streamby-core 0.28.0 → 0.28.1

package/dist/middleware/routes/export.js

@@ -295,48 +295,51 @@ function exportRouter(config) {
             if (!exportMetadata) {
                 return res.status(404).json({ message: 'Export not found in this project' });
             }
-            const origin = req.headers.origin;
-            let effectiveAllowedOrigins = exportMetadata.allowedOrigin;
-            const projectOrigins = project.allowedOrigin;
-            // If export's allowedOrigin is ['*'] or it's not set, it inherits from the project.
-            if (!effectiveAllowedOrigins || (effectiveAllowedOrigins.length === 1 && effectiveAllowedOrigins[0] === '*')) {
-                effectiveAllowedOrigins = projectOrigins;
-            }
-            else {
-                // If the export has its own list, ensure it's a subset of the project's list (if project is not public).
-                if (projectOrigins && !projectOrigins.includes('*')) {
-                    const isSubset = effectiveAllowedOrigins.every((o) => projectOrigins.includes(o));
-                    if (!isSubset) {
-                        return res.status(403).json({ message: 'Unauthorized: Export origins are not allowed by the parent project.' });
-                    }
+            // Authenticated project members bypass origin checks (e.g. dev environments).
+            const auth = await config.authProvider(req).catch(() => null);
+            const isMember = auth?.userId && (0, auth_1.isProjectMember)(project, auth.userId);
+            if (!isMember) {
+                const origin = req.headers.origin;
+                let effectiveAllowedOrigins = exportMetadata.allowedOrigin;
+                const projectOrigins = project.allowedOrigin;
+                // If export's allowedOrigin is empty, ['*'], or not set, it inherits from the project.
+                if (!effectiveAllowedOrigins || effectiveAllowedOrigins.length === 0 || (effectiveAllowedOrigins.length === 1 && effectiveAllowedOrigins[0] === '*')) {
+                    effectiveAllowedOrigins = projectOrigins;
                 }
-            }
-            // Dev mode: auto-allow localhost requests on configured ports.
-            let devModeAllowed = false;
-            if (exportMetadata.devMode && origin) {
-                const match = origin.match(/^https?:\/\/localhost:(\d+)$/);
-                if (match) {
-                    const port = parseInt(match[1]);
-                    const allowedPorts = exportMetadata.devPorts?.length
-                        ? exportMetadata.devPorts
-                        : [3000, 5173, 8080, 4200];
-                    if (allowedPorts.includes(port)) {
-                        devModeAllowed = true;
-                        res.header('Access-Control-Allow-Origin', origin);
-                        res.header('Access-Control-Allow-Methods', 'GET, POST, PUT, DELETE, OPTIONS');
-                        res.header('Access-Control-Allow-Headers', 'Content-Type, Authorization');
+                else {
+                    // If the export has its own list, ensure it's a subset of the project's list (if project is not public).
+                    if (projectOrigins && !projectOrigins.includes('*')) {
+                        const isSubset = effectiveAllowedOrigins.every((o) => projectOrigins.includes(o));
+                        if (!isSubset) {
+                            return res.status(403).json({ message: 'Unauthorized: Export origins are not allowed by the parent project.' });
+                        }
                     }
                 }
-            }
-            if (!devModeAllowed) {
-                // If there's no origin header, deny access unless the effective scope is public.
-                if (!origin && !(effectiveAllowedOrigins && effectiveAllowedOrigins.includes('*'))) {
-                    return res.status(403).json({ message: 'Origin header required' });
+                // Dev mode: auto-allow localhost requests on configured ports.
+                let devModeAllowed = false;
+                if (exportMetadata.devMode && origin) {
+                    const match = origin.match(/^https?:\/\/localhost:(\d+)$/);
+                    if (match) {
+                        const port = parseInt(match[1]);
+                        const allowedPorts = exportMetadata.devPorts?.length
+                            ? exportMetadata.devPorts
+                            : [3000, 5173, 8080, 4200];
+                        if (allowedPorts.includes(port)) {
+                            devModeAllowed = true;
+                            res.header('Access-Control-Allow-Origin', origin);
+                            res.header('Access-Control-Allow-Methods', 'GET, POST, PUT, DELETE, OPTIONS');
+                            res.header('Access-Control-Allow-Headers', 'Content-Type, Authorization');
+                        }
+                    }
                 }
-                // Check for public access ('*') or if the request's origin is in the effective list.
-                const isAllowed = effectiveAllowedOrigins && (effectiveAllowedOrigins.includes('*') || (origin && effectiveAllowedOrigins.includes(origin)));
-                if (!isAllowed) {
-                    return res.status(403).json({ message: 'Unauthorized' });
+                if (!devModeAllowed) {
+                    if (!origin && !(effectiveAllowedOrigins && effectiveAllowedOrigins.includes('*'))) {
+                        return res.status(403).json({ message: 'Origin header required' });
+                    }
+                    const isAllowed = effectiveAllowedOrigins && (effectiveAllowedOrigins.includes('*') || (origin && effectiveAllowedOrigins.includes(origin)));
+                    if (!isAllowed) {
+                        return res.status(403).json({ message: 'Unauthorized' });
+                    }
                 }
             }
             let data;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "streamby-core",
-  "version": "0.28.0",
+  "version": "0.28.1",
   "description": "StreamBy middleware framework for media storage management",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",