streamby-core 0.26.9 → 0.27.0

package/dist/adapters/database/connectionManager.js

@@ -43,58 +43,81 @@ const getConnection = (id) => {
 exports.getConnection = getConnection;
 const ensureTablesExist = async (pool) => {
     try {
-        await pool.query(`
-      CREATE SCHEMA IF NOT EXISTS streamby;
-      CREATE EXTENSION IF NOT EXISTS "uuid-ossp";
-      CREATE TABLE IF NOT EXISTS streamby.projects (
-        id UUID PRIMARY KEY DEFAULT uuid_generate_v4(),
-        name VARCHAR(255) NOT NULL,
-        description TEXT,
-        image TEXT,
-        "createdAt" TIMESTAMP WITH TIME ZONE DEFAULT NOW(),
-        "updatedAt" TIMESTAMP WITH TIME ZONE DEFAULT NOW()
-      );
+        await pool.query(`
+      CREATE SCHEMA IF NOT EXISTS streamby;
+      CREATE EXTENSION IF NOT EXISTS "uuid-ossp";
+    `);
+        // Migrate id column from UUID to TEXT if it was created with the old schema
+        await pool.query(`
+      DO $$ BEGIN
+        ALTER TABLE streamby.projects ALTER COLUMN id TYPE TEXT USING id::text;
+        ALTER TABLE streamby.projects ALTER COLUMN id SET DEFAULT uuid_generate_v4()::text;
+      EXCEPTION WHEN OTHERS THEN NULL; END $$;
+    `);
+        await pool.query(`
+      CREATE TABLE IF NOT EXISTS streamby.projects (
+        id               TEXT PRIMARY KEY DEFAULT uuid_generate_v4()::text,
+        name             VARCHAR(255) NOT NULL,
+        description      TEXT,
+        image            TEXT,
+        "allowedOrigin"  JSONB DEFAULT '[]',
+        exports          JSONB DEFAULT '[]',
+        credentials      JSONB DEFAULT '[]',
+        "apiConnections" JSONB DEFAULT '[]',
+        "dbConnections"  JSONB DEFAULT '[]',
+        "dbType"         VARCHAR(50) NOT NULL DEFAULT 'sql',
+        "createdAt"      TIMESTAMP WITH TIME ZONE DEFAULT NOW(),
+        "updatedAt"      TIMESTAMP WITH TIME ZONE DEFAULT NOW()
+      );
     `);
         console.log('✅ "projects" table ensured to exist.');
-        // Ensure dbType column exists and is correctly configured
-        await pool.query(`
-      ALTER TABLE streamby.projects ADD COLUMN IF NOT EXISTS "dbType" VARCHAR(50);
+        // Add JSONB columns to existing tables that predate this schema version
+        await pool.query(`
+      ALTER TABLE streamby.projects ADD COLUMN IF NOT EXISTS "allowedOrigin"  JSONB DEFAULT '[]';
+      ALTER TABLE streamby.projects ADD COLUMN IF NOT EXISTS exports          JSONB DEFAULT '[]';
+      ALTER TABLE streamby.projects ADD COLUMN IF NOT EXISTS credentials      JSONB DEFAULT '[]';
+      ALTER TABLE streamby.projects ADD COLUMN IF NOT EXISTS "apiConnections" JSONB DEFAULT '[]';
+      ALTER TABLE streamby.projects ADD COLUMN IF NOT EXISTS "dbConnections"  JSONB DEFAULT '[]';
     `);
-        await pool.query(`
-      UPDATE streamby.projects SET "dbType" = 'nosql' WHERE "dbType" IS NULL;
+        // Ensure dbType exists with a non-null default
+        await pool.query(`
+      ALTER TABLE streamby.projects ADD COLUMN IF NOT EXISTS "dbType" VARCHAR(50) NOT NULL DEFAULT 'sql';
     `);
-        await pool.query(`
-      ALTER TABLE streamby.projects ALTER COLUMN "dbType" SET NOT NULL;
+        await pool.query(`
+      CREATE TABLE IF NOT EXISTS streamby.project_members (
+        id           TEXT PRIMARY KEY DEFAULT uuid_generate_v4()::text,
+        "projectId"  TEXT NOT NULL REFERENCES streamby.projects(id) ON DELETE CASCADE,
+        "userId"     VARCHAR(255) NOT NULL,
+        role         VARCHAR(255) NOT NULL DEFAULT 'member',
+        archived     BOOLEAN NOT NULL DEFAULT FALSE,
+        "archivedBy" VARCHAR(255),
+        "archivedAt" TIMESTAMP WITH TIME ZONE,
+        "createdAt"  TIMESTAMP WITH TIME ZONE DEFAULT NOW(),
+        "updatedAt"  TIMESTAMP WITH TIME ZONE DEFAULT NOW(),
+        UNIQUE ("projectId", "userId")
+      );
     `);
-        await pool.query(`
-      ALTER TABLE streamby.projects ALTER COLUMN "dbType" SET DEFAULT 'nosql';
+        console.log('✅ "project_members" table ensured to exist.');
+        // Migrate projectId FK column from UUID to TEXT if table predates this schema version
+        await pool.query(`
+      DO $$ BEGIN
+        ALTER TABLE streamby.project_members DROP CONSTRAINT IF EXISTS project_members_projectId_fkey;
+        ALTER TABLE streamby.project_members ALTER COLUMN "projectId" TYPE TEXT;
+        ALTER TABLE streamby.project_members ADD CONSTRAINT project_members_projectid_fkey
+          FOREIGN KEY ("projectId") REFERENCES streamby.projects(id) ON DELETE CASCADE;
+      EXCEPTION WHEN OTHERS THEN NULL; END $$;
     `);
-        await pool.query(`
-      CREATE TABLE IF NOT EXISTS streamby.exports (
-        id UUID PRIMARY KEY DEFAULT uuid_generate_v4(),
-        "projectId" UUID NOT NULL REFERENCES streamby.projects(id) ON DELETE CASCADE,
-        status VARCHAR(50) NOT NULL DEFAULT 'pending',
-        "filePath" TEXT,
-        "createdAt" TIMESTAMP WITH TIME ZONE DEFAULT NOW(),
-        "updatedAt" TIMESTAMP WITH TIME ZONE DEFAULT NOW()
-      );
+        await pool.query(`
+      CREATE TABLE IF NOT EXISTS streamby.exports (
+        id          TEXT PRIMARY KEY DEFAULT uuid_generate_v4()::text,
+        "projectId" TEXT NOT NULL REFERENCES streamby.projects(id) ON DELETE CASCADE,
+        status      VARCHAR(50) NOT NULL DEFAULT 'pending',
+        "filePath"  TEXT,
+        "createdAt" TIMESTAMP WITH TIME ZONE DEFAULT NOW(),
+        "updatedAt" TIMESTAMP WITH TIME ZONE DEFAULT NOW()
+      );
     `);
         console.log('✅ "exports" table ensured to exist.');
-        await pool.query(`
-      CREATE TABLE IF NOT EXISTS streamby.project_members (
-        id UUID PRIMARY KEY DEFAULT uuid_generate_v4(),
-        "projectId" UUID NOT NULL REFERENCES streamby.projects(id) ON DELETE CASCADE,
-        "userId" VARCHAR(255) NOT NULL,
-        role VARCHAR(255) NOT NULL DEFAULT 'member',
-        archived BOOLEAN NOT NULL DEFAULT FALSE,
-        "archivedBy" VARCHAR(255),
-        "archivedAt" TIMESTAMP WITH TIME ZONE,
-        "createdAt" TIMESTAMP WITH TIME ZONE DEFAULT NOW(),
-        "updatedAt" TIMESTAMP WITH TIME ZONE DEFAULT NOW(),
-        UNIQUE ("projectId", "userId")
-      );
-    `);
-        console.log('✅ "project_members" table ensured to exist.');
     }
     catch (error) {
         console.error('❌ Error ensuring tables exist:', error);

package/dist/adapters/database/sql.js

@@ -6,13 +6,13 @@ const createSQLExportTable = async (connection, projectId, exportName, fields) =
     const slug = exportName.toLowerCase().replace(/[^a-z0-9]+/g, '-').replace(/^-|-$/g, '');
     const tableName = `export_${projectId}_${slug}`;
     const columns = fields.map(field => `"${field.name}" ${field.type}`).join(',');
-    const createTableQuery = `
-    CREATE TABLE IF NOT EXISTS "${tableName}" (
-      id UUID PRIMARY KEY DEFAULT uuid_generate_v4(),
-      "projectId" UUID NOT NULL,
-      __metadata JSONB NOT NULL,
-      ${columns ? `, ${columns}` : ''}
-    );
+    const createTableQuery = `
+    CREATE TABLE IF NOT EXISTS "${tableName}" (
+      id UUID PRIMARY KEY DEFAULT uuid_generate_v4(),
+      "projectId" UUID NOT NULL,
+      __metadata JSONB NOT NULL,
+      ${columns ? `, ${columns}` : ''}
+    );
   `;
     await connection.query(createTableQuery);
     console.log(`✅ Table '${tableName}' created with metadata.`);
@@ -30,15 +30,15 @@ exports.createSQLExportTable = createSQLExportTable;
 const createSQLRawExportTable = async (connection, projectId, exportName, nodeSchema) => {
     const tableName = projectId;
     const exportId = (0, crypto_1.randomUUID)();
-    const createTableQuery = `
-    CREATE TABLE IF NOT EXISTS "${tableName}" (
-      id UUID PRIMARY KEY DEFAULT uuid_generate_v4(),
-      node_schema JSONB,
-      name TEXT,
-      method TEXT,
-      created_at TIMESTAMPTZ DEFAULT NOW(),
-      updated_at TIMESTAMPTZ DEFAULT NOW()
-    );
+    const createTableQuery = `
+    CREATE TABLE IF NOT EXISTS "${tableName}" (
+      id UUID PRIMARY KEY DEFAULT uuid_generate_v4(),
+      node_schema JSONB,
+      name TEXT,
+      method TEXT,
+      created_at TIMESTAMPTZ DEFAULT NOW(),
+      updated_at TIMESTAMPTZ DEFAULT NOW()
+    );
   `;
     await connection.query(createTableQuery);
     await connection.query(`INSERT INTO "${tableName}" (id, node_schema, name, method) VALUES ($1, $2, $3, $4)`, [exportId, nodeSchema ? JSON.stringify(nodeSchema) : null, exportName, 'GET']);
@@ -53,7 +53,7 @@ exports.sqlAdapter = {
         const fullTableName = schema ? `"${schema}"."${tableName}"` : `"${tableName}"`;
         let query = `SELECT * FROM ${fullTableName}`;
         if (keys.length > 0) {
-            const where = keys.map((key, i) => `"${key}" = ${i + 1}`).join(' AND ');
+            const where = keys.map((key, i) => `"${key}" = $${i + 1}`).join(' AND ');
             query += ` WHERE ${where}`;
         }
         const result = await connection.query(query, values);
@@ -62,7 +62,7 @@ exports.sqlAdapter = {
     findOne: async (connection, tableName, filter, schema) => {
         const keys = Object.keys(filter);
         const values = Object.values(filter);
-        const where = keys.map((key, i) => `"${key}" = ${i + 1}`).join(' AND ');
+        const where = keys.map((key, i) => `"${key}" = $${i + 1}`).join(' AND ');
         const fullTableName = schema ? `"${schema}"."${tableName}"` : `"${tableName}"`;
         const result = await connection.query(`SELECT * FROM ${fullTableName} WHERE ${where} LIMIT 1`, values);
         return result.rows[0] || null;
@@ -70,7 +70,7 @@ exports.sqlAdapter = {
     create: async (connection, tableName, data, schema) => {
         const keys = Object.keys(data).map(key => `"${key}"`).join(', ');
         const values = Object.values(data);
-        const placeholders = values.map((_, i) => `${i + 1}`).join(', ');
+        const placeholders = values.map((_, i) => `$${i + 1}`).join(', ');
         const fullTableName = schema ? `"${schema}"."${tableName}"` : `"${tableName}"`;
         const result = await connection.query(`INSERT INTO ${fullTableName} (${keys}) VALUES (${placeholders}) RETURNING *`, values);
         return result.rows[0];
@@ -79,8 +79,8 @@ exports.sqlAdapter = {
         const dataKeys = Object.keys(data);
         const filterKeys = Object.keys(filter);
         const values = [...Object.values(data), ...Object.values(filter)];
-        const setClause = dataKeys.map((key, i) => `"${key}" = ${i + 1}`).join(', ');
-        const whereClause = filterKeys.map((key, i) => `"${key}" = ${dataKeys.length + i + 1}`).join(' AND ');
+        const setClause = dataKeys.map((key, i) => `"${key}" = $${i + 1}`).join(', ');
+        const whereClause = filterKeys.map((key, i) => `"${key}" = $${dataKeys.length + i + 1}`).join(' AND ');
         const fullTableName = schema ? `"${schema}"."${tableName}"` : `"${tableName}"`;
         const result = await connection.query(`UPDATE ${fullTableName} SET ${setClause} WHERE ${whereClause} RETURNING *`, values);
         return result.rows[0] || null;

package/dist/middleware/createRouter.js

@@ -20,6 +20,7 @@ const project_1 = require("./routes/project");
 const database_1 = require("./routes/database");
 const credential_1 = require("./routes/credential");
 const connection_1 = require("./routes/connection");
+const dbConnection_1 = require("./routes/dbConnection");
 const notification_1 = require("./routes/notification");
 function createStreamByRouter(config) {
     const router = express_1.default.Router();
@@ -55,6 +56,7 @@ function createStreamByRouter(config) {
     router.use((0, database_1.databaseRouter)(config));
     router.use((0, credential_1.credentialRouter)(config));
     router.use((0, connection_1.connectionRouter)(config));
+    router.use((0, dbConnection_1.dbConnectionRouter)(config));
     router.use((0, notification_1.notificationRouter)(config));
     return router;
 }

package/dist/middleware/routes/credential.js

@@ -4,6 +4,7 @@ exports.credentialRouter = credentialRouter;
 const express_1 = require("express");
 const manager_1 = require("../../models/manager");
 const auth_1 = require("../../utils/auth");
+const sanitize_1 = require("../../utils/sanitize");
 const credential_1 = require("../../services/credential");
 function credentialRouter(config) {
     const router = (0, express_1.Router)();
@@ -25,7 +26,7 @@ function credentialRouter(config) {
                 return res.status(403).json({ message: 'Unauthorized project access' });
             }
             const updatedProject = await (0, credential_1.addCredential)(config, projectId, { id, key, value });
-            res.status(201).json({ message: 'Credential added successfully', project: updatedProject });
+            res.status(201).json({ message: 'Credential added successfully', project: (0, sanitize_1.sanitizeProject)(updatedProject) });
         }
         catch (err) {
             res.status(500).json({ message: 'Failed to add credential', details: err.message });
@@ -49,7 +50,7 @@ function credentialRouter(config) {
                 return res.status(403).json({ message: 'Unauthorized project access' });
             }
             const updatedProject = await (0, credential_1.updateCredential)(config, projectId, credentialId, { key, value });
-            res.status(200).json({ message: 'Credential updated successfully', project: updatedProject });
+            res.status(200).json({ message: 'Credential updated successfully', project: (0, sanitize_1.sanitizeProject)(updatedProject) });
         }
         catch (err) {
             res.status(500).json({ message: 'Failed to update credential', details: err.message });
@@ -69,7 +70,7 @@ function credentialRouter(config) {
                 return res.status(403).json({ message: 'Unauthorized project access' });
             }
             const updatedProject = await (0, credential_1.deleteCredential)(config, projectId, credentialId);
-            res.status(200).json({ message: 'Credential deleted successfully', project: updatedProject });
+            res.status(200).json({ message: 'Credential deleted successfully', project: (0, sanitize_1.sanitizeProject)(updatedProject) });
         }
         catch (err) {
             res.status(500).json({ message: 'Failed to delete credential', details: err.message });

package/dist/middleware/routes/dbConnection.d.ts

@@ -0,0 +1,3 @@
+import { Router } from 'express';
+import { StreamByConfig } from '../../types';
+export declare function dbConnectionRouter(config: StreamByConfig): Router;

package/dist/middleware/routes/dbConnection.js

@@ -0,0 +1,278 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.dbConnectionRouter = dbConnectionRouter;
+const express_1 = require("express");
+const mongodb_1 = require("mongodb");
+const manager_1 = require("../../models/manager");
+const auth_1 = require("../../utils/auth");
+const connectionManager_1 = require("../../adapters/database/connectionManager");
+const dbConnection_1 = require("../../services/dbConnection");
+const VALID_DB_TYPES = ['postgresql', 'mongodb'];
+function isBuiltinDb(connId, config) {
+    return (config.databases ?? []).some(db => db.id === connId);
+}
+function resolveBuiltinConnection(connId, config) {
+    const db = (config.databases ?? []).find(d => d.id === connId);
+    if (!db)
+        return { error: `Database '${connId}' not found in config`, status: 404 };
+    try {
+        const { client, type } = (0, connectionManager_1.getConnection)(connId);
+        return { client: client, dbType: type };
+    }
+    catch (e) {
+        return { error: e.message, status: 503 };
+    }
+}
+async function getDecryptedConnectionString(project, connId) {
+    const conn = project.dbConnections?.find((c) => c.id === connId);
+    if (!conn)
+        return { error: 'DB connection not found', status: 404 };
+    const { decrypt, isEncryptionKeySet } = await Promise.resolve().then(() => __importStar(require('../../utils/encryption')));
+    if (!isEncryptionKeySet())
+        return { error: 'Encryption key is not set', status: 500 };
+    const credential = project.credentials?.find((c) => c.id === conn.credentialId);
+    if (!credential)
+        return { error: 'Credential not found in project', status: 400 };
+    return { connectionString: decrypt(credential.encryptedValue), conn };
+}
+function dbConnectionRouter(config) {
+    const router = (0, express_1.Router)();
+    const Project = (0, manager_1.getModel)('projects');
+    // ─── List DB connections ──────────────────────────────────────────────────
+    router.get('/projects/:id/connections/db', async (req, res) => {
+        try {
+            const auth = req.auth;
+            const project = await Project.findOne({ _id: req.params.id });
+            if (!project)
+                return res.status(404).json({ message: 'Project not found' });
+            if (!(0, auth_1.isProjectMember)(project, auth.userId))
+                return res.status(403).json({ message: 'Unauthorized project access' });
+            return res.status(200).json({ data: project.dbConnections || [] });
+        }
+        catch (err) {
+            res.status(500).json({ message: 'Failed to fetch DB connections', details: err.message });
+        }
+    });
+    // ─── Add DB connection ────────────────────────────────────────────────────
+    router.post('/projects/:id/connections/db', async (req, res) => {
+        try {
+            const auth = req.auth;
+            if (auth.role !== 'admin' && auth.role !== 'editor') {
+                return res.status(403).json({ message: 'Permission denied' });
+            }
+            const { name, dbType, credentialId, description } = req.body;
+            if (!name || !dbType || !credentialId) {
+                return res.status(400).json({ message: 'name, dbType, and credentialId are required' });
+            }
+            if (!VALID_DB_TYPES.includes(dbType)) {
+                return res.status(400).json({ message: `dbType must be one of: ${VALID_DB_TYPES.join(', ')}` });
+            }
+            const project = await Project.findOne({ _id: req.params.id });
+            if (!project)
+                return res.status(404).json({ message: 'Project not found' });
+            if (!(0, auth_1.isProjectMember)(project, auth.userId))
+                return res.status(403).json({ message: 'Unauthorized project access' });
+            const credExists = project.credentials?.some((c) => c.id === credentialId);
+            if (!credExists)
+                return res.status(400).json({ message: 'Credential not found in project' });
+            const connection = {
+                id: new mongodb_1.ObjectId().toHexString(),
+                name,
+                dbType,
+                credentialId,
+                projectId: req.params.id,
+                createdAt: new Date(),
+                ...(description !== undefined && { description }),
+            };
+            await Project.update({ _id: req.params.id }, { $push: { dbConnections: connection } });
+            return res.status(201).json({ data: connection });
+        }
+        catch (err) {
+            res.status(500).json({ message: 'Failed to add DB connection', details: err.message });
+        }
+    });
+    // ─── Delete DB connection ─────────────────────────────────────────────────
+    router.delete('/projects/:id/connections/db/:connId', async (req, res) => {
+        try {
+            if (isBuiltinDb(req.params.connId, config)) {
+                return res.status(403).json({ message: 'Cannot delete a built-in database connection' });
+            }
+            const auth = req.auth;
+            if (auth.role !== 'admin' && auth.role !== 'editor') {
+                return res.status(403).json({ message: 'Permission denied' });
+            }
+            const project = await Project.findOne({ _id: req.params.id });
+            if (!project)
+                return res.status(404).json({ message: 'Project not found' });
+            if (!(0, auth_1.isProjectMember)(project, auth.userId))
+                return res.status(403).json({ message: 'Unauthorized project access' });
+            const exists = project.dbConnections?.some((c) => c.id === req.params.connId);
+            if (!exists)
+                return res.status(404).json({ message: 'DB connection not found' });
+            await Project.update({ _id: req.params.id }, { $pull: { dbConnections: { id: req.params.connId } } });
+            return res.status(200).json({ message: 'DB connection deleted successfully' });
+        }
+        catch (err) {
+            res.status(500).json({ message: 'Failed to delete DB connection', details: err.message });
+        }
+    });
+    // ─── List tables / collections ────────────────────────────────────────────
+    router.get('/projects/:id/connections/db/:connId/tables', async (req, res) => {
+        try {
+            const auth = req.auth;
+            const project = await Project.findOne({ _id: req.params.id });
+            if (!project)
+                return res.status(404).json({ message: 'Project not found' });
+            if (!(0, auth_1.isProjectMember)(project, auth.userId))
+                return res.status(403).json({ message: 'Unauthorized project access' });
+            if (isBuiltinDb(req.params.connId, config)) {
+                const internal = resolveBuiltinConnection(req.params.connId, config);
+                if ('error' in internal)
+                    return res.status(internal.status).json({ message: internal.error });
+                const tables = await (0, dbConnection_1.listTablesInternal)(internal.client, internal.dbType, req.params.id);
+                return res.status(200).json({ data: tables });
+            }
+            const resolved = await getDecryptedConnectionString(project, req.params.connId);
+            if ('error' in resolved)
+                return res.status(resolved.status).json({ message: resolved.error });
+            const tables = await (0, dbConnection_1.listTablesOrCollections)(resolved.connectionString, resolved.conn.dbType);
+            return res.status(200).json({ data: tables });
+        }
+        catch (err) {
+            res.status(500).json({ message: 'Failed to list tables', details: err.message });
+        }
+    });
+    // ─── Create table / collection ────────────────────────────────────────────
+    router.post('/projects/:id/connections/db/:connId/tables', async (req, res) => {
+        try {
+            const auth = req.auth;
+            if (auth.role !== 'admin' && auth.role !== 'editor') {
+                return res.status(403).json({ message: 'Permission denied' });
+            }
+            const project = await Project.findOne({ _id: req.params.id });
+            if (!project)
+                return res.status(404).json({ message: 'Project not found' });
+            if (!(0, auth_1.isProjectMember)(project, auth.userId))
+                return res.status(403).json({ message: 'Unauthorized project access' });
+            const schema = req.body;
+            if (!schema.tableName)
+                return res.status(400).json({ message: 'tableName is required' });
+            if (isBuiltinDb(req.params.connId, config)) {
+                const internal = resolveBuiltinConnection(req.params.connId, config);
+                if ('error' in internal)
+                    return res.status(internal.status).json({ message: internal.error });
+                if (internal.dbType === 'sql' && (!Array.isArray(schema.columns) || schema.columns.length === 0)) {
+                    return res.status(400).json({ message: 'columns are required for SQL tables' });
+                }
+                await (0, dbConnection_1.createTableOrCollectionInternal)(internal.client, internal.dbType, schema, req.params.id);
+                return res.status(201).json({ message: `${internal.dbType === 'sql' ? 'Table' : 'Collection'} created successfully` });
+            }
+            const resolved = await getDecryptedConnectionString(project, req.params.connId);
+            if ('error' in resolved)
+                return res.status(resolved.status).json({ message: resolved.error });
+            if (resolved.conn.dbType === 'postgresql' && (!Array.isArray(schema.columns) || schema.columns.length === 0)) {
+                return res.status(400).json({ message: 'columns are required for PostgreSQL tables' });
+            }
+            await (0, dbConnection_1.createTableOrCollection)(resolved.connectionString, resolved.conn.dbType, schema);
+            return res.status(201).json({ message: `${resolved.conn.dbType === 'postgresql' ? 'Table' : 'Collection'} created successfully` });
+        }
+        catch (err) {
+            res.status(500).json({ message: 'Failed to create table/collection', details: err.message });
+        }
+    });
+    // ─── Query records ────────────────────────────────────────────────────────
+    router.get('/projects/:id/connections/db/:connId/tables/:tableName', async (req, res) => {
+        try {
+            const auth = req.auth;
+            const project = await Project.findOne({ _id: req.params.id });
+            if (!project)
+                return res.status(404).json({ message: 'Project not found' });
+            if (!(0, auth_1.isProjectMember)(project, auth.userId))
+                return res.status(403).json({ message: 'Unauthorized project access' });
+            const limit = Math.min(parseInt(String(req.query.limit ?? 50), 10), 500);
+            const offset = Math.max(parseInt(String(req.query.offset ?? 0), 10), 0);
+            if (isBuiltinDb(req.params.connId, config)) {
+                const internal = resolveBuiltinConnection(req.params.connId, config);
+                if ('error' in internal)
+                    return res.status(internal.status).json({ message: internal.error });
+                const records = await (0, dbConnection_1.queryRecordsInternal)(internal.client, internal.dbType, req.params.tableName, limit, offset, req.params.id);
+                return res.status(200).json({ data: records });
+            }
+            const resolved = await getDecryptedConnectionString(project, req.params.connId);
+            if ('error' in resolved)
+                return res.status(resolved.status).json({ message: resolved.error });
+            const records = await (0, dbConnection_1.queryRecords)(resolved.connectionString, resolved.conn.dbType, req.params.tableName, limit, offset);
+            return res.status(200).json({ data: records });
+        }
+        catch (err) {
+            res.status(500).json({ message: 'Failed to query records', details: err.message });
+        }
+    });
+    // ─── Insert record ────────────────────────────────────────────────────────
+    router.post('/projects/:id/connections/db/:connId/tables/:tableName', async (req, res) => {
+        try {
+            const auth = req.auth;
+            if (auth.role !== 'admin' && auth.role !== 'editor') {
+                return res.status(403).json({ message: 'Permission denied' });
+            }
+            const project = await Project.findOne({ _id: req.params.id });
+            if (!project)
+                return res.status(404).json({ message: 'Project not found' });
+            if (!(0, auth_1.isProjectMember)(project, auth.userId))
+                return res.status(403).json({ message: 'Unauthorized project access' });
+            const record = req.body;
+            if (!record || typeof record !== 'object' || Array.isArray(record)) {
+                return res.status(400).json({ message: 'Request body must be a JSON object' });
+            }
+            if (isBuiltinDb(req.params.connId, config)) {
+                const internal = resolveBuiltinConnection(req.params.connId, config);
+                if ('error' in internal)
+                    return res.status(internal.status).json({ message: internal.error });
+                const inserted = await (0, dbConnection_1.insertRecordInternal)(internal.client, internal.dbType, req.params.tableName, record, req.params.id);
+                return res.status(201).json({ data: inserted });
+            }
+            const resolved = await getDecryptedConnectionString(project, req.params.connId);
+            if ('error' in resolved)
+                return res.status(resolved.status).json({ message: resolved.error });
+            const inserted = await (0, dbConnection_1.insertRecord)(resolved.connectionString, resolved.conn.dbType, req.params.tableName, record);
+            return res.status(201).json({ data: inserted });
+        }
+        catch (err) {
+            res.status(500).json({ message: 'Failed to insert record', details: err.message });
+        }
+    });
+    return router;
+}

package/dist/middleware/routes/export.js

@@ -189,7 +189,7 @@ function exportRouter(config) {
                 return res.status(401).json({ message: 'Unauthorized' });
             }
             const projectId = req.params.id;
-            const { name, description, isPrivate, allowedOrigin, useConnections, useCredentials, nodeSchema } = req.body;
+            const { name, description, isPrivate, allowedOrigin, useConnections, useCredentials, nodeSchema, storageDbId } = req.body;
             if (!name) {
                 return res.status(400).json({ message: 'Missing export name' });
             }
@@ -199,7 +199,9 @@ function exportRouter(config) {
             if (!project || !(0, auth_1.isProjectMember)(project, auth.userId)) {
                 return res.status(403).json({ message: 'Unauthorized project access' });
             }
-            const result = await (0, export_1.createExport)(config, projectId, description, name, project.dbType, exportType, isPrivate, allowedOrigin, resolvedNodeSchema, useConnections, useCredentials);
+            const mainDb = config.databases?.find(db => db.main) ?? config.databases?.[0];
+            const dbType = mainDb?.type ?? 'nosql';
+            const result = await (0, export_1.createExport)(config, projectId, description, name, dbType, exportType, isPrivate, allowedOrigin, resolvedNodeSchema, useConnections, useCredentials, storageDbId);
             res.status(201).json({ data: result, message: result.message });
         }
         catch (err) {

package/dist/middleware/routes/project.js

@@ -6,6 +6,7 @@ const manager_1 = require("../../models/manager");
 const auth_1 = require("../../utils/auth");
 const connectionManager_1 = require("../../adapters/database/connectionManager");
 const sql_1 = require("../../adapters/database/sql");
+const sanitize_1 = require("../../utils/sanitize");
 function projectRouter(config) {
     const router = (0, express_1.Router)();
     const Project = (0, manager_1.getModel)('projects');
@@ -49,19 +50,19 @@ function projectRouter(config) {
             if (auth.role !== 'admin' && auth.role !== 'editor') {
                 return res.status(403).json({ message: 'Permission denied' });
             }
-            const { name, description, dbType, image, allowedOrigin } = req.body;
-            const mainDb = config.databases?.find(db => db.main);
+            const { name, description, image, allowedOrigin } = req.body;
+            const mainDb = config.databases?.find(db => db.main) ?? config.databases?.[0];
             if (!mainDb) {
-                return res.status(500).json({ message: 'Main database not configured' });
+                return res.status(500).json({ message: 'No database configured' });
             }
-            const userDbType = mainDb.type;
-            const User = (0, manager_1.getModel)('users', userDbType);
+            const dbType = mainDb.type;
+            const User = (0, manager_1.getModel)('users', dbType);
             const user = await User.findOne({ _id: auth.userId });
             if (!user) {
                 return res.status(404).json({ message: 'User not found' });
             }
             const newProject = await Project.create({
-                dbType: dbType || 'nosql',
+                dbType,
                 name,
                 description: description || '',
                 image: image || '',
@@ -136,7 +137,8 @@ function projectRouter(config) {
                 useConnections: e.useConnections,
                 useCredentials: e.useCredentials,
             }));
-            res.json({ project: { ...project, id: project._id || project.id, _id: undefined, apiConnections: project.apiConnections || [], exports }, message: 'Project fetched successfully' });
+            const sanitized = (0, sanitize_1.sanitizeProject)({ ...project, id: project._id || project.id, _id: undefined, apiConnections: project.apiConnections || [], exports });
+            res.json({ project: sanitized, message: 'Project fetched successfully' });
         }
         catch (err) {
             res.status(500).json({ message: 'Failed to fetch project', details: err.message });
@@ -304,7 +306,7 @@ function projectRouter(config) {
             if (!updatedProject) {
                 return res.status(404).json({ message: 'Project not found or not updated' });
             }
-            res.status(200).json({ success: true, project: { ...updatedProject, id: updatedProject._id || updatedProject.id, _id: undefined }, message: 'Project image updated successfully' });
+            res.status(200).json({ success: true, project: (0, sanitize_1.sanitizeProject)({ ...updatedProject, id: updatedProject._id || updatedProject.id, _id: undefined }), message: 'Project image updated successfully' });
         }
         catch (err) {
             res.status(500).json({ message: 'Failed to update project image', details: err.message });
@@ -329,7 +331,7 @@ function projectRouter(config) {
             if (!updated) {
                 return res.status(404).json({ message: 'Project not found or not updated' });
             }
-            res.status(200).json({ success: true, project: updated, message: 'Project origins updated successfully' });
+            res.status(200).json({ success: true, project: (0, sanitize_1.sanitizeProject)(updated), message: 'Project origins updated successfully' });
         }
         catch (err) {
             res.status(500).json({ message: 'Failed to update project origins', details: err.message });

package/dist/models/Model.d.ts

@@ -11,6 +11,7 @@ export declare class Model<T extends Document> {
     private transformResult;
     findOne(filter: any): Promise<T | null>;
     create(data: T): Promise<T>;
+    private updateSqlJsonbArray;
     update(filter: any, data: Partial<T>): Promise<T | null>;
     delete(filter: any): Promise<number>;
 }