streamby-core 0.29.8 → 0.29.11

package/dist/middleware/routes/storage.js

@@ -13,6 +13,8 @@ const manager_1 = require("../../models/manager");
 const connectionManager_1 = require("../../adapters/database/connectionManager");
 const auth_1 = require("../../utils/auth");
 const encryption_1 = require("../../utils/encryption");
+const builtinAccess_1 = require("../../utils/builtinAccess");
+const userIntegration_1 = require("../../services/userIntegration");
 const mongodb_1 = require("mongodb");
 const crypto_1 = __importDefault(require("crypto"));
 const VALID_CATEGORIES = ['images', 'audios', 'videos', '3d-models'];
@@ -46,36 +48,64 @@ function getRawFoldersCollection() {
         return null;
     return (0, connectionManager_1.getConnection)(activeId).client.db().collection('storage_folders');
 }
-function connFilter(projectId, connId, extra) {
-    const isBuiltin = connId === 'builtin' || connId.startsWith('builtin-');
-    const connMatch = isBuiltin
-        ? { $or: [{ storageConnectionId: connId }, { storageConnectionId: { $exists: false } }] }
-        : { storageConnectionId: connId };
-    return { projectId, ...connMatch, ...(extra ?? {}) };
-}
-async function resolveConnAdapter(connId, project, globalAdapter) {
-    if (connId === 'builtin' || connId.startsWith('builtin-'))
-        return globalAdapter;
-    const conn = project.storageConnections?.find((c) => c.id === connId);
-    if (!conn)
-        return { error: 'Storage connection not found', status: 404 };
-    if (!(0, encryption_1.isEncryptionKeySet)())
-        return { error: 'Encryption key not set', status: 500 };
-    const credential = project.credentials?.find((c) => c.id === conn.credentialId);
-    if (!credential)
-        return { error: 'Credential not found in project', status: 400 };
-    try {
-        const s3Config = JSON.parse((0, encryption_1.decrypt)(credential.encryptedValue));
-        return new s3_1.S3Adapter(s3Config);
-    }
-    catch (e) {
-        return { error: `Failed to initialize storage adapter: ${e.message}`, status: 500 };
-    }
-}
 function storageRouter(config) {
     const router = (0, express_1.Router)();
     const adapter = config.adapter || (0, storage_1.createStorageProvider)(config.storageProviders);
     const Project = (0, manager_1.getModel)('projects');
+    // A row is builtin iff its own `source === 'builtin'` (set at backfill/creation time) —
+    // NOT by comparing connId (the row's own generated id) against config.storageProviders,
+    // which no longer holds since builtin rows get their own id distinct from provider.id.
+    function findStorageConn(project, connId) {
+        return project.storageConnections?.find((c) => c.id === connId);
+    }
+    function connFilter(projectId, connId, project, extra) {
+        const conn = findStorageConn(project, connId);
+        const isBuiltin = conn?.source === 'builtin';
+        const connMatch = isBuiltin
+            ? { $or: [{ storageConnectionId: connId }, { storageConnectionId: { $exists: false } }] }
+            : { storageConnectionId: connId };
+        return { projectId, ...connMatch, ...(extra ?? {}) };
+    }
+    async function resolveConnAdapter(connId, project, auth) {
+        const conn = findStorageConn(project, connId);
+        if (!conn)
+            return { error: 'Storage connection not found', status: 404 };
+        if (conn.source === 'builtin') {
+            const builtinId = conn.integrationId;
+            if (!(await (0, builtinAccess_1.assertBuiltinAccess)(auth, builtinId, config, 'storage'))) {
+                return { error: 'Access to this built-in storage is not permitted', status: 403 };
+            }
+            const provider = config.storageProviders.find(p => p.id === builtinId);
+            if (!provider)
+                return { error: 'Storage provider not found', status: 404 };
+            return provider.type === 's3' ? new s3_1.S3Adapter(provider.config) : adapter;
+        }
+        if (conn.source === 'integration') {
+            if (!conn.integrationId)
+                return { error: 'Connection is missing its integrationId', status: 500 };
+            try {
+                const s3Config = await (0, userIntegration_1.getDecryptedIntegrationCredentialById)(conn.integrationId);
+                if (!s3Config)
+                    return { error: 'Integration not found', status: 400 };
+                return new s3_1.S3Adapter(s3Config);
+            }
+            catch (e) {
+                return { error: `Failed to initialize storage adapter: ${e.message}`, status: 500 };
+            }
+        }
+        if (!(0, encryption_1.isEncryptionKeySet)())
+            return { error: 'Encryption key not set', status: 500 };
+        const credential = project.credentials?.find((c) => c.id === conn.credentialId);
+        if (!credential)
+            return { error: 'Credential not found in project', status: 400 };
+        try {
+            const s3Config = JSON.parse((0, encryption_1.decrypt)(credential.encryptedValue));
+            return new s3_1.S3Adapter(s3Config);
+        }
+        catch (e) {
+            return { error: `Failed to initialize storage adapter: ${e.message}`, status: 500 };
+        }
+    }
     router.get('/upload-project-image-url/:id', async (req, res) => {
         try {
             const auth = req.auth;
@@ -301,7 +331,7 @@ function storageRouter(config) {
                 return res.status(404).json({ message: 'Project not found' });
             if (!(0, auth_1.isProjectMember)(project, auth.userId))
                 return res.status(403).json({ message: 'Unauthorized access' });
-            const connAdapter = await resolveConnAdapter(connId, project, adapter);
+            const connAdapter = await resolveConnAdapter(connId, project, auth);
             if ('error' in connAdapter)
                 return res.status(connAdapter.status).json({ message: connAdapter.error });
             if (!connAdapter.getPresignedUploadUrl)
@@ -340,13 +370,13 @@ function storageRouter(config) {
                 return res.status(404).json({ message: 'Project not found' });
             if (!(0, auth_1.isProjectMember)(project, auth.userId))
                 return res.status(403).json({ message: 'Unauthorized access' });
-            const connAdapter = await resolveConnAdapter(connId, project, adapter);
+            const connAdapter = await resolveConnAdapter(connId, project, auth);
             if ('error' in connAdapter)
                 return res.status(connAdapter.status).json({ message: connAdapter.error });
             const collection = getRawFilesCollection();
             if (!collection)
                 return res.status(500).json({ message: 'Database not available' });
-            const files = await collection.find(connFilter(projectId, connId)).sort({ createdAt: -1 }).limit(12).toArray();
+            const files = await collection.find(connFilter(projectId, connId, project)).sort({ createdAt: -1 }).limit(12).toArray();
             const data = await Promise.all(files.map(f => resolveFileUrl(f, connAdapter)));
             res.json({ data });
         }
@@ -366,13 +396,13 @@ function storageRouter(config) {
                 return res.status(404).json({ message: 'Project not found' });
             if (!(0, auth_1.isProjectMember)(project, auth.userId))
                 return res.status(403).json({ message: 'Unauthorized access' });
-            const connAdapter = await resolveConnAdapter(connId, project, adapter);
+            const connAdapter = await resolveConnAdapter(connId, project, auth);
             if ('error' in connAdapter)
                 return res.status(connAdapter.status).json({ message: connAdapter.error });
             const collection = getRawFilesCollection();
             if (!collection)
                 return res.status(500).json({ message: 'Database not available' });
-            const files = await collection.find(connFilter(projectId, connId, { category })).sort({ createdAt: -1 }).toArray();
+            const files = await collection.find(connFilter(projectId, connId, project, { category })).sort({ createdAt: -1 }).toArray();
             const data = await Promise.all(files.map(f => resolveFileUrl(f, connAdapter)));
             res.json({ data });
         }
@@ -396,20 +426,20 @@ function storageRouter(config) {
             const collection = getRawFilesCollection();
             if (!collection)
                 return res.status(500).json({ message: 'Database not available' });
-            const fileDoc = await collection.findOne(connFilter(projectId, connId, { fileId }));
+            const fileDoc = await collection.findOne(connFilter(projectId, connId, project, { fileId }));
             if (!fileDoc)
                 return res.status(404).json({ message: 'File not found' });
             if (!validateContentType(contentType, fileName, fileDoc.category)) {
                 return res.status(400).json({ message: `File does not match category ${fileDoc.category}` });
             }
-            const connAdapter = await resolveConnAdapter(connId, project, adapter);
+            const connAdapter = await resolveConnAdapter(connId, project, auth);
             if ('error' in connAdapter)
                 return res.status(connAdapter.status).json({ message: connAdapter.error });
             if (!connAdapter.getPresignedUploadUrl) {
                 return res.status(501).json({ message: 'Storage adapter does not support presigned uploads' });
             }
             const url = await connAdapter.getPresignedUploadUrl(fileDoc.storageKey, contentType);
-            await collection.updateOne(connFilter(projectId, connId, { fileId }), { $set: { contentType, updatedAt: new Date() } });
+            await collection.updateOne(connFilter(projectId, connId, project, { fileId }), { $set: { contentType, updatedAt: new Date() } });
             res.json({ url, storageKey: fileDoc.storageKey, fileId });
         }
         catch (err) {
@@ -432,7 +462,7 @@ function storageRouter(config) {
             const collection = getRawFilesCollection();
             if (!collection)
                 return res.status(500).json({ message: 'Database not available' });
-            const result = await collection.findOneAndUpdate(connFilter(projectId, connId, { fileId }), { $set: { displayName } }, { returnDocument: 'after' });
+            const result = await collection.findOneAndUpdate(connFilter(projectId, connId, project, { fileId }), { $set: { displayName } }, { returnDocument: 'after' });
             if (!result)
                 return res.status(404).json({ message: 'File not found' });
             res.json({ message: 'File renamed successfully', file: result });
@@ -450,18 +480,18 @@ function storageRouter(config) {
                 return res.status(404).json({ message: 'Project not found' });
             if (!(0, auth_1.isProjectMember)(project, auth.userId))
                 return res.status(403).json({ message: 'Unauthorized access' });
-            const connAdapter = await resolveConnAdapter(connId, project, adapter);
+            const connAdapter = await resolveConnAdapter(connId, project, auth);
             if ('error' in connAdapter)
                 return res.status(connAdapter.status).json({ message: connAdapter.error });
             const collection = getRawFilesCollection();
             if (!collection)
                 return res.status(500).json({ message: 'Database not available' });
-            const fileDoc = await collection.findOne(connFilter(projectId, connId, { fileId }));
+            const fileDoc = await collection.findOne(connFilter(projectId, connId, project, { fileId }));
             if (!fileDoc)
                 return res.status(404).json({ message: 'File not found' });
             if (connAdapter.deleteFile)
                 await connAdapter.deleteFile(fileDoc.storageKey);
-            await collection.deleteOne(connFilter(projectId, connId, { fileId }));
+            await collection.deleteOne(connFilter(projectId, connId, project, { fileId }));
             res.json({ message: 'File deleted successfully' });
         }
         catch (err) {
@@ -486,7 +516,7 @@ function storageRouter(config) {
                 ? { parentId: null }
                 : { parentId };
             const folders = await collection
-                .find(connFilter(projectId, connId, parentFilter))
+                .find(connFilter(projectId, connId, project, parentFilter))
                 .sort({ name: 1 })
                 .toArray();
             res.json({
@@ -517,7 +547,7 @@ function storageRouter(config) {
             const collection = getRawFoldersCollection();
             if (!collection)
                 return res.status(500).json({ message: 'Database not available' });
-            const f = await collection.findOne(connFilter(projectId, connId, { folderId }));
+            const f = await collection.findOne(connFilter(projectId, connId, project, { folderId }));
             if (!f)
                 return res.status(404).json({ message: 'Folder not found' });
             res.json({
@@ -549,11 +579,15 @@ function storageRouter(config) {
                 return res.status(404).json({ message: 'Project not found' });
             if (!(0, auth_1.isProjectMember)(project, auth.userId))
                 return res.status(403).json({ message: 'Unauthorized access' });
+            const conn = findStorageConn(project, connId);
+            const isBuiltin = conn?.source === 'builtin';
+            if (isBuiltin && !(await (0, builtinAccess_1.assertBuiltinAccess)(auth, conn.integrationId, config, 'storage'))) {
+                return res.status(403).json({ message: 'Access to this built-in storage is not permitted' });
+            }
             const collection = getRawFoldersCollection();
             if (!collection)
                 return res.status(500).json({ message: 'Database not available' });
             const folderId = crypto_1.default.randomUUID();
-            const isBuiltin = connId === 'builtin' || connId.startsWith('builtin-');
             const folderDoc = {
                 _id: new mongodb_1.ObjectId(),
                 folderId,
@@ -599,7 +633,7 @@ function storageRouter(config) {
             const collection = getRawFoldersCollection();
             if (!collection)
                 return res.status(500).json({ message: 'Database not available' });
-            const result = await collection.findOneAndUpdate(connFilter(projectId, connId, { folderId }), { $set: { name: name.trim(), updatedAt: new Date() } }, { returnDocument: 'after' });
+            const result = await collection.findOneAndUpdate(connFilter(projectId, connId, project, { folderId }), { $set: { name: name.trim(), updatedAt: new Date() } }, { returnDocument: 'after' });
             if (!result)
                 return res.status(404).json({ message: 'Folder not found' });
             res.json({
@@ -633,7 +667,7 @@ function storageRouter(config) {
             const collection = getRawFoldersCollection();
             if (!collection)
                 return res.status(500).json({ message: 'Database not available' });
-            const result = await collection.findOneAndUpdate(connFilter(projectId, connId, { folderId }), { $set: { parentId: newParentId ?? null, updatedAt: new Date() } }, { returnDocument: 'after' });
+            const result = await collection.findOneAndUpdate(connFilter(projectId, connId, project, { folderId }), { $set: { parentId: newParentId ?? null, updatedAt: new Date() } }, { returnDocument: 'after' });
             if (!result)
                 return res.status(404).json({ message: 'Folder not found' });
             res.json({
@@ -663,15 +697,15 @@ function storageRouter(config) {
             const foldersCollection = getRawFoldersCollection();
             if (!foldersCollection)
                 return res.status(500).json({ message: 'Database not available' });
-            const folderDoc = await foldersCollection.findOne(connFilter(projectId, connId, { folderId }));
+            const folderDoc = await foldersCollection.findOne(connFilter(projectId, connId, project, { folderId }));
             if (!folderDoc)
                 return res.status(404).json({ message: 'Folder not found' });
             const filesCollection = getRawFilesCollection();
             if (filesCollection) {
-                await filesCollection.updateMany(connFilter(projectId, connId, { folderId }), { $set: { folderId: folderDoc.parentId ?? null } });
+                await filesCollection.updateMany(connFilter(projectId, connId, project, { folderId }), { $set: { folderId: folderDoc.parentId ?? null } });
             }
-            await foldersCollection.updateMany(connFilter(projectId, connId, { parentId: folderId }), { $set: { parentId: folderDoc.parentId ?? null } });
-            await foldersCollection.deleteOne(connFilter(projectId, connId, { folderId }));
+            await foldersCollection.updateMany(connFilter(projectId, connId, project, { parentId: folderId }), { $set: { parentId: folderDoc.parentId ?? null } });
+            await foldersCollection.deleteOne(connFilter(projectId, connId, project, { folderId }));
             res.json({ message: 'Folder deleted successfully' });
         }
         catch (err) {
@@ -691,7 +725,7 @@ function storageRouter(config) {
             if (folderId != null) {
                 const foldersCollection = getRawFoldersCollection();
                 if (foldersCollection) {
-                    const folderDoc = await foldersCollection.findOne(connFilter(projectId, connId, { folderId }));
+                    const folderDoc = await foldersCollection.findOne(connFilter(projectId, connId, project, { folderId }));
                     if (!folderDoc)
                         return res.status(404).json({ message: 'Folder not found' });
                 }
@@ -699,7 +733,7 @@ function storageRouter(config) {
             const filesCollection = getRawFilesCollection();
             if (!filesCollection)
                 return res.status(500).json({ message: 'Database not available' });
-            const result = await filesCollection.findOneAndUpdate(connFilter(projectId, connId, { fileId }), { $set: { folderId: folderId ?? null } }, { returnDocument: 'after' });
+            const result = await filesCollection.findOneAndUpdate(connFilter(projectId, connId, project, { fileId }), { $set: { folderId: folderId ?? null } }, { returnDocument: 'after' });
             if (!result)
                 return res.status(404).json({ message: 'File not found' });
             res.json({ message: 'File moved successfully', file: result });
@@ -717,6 +751,7 @@ function storageRouter(config) {
                 r2: { value: 'cloudflare-r2', name: 'Cloudflare R2' },
             };
             const storages = (config.storageProviders || []).map(provider => ({
+                id: provider.id,
                 ...STORAGE_DISPLAY[provider.type],
                 type: provider.type,
             }));

package/dist/middleware/routes/storageConnection.js

@@ -5,13 +5,8 @@ const express_1 = require("express");
 const mongodb_1 = require("mongodb");
 const manager_1 = require("../../models/manager");
 const auth_1 = require("../../utils/auth");
+const builtinAccess_1 = require("../../utils/builtinAccess");
 const VALID_STORAGE_TYPES = ['s3', 'gcs', 'r2', 'azure'];
-const STORAGE_DISPLAY = {
-    s3: 'AWS S3',
-    gcs: 'Google Cloud Storage',
-    r2: 'Cloudflare R2',
-    azure: 'Azure Blob Storage',
-};
 function storageConnectionRouter(config) {
     const router = (0, express_1.Router)();
     const Project = (0, manager_1.getModel)('projects');
@@ -24,17 +19,16 @@ function storageConnectionRouter(config) {
                 return res.status(404).json({ message: 'Project not found' });
             if (!(0, auth_1.isProjectMember)(project, auth.userId))
                 return res.status(403).json({ message: 'Unauthorized project access' });
-            const builtinConnections = (config.storageProviders || []).map((provider, i) => ({
-                id: i === 0 ? 'builtin' : `builtin-${i}`,
-                name: STORAGE_DISPLAY[provider.type] || provider.type,
-                type: provider.type,
-                credentialId: '',
-                projectId: req.params.id,
-                createdAt: new Date(0),
-                isBuiltin: true,
+            const connections = project.storageConnections || [];
+            // Recompute availability live for builtins — never trust a stored flag, per
+            // "validate on every use" (TCORE-69). BYOC (source: 'integration') is always available.
+            const data = await Promise.all(connections.map(async (conn) => {
+                if (conn.source !== 'builtin')
+                    return conn;
+                const available = await (0, builtinAccess_1.assertBuiltinAccess)(auth, conn.integrationId ?? conn.id, config, 'storage');
+                return { ...conn, isBuiltin: true, available };
             }));
-            const projectConnections = project.storageConnections || [];
-            return res.status(200).json({ data: [...builtinConnections, ...projectConnections] });
+            return res.status(200).json({ data });
         }
         catch (err) {
             res.status(500).json({ message: 'Failed to fetch storage connections', details: err.message });
@@ -47,9 +41,15 @@ function storageConnectionRouter(config) {
             if (auth.role !== 'admin' && auth.role !== 'editor') {
                 return res.status(403).json({ message: 'Permission denied' });
             }
-            const { name, type, credentialId, description } = req.body;
-            if (!name || !type || !credentialId) {
-                return res.status(400).json({ message: 'name, type, and credentialId are required' });
+            const { name, type, credentialId, integrationId, description } = req.body;
+            if (!name || !type) {
+                return res.status(400).json({ message: 'name and type are required' });
+            }
+            if (!credentialId && !integrationId) {
+                return res.status(400).json({ message: 'Either credentialId or integrationId is required' });
+            }
+            if (credentialId && integrationId) {
+                return res.status(400).json({ message: 'Provide only one of credentialId or integrationId' });
             }
             if (!VALID_STORAGE_TYPES.includes(type)) {
                 return res.status(400).json({ message: `type must be one of: ${VALID_STORAGE_TYPES.join(', ')}` });
@@ -59,16 +59,28 @@ function storageConnectionRouter(config) {
                 return res.status(404).json({ message: 'Project not found' });
             if (!(0, auth_1.isProjectMember)(project, auth.userId))
                 return res.status(403).json({ message: 'Unauthorized project access' });
-            const credExists = project.credentials?.some((c) => c.id === credentialId);
-            if (!credExists)
-                return res.status(400).json({ message: 'Credential not found in project' });
+            if (integrationId) {
+                const UserIntegrationModel = (0, manager_1.getModel)('user_integrations');
+                const integration = await UserIntegrationModel.findOne({ id: integrationId, userId: auth.userId });
+                if (!integration)
+                    return res.status(404).json({ message: 'Integration not found' });
+                if (integration.kind !== 'storage')
+                    return res.status(400).json({ message: 'Integration is not a storage integration' });
+            }
+            else {
+                const credExists = project.credentials?.some((c) => c.id === credentialId);
+                if (!credExists)
+                    return res.status(400).json({ message: 'Credential not found in project' });
+            }
             const connection = {
                 id: new mongodb_1.ObjectId().toHexString(),
                 name,
                 type,
-                credentialId,
+                credentialId: credentialId ?? '',
                 projectId: req.params.id,
                 createdAt: new Date(),
+                source: integrationId ? 'integration' : 'manual',
+                ...(integrationId && { integrationId }),
                 ...(description !== undefined && { description }),
             };
             await Project.update({ _id: req.params.id }, { $push: { storageConnections: connection } });
@@ -82,9 +94,6 @@ function storageConnectionRouter(config) {
     router.delete('/projects/:id/connections/storage/:connId', async (req, res) => {
         try {
             const { connId } = req.params;
-            if (connId === 'builtin' || connId.startsWith('builtin-')) {
-                return res.status(403).json({ message: 'Cannot delete a built-in storage connection' });
-            }
             const auth = req.auth;
             if (auth.role !== 'admin' && auth.role !== 'editor') {
                 return res.status(403).json({ message: 'Permission denied' });
@@ -94,9 +103,12 @@ function storageConnectionRouter(config) {
                 return res.status(404).json({ message: 'Project not found' });
             if (!(0, auth_1.isProjectMember)(project, auth.userId))
                 return res.status(403).json({ message: 'Unauthorized project access' });
-            const exists = project.storageConnections?.some((c) => c.id === connId);
-            if (!exists)
+            const conn = project.storageConnections?.find((c) => c.id === connId);
+            if (!conn)
                 return res.status(404).json({ message: 'Storage connection not found' });
+            if (conn.source === 'builtin') {
+                return res.status(403).json({ message: 'Cannot delete a built-in storage connection' });
+            }
             await Project.update({ _id: req.params.id }, { $pull: { storageConnections: { id: connId } } });
             return res.status(200).json({ message: 'Storage connection deleted successfully' });
         }

package/dist/middleware/routes/userIntegration.d.ts

@@ -0,0 +1,3 @@
+import { Router } from 'express';
+import { StreamByConfig } from '../../types';
+export declare function userIntegrationRouter(config: StreamByConfig): Router;

package/dist/middleware/routes/userIntegration.js

@@ -0,0 +1,93 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.userIntegrationRouter = userIntegrationRouter;
+const express_1 = require("express");
+const builtinAccess_1 = require("../../utils/builtinAccess");
+const userIntegration_1 = require("../../services/userIntegration");
+const sanitize_1 = require("../../utils/sanitize");
+const VALID_KINDS = ['database', 'storage'];
+const VALID_DB_PROVIDERS = ['postgresql', 'mongodb'];
+const VALID_STORAGE_PROVIDERS = ['s3', 'gcs', 'r2', 'azure'];
+function userIntegrationRouter(config) {
+    const router = (0, express_1.Router)();
+    // ─── Combined pool: account integrations + built-ins the user can access ─────
+    router.get('/user/integrations', async (req, res) => {
+        try {
+            const auth = req.auth;
+            const owned = await (0, userIntegration_1.listUserIntegrations)(auth.userId);
+            const pool = owned.map(i => ({
+                id: i.id, kind: i.kind, name: i.name, provider: i.provider, source: 'integration', available: true,
+            }));
+            for (const db of config.databases ?? []) {
+                // requiredPlan is not populated here — canUseBuiltin only returns a boolean today,
+                // so there's no plan-level detail to surface without a hook-signature change.
+                const available = await (0, builtinAccess_1.assertBuiltinAccess)(auth, db.id, config, 'database');
+                pool.push({ id: db.id, kind: 'database', name: builtinAccess_1.BUILTIN_DB_DISPLAY[db.type] ?? db.type, provider: db.type, source: 'builtin', available });
+            }
+            for (const provider of config.storageProviders ?? []) {
+                const available = await (0, builtinAccess_1.assertBuiltinAccess)(auth, provider.id, config, 'storage');
+                pool.push({ id: provider.id, kind: 'storage', name: builtinAccess_1.BUILTIN_STORAGE_DISPLAY[provider.type] ?? provider.type, provider: provider.type, source: 'builtin', available });
+            }
+            res.json({ data: pool });
+        }
+        catch (err) {
+            res.status(500).json({ message: 'Failed to list integrations', details: err.message });
+        }
+    });
+    // ─── Create ────────────────────────────────────────────────────────────────
+    router.post('/user/integrations', async (req, res) => {
+        try {
+            const auth = req.auth;
+            const { kind, provider, name, description, credential } = req.body;
+            if (!kind || !VALID_KINDS.includes(kind)) {
+                return res.status(400).json({ message: `kind must be one of: ${VALID_KINDS.join(', ')}` });
+            }
+            const validProviders = kind === 'database' ? VALID_DB_PROVIDERS : VALID_STORAGE_PROVIDERS;
+            if (!provider || !validProviders.includes(provider)) {
+                return res.status(400).json({ message: `provider must be one of: ${validProviders.join(', ')}` });
+            }
+            if (!name)
+                return res.status(400).json({ message: 'name is required' });
+            if (credential === undefined || credential === null) {
+                return res.status(400).json({ message: 'credential is required' });
+            }
+            const integration = await (0, userIntegration_1.createUserIntegration)(auth.userId, {
+                kind, provider, name, description, credentialValue: credential,
+            });
+            res.status(201).json({ data: (0, sanitize_1.sanitizeUserIntegration)(integration) });
+        }
+        catch (err) {
+            res.status(500).json({ message: 'Failed to create integration', details: err.message });
+        }
+    });
+    // ─── Update ────────────────────────────────────────────────────────────────
+    router.patch('/user/integrations/:integrationId', async (req, res) => {
+        try {
+            const auth = req.auth;
+            const { name, description, credential } = req.body;
+            const updated = await (0, userIntegration_1.updateUserIntegration)(auth.userId, req.params.integrationId, {
+                name, description, credentialValue: credential,
+            });
+            if (!updated)
+                return res.status(404).json({ message: 'Integration not found' });
+            res.json({ data: (0, sanitize_1.sanitizeUserIntegration)(updated) });
+        }
+        catch (err) {
+            res.status(500).json({ message: 'Failed to update integration', details: err.message });
+        }
+    });
+    // ─── Delete ────────────────────────────────────────────────────────────────
+    router.delete('/user/integrations/:integrationId', async (req, res) => {
+        try {
+            const auth = req.auth;
+            const deleted = await (0, userIntegration_1.deleteUserIntegration)(auth.userId, req.params.integrationId);
+            if (!deleted)
+                return res.status(404).json({ message: 'Integration not found' });
+            res.json({ message: 'Integration deleted' });
+        }
+        catch (err) {
+            res.status(500).json({ message: 'Failed to delete integration', details: err.message });
+        }
+    });
+    return router;
+}

package/dist/services/backfillBuiltinConnections.d.ts

@@ -0,0 +1,2 @@
+import { StreamByConfig } from '../types';
+export declare function backfillBuiltinConnections(config: StreamByConfig): Promise<void>;

package/dist/services/backfillBuiltinConnections.js

@@ -0,0 +1,57 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.backfillBuiltinConnections = backfillBuiltinConnections;
+const crypto_1 = __importDefault(require("crypto"));
+const manager_1 = require("../models/manager");
+const builtinAccess_1 = require("../utils/builtinAccess");
+// Pre-BYOC, every project appeared connected to every configured builtin because
+// storageConnection.ts/dbConnection.ts SYNTHESIZED builtins at read time instead of
+// persisting them (see storageConnection.ts's old GET handler). Now that connections must
+// be real rows on the project, this seeds those rows once for projects that predate the
+// change — so existing projects don't silently lose access on deploy.
+//
+// Guarded by ProjectInfo.builtinBackfilledAt: runs once per project, ever. An admin who
+// later disconnects a builtin on purpose won't have it silently reappear on the next boot.
+async function backfillBuiltinConnections(config) {
+    if (!config.databases?.length && !config.storageProviders?.length)
+        return;
+    const Project = (0, manager_1.getModel)('projects');
+    const allProjects = await Project.find({});
+    const pending = allProjects.filter(p => !p.builtinBackfilledAt);
+    if (!pending.length)
+        return;
+    for (const project of pending) {
+        const now = new Date();
+        const dbConnections = (config.databases ?? []).map(db => ({
+            id: crypto_1.default.randomUUID(),
+            name: builtinAccess_1.BUILTIN_DB_DISPLAY[db.type] ?? db.type,
+            dbType: db.type === 'sql' ? 'postgresql' : 'mongodb',
+            credentialId: '',
+            projectId: project.id,
+            createdAt: now,
+            isBuiltin: true,
+            integrationId: db.id,
+            source: 'builtin',
+        }));
+        const storageConnections = (config.storageProviders ?? []).map(provider => ({
+            id: crypto_1.default.randomUUID(),
+            name: builtinAccess_1.BUILTIN_STORAGE_DISPLAY[provider.type] ?? provider.type,
+            type: provider.type,
+            credentialId: '',
+            projectId: project.id,
+            createdAt: now,
+            isBuiltin: true,
+            integrationId: provider.id,
+            source: 'builtin',
+        }));
+        await Project.update({ _id: project.id }, {
+            dbConnections: [...(project.dbConnections ?? []), ...dbConnections],
+            storageConnections: [...(project.storageConnections ?? []), ...storageConnections],
+            builtinBackfilledAt: now,
+        });
+    }
+    console.log(`✅ Backfilled built-in connections for ${pending.length} project(s).`);
+}

package/dist/services/projectIntegration.d.ts

@@ -0,0 +1,13 @@
+import { Auth, DbConnection, StorageConnection, StreamByConfig } from '../types';
+type ClassifyResult = {
+    kind: 'database';
+    connection: DbConnection;
+} | {
+    kind: 'storage';
+    connection: StorageConnection;
+} | {
+    error: string;
+    status: number;
+};
+export declare function classifyIntegrationId(id: string, auth: Auth, config: StreamByConfig, projectId: string): Promise<ClassifyResult>;
+export {};

package/dist/services/projectIntegration.js

@@ -0,0 +1,63 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.classifyIntegrationId = classifyIntegrationId;
+const crypto_1 = __importDefault(require("crypto"));
+const manager_1 = require("../models/manager");
+const builtinAccess_1 = require("../utils/builtinAccess");
+// Classifies a client-supplied integrationId (builtin db, builtin storage, or a user's own
+// BYOC integration) and revalidates access/ownership server-side — never trust the client.
+// Shared by POST /projects/create (bulk, at project creation) and
+// POST /projects/:id/integrations (single, added to an existing project).
+async function classifyIntegrationId(id, auth, config, projectId) {
+    const now = new Date();
+    if ((0, builtinAccess_1.isBuiltinDb)(id, config)) {
+        if (!(await (0, builtinAccess_1.assertBuiltinAccess)(auth, id, config, 'database'))) {
+            return { error: `Access to built-in database '${id}' is not permitted`, status: 403 };
+        }
+        const db = config.databases.find(d => d.id === id);
+        return {
+            kind: 'database',
+            connection: {
+                id: crypto_1.default.randomUUID(), name: builtinAccess_1.BUILTIN_DB_DISPLAY[db.type] ?? db.type, dbType: db.type === 'sql' ? 'postgresql' : 'mongodb',
+                credentialId: '', projectId, createdAt: now, isBuiltin: true, integrationId: id, source: 'builtin',
+            },
+        };
+    }
+    if ((0, builtinAccess_1.isBuiltinStorageId)(id, config)) {
+        if (!(await (0, builtinAccess_1.assertBuiltinAccess)(auth, id, config, 'storage'))) {
+            return { error: `Access to built-in storage '${id}' is not permitted`, status: 403 };
+        }
+        const provider = config.storageProviders.find(p => p.id === id);
+        return {
+            kind: 'storage',
+            connection: {
+                id: crypto_1.default.randomUUID(), name: builtinAccess_1.BUILTIN_STORAGE_DISPLAY[provider.type] ?? provider.type, type: provider.type,
+                credentialId: '', projectId, createdAt: now, isBuiltin: true, integrationId: id, source: 'builtin',
+            },
+        };
+    }
+    const UserIntegrationModel = (0, manager_1.getModel)('user_integrations');
+    const integration = await UserIntegrationModel.findOne({ id, userId: auth.userId });
+    if (!integration) {
+        return { error: `Integration '${id}' is not valid or does not belong to you`, status: 403 };
+    }
+    if (integration.kind === 'database') {
+        return {
+            kind: 'database',
+            connection: {
+                id: crypto_1.default.randomUUID(), name: integration.name, dbType: integration.provider,
+                credentialId: '', projectId, createdAt: now, isBuiltin: false, integrationId: id, source: 'integration',
+            },
+        };
+    }
+    return {
+        kind: 'storage',
+        connection: {
+            id: crypto_1.default.randomUUID(), name: integration.name, type: integration.provider,
+            credentialId: '', projectId, createdAt: now, isBuiltin: false, integrationId: id, source: 'integration',
+        },
+    };
+}