streamby-core 0.29.8 → 0.29.11

package/dist/adapters/database/connectionManager.js

@@ -73,13 +73,15 @@ const ensureTablesExist = async (pool) => {
         console.log('✅ "projects" table ensured to exist.');
         // Add JSONB columns to existing tables that predate this schema version
         await pool.query(`
-      ALTER TABLE streamby.projects ADD COLUMN IF NOT EXISTS "allowedOrigin"  JSONB DEFAULT '[]';
-      ALTER TABLE streamby.projects ADD COLUMN IF NOT EXISTS exports          JSONB DEFAULT '[]';
-      ALTER TABLE streamby.projects ADD COLUMN IF NOT EXISTS credentials      JSONB DEFAULT '[]';
-      ALTER TABLE streamby.projects ADD COLUMN IF NOT EXISTS "apiConnections" JSONB DEFAULT '[]';
-      ALTER TABLE streamby.projects ADD COLUMN IF NOT EXISTS "dbConnections"  JSONB DEFAULT '[]';
-      ALTER TABLE streamby.projects ADD COLUMN IF NOT EXISTS workflow         JSONB;
-      ALTER TABLE streamby.projects ADD COLUMN IF NOT EXISTS pipelines        JSONB DEFAULT '[]';
+      ALTER TABLE streamby.projects ADD COLUMN IF NOT EXISTS "allowedOrigin"     JSONB DEFAULT '[]';
+      ALTER TABLE streamby.projects ADD COLUMN IF NOT EXISTS exports             JSONB DEFAULT '[]';
+      ALTER TABLE streamby.projects ADD COLUMN IF NOT EXISTS credentials         JSONB DEFAULT '[]';
+      ALTER TABLE streamby.projects ADD COLUMN IF NOT EXISTS "apiConnections"    JSONB DEFAULT '[]';
+      ALTER TABLE streamby.projects ADD COLUMN IF NOT EXISTS "dbConnections"     JSONB DEFAULT '[]';
+      ALTER TABLE streamby.projects ADD COLUMN IF NOT EXISTS "storageConnections" JSONB DEFAULT '[]';
+      ALTER TABLE streamby.projects ADD COLUMN IF NOT EXISTS workflow            JSONB;
+      ALTER TABLE streamby.projects ADD COLUMN IF NOT EXISTS pipelines           JSONB DEFAULT '[]';
+      ALTER TABLE streamby.projects ADD COLUMN IF NOT EXISTS "builtinBackfilledAt" TIMESTAMP WITH TIME ZONE;
     `);
         // Ensure dbType exists with a non-null default
         await pool.query(`
@@ -124,6 +126,24 @@ const ensureTablesExist = async (pool) => {
       );
     `);
         console.log('✅ "exports" table ensured to exist.');
+        // user_integrations is registered against the main db only (see createRouter.ts), but
+        // this function runs per-SQL-connection like projects/exports above — harmless on
+        // non-main connections since the model never queries them there.
+        await pool.query(`
+      CREATE TABLE IF NOT EXISTS streamby.user_integrations (
+        id                     TEXT PRIMARY KEY DEFAULT uuid_generate_v4()::text,
+        "userId"               VARCHAR(255) NOT NULL,
+        kind                   VARCHAR(20) NOT NULL,
+        provider               VARCHAR(20) NOT NULL,
+        name                   VARCHAR(255) NOT NULL,
+        description            TEXT,
+        "encryptedCredential"  TEXT NOT NULL,
+        "createdAt"            TIMESTAMP WITH TIME ZONE DEFAULT NOW(),
+        "updatedAt"            TIMESTAMP WITH TIME ZONE DEFAULT NOW()
+      );
+      CREATE INDEX IF NOT EXISTS user_integrations_userid_idx ON streamby.user_integrations ("userId");
+    `);
+        console.log('✅ "user_integrations" table ensured to exist.');
     }
     catch (error) {
         console.error('❌ Error ensuring tables exist:', error);

package/dist/middleware/createRouter.js

@@ -8,6 +8,7 @@ const express_1 = __importDefault(require("express"));
 const manager_1 = require("../models/manager");
 const storage_1 = require("../providers/storage");
 const connectionManager_1 = require("../adapters/database/connectionManager");
+const backfillBuiltinConnections_1 = require("../services/backfillBuiltinConnections");
 const wsHub_1 = require("../services/wsHub");
 const auth_1 = require("../services/auth");
 const encryption_1 = require("../utils/encryption");
@@ -22,6 +23,7 @@ const credential_1 = require("./routes/credential");
 const connection_1 = require("./routes/connection");
 const dbConnection_1 = require("./routes/dbConnection");
 const storageConnection_1 = require("./routes/storageConnection");
+const userIntegration_1 = require("./routes/userIntegration");
 const notification_1 = require("./routes/notification");
 const subscription_1 = require("./routes/subscription");
 const media_1 = require("./routes/media");
@@ -46,6 +48,10 @@ function createStreamByRouter(config) {
     const readyPromise = (0, connectionManager_1.initConnections)(config.databases || [])
         .catch((err) => {
         console.error('❌ StreamBy: failed to initialize database connections:', err);
+    })
+        .then(() => (0, backfillBuiltinConnections_1.backfillBuiltinConnections)(config))
+        .catch((err) => {
+        console.error('❌ StreamBy: failed to backfill built-in connections:', err);
     })
         .finally(() => {
         ready = true;
@@ -77,6 +83,7 @@ function createStreamByRouter(config) {
         if (mainDb) {
             (0, manager_1.registerModel)('users', [mainDb.id], 'users', 'accounts');
             (0, manager_1.registerModel)('user_subscriptions', [mainDb.id], 'user_subscriptions', 'streamby');
+            (0, manager_1.registerModel)('user_integrations', [mainDb.id], 'user_integrations', streambySchema);
         }
     }
     if (config.websocket?.server) {
@@ -95,6 +102,7 @@ function createStreamByRouter(config) {
     router.use((0, connection_1.connectionRouter)(config));
     router.use((0, dbConnection_1.dbConnectionRouter)(config));
     router.use((0, storageConnection_1.storageConnectionRouter)(config));
+    router.use((0, userIntegration_1.userIntegrationRouter)(config));
     router.use((0, notification_1.notificationRouter)(config));
     router.use((0, subscription_1.subscriptionRouter)(config));
     router.use((0, media_1.mediaRouter)(config));

package/dist/middleware/routes/dbConnection.js

@@ -39,27 +39,42 @@ const mongodb_1 = require("mongodb");
 const manager_1 = require("../../models/manager");
 const auth_1 = require("../../utils/auth");
 const connectionManager_1 = require("../../adapters/database/connectionManager");
+const builtinAccess_1 = require("../../utils/builtinAccess");
+const userIntegration_1 = require("../../services/userIntegration");
 const dbConnection_1 = require("../../services/dbConnection");
 const VALID_DB_TYPES = ['postgresql', 'mongodb'];
-function isBuiltinDb(connId, config) {
-    return (config.databases ?? []).some(db => db.id === connId);
-}
-function resolveBuiltinConnection(connId, config) {
-    const db = (config.databases ?? []).find(d => d.id === connId);
+// `builtinId` is config.databases[].id (e.g. 'mongo'), NOT the DbConnection row's own id —
+// those are different values since TCORE-69's backfill gives each row its own UUID.
+function resolveBuiltinConnection(builtinId, config) {
+    const db = (config.databases ?? []).find(d => d.id === builtinId);
     if (!db)
-        return { error: `Database '${connId}' not found in config`, status: 404 };
+        return { error: `Database '${builtinId}' not found in config`, status: 404 };
     try {
-        const { client, type } = (0, connectionManager_1.getConnection)(connId);
+        const { client, type } = (0, connectionManager_1.getConnection)(builtinId);
         return { client: client, dbType: type };
     }
     catch (e) {
         return { error: e.message, status: 503 };
     }
 }
+// Finds the connection row + classifies it. A row is builtin iff conn.source === 'builtin'
+// (persisted at creation/backfill time) — NOT by comparing the row's own id against
+// config.databases, which no longer holds since builtin rows get their own generated id.
+function findDbConnection(project, connId) {
+    return project.dbConnections?.find((c) => c.id === connId);
+}
 async function getDecryptedConnectionString(project, connId) {
     const conn = project.dbConnections?.find((c) => c.id === connId);
     if (!conn)
         return { error: 'DB connection not found', status: 404 };
+    if (conn.source === 'integration') {
+        if (!conn.integrationId)
+            return { error: 'Connection is missing its integrationId', status: 500 };
+        const credential = await (0, userIntegration_1.getDecryptedIntegrationCredentialById)(conn.integrationId);
+        if (!credential)
+            return { error: 'Integration not found', status: 400 };
+        return { connectionString: credential, conn };
+    }
     const { decrypt, isEncryptionKeySet } = await Promise.resolve().then(() => __importStar(require('../../utils/encryption')));
     if (!isEncryptionKeySet())
         return { error: 'Encryption key is not set', status: 500 };
@@ -93,9 +108,15 @@ function dbConnectionRouter(config) {
             if (auth.role !== 'admin' && auth.role !== 'editor') {
                 return res.status(403).json({ message: 'Permission denied' });
             }
-            const { name, dbType, credentialId, description } = req.body;
-            if (!name || !dbType || !credentialId) {
-                return res.status(400).json({ message: 'name, dbType, and credentialId are required' });
+            const { name, dbType, credentialId, integrationId, description } = req.body;
+            if (!name || !dbType) {
+                return res.status(400).json({ message: 'name and dbType are required' });
+            }
+            if (!credentialId && !integrationId) {
+                return res.status(400).json({ message: 'Either credentialId or integrationId is required' });
+            }
+            if (credentialId && integrationId) {
+                return res.status(400).json({ message: 'Provide only one of credentialId or integrationId' });
             }
             if (!VALID_DB_TYPES.includes(dbType)) {
                 return res.status(400).json({ message: `dbType must be one of: ${VALID_DB_TYPES.join(', ')}` });
@@ -105,16 +126,28 @@ function dbConnectionRouter(config) {
                 return res.status(404).json({ message: 'Project not found' });
             if (!(0, auth_1.isProjectMember)(project, auth.userId))
                 return res.status(403).json({ message: 'Unauthorized project access' });
-            const credExists = project.credentials?.some((c) => c.id === credentialId);
-            if (!credExists)
-                return res.status(400).json({ message: 'Credential not found in project' });
+            if (integrationId) {
+                const UserIntegrationModel = (0, manager_1.getModel)('user_integrations');
+                const integration = await UserIntegrationModel.findOne({ id: integrationId, userId: auth.userId });
+                if (!integration)
+                    return res.status(404).json({ message: 'Integration not found' });
+                if (integration.kind !== 'database')
+                    return res.status(400).json({ message: 'Integration is not a database integration' });
+            }
+            else {
+                const credExists = project.credentials?.some((c) => c.id === credentialId);
+                if (!credExists)
+                    return res.status(400).json({ message: 'Credential not found in project' });
+            }
             const connection = {
                 id: new mongodb_1.ObjectId().toHexString(),
                 name,
                 dbType,
-                credentialId,
+                credentialId: credentialId ?? '',
                 projectId: req.params.id,
                 createdAt: new Date(),
+                source: integrationId ? 'integration' : 'manual',
+                ...(integrationId && { integrationId }),
                 ...(description !== undefined && { description }),
             };
             await Project.update({ _id: req.params.id }, { $push: { dbConnections: connection } });
@@ -127,9 +160,6 @@ function dbConnectionRouter(config) {
     // ─── Delete DB connection ─────────────────────────────────────────────────
     router.delete('/projects/:id/connections/db/:connId', async (req, res) => {
         try {
-            if (isBuiltinDb(req.params.connId, config)) {
-                return res.status(403).json({ message: 'Cannot delete a built-in database connection' });
-            }
             const auth = req.auth;
             if (auth.role !== 'admin' && auth.role !== 'editor') {
                 return res.status(403).json({ message: 'Permission denied' });
@@ -139,9 +169,12 @@ function dbConnectionRouter(config) {
                 return res.status(404).json({ message: 'Project not found' });
             if (!(0, auth_1.isProjectMember)(project, auth.userId))
                 return res.status(403).json({ message: 'Unauthorized project access' });
-            const exists = project.dbConnections?.some((c) => c.id === req.params.connId);
-            if (!exists)
+            const conn = findDbConnection(project, req.params.connId);
+            if (!conn)
                 return res.status(404).json({ message: 'DB connection not found' });
+            if (conn.source === 'builtin') {
+                return res.status(403).json({ message: 'Cannot delete a built-in database connection' });
+            }
             await Project.update({ _id: req.params.id }, { $pull: { dbConnections: { id: req.params.connId } } });
             return res.status(200).json({ message: 'DB connection deleted successfully' });
         }
@@ -158,8 +191,15 @@ function dbConnectionRouter(config) {
                 return res.status(404).json({ message: 'Project not found' });
             if (!(0, auth_1.isProjectMember)(project, auth.userId))
                 return res.status(403).json({ message: 'Unauthorized project access' });
-            if (isBuiltinDb(req.params.connId, config)) {
-                const internal = resolveBuiltinConnection(req.params.connId, config);
+            const conn = findDbConnection(project, req.params.connId);
+            if (!conn)
+                return res.status(404).json({ message: 'DB connection not found' });
+            if (conn.source === 'builtin') {
+                const builtinId = conn.integrationId;
+                if (!(await (0, builtinAccess_1.assertBuiltinAccess)(auth, builtinId, config, 'database'))) {
+                    return res.status(403).json({ message: 'Access to this built-in database is not permitted' });
+                }
+                const internal = resolveBuiltinConnection(builtinId, config);
                 if ('error' in internal)
                     return res.status(internal.status).json({ message: internal.error });
                 const tables = await (0, dbConnection_1.listTablesInternal)(internal.client, internal.dbType, req.params.id);
@@ -190,8 +230,15 @@ function dbConnectionRouter(config) {
             const schema = req.body;
             if (!schema.tableName)
                 return res.status(400).json({ message: 'tableName is required' });
-            if (isBuiltinDb(req.params.connId, config)) {
-                const internal = resolveBuiltinConnection(req.params.connId, config);
+            const conn = findDbConnection(project, req.params.connId);
+            if (!conn)
+                return res.status(404).json({ message: 'DB connection not found' });
+            if (conn.source === 'builtin') {
+                const builtinId = conn.integrationId;
+                if (!(await (0, builtinAccess_1.assertBuiltinAccess)(auth, builtinId, config, 'database'))) {
+                    return res.status(403).json({ message: 'Access to this built-in database is not permitted' });
+                }
+                const internal = resolveBuiltinConnection(builtinId, config);
                 if ('error' in internal)
                     return res.status(internal.status).json({ message: internal.error });
                 if (internal.dbType === 'sql' && (!Array.isArray(schema.columns) || schema.columns.length === 0)) {
@@ -225,8 +272,15 @@ function dbConnectionRouter(config) {
                 return res.status(404).json({ message: 'Project not found' });
             if (!(0, auth_1.isProjectMember)(project, auth.userId))
                 return res.status(403).json({ message: 'Unauthorized project access' });
-            if (isBuiltinDb(req.params.connId, config)) {
-                const internal = resolveBuiltinConnection(req.params.connId, config);
+            const conn = findDbConnection(project, req.params.connId);
+            if (!conn)
+                return res.status(404).json({ message: 'DB connection not found' });
+            if (conn.source === 'builtin') {
+                const builtinId = conn.integrationId;
+                if (!(await (0, builtinAccess_1.assertBuiltinAccess)(auth, builtinId, config, 'database'))) {
+                    return res.status(403).json({ message: 'Access to this built-in database is not permitted' });
+                }
+                const internal = resolveBuiltinConnection(builtinId, config);
                 if ('error' in internal)
                     return res.status(internal.status).json({ message: internal.error });
                 await (0, dbConnection_1.deleteTableOrCollectionInternal)(internal.client, internal.dbType, req.params.tableName, req.params.id);
@@ -253,8 +307,15 @@ function dbConnectionRouter(config) {
                 return res.status(403).json({ message: 'Unauthorized project access' });
             const limit = Math.min(parseInt(String(req.query.limit ?? 50), 10), 500);
             const offset = Math.max(parseInt(String(req.query.offset ?? 0), 10), 0);
-            if (isBuiltinDb(req.params.connId, config)) {
-                const internal = resolveBuiltinConnection(req.params.connId, config);
+            const conn = findDbConnection(project, req.params.connId);
+            if (!conn)
+                return res.status(404).json({ message: 'DB connection not found' });
+            if (conn.source === 'builtin') {
+                const builtinId = conn.integrationId;
+                if (!(await (0, builtinAccess_1.assertBuiltinAccess)(auth, builtinId, config, 'database'))) {
+                    return res.status(403).json({ message: 'Access to this built-in database is not permitted' });
+                }
+                const internal = resolveBuiltinConnection(builtinId, config);
                 if ('error' in internal)
                     return res.status(internal.status).json({ message: internal.error });
                 const records = await (0, dbConnection_1.queryRecordsInternal)(internal.client, internal.dbType, req.params.tableName, limit, offset, req.params.id);
@@ -286,8 +347,15 @@ function dbConnectionRouter(config) {
             if (!record || typeof record !== 'object' || Array.isArray(record)) {
                 return res.status(400).json({ message: 'Request body must be a JSON object' });
             }
-            if (isBuiltinDb(req.params.connId, config)) {
-                const internal = resolveBuiltinConnection(req.params.connId, config);
+            const conn = findDbConnection(project, req.params.connId);
+            if (!conn)
+                return res.status(404).json({ message: 'DB connection not found' });
+            if (conn.source === 'builtin') {
+                const builtinId = conn.integrationId;
+                if (!(await (0, builtinAccess_1.assertBuiltinAccess)(auth, builtinId, config, 'database'))) {
+                    return res.status(403).json({ message: 'Access to this built-in database is not permitted' });
+                }
+                const internal = resolveBuiltinConnection(builtinId, config);
                 if ('error' in internal)
                     return res.status(internal.status).json({ message: internal.error });
                 const inserted = await (0, dbConnection_1.insertRecordInternal)(internal.client, internal.dbType, req.params.tableName, record, req.params.id);
@@ -318,8 +386,15 @@ function dbConnectionRouter(config) {
             if (!updates || typeof updates !== 'object' || Array.isArray(updates)) {
                 return res.status(400).json({ message: 'Request body must be a JSON object' });
             }
-            if (isBuiltinDb(req.params.connId, config)) {
-                const internal = resolveBuiltinConnection(req.params.connId, config);
+            const conn = findDbConnection(project, req.params.connId);
+            if (!conn)
+                return res.status(404).json({ message: 'DB connection not found' });
+            if (conn.source === 'builtin') {
+                const builtinId = conn.integrationId;
+                if (!(await (0, builtinAccess_1.assertBuiltinAccess)(auth, builtinId, config, 'database'))) {
+                    return res.status(403).json({ message: 'Access to this built-in database is not permitted' });
+                }
+                const internal = resolveBuiltinConnection(builtinId, config);
                 if ('error' in internal)
                     return res.status(internal.status).json({ message: internal.error });
                 const updated = await (0, dbConnection_1.updateRecordInternal)(internal.client, internal.dbType, req.params.tableName, req.params.recordId, updates, req.params.id);
@@ -346,8 +421,15 @@ function dbConnectionRouter(config) {
                 return res.status(404).json({ message: 'Project not found' });
             if (!(0, auth_1.isProjectMember)(project, auth.userId))
                 return res.status(403).json({ message: 'Unauthorized project access' });
-            if (isBuiltinDb(req.params.connId, config)) {
-                const internal = resolveBuiltinConnection(req.params.connId, config);
+            const conn = findDbConnection(project, req.params.connId);
+            if (!conn)
+                return res.status(404).json({ message: 'DB connection not found' });
+            if (conn.source === 'builtin') {
+                const builtinId = conn.integrationId;
+                if (!(await (0, builtinAccess_1.assertBuiltinAccess)(auth, builtinId, config, 'database'))) {
+                    return res.status(403).json({ message: 'Access to this built-in database is not permitted' });
+                }
+                const internal = resolveBuiltinConnection(builtinId, config);
                 if ('error' in internal)
                     return res.status(internal.status).json({ message: internal.error });
                 await (0, dbConnection_1.deleteRecordInternal)(internal.client, internal.dbType, req.params.tableName, req.params.recordId, req.params.id);

package/dist/middleware/routes/project.js

@@ -7,6 +7,7 @@ const auth_1 = require("../../utils/auth");
 const connectionManager_1 = require("../../adapters/database/connectionManager");
 const sql_1 = require("../../adapters/database/sql");
 const sanitize_1 = require("../../utils/sanitize");
+const projectIntegration_1 = require("../../services/projectIntegration");
 function projectRouter(config) {
     const router = (0, express_1.Router)();
     const Project = (0, manager_1.getModel)('projects');
@@ -74,7 +75,7 @@ function projectRouter(config) {
             if (auth.role !== 'admin' && auth.role !== 'editor') {
                 return res.status(403).json({ message: 'Permission denied' });
             }
-            const { name, description, image, allowedOrigin, public: isPublic = true, category } = req.body;
+            const { name, description, image, allowedOrigin, public: isPublic = true, category, integrationIds } = req.body;
             if (isPublic === false && req.subscription === 'freemium') {
                 return res.status(403).json({ error: 'Private projects require a subscriber plan' });
             }
@@ -88,7 +89,22 @@ function projectRouter(config) {
             if (!user) {
                 return res.status(404).json({ message: 'User not found' });
             }
-            const newProject = await Project.create({
+            // Classify + revalidate every integrationId server-side — never trust a client-supplied
+            // builtin id. Any invalid id rejects the whole request (no project is created).
+            const dbConnections = [];
+            const storageConnections = [];
+            if (Array.isArray(integrationIds)) {
+                for (const id of integrationIds) {
+                    const result = await (0, projectIntegration_1.classifyIntegrationId)(id, auth, config, '');
+                    if ('error' in result)
+                        return res.status(result.status).json({ message: result.error });
+                    if (result.kind === 'database')
+                        dbConnections.push(result.connection);
+                    else
+                        storageConnections.push(result.connection);
+                }
+            }
+            let newProject = await Project.create({
                 dbType,
                 name,
                 description: description || '',
@@ -97,7 +113,18 @@ function projectRouter(config) {
                 public: isPublic,
                 category: category || null,
                 members: [{ userId: auth.userId, username: user.username, role: "admin", status: "active", archived: false }],
+                dbConnections: [],
+                storageConnections: [],
             });
+            const newProjectId = newProject._id || newProject.id;
+            if (dbConnections.length || storageConnections.length) {
+                const stamped = await Project.update({ _id: newProjectId }, {
+                    dbConnections: dbConnections.map(c => ({ ...c, projectId: newProjectId })),
+                    storageConnections: storageConnections.map(c => ({ ...c, projectId: newProjectId })),
+                });
+                if (stamped)
+                    newProject = stamped;
+            }
             const allProjects = await Project.find({});
             const projects = allProjects
                 .filter(project => {
@@ -366,5 +393,68 @@ function projectRouter(config) {
             res.status(500).json({ message: 'Failed to update project origins', details: err.message });
         }
     });
+    // ─── Add an integration to an existing project ───────────────────────────
+    router.post('/projects/:id/integrations', async (req, res) => {
+        try {
+            const auth = req.auth;
+            if (auth.role !== 'admin' && auth.role !== 'editor') {
+                return res.status(403).json({ message: 'Permission denied' });
+            }
+            const projectId = req.params.id;
+            const { integrationId } = req.body;
+            if (!integrationId)
+                return res.status(400).json({ message: 'integrationId is required' });
+            const project = await Project.findOne({ _id: projectId });
+            if (!project)
+                return res.status(404).json({ message: 'Project not found' });
+            if (!(0, auth_1.isProjectMember)(project, auth.userId))
+                return res.status(403).json({ message: 'Unauthorized project access' });
+            const alreadyConnected = [...(project.dbConnections ?? []), ...(project.storageConnections ?? [])]
+                .some((c) => c.integrationId === integrationId);
+            if (alreadyConnected)
+                return res.status(400).json({ message: 'This integration is already connected to the project' });
+            const result = await (0, projectIntegration_1.classifyIntegrationId)(integrationId, auth, config, projectId);
+            if ('error' in result)
+                return res.status(result.status).json({ message: result.error });
+            const updated = result.kind === 'database'
+                ? await Project.update({ _id: projectId }, { $push: { dbConnections: result.connection } })
+                : await Project.update({ _id: projectId }, { $push: { storageConnections: result.connection } });
+            if (!updated)
+                return res.status(404).json({ message: 'Project not found or not updated' });
+            res.status(201).json({ data: result.connection, project: (0, sanitize_1.sanitizeProject)(updated) });
+        }
+        catch (err) {
+            res.status(500).json({ message: 'Failed to add integration', details: err.message });
+        }
+    });
+    // ─── Remove an integration from a project ────────────────────────────────
+    router.delete('/projects/:id/integrations/:integrationId', async (req, res) => {
+        try {
+            const auth = req.auth;
+            if (auth.role !== 'admin' && auth.role !== 'editor') {
+                return res.status(403).json({ message: 'Permission denied' });
+            }
+            const projectId = req.params.id;
+            const { integrationId } = req.params;
+            const project = await Project.findOne({ _id: projectId });
+            if (!project)
+                return res.status(404).json({ message: 'Project not found' });
+            if (!(0, auth_1.isProjectMember)(project, auth.userId))
+                return res.status(403).json({ message: 'Unauthorized project access' });
+            const dbConn = (project.dbConnections ?? []).find((c) => c.integrationId === integrationId);
+            const storageConn = (project.storageConnections ?? []).find((c) => c.integrationId === integrationId);
+            if (!dbConn && !storageConn)
+                return res.status(404).json({ message: 'Integration not connected to this project' });
+            const updated = dbConn
+                ? await Project.update({ _id: projectId }, { $pull: { dbConnections: { id: dbConn.id } } })
+                : await Project.update({ _id: projectId }, { $pull: { storageConnections: { id: storageConn.id } } });
+            if (!updated)
+                return res.status(404).json({ message: 'Project not found or not updated' });
+            res.status(200).json({ message: 'Integration removed', project: (0, sanitize_1.sanitizeProject)(updated) });
+        }
+        catch (err) {
+            res.status(500).json({ message: 'Failed to remove integration', details: err.message });
+        }
+    });
     return router;
 }