachment>,
     @Query(
-      new SearchFilterPipe<Attachment>({ allowedFields: ['name', 'type'] }),
+      new SearchFilterPipe<Attachment>({
+        allowedFields: ['name', 'type', 'resourceRef'],
+      }),
     )
     filters: TFilterQuery<Attachment>,
   ) {
@@ -114,26 +123,49 @@ export class AttachmentController extends BaseController<Attachment> {
         if (config.parameters.storageMode === 'memory') {
           return memoryStorage();
         } else {
-          return diskStorage({
-            destination: config.parameters.uploadDir,
-            filename: (req, file, cb) => {
-              const name = file.originalname.split('.')[0];
-              const extension = extname(file.originalname);
-              cb(null, `${name}-${uuidv4()}${extension}`);
-            },
-          });
+          return diskStorage({});
         }
       })(),
     }),
   )
   async uploadFile(
     @UploadedFiles() files: { file: Express.Multer.File[] },
+    @Req() req: Request,
+    @Query()
+    {
+      resourceRef,
+      access = AttachmentAccess.Public,
+    }: AttachmentContextParamDto,
   ): Promise<Attachment[]> {
     if (!files || !Array.isArray(files?.file) || files.file.length === 0) {
       throw new BadRequestException('No file was selected');
     }
 
-    return await this.attachmentService.uploadFiles(files);
+    const userId = req.session?.passport?.user?.id;
+    if (!userId) {
+      throw new ForbiddenException(
+        'Unexpected Error: Only authenticated users are allowed to upload',
+      );
+    }
+
+    const attachments: Attachment[] = [];
+    for (const file of files.file) {
+      const attachment = await this.attachmentService.store(file, {
+        name: file.originalname,
+        size: file.size,
+        type: file.mimetype,
+        resourceRef,
+        access,
+        createdBy: userId,
+        createdByRef: AttachmentCreatedByRef.User,
+      });
+
+      if (attachment) {
+        attachments.push(attachment);
+      }
+    }
+
+    return attachments;
   }
 
   /**