streamby-core 0.27.4 → 0.28.1

package/dist/index.d.ts

@@ -1,3 +1,4 @@
 export { createStreamByRouter } from './middleware/createRouter';
 export { emitToUser } from './services/wsHub';
 export { createNotification } from './services/notification';
+export type { UserPlan, UserSubscription } from './types';

package/dist/middleware/createRouter.js

@@ -23,6 +23,7 @@ const connection_1 = require("./routes/connection");
 const dbConnection_1 = require("./routes/dbConnection");
 const storageConnection_1 = require("./routes/storageConnection");
 const notification_1 = require("./routes/notification");
+const subscription_1 = require("./routes/subscription");
 function createStreamByRouter(config) {
     const router = express_1.default.Router();
     if (config.encrypt)
@@ -42,6 +43,7 @@ function createStreamByRouter(config) {
         const mainDb = config.databases.find(db => db.main);
         if (mainDb) {
             (0, manager_1.registerModel)('users', [mainDb.id], 'users', 'accounts');
+            (0, manager_1.registerModel)('user_subscriptions', [mainDb.id], 'user_subscriptions', 'streamby');
         }
     }
     if (config.websocket?.server) {
@@ -50,6 +52,7 @@ function createStreamByRouter(config) {
     router.use((0, user_1.userRouter)(config));
     router.use((0, auth_2.authRouter)(config));
     router.use((0, auth_1.authenticate)(config));
+    router.use(subscription_1.ensureSubscription);
     router.use((0, export_1.exportRouter)(config));
     router.use((0, member_1.memberRouter)(config));
     router.use((0, storage_2.storageRouter)(config));
@@ -60,5 +63,6 @@ function createStreamByRouter(config) {
     router.use((0, dbConnection_1.dbConnectionRouter)(config));
     router.use((0, storageConnection_1.storageConnectionRouter)(config));
     router.use((0, notification_1.notificationRouter)(config));
+    router.use((0, subscription_1.subscriptionRouter)(config));
     return router;
 }

package/dist/middleware/routes/export.js

@@ -295,48 +295,51 @@ function exportRouter(config) {
             if (!exportMetadata) {
                 return res.status(404).json({ message: 'Export not found in this project' });
             }
-            const origin = req.headers.origin;
-            let effectiveAllowedOrigins = exportMetadata.allowedOrigin;
-            const projectOrigins = project.allowedOrigin;
-            // If export's allowedOrigin is ['*'] or it's not set, it inherits from the project.
-            if (!effectiveAllowedOrigins || (effectiveAllowedOrigins.length === 1 && effectiveAllowedOrigins[0] === '*')) {
-                effectiveAllowedOrigins = projectOrigins;
-            }
-            else {
-                // If the export has its own list, ensure it's a subset of the project's list (if project is not public).
-                if (projectOrigins && !projectOrigins.includes('*')) {
-                    const isSubset = effectiveAllowedOrigins.every((o) => projectOrigins.includes(o));
-                    if (!isSubset) {
-                        return res.status(403).json({ message: 'Unauthorized: Export origins are not allowed by the parent project.' });
-                    }
+            // Authenticated project members bypass origin checks (e.g. dev environments).
+            const auth = await config.authProvider(req).catch(() => null);
+            const isMember = auth?.userId && (0, auth_1.isProjectMember)(project, auth.userId);
+            if (!isMember) {
+                const origin = req.headers.origin;
+                let effectiveAllowedOrigins = exportMetadata.allowedOrigin;
+                const projectOrigins = project.allowedOrigin;
+                // If export's allowedOrigin is empty, ['*'], or not set, it inherits from the project.
+                if (!effectiveAllowedOrigins || effectiveAllowedOrigins.length === 0 || (effectiveAllowedOrigins.length === 1 && effectiveAllowedOrigins[0] === '*')) {
+                    effectiveAllowedOrigins = projectOrigins;
                 }
-            }
-            // Dev mode: auto-allow localhost requests on configured ports.
-            let devModeAllowed = false;
-            if (exportMetadata.devMode && origin) {
-                const match = origin.match(/^https?:\/\/localhost:(\d+)$/);
-                if (match) {
-                    const port = parseInt(match[1]);
-                    const allowedPorts = exportMetadata.devPorts?.length
-                        ? exportMetadata.devPorts
-                        : [3000, 5173, 8080, 4200];
-                    if (allowedPorts.includes(port)) {
-                        devModeAllowed = true;
-                        res.header('Access-Control-Allow-Origin', origin);
-                        res.header('Access-Control-Allow-Methods', 'GET, POST, PUT, DELETE, OPTIONS');
-                        res.header('Access-Control-Allow-Headers', 'Content-Type, Authorization');
+                else {
+                    // If the export has its own list, ensure it's a subset of the project's list (if project is not public).
+                    if (projectOrigins && !projectOrigins.includes('*')) {
+                        const isSubset = effectiveAllowedOrigins.every((o) => projectOrigins.includes(o));
+                        if (!isSubset) {
+                            return res.status(403).json({ message: 'Unauthorized: Export origins are not allowed by the parent project.' });
+                        }
                     }
                 }
-            }
-            if (!devModeAllowed) {
-                // If there's no origin header, deny access unless the effective scope is public.
-                if (!origin && !(effectiveAllowedOrigins && effectiveAllowedOrigins.includes('*'))) {
-                    return res.status(403).json({ message: 'Origin header required' });
+                // Dev mode: auto-allow localhost requests on configured ports.
+                let devModeAllowed = false;
+                if (exportMetadata.devMode && origin) {
+                    const match = origin.match(/^https?:\/\/localhost:(\d+)$/);
+                    if (match) {
+                        const port = parseInt(match[1]);
+                        const allowedPorts = exportMetadata.devPorts?.length
+                            ? exportMetadata.devPorts
+                            : [3000, 5173, 8080, 4200];
+                        if (allowedPorts.includes(port)) {
+                            devModeAllowed = true;
+                            res.header('Access-Control-Allow-Origin', origin);
+                            res.header('Access-Control-Allow-Methods', 'GET, POST, PUT, DELETE, OPTIONS');
+                            res.header('Access-Control-Allow-Headers', 'Content-Type, Authorization');
+                        }
+                    }
                 }
-                // Check for public access ('*') or if the request's origin is in the effective list.
-                const isAllowed = effectiveAllowedOrigins && (effectiveAllowedOrigins.includes('*') || (origin && effectiveAllowedOrigins.includes(origin)));
-                if (!isAllowed) {
-                    return res.status(403).json({ message: 'Unauthorized' });
+                if (!devModeAllowed) {
+                    if (!origin && !(effectiveAllowedOrigins && effectiveAllowedOrigins.includes('*'))) {
+                        return res.status(403).json({ message: 'Origin header required' });
+                    }
+                    const isAllowed = effectiveAllowedOrigins && (effectiveAllowedOrigins.includes('*') || (origin && effectiveAllowedOrigins.includes(origin)));
+                    if (!isAllowed) {
+                        return res.status(403).json({ message: 'Unauthorized' });
+                    }
                 }
             }
             let data;

package/dist/middleware/routes/member.js

@@ -197,6 +197,88 @@ function memberRouter(config) {
             res.status(500).json({ message: 'Failed to reject invitation', details: err.message });
         }
     });
+    router.post('/projects/:id/request-join', async (req, res) => {
+        try {
+            const auth = req.auth;
+            const projectId = req.params.id;
+            const project = await Project.findOne({ _id: projectId });
+            if (!project) {
+                return res.status(404).json({ message: 'Project not found' });
+            }
+            if (project.public === false) {
+                return res.status(403).json({ message: 'This project is not open for join requests' });
+            }
+            const alreadyMember = project.members?.some((m) => m.userId?.toString() === auth.userId?.toString());
+            if (alreadyMember) {
+                return res.status(400).json({ message: 'You are already a member or have a pending request' });
+            }
+            const User = (0, manager_1.getModel)('users');
+            const user = await User.findOne({ _id: auth.userId });
+            const username = user?.username || auth.username;
+            if (project.dbType === 'sql') {
+                const connection = getSqlConnection();
+                if (!connection) {
+                    return res.status(503).json({ message: 'SQL connection not available' });
+                }
+                await sql_1.sqlAdapter.create(connection, 'project_members', {
+                    projectId,
+                    userId: auth.userId,
+                    role: 'viewer',
+                    archived: false,
+                    status: 'pending',
+                    invitedBy: auth.userId,
+                }, 'streamby');
+            }
+            else {
+                await Project.update({ _id: projectId }, {
+                    $push: { members: { userId: auth.userId, username, role: 'viewer', archived: false, status: 'pending', invitedBy: auth.userId } },
+                });
+            }
+            const admins = (project.members || []).filter((m) => m.role === 'admin' && m.status === 'active');
+            await Promise.all(admins.map((admin) => (0, notification_1.createNotification)(admin.userId, 'join_request', `${username} has requested to join "${project.name}"`, { projectId, userId: auth.userId })));
+            res.status(201).json({ message: 'Join request sent successfully' });
+        }
+        catch (err) {
+            res.status(500).json({ message: 'Failed to send join request', details: err.message });
+        }
+    });
+    router.patch('/projects/:id/members/:userId/approve', async (req, res) => {
+        try {
+            const auth = req.auth;
+            const { id: projectId, userId: targetUserId } = req.params;
+            const project = await Project.findOne({ _id: projectId });
+            if (!project) {
+                return res.status(404).json({ message: 'Project not found' });
+            }
+            const requestingMember = project.members?.find((m) => m.userId?.toString() === auth.userId?.toString());
+            if (!requestingMember || requestingMember.status !== 'active' || requestingMember.role !== 'admin') {
+                return res.status(403).json({ message: 'Only project admins can approve requests' });
+            }
+            const targetMember = project.members?.find((m) => m.userId?.toString() === targetUserId?.toString());
+            if (!targetMember) {
+                return res.status(404).json({ message: 'Member not found in project' });
+            }
+            if (targetMember.status !== 'pending') {
+                return res.status(400).json({ message: 'No pending request for this user' });
+            }
+            if (project.dbType === 'sql') {
+                const connection = getSqlConnection();
+                if (!connection) {
+                    return res.status(503).json({ message: 'SQL connection not available' });
+                }
+                await sql_1.sqlAdapter.update(connection, 'project_members', { projectId, userId: targetUserId }, { status: 'active' }, 'streamby');
+            }
+            else {
+                const updatedMembers = project.members.map((m) => m.userId?.toString() === targetUserId ? { ...m, status: 'active' } : m);
+                await Project.update({ _id: projectId }, { members: updatedMembers });
+            }
+            await (0, notification_1.createNotification)(targetUserId, 'join_approved', `Your request to join "${project.name}" has been approved`, { projectId });
+            res.status(200).json({ message: 'Join request approved' });
+        }
+        catch (err) {
+            res.status(500).json({ message: 'Failed to approve join request', details: err.message });
+        }
+    });
     router.delete('/projects/:id/members/:userId', async (req, res) => {
         try {
             const auth = req.auth;

package/dist/middleware/routes/project.js

@@ -44,13 +44,40 @@ function projectRouter(config) {
             res.status(500).json({ message: 'Failed to list projects', details: err });
         }
     });
+    router.get('/projects/explore', async (req, res) => {
+        try {
+            const auth = req.auth;
+            const allProjects = await Project.find({});
+            const result = allProjects
+                .filter((p) => p.public !== false)
+                .map((p) => ({
+                id: p._id || p.id,
+                name: p.name,
+                description: p.description || '',
+                image: p.image || '',
+                memberCount: (p.members || []).filter((m) => m.status === 'active').length,
+                isMember: (p.members || []).some((m) => m.userId?.toString() === auth.userId && m.status === 'active'),
+                hasPendingRequest: (p.members || []).some((m) => m.userId?.toString() === auth.userId && m.status === 'pending'),
+            }));
+            res.json({ projects: result });
+        }
+        catch (err) {
+            res.status(500).json({ message: 'Failed to explore projects', details: err.message });
+        }
+    });
     router.post('/projects/create', async (req, res) => {
         try {
             const auth = req.auth;
+            if (req.subscription === 'freemium') {
+                return res.status(403).json({ error: 'Freemium users cannot create projects' });
+            }
             if (auth.role !== 'admin' && auth.role !== 'editor') {
                 return res.status(403).json({ message: 'Permission denied' });
             }
-            const { name, description, image, allowedOrigin } = req.body;
+            const { name, description, image, allowedOrigin, public: isPublic = true } = req.body;
+            if (isPublic === false && req.subscription === 'freemium') {
+                return res.status(403).json({ error: 'Private projects require a subscriber plan' });
+            }
             const mainDb = config.databases?.find(db => db.main) ?? config.databases?.[0];
             if (!mainDb) {
                 return res.status(500).json({ message: 'No database configured' });
@@ -67,6 +94,7 @@ function projectRouter(config) {
                 description: description || '',
                 image: image || '',
                 allowedOrigin: allowedOrigin || [],
+                public: isPublic,
                 members: [{ userId: auth.userId, username: user.username, role: "admin", status: "active", archived: false }],
             });
             const allProjects = await Project.find({});

package/dist/middleware/routes/subscription.d.ts

@@ -0,0 +1,4 @@
+import { Router, Request, Response, NextFunction } from 'express';
+import { StreamByConfig } from '../../types';
+export declare const ensureSubscription: (req: Request, res: Response, next: NextFunction) => Promise<void>;
+export declare function subscriptionRouter(config: StreamByConfig): Router;

package/dist/middleware/routes/subscription.js

@@ -0,0 +1,34 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ensureSubscription = void 0;
+exports.subscriptionRouter = subscriptionRouter;
+const express_1 = require("express");
+const manager_1 = require("../../models/manager");
+const resolveSubscription = async (auth) => {
+    const Subscription = (0, manager_1.getModel)('user_subscriptions');
+    const existing = await Subscription.findOne({ user_id: auth.userId });
+    if (existing)
+        return existing.plan;
+    const plan = auth.role === 'admin' ? 'admin' : 'freemium';
+    await Subscription.create({ user_id: auth.userId, plan, dbType: 'sql' });
+    return plan;
+};
+const ensureSubscription = async (req, res, next) => {
+    try {
+        const auth = req.auth;
+        const plan = await resolveSubscription(auth);
+        req.subscription = plan;
+        next();
+    }
+    catch (err) {
+        res.status(403).json({ error: 'Unauthorized', details: err.message });
+    }
+};
+exports.ensureSubscription = ensureSubscription;
+function subscriptionRouter(config) {
+    const router = (0, express_1.Router)();
+    router.get('/user/subscription', async (req, res) => {
+        res.json({ subscription: req.subscription });
+    });
+    return router;
+}

package/dist/models/Model.js

@@ -180,8 +180,10 @@ class Model {
                 if (this.tableName === 'projects' && key === 'members') {
                     membersToInsert = data[key];
                 }
-                else if (this.tableName === 'projects' && key.toLowerCase() === 'dbtype') {
-                    dataToInsert["dbType"] = data[key];
+                else if (key.toLowerCase() === 'dbtype') {
+                    if (this.tableName === 'projects')
+                        dataToInsert["dbType"] = data[key];
+                    // else: routing hint only — never a real column
                 }
                 else {
                     dataToInsert[key] = data[key];

package/dist/types/index.d.ts

@@ -54,6 +54,7 @@ export interface ProjectInfo {
     dbType?: DatabaseType;
     name: string;
     image?: string;
+    public?: boolean;
     members?: {
         role: 'viewer' | 'editor' | 'admin';
         userId: string;
@@ -135,6 +136,14 @@ export interface Auth {
     role: 'viewer' | 'editor' | 'admin';
 }
 export type AuthProvider = (req: Request) => Promise<Auth>;
+export type UserPlan = 'freemium' | 'subscriber' | 'admin';
+export interface UserSubscription {
+    id: string;
+    user_id: string;
+    plan: UserPlan;
+    created_at: Date;
+    updated_at: Date;
+}
 export type ExternalDbType = 'postgresql' | 'mongodb';
 export interface DbConnection {
     id: string;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "streamby-core",
-  "version": "0.27.4",
+  "version": "0.28.1",
   "description": "StreamBy middleware framework for media storage management",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",