streamby-core 0.28.1 → 0.28.3

package/dist/middleware/routes/export.js

@@ -295,51 +295,45 @@ function exportRouter(config) {
             if (!exportMetadata) {
                 return res.status(404).json({ message: 'Export not found in this project' });
             }
-            // Authenticated project members bypass origin checks (e.g. dev environments).
-            const auth = await config.authProvider(req).catch(() => null);
-            const isMember = auth?.userId && (0, auth_1.isProjectMember)(project, auth.userId);
-            if (!isMember) {
-                const origin = req.headers.origin;
-                let effectiveAllowedOrigins = exportMetadata.allowedOrigin;
-                const projectOrigins = project.allowedOrigin;
-                // If export's allowedOrigin is empty, ['*'], or not set, it inherits from the project.
-                if (!effectiveAllowedOrigins || effectiveAllowedOrigins.length === 0 || (effectiveAllowedOrigins.length === 1 && effectiveAllowedOrigins[0] === '*')) {
-                    effectiveAllowedOrigins = projectOrigins;
-                }
-                else {
-                    // If the export has its own list, ensure it's a subset of the project's list (if project is not public).
-                    if (projectOrigins && !projectOrigins.includes('*')) {
-                        const isSubset = effectiveAllowedOrigins.every((o) => projectOrigins.includes(o));
-                        if (!isSubset) {
-                            return res.status(403).json({ message: 'Unauthorized: Export origins are not allowed by the parent project.' });
-                        }
+            const origin = req.headers.origin;
+            let effectiveAllowedOrigins = exportMetadata.allowedOrigin;
+            const projectOrigins = project.allowedOrigin;
+            // If export's allowedOrigin is empty, ['*'], or not set, it inherits from the project.
+            if (!effectiveAllowedOrigins || effectiveAllowedOrigins.length === 0 || (effectiveAllowedOrigins.length === 1 && effectiveAllowedOrigins[0] === '*')) {
+                effectiveAllowedOrigins = projectOrigins;
+            }
+            else {
+                if (projectOrigins && !projectOrigins.includes('*')) {
+                    const isSubset = effectiveAllowedOrigins.every((o) => projectOrigins.includes(o));
+                    if (!isSubset) {
+                        return res.status(403).json({ message: 'Unauthorized: Export origins are not allowed by the parent project.' });
                     }
                 }
-                // Dev mode: auto-allow localhost requests on configured ports.
-                let devModeAllowed = false;
-                if (exportMetadata.devMode && origin) {
-                    const match = origin.match(/^https?:\/\/localhost:(\d+)$/);
-                    if (match) {
-                        const port = parseInt(match[1]);
-                        const allowedPorts = exportMetadata.devPorts?.length
-                            ? exportMetadata.devPorts
-                            : [3000, 5173, 8080, 4200];
-                        if (allowedPorts.includes(port)) {
-                            devModeAllowed = true;
-                            res.header('Access-Control-Allow-Origin', origin);
-                            res.header('Access-Control-Allow-Methods', 'GET, POST, PUT, DELETE, OPTIONS');
-                            res.header('Access-Control-Allow-Headers', 'Content-Type, Authorization');
-                        }
+            }
+            // Dev mode: auto-allow localhost requests on configured ports.
+            let devModeAllowed = false;
+            if (exportMetadata.devMode && origin) {
+                const match = origin.match(/^https?:\/\/localhost:(\d+)$/);
+                if (match) {
+                    const port = parseInt(match[1]);
+                    const allowedPorts = exportMetadata.devPorts?.length
+                        ? exportMetadata.devPorts
+                        : [3000, 5173, 8080, 4200];
+                    if (allowedPorts.includes(port)) {
+                        devModeAllowed = true;
+                        res.header('Access-Control-Allow-Origin', origin);
+                        res.header('Access-Control-Allow-Methods', 'GET, POST, PUT, DELETE, OPTIONS');
+                        res.header('Access-Control-Allow-Headers', 'Content-Type, Authorization');
                     }
                 }
-                if (!devModeAllowed) {
-                    if (!origin && !(effectiveAllowedOrigins && effectiveAllowedOrigins.includes('*'))) {
-                        return res.status(403).json({ message: 'Origin header required' });
-                    }
-                    const isAllowed = effectiveAllowedOrigins && (effectiveAllowedOrigins.includes('*') || (origin && effectiveAllowedOrigins.includes(origin)));
-                    if (!isAllowed) {
-                        return res.status(403).json({ message: 'Unauthorized' });
-                    }
+            }
+            if (!devModeAllowed) {
+                if (!origin && !(effectiveAllowedOrigins && effectiveAllowedOrigins.includes('*'))) {
+                    return res.status(403).json({ message: 'Origin header required' });
+                }
+                const isAllowed = effectiveAllowedOrigins && (effectiveAllowedOrigins.includes('*') || (origin && effectiveAllowedOrigins.includes(origin)));
+                if (!isAllowed) {
+                    return res.status(403).json({ message: 'Unauthorized' });
                 }
             }
             let data;

package/dist/middleware/routes/subscription.js

@@ -16,6 +16,8 @@ const resolveSubscription = async (auth) => {
 const ensureSubscription = async (req, res, next) => {
     try {
         const auth = req.auth;
+        if (!auth)
+            return next();
         const plan = await resolveSubscription(auth);
         req.subscription = plan;
         next();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "streamby-core",
-  "version": "0.28.1",
+  "version": "0.28.3",
   "description": "StreamBy middleware framework for media storage management",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",