streamby-core 0.29.7 → 0.29.9

package/dist/adapters/database/connectionManager.js

@@ -43,87 +43,106 @@ const getConnection = (id) => {
 exports.getConnection = getConnection;
 const ensureTablesExist = async (pool) => {
     try {
-        await pool.query(`
-      CREATE SCHEMA IF NOT EXISTS streamby;
-      CREATE EXTENSION IF NOT EXISTS "uuid-ossp";
+        await pool.query(`
+      CREATE SCHEMA IF NOT EXISTS streamby;
+      CREATE EXTENSION IF NOT EXISTS "uuid-ossp";
     `);
         // Migrate id column from UUID to TEXT if it was created with the old schema
-        await pool.query(`
-      DO $$ BEGIN
-        ALTER TABLE streamby.projects ALTER COLUMN id TYPE TEXT USING id::text;
-        ALTER TABLE streamby.projects ALTER COLUMN id SET DEFAULT uuid_generate_v4()::text;
-      EXCEPTION WHEN OTHERS THEN NULL; END $$;
+        await pool.query(`
+      DO $$ BEGIN
+        ALTER TABLE streamby.projects ALTER COLUMN id TYPE TEXT USING id::text;
+        ALTER TABLE streamby.projects ALTER COLUMN id SET DEFAULT uuid_generate_v4()::text;
+      EXCEPTION WHEN OTHERS THEN NULL; END $$;
     `);
-        await pool.query(`
-      CREATE TABLE IF NOT EXISTS streamby.projects (
-        id               TEXT PRIMARY KEY DEFAULT uuid_generate_v4()::text,
-        name             VARCHAR(255) NOT NULL,
-        description      TEXT,
-        image            TEXT,
-        "allowedOrigin"  JSONB DEFAULT '[]',
-        exports          JSONB DEFAULT '[]',
-        credentials      JSONB DEFAULT '[]',
-        "apiConnections" JSONB DEFAULT '[]',
-        "dbConnections"  JSONB DEFAULT '[]',
-        "dbType"         VARCHAR(50) NOT NULL DEFAULT 'sql',
-        "createdAt"      TIMESTAMP WITH TIME ZONE DEFAULT NOW(),
-        "updatedAt"      TIMESTAMP WITH TIME ZONE DEFAULT NOW()
-      );
+        await pool.query(`
+      CREATE TABLE IF NOT EXISTS streamby.projects (
+        id               TEXT PRIMARY KEY DEFAULT uuid_generate_v4()::text,
+        name             VARCHAR(255) NOT NULL,
+        description      TEXT,
+        image            TEXT,
+        "allowedOrigin"  JSONB DEFAULT '[]',
+        exports          JSONB DEFAULT '[]',
+        credentials      JSONB DEFAULT '[]',
+        "apiConnections" JSONB DEFAULT '[]',
+        "dbConnections"  JSONB DEFAULT '[]',
+        "dbType"         VARCHAR(50) NOT NULL DEFAULT 'sql',
+        "createdAt"      TIMESTAMP WITH TIME ZONE DEFAULT NOW(),
+        "updatedAt"      TIMESTAMP WITH TIME ZONE DEFAULT NOW()
+      );
     `);
         console.log('✅ "projects" table ensured to exist.');
         // Add JSONB columns to existing tables that predate this schema version
-        await pool.query(`
-      ALTER TABLE streamby.projects ADD COLUMN IF NOT EXISTS "allowedOrigin"  JSONB DEFAULT '[]';
-      ALTER TABLE streamby.projects ADD COLUMN IF NOT EXISTS exports          JSONB DEFAULT '[]';
-      ALTER TABLE streamby.projects ADD COLUMN IF NOT EXISTS credentials      JSONB DEFAULT '[]';
-      ALTER TABLE streamby.projects ADD COLUMN IF NOT EXISTS "apiConnections" JSONB DEFAULT '[]';
-      ALTER TABLE streamby.projects ADD COLUMN IF NOT EXISTS "dbConnections"  JSONB DEFAULT '[]';
-      ALTER TABLE streamby.projects ADD COLUMN IF NOT EXISTS workflow         JSONB;
-      ALTER TABLE streamby.projects ADD COLUMN IF NOT EXISTS pipelines        JSONB DEFAULT '[]';
+        await pool.query(`
+      ALTER TABLE streamby.projects ADD COLUMN IF NOT EXISTS "allowedOrigin"     JSONB DEFAULT '[]';
+      ALTER TABLE streamby.projects ADD COLUMN IF NOT EXISTS exports             JSONB DEFAULT '[]';
+      ALTER TABLE streamby.projects ADD COLUMN IF NOT EXISTS credentials         JSONB DEFAULT '[]';
+      ALTER TABLE streamby.projects ADD COLUMN IF NOT EXISTS "apiConnections"    JSONB DEFAULT '[]';
+      ALTER TABLE streamby.projects ADD COLUMN IF NOT EXISTS "dbConnections"     JSONB DEFAULT '[]';
+      ALTER TABLE streamby.projects ADD COLUMN IF NOT EXISTS "storageConnections" JSONB DEFAULT '[]';
+      ALTER TABLE streamby.projects ADD COLUMN IF NOT EXISTS workflow            JSONB;
+      ALTER TABLE streamby.projects ADD COLUMN IF NOT EXISTS pipelines           JSONB DEFAULT '[]';
     `);
         // Ensure dbType exists with a non-null default
-        await pool.query(`
-      ALTER TABLE streamby.projects ADD COLUMN IF NOT EXISTS "dbType" VARCHAR(50) NOT NULL DEFAULT 'sql';
+        await pool.query(`
+      ALTER TABLE streamby.projects ADD COLUMN IF NOT EXISTS "dbType" VARCHAR(50) NOT NULL DEFAULT 'sql';
     `);
-        await pool.query(`
-      CREATE TABLE IF NOT EXISTS streamby.project_members (
-        id           TEXT PRIMARY KEY DEFAULT uuid_generate_v4()::text,
-        "projectId"  TEXT NOT NULL REFERENCES streamby.projects(id) ON DELETE CASCADE,
-        "userId"     VARCHAR(255) NOT NULL,
-        role         VARCHAR(255) NOT NULL DEFAULT 'member',
-        status       VARCHAR(50) NOT NULL DEFAULT 'active',
-        archived     BOOLEAN NOT NULL DEFAULT FALSE,
-        "archivedBy" VARCHAR(255),
-        "archivedAt" TIMESTAMP WITH TIME ZONE,
-        "createdAt"  TIMESTAMP WITH TIME ZONE DEFAULT NOW(),
-        "updatedAt"  TIMESTAMP WITH TIME ZONE DEFAULT NOW(),
-        UNIQUE ("projectId", "userId")
-      );
+        await pool.query(`
+      CREATE TABLE IF NOT EXISTS streamby.project_members (
+        id           TEXT PRIMARY KEY DEFAULT uuid_generate_v4()::text,
+        "projectId"  TEXT NOT NULL REFERENCES streamby.projects(id) ON DELETE CASCADE,
+        "userId"     VARCHAR(255) NOT NULL,
+        role         VARCHAR(255) NOT NULL DEFAULT 'member',
+        status       VARCHAR(50) NOT NULL DEFAULT 'active',
+        archived     BOOLEAN NOT NULL DEFAULT FALSE,
+        "archivedBy" VARCHAR(255),
+        "archivedAt" TIMESTAMP WITH TIME ZONE,
+        "createdAt"  TIMESTAMP WITH TIME ZONE DEFAULT NOW(),
+        "updatedAt"  TIMESTAMP WITH TIME ZONE DEFAULT NOW(),
+        UNIQUE ("projectId", "userId")
+      );
     `);
-        await pool.query(`
-      ALTER TABLE streamby.project_members ADD COLUMN IF NOT EXISTS status VARCHAR(50) NOT NULL DEFAULT 'active';
+        await pool.query(`
+      ALTER TABLE streamby.project_members ADD COLUMN IF NOT EXISTS status VARCHAR(50) NOT NULL DEFAULT 'active';
     `);
         console.log('✅ "project_members" table ensured to exist.');
         // Migrate projectId FK column from UUID to TEXT if table predates this schema version
-        await pool.query(`
-      DO $$ BEGIN
-        ALTER TABLE streamby.project_members DROP CONSTRAINT IF EXISTS project_members_projectId_fkey;
-        ALTER TABLE streamby.project_members ALTER COLUMN "projectId" TYPE TEXT;
-        ALTER TABLE streamby.project_members ADD CONSTRAINT project_members_projectid_fkey
-          FOREIGN KEY ("projectId") REFERENCES streamby.projects(id) ON DELETE CASCADE;
-      EXCEPTION WHEN OTHERS THEN NULL; END $$;
+        await pool.query(`
+      DO $$ BEGIN
+        ALTER TABLE streamby.project_members DROP CONSTRAINT IF EXISTS project_members_projectId_fkey;
+        ALTER TABLE streamby.project_members ALTER COLUMN "projectId" TYPE TEXT;
+        ALTER TABLE streamby.project_members ADD CONSTRAINT project_members_projectid_fkey
+          FOREIGN KEY ("projectId") REFERENCES streamby.projects(id) ON DELETE CASCADE;
+      EXCEPTION WHEN OTHERS THEN NULL; END $$;
     `);
-        await pool.query(`
-      CREATE TABLE IF NOT EXISTS streamby.exports (
-        id          TEXT PRIMARY KEY DEFAULT uuid_generate_v4()::text,
-        "projectId" TEXT NOT NULL REFERENCES streamby.projects(id) ON DELETE CASCADE,
-        status      VARCHAR(50) NOT NULL DEFAULT 'pending',
-        "filePath"  TEXT,
-        "createdAt" TIMESTAMP WITH TIME ZONE DEFAULT NOW(),
-        "updatedAt" TIMESTAMP WITH TIME ZONE DEFAULT NOW()
-      );
+        await pool.query(`
+      CREATE TABLE IF NOT EXISTS streamby.exports (
+        id          TEXT PRIMARY KEY DEFAULT uuid_generate_v4()::text,
+        "projectId" TEXT NOT NULL REFERENCES streamby.projects(id) ON DELETE CASCADE,
+        status      VARCHAR(50) NOT NULL DEFAULT 'pending',
+        "filePath"  TEXT,
+        "createdAt" TIMESTAMP WITH TIME ZONE DEFAULT NOW(),
+        "updatedAt" TIMESTAMP WITH TIME ZONE DEFAULT NOW()
+      );
     `);
         console.log('✅ "exports" table ensured to exist.');
+        // user_integrations is registered against the main db only (see createRouter.ts), but
+        // this function runs per-SQL-connection like projects/exports above — harmless on
+        // non-main connections since the model never queries them there.
+        await pool.query(`
+      CREATE TABLE IF NOT EXISTS streamby.user_integrations (
+        id                     TEXT PRIMARY KEY DEFAULT uuid_generate_v4()::text,
+        "userId"               VARCHAR(255) NOT NULL,
+        kind                   VARCHAR(20) NOT NULL,
+        provider               VARCHAR(20) NOT NULL,
+        name                   VARCHAR(255) NOT NULL,
+        description            TEXT,
+        "encryptedCredential"  TEXT NOT NULL,
+        "createdAt"            TIMESTAMP WITH TIME ZONE DEFAULT NOW(),
+        "updatedAt"            TIMESTAMP WITH TIME ZONE DEFAULT NOW()
+      );
+      CREATE INDEX IF NOT EXISTS user_integrations_userid_idx ON streamby.user_integrations ("userId");
+    `);
+        console.log('✅ "user_integrations" table ensured to exist.');
     }
     catch (error) {
         console.error('❌ Error ensuring tables exist:', error);

package/dist/adapters/database/sql.js

@@ -10,7 +10,7 @@ function serializeForPg(v) {
 }
 const createSQLExportTable = async (connection, projectId, exportName, nodeSchema) => {
     const exportId = (0, crypto_1.randomUUID)();
-    await connection.query(`INSERT INTO "exports" (id, "projectId", node_schema, name, method, created_at, updated_at)
+    await connection.query(`INSERT INTO "exports" (id, "projectId", node_schema, name, method, created_at, updated_at)
      VALUES ($1, $2, $3, $4, 'GET', NOW(), NOW())`, [exportId, projectId, nodeSchema ? JSON.stringify(nodeSchema) : null, exportName]);
     return { exportId };
 };

package/dist/middleware/createRouter.js

@@ -8,6 +8,7 @@ const express_1 = __importDefault(require("express"));
 const manager_1 = require("../models/manager");
 const storage_1 = require("../providers/storage");
 const connectionManager_1 = require("../adapters/database/connectionManager");
+const backfillBuiltinConnections_1 = require("../services/backfillBuiltinConnections");
 const wsHub_1 = require("../services/wsHub");
 const auth_1 = require("../services/auth");
 const encryption_1 = require("../utils/encryption");
@@ -22,6 +23,7 @@ const credential_1 = require("./routes/credential");
 const connection_1 = require("./routes/connection");
 const dbConnection_1 = require("./routes/dbConnection");
 const storageConnection_1 = require("./routes/storageConnection");
+const userIntegration_1 = require("./routes/userIntegration");
 const notification_1 = require("./routes/notification");
 const subscription_1 = require("./routes/subscription");
 const media_1 = require("./routes/media");
@@ -32,6 +34,7 @@ const ai_1 = require("./routes/ai");
 const production_1 = require("./routes/production");
 const rights_1 = require("./routes/rights");
 const workflow_1 = require("./routes/workflow");
+const pipeline_1 = require("./routes/pipeline");
 function createStreamByRouter(config) {
     const router = express_1.default.Router();
     if (config.encrypt)
@@ -45,6 +48,10 @@ function createStreamByRouter(config) {
     const readyPromise = (0, connectionManager_1.initConnections)(config.databases || [])
         .catch((err) => {
         console.error('❌ StreamBy: failed to initialize database connections:', err);
+    })
+        .then(() => (0, backfillBuiltinConnections_1.backfillBuiltinConnections)(config))
+        .catch((err) => {
+        console.error('❌ StreamBy: failed to backfill built-in connections:', err);
     })
         .finally(() => {
         ready = true;
@@ -76,6 +83,7 @@ function createStreamByRouter(config) {
         if (mainDb) {
             (0, manager_1.registerModel)('users', [mainDb.id], 'users', 'accounts');
             (0, manager_1.registerModel)('user_subscriptions', [mainDb.id], 'user_subscriptions', 'streamby');
+            (0, manager_1.registerModel)('user_integrations', [mainDb.id], 'user_integrations', streambySchema);
         }
     }
     if (config.websocket?.server) {
@@ -94,6 +102,7 @@ function createStreamByRouter(config) {
     router.use((0, connection_1.connectionRouter)(config));
     router.use((0, dbConnection_1.dbConnectionRouter)(config));
     router.use((0, storageConnection_1.storageConnectionRouter)(config));
+    router.use((0, userIntegration_1.userIntegrationRouter)(config));
     router.use((0, notification_1.notificationRouter)(config));
     router.use((0, subscription_1.subscriptionRouter)(config));
     router.use((0, media_1.mediaRouter)(config));
@@ -104,5 +113,6 @@ function createStreamByRouter(config) {
     router.use((0, production_1.productionRouter)(config));
     router.use((0, rights_1.rightsRouter)(config));
     router.use((0, workflow_1.workflowRouter)(config));
+    router.use((0, pipeline_1.pipelineRouter)(config));
     return router;
 }

package/dist/middleware/routes/dbConnection.js

@@ -39,11 +39,9 @@ const mongodb_1 = require("mongodb");
 const manager_1 = require("../../models/manager");
 const auth_1 = require("../../utils/auth");
 const connectionManager_1 = require("../../adapters/database/connectionManager");
+const builtinAccess_1 = require("../../utils/builtinAccess");
 const dbConnection_1 = require("../../services/dbConnection");
 const VALID_DB_TYPES = ['postgresql', 'mongodb'];
-function isBuiltinDb(connId, config) {
-    return (config.databases ?? []).some(db => db.id === connId);
-}
 function resolveBuiltinConnection(connId, config) {
     const db = (config.databases ?? []).find(d => d.id === connId);
     if (!db)
@@ -127,7 +125,7 @@ function dbConnectionRouter(config) {
     // ─── Delete DB connection ─────────────────────────────────────────────────
     router.delete('/projects/:id/connections/db/:connId', async (req, res) => {
         try {
-            if (isBuiltinDb(req.params.connId, config)) {
+            if ((0, builtinAccess_1.isBuiltinDb)(req.params.connId, config)) {
                 return res.status(403).json({ message: 'Cannot delete a built-in database connection' });
             }
             const auth = req.auth;
@@ -158,7 +156,10 @@ function dbConnectionRouter(config) {
                 return res.status(404).json({ message: 'Project not found' });
             if (!(0, auth_1.isProjectMember)(project, auth.userId))
                 return res.status(403).json({ message: 'Unauthorized project access' });
-            if (isBuiltinDb(req.params.connId, config)) {
+            if ((0, builtinAccess_1.isBuiltinDb)(req.params.connId, config)) {
+                if (!(await (0, builtinAccess_1.assertBuiltinAccess)(auth, req.params.connId, config, 'database'))) {
+                    return res.status(403).json({ message: 'Access to this built-in database is not permitted' });
+                }
                 const internal = resolveBuiltinConnection(req.params.connId, config);
                 if ('error' in internal)
                     return res.status(internal.status).json({ message: internal.error });
@@ -190,7 +191,10 @@ function dbConnectionRouter(config) {
             const schema = req.body;
             if (!schema.tableName)
                 return res.status(400).json({ message: 'tableName is required' });
-            if (isBuiltinDb(req.params.connId, config)) {
+            if ((0, builtinAccess_1.isBuiltinDb)(req.params.connId, config)) {
+                if (!(await (0, builtinAccess_1.assertBuiltinAccess)(auth, req.params.connId, config, 'database'))) {
+                    return res.status(403).json({ message: 'Access to this built-in database is not permitted' });
+                }
                 const internal = resolveBuiltinConnection(req.params.connId, config);
                 if ('error' in internal)
                     return res.status(internal.status).json({ message: internal.error });
@@ -225,7 +229,10 @@ function dbConnectionRouter(config) {
                 return res.status(404).json({ message: 'Project not found' });
             if (!(0, auth_1.isProjectMember)(project, auth.userId))
                 return res.status(403).json({ message: 'Unauthorized project access' });
-            if (isBuiltinDb(req.params.connId, config)) {
+            if ((0, builtinAccess_1.isBuiltinDb)(req.params.connId, config)) {
+                if (!(await (0, builtinAccess_1.assertBuiltinAccess)(auth, req.params.connId, config, 'database'))) {
+                    return res.status(403).json({ message: 'Access to this built-in database is not permitted' });
+                }
                 const internal = resolveBuiltinConnection(req.params.connId, config);
                 if ('error' in internal)
                     return res.status(internal.status).json({ message: internal.error });
@@ -253,7 +260,10 @@ function dbConnectionRouter(config) {
                 return res.status(403).json({ message: 'Unauthorized project access' });
             const limit = Math.min(parseInt(String(req.query.limit ?? 50), 10), 500);
             const offset = Math.max(parseInt(String(req.query.offset ?? 0), 10), 0);
-            if (isBuiltinDb(req.params.connId, config)) {
+            if ((0, builtinAccess_1.isBuiltinDb)(req.params.connId, config)) {
+                if (!(await (0, builtinAccess_1.assertBuiltinAccess)(auth, req.params.connId, config, 'database'))) {
+                    return res.status(403).json({ message: 'Access to this built-in database is not permitted' });
+                }
                 const internal = resolveBuiltinConnection(req.params.connId, config);
                 if ('error' in internal)
                     return res.status(internal.status).json({ message: internal.error });
@@ -286,7 +296,10 @@ function dbConnectionRouter(config) {
             if (!record || typeof record !== 'object' || Array.isArray(record)) {
                 return res.status(400).json({ message: 'Request body must be a JSON object' });
             }
-            if (isBuiltinDb(req.params.connId, config)) {
+            if ((0, builtinAccess_1.isBuiltinDb)(req.params.connId, config)) {
+                if (!(await (0, builtinAccess_1.assertBuiltinAccess)(auth, req.params.connId, config, 'database'))) {
+                    return res.status(403).json({ message: 'Access to this built-in database is not permitted' });
+                }
                 const internal = resolveBuiltinConnection(req.params.connId, config);
                 if ('error' in internal)
                     return res.status(internal.status).json({ message: internal.error });
@@ -318,7 +331,10 @@ function dbConnectionRouter(config) {
             if (!updates || typeof updates !== 'object' || Array.isArray(updates)) {
                 return res.status(400).json({ message: 'Request body must be a JSON object' });
             }
-            if (isBuiltinDb(req.params.connId, config)) {
+            if ((0, builtinAccess_1.isBuiltinDb)(req.params.connId, config)) {
+                if (!(await (0, builtinAccess_1.assertBuiltinAccess)(auth, req.params.connId, config, 'database'))) {
+                    return res.status(403).json({ message: 'Access to this built-in database is not permitted' });
+                }
                 const internal = resolveBuiltinConnection(req.params.connId, config);
                 if ('error' in internal)
                     return res.status(internal.status).json({ message: internal.error });
@@ -346,7 +362,10 @@ function dbConnectionRouter(config) {
                 return res.status(404).json({ message: 'Project not found' });
             if (!(0, auth_1.isProjectMember)(project, auth.userId))
                 return res.status(403).json({ message: 'Unauthorized project access' });
-            if (isBuiltinDb(req.params.connId, config)) {
+            if ((0, builtinAccess_1.isBuiltinDb)(req.params.connId, config)) {
+                if (!(await (0, builtinAccess_1.assertBuiltinAccess)(auth, req.params.connId, config, 'database'))) {
+                    return res.status(403).json({ message: 'Access to this built-in database is not permitted' });
+                }
                 const internal = resolveBuiltinConnection(req.params.connId, config);
                 if ('error' in internal)
                     return res.status(internal.status).json({ message: internal.error });

package/dist/middleware/routes/pipeline.d.ts

@@ -0,0 +1,3 @@
+import { Router } from 'express';
+import { StreamByConfig } from '../../types';
+export declare function pipelineRouter(_config: StreamByConfig): Router;

package/dist/middleware/routes/pipeline.js

@@ -0,0 +1,171 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.pipelineRouter = pipelineRouter;
+const express_1 = require("express");
+const auth_1 = require("../../utils/auth");
+const connectionManager_1 = require("../../adapters/database/connectionManager");
+const manager_1 = require("../../models/manager");
+const crypto_1 = __importDefault(require("crypto"));
+function getDb() {
+    const ids = (0, connectionManager_1.getConnectedIds)().filter(id => (0, connectionManager_1.getConnection)(id).type === 'nosql');
+    if (!ids.length)
+        return null;
+    return (0, connectionManager_1.getConnection)(ids[0]).client.db();
+}
+// A Pipeline is a sub-workflow scoped to a project. The `pipelines` collection is the
+// source of truth (holds the full nodeSchema); ProjectInfo.pipelines mirrors lightweight
+// refs so the sidebar can list them without loading every schema.
+function pipelineRouter(_config) {
+    const router = (0, express_1.Router)();
+    const Project = (0, manager_1.getModel)('projects');
+    const toRef = (p) => ({ id: p.id, name: p.name, order: p.order });
+    // Rewrite ProjectInfo.pipelines from the current collection state, sorted by order.
+    const syncProjectRefs = async (projectId) => {
+        const db = getDb();
+        if (!db)
+            return;
+        const all = await db.collection('pipelines')
+            .find({ projectId })
+            .project({ _id: 0, id: 1, name: 1, order: 1 })
+            .sort({ order: 1, createdAt: 1 })
+            .toArray();
+        const refs = all.map(p => toRef(p));
+        await Project.update({ _id: projectId }, { pipelines: refs });
+    };
+    router.get('/projects/:projectId/pipelines', async (req, res) => {
+        try {
+            const auth = req.auth;
+            const { projectId } = req.params;
+            const project = await Project.findOne({ _id: projectId });
+            if (!project)
+                return res.status(404).json({ message: 'Project not found' });
+            if (!(0, auth_1.isProjectMember)(project, auth.userId))
+                return res.status(403).json({ message: 'Unauthorized' });
+            const db = getDb();
+            if (!db)
+                return res.status(500).json({ message: 'Database not available' });
+            const pipelines = await db.collection('pipelines')
+                .find({ projectId })
+                .sort({ order: 1, createdAt: 1 })
+                .toArray();
+            res.json({ pipelines });
+        }
+        catch (err) {
+            res.status(500).json({ message: err.message });
+        }
+    });
+    router.post('/projects/:projectId/pipelines', async (req, res) => {
+        try {
+            const auth = req.auth;
+            const { projectId } = req.params;
+            const { name, description, order } = req.body;
+            if (!name)
+                return res.status(400).json({ message: 'name is required' });
+            const project = await Project.findOne({ _id: projectId });
+            if (!project)
+                return res.status(404).json({ message: 'Project not found' });
+            if (!(0, auth_1.isProjectMember)(project, auth.userId))
+                return res.status(403).json({ message: 'Unauthorized' });
+            const db = getDb();
+            if (!db)
+                return res.status(500).json({ message: 'Database not available' });
+            const now = new Date();
+            const pipeline = {
+                id: crypto_1.default.randomUUID(),
+                projectId,
+                name,
+                description: description ?? null,
+                order: order ?? (project.pipelines?.length ?? 0),
+                nodeSchema: null,
+                createdBy: auth.userId,
+                createdAt: now,
+                updatedAt: now,
+            };
+            await db.collection('pipelines').insertOne({ ...pipeline });
+            await syncProjectRefs(projectId);
+            res.status(201).json({ pipeline });
+        }
+        catch (err) {
+            res.status(500).json({ message: err.message });
+        }
+    });
+    router.get('/projects/:projectId/pipelines/:pipelineId', async (req, res) => {
+        try {
+            const auth = req.auth;
+            const { projectId, pipelineId } = req.params;
+            const project = await Project.findOne({ _id: projectId });
+            if (!project)
+                return res.status(404).json({ message: 'Project not found' });
+            if (!(0, auth_1.isProjectMember)(project, auth.userId))
+                return res.status(403).json({ message: 'Unauthorized' });
+            const db = getDb();
+            if (!db)
+                return res.status(500).json({ message: 'Database not available' });
+            const pipeline = await db.collection('pipelines').findOne({ id: pipelineId, projectId });
+            if (!pipeline)
+                return res.status(404).json({ message: 'Pipeline not found' });
+            res.json({ pipeline });
+        }
+        catch (err) {
+            res.status(500).json({ message: err.message });
+        }
+    });
+    router.patch('/projects/:projectId/pipelines/:pipelineId', async (req, res) => {
+        try {
+            const auth = req.auth;
+            const { projectId, pipelineId } = req.params;
+            const project = await Project.findOne({ _id: projectId });
+            if (!project)
+                return res.status(404).json({ message: 'Project not found' });
+            if (!(0, auth_1.isProjectMember)(project, auth.userId))
+                return res.status(403).json({ message: 'Unauthorized' });
+            const db = getDb();
+            if (!db)
+                return res.status(500).json({ message: 'Database not available' });
+            const { name, description, nodeSchema, order } = req.body;
+            const $set = { updatedAt: new Date() };
+            if (name !== undefined)
+                $set.name = name;
+            if (description !== undefined)
+                $set.description = description;
+            if (nodeSchema !== undefined)
+                $set.nodeSchema = nodeSchema;
+            if (order !== undefined)
+                $set.order = order;
+            const result = await db.collection('pipelines').findOneAndUpdate({ id: pipelineId, projectId }, { $set }, { returnDocument: 'after' });
+            if (!result)
+                return res.status(404).json({ message: 'Pipeline not found' });
+            // Only name/order affect the lightweight refs.
+            if (name !== undefined || order !== undefined)
+                await syncProjectRefs(projectId);
+            res.json({ pipeline: result });
+        }
+        catch (err) {
+            res.status(500).json({ message: err.message });
+        }
+    });
+    router.delete('/projects/:projectId/pipelines/:pipelineId', async (req, res) => {
+        try {
+            const auth = req.auth;
+            const { projectId, pipelineId } = req.params;
+            const project = await Project.findOne({ _id: projectId });
+            if (!project)
+                return res.status(404).json({ message: 'Project not found' });
+            if (!(0, auth_1.isProjectMember)(project, auth.userId))
+                return res.status(403).json({ message: 'Unauthorized' });
+            const db = getDb();
+            if (!db)
+                return res.status(500).json({ message: 'Database not available' });
+            await db.collection('pipelines').deleteOne({ id: pipelineId, projectId });
+            await syncProjectRefs(projectId);
+            res.json({ message: 'Pipeline deleted' });
+        }
+        catch (err) {
+            res.status(500).json({ message: err.message });
+        }
+    });
+    return router;
+}

package/dist/middleware/routes/project.js

@@ -1,12 +1,17 @@
 "use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.projectRouter = projectRouter;
 const express_1 = require("express");
+const crypto_1 = __importDefault(require("crypto"));
 const manager_1 = require("../../models/manager");
 const auth_1 = require("../../utils/auth");
 const connectionManager_1 = require("../../adapters/database/connectionManager");
 const sql_1 = require("../../adapters/database/sql");
 const sanitize_1 = require("../../utils/sanitize");
+const builtinAccess_1 = require("../../utils/builtinAccess");
 function projectRouter(config) {
     const router = (0, express_1.Router)();
     const Project = (0, manager_1.getModel)('projects');
@@ -74,7 +79,7 @@ function projectRouter(config) {
             if (auth.role !== 'admin' && auth.role !== 'editor') {
                 return res.status(403).json({ message: 'Permission denied' });
             }
-            const { name, description, image, allowedOrigin, public: isPublic = true, category } = req.body;
+            const { name, description, image, allowedOrigin, public: isPublic = true, category, integrationIds } = req.body;
             if (isPublic === false && req.subscription === 'freemium') {
                 return res.status(403).json({ error: 'Private projects require a subscriber plan' });
             }
@@ -88,7 +93,55 @@ function projectRouter(config) {
             if (!user) {
                 return res.status(404).json({ message: 'User not found' });
             }
-            const newProject = await Project.create({
+            // Classify + revalidate every integrationId server-side — never trust a client-supplied
+            // builtin id. Any invalid id rejects the whole request (no project is created).
+            const dbConnections = [];
+            const storageConnections = [];
+            if (Array.isArray(integrationIds)) {
+                const UserIntegrationModel = (0, manager_1.getModel)('user_integrations');
+                for (const id of integrationIds) {
+                    const now = new Date();
+                    if ((0, builtinAccess_1.isBuiltinDb)(id, config)) {
+                        if (!(await (0, builtinAccess_1.assertBuiltinAccess)(auth, id, config, 'database'))) {
+                            return res.status(403).json({ message: `Access to built-in database '${id}' is not permitted` });
+                        }
+                        const db = config.databases.find(d => d.id === id);
+                        dbConnections.push({
+                            id: crypto_1.default.randomUUID(), name: id, dbType: db.type === 'sql' ? 'postgresql' : 'mongodb',
+                            credentialId: '', projectId: '', createdAt: now, isBuiltin: true, integrationId: id, source: 'builtin',
+                        });
+                    }
+                    else if ((0, builtinAccess_1.isBuiltinStorageId)(id, config)) {
+                        if (!(await (0, builtinAccess_1.assertBuiltinAccess)(auth, id, config, 'storage'))) {
+                            return res.status(403).json({ message: `Access to built-in storage '${id}' is not permitted` });
+                        }
+                        const provider = config.storageProviders.find(p => p.id === id);
+                        storageConnections.push({
+                            id: crypto_1.default.randomUUID(), name: id, type: provider.type,
+                            credentialId: '', projectId: '', createdAt: now, isBuiltin: true, integrationId: id, source: 'builtin',
+                        });
+                    }
+                    else {
+                        const integration = await UserIntegrationModel.findOne({ id, userId: auth.userId });
+                        if (!integration) {
+                            return res.status(403).json({ message: `Integration '${id}' is not valid or does not belong to you` });
+                        }
+                        if (integration.kind === 'database') {
+                            dbConnections.push({
+                                id: crypto_1.default.randomUUID(), name: integration.name, dbType: integration.provider,
+                                credentialId: '', projectId: '', createdAt: now, isBuiltin: false, integrationId: id, source: 'integration',
+                            });
+                        }
+                        else {
+                            storageConnections.push({
+                                id: crypto_1.default.randomUUID(), name: integration.name, type: integration.provider,
+                                credentialId: '', projectId: '', createdAt: now, isBuiltin: false, integrationId: id, source: 'integration',
+                            });
+                        }
+                    }
+                }
+            }
+            let newProject = await Project.create({
                 dbType,
                 name,
                 description: description || '',
@@ -97,7 +150,18 @@ function projectRouter(config) {
                 public: isPublic,
                 category: category || null,
                 members: [{ userId: auth.userId, username: user.username, role: "admin", status: "active", archived: false }],
+                dbConnections: [],
+                storageConnections: [],
             });
+            const newProjectId = newProject._id || newProject.id;
+            if (dbConnections.length || storageConnections.length) {
+                const stamped = await Project.update({ _id: newProjectId }, {
+                    dbConnections: dbConnections.map(c => ({ ...c, projectId: newProjectId })),
+                    storageConnections: storageConnections.map(c => ({ ...c, projectId: newProjectId })),
+                });
+                if (stamped)
+                    newProject = stamped;
+            }
             const allProjects = await Project.find({});
             const projects = allProjects
                 .filter(project => {