streamby-core 0.29.8 → 0.29.9

package/dist/adapters/database/connectionManager.js

@@ -73,13 +73,14 @@ const ensureTablesExist = async (pool) => {
         console.log('✅ "projects" table ensured to exist.');
         // Add JSONB columns to existing tables that predate this schema version
         await pool.query(`
-      ALTER TABLE streamby.projects ADD COLUMN IF NOT EXISTS "allowedOrigin"  JSONB DEFAULT '[]';
-      ALTER TABLE streamby.projects ADD COLUMN IF NOT EXISTS exports          JSONB DEFAULT '[]';
-      ALTER TABLE streamby.projects ADD COLUMN IF NOT EXISTS credentials      JSONB DEFAULT '[]';
-      ALTER TABLE streamby.projects ADD COLUMN IF NOT EXISTS "apiConnections" JSONB DEFAULT '[]';
-      ALTER TABLE streamby.projects ADD COLUMN IF NOT EXISTS "dbConnections"  JSONB DEFAULT '[]';
-      ALTER TABLE streamby.projects ADD COLUMN IF NOT EXISTS workflow         JSONB;
-      ALTER TABLE streamby.projects ADD COLUMN IF NOT EXISTS pipelines        JSONB DEFAULT '[]';
+      ALTER TABLE streamby.projects ADD COLUMN IF NOT EXISTS "allowedOrigin"     JSONB DEFAULT '[]';
+      ALTER TABLE streamby.projects ADD COLUMN IF NOT EXISTS exports             JSONB DEFAULT '[]';
+      ALTER TABLE streamby.projects ADD COLUMN IF NOT EXISTS credentials         JSONB DEFAULT '[]';
+      ALTER TABLE streamby.projects ADD COLUMN IF NOT EXISTS "apiConnections"    JSONB DEFAULT '[]';
+      ALTER TABLE streamby.projects ADD COLUMN IF NOT EXISTS "dbConnections"     JSONB DEFAULT '[]';
+      ALTER TABLE streamby.projects ADD COLUMN IF NOT EXISTS "storageConnections" JSONB DEFAULT '[]';
+      ALTER TABLE streamby.projects ADD COLUMN IF NOT EXISTS workflow            JSONB;
+      ALTER TABLE streamby.projects ADD COLUMN IF NOT EXISTS pipelines           JSONB DEFAULT '[]';
     `);
         // Ensure dbType exists with a non-null default
         await pool.query(`
@@ -124,6 +125,24 @@ const ensureTablesExist = async (pool) => {
       );
     `);
         console.log('✅ "exports" table ensured to exist.');
+        // user_integrations is registered against the main db only (see createRouter.ts), but
+        // this function runs per-SQL-connection like projects/exports above — harmless on
+        // non-main connections since the model never queries them there.
+        await pool.query(`
+      CREATE TABLE IF NOT EXISTS streamby.user_integrations (
+        id                     TEXT PRIMARY KEY DEFAULT uuid_generate_v4()::text,
+        "userId"               VARCHAR(255) NOT NULL,
+        kind                   VARCHAR(20) NOT NULL,
+        provider               VARCHAR(20) NOT NULL,
+        name                   VARCHAR(255) NOT NULL,
+        description            TEXT,
+        "encryptedCredential"  TEXT NOT NULL,
+        "createdAt"            TIMESTAMP WITH TIME ZONE DEFAULT NOW(),
+        "updatedAt"            TIMESTAMP WITH TIME ZONE DEFAULT NOW()
+      );
+      CREATE INDEX IF NOT EXISTS user_integrations_userid_idx ON streamby.user_integrations ("userId");
+    `);
+        console.log('✅ "user_integrations" table ensured to exist.');
     }
     catch (error) {
         console.error('❌ Error ensuring tables exist:', error);

package/dist/middleware/createRouter.js

@@ -8,6 +8,7 @@ const express_1 = __importDefault(require("express"));
 const manager_1 = require("../models/manager");
 const storage_1 = require("../providers/storage");
 const connectionManager_1 = require("../adapters/database/connectionManager");
+const backfillBuiltinConnections_1 = require("../services/backfillBuiltinConnections");
 const wsHub_1 = require("../services/wsHub");
 const auth_1 = require("../services/auth");
 const encryption_1 = require("../utils/encryption");
@@ -22,6 +23,7 @@ const credential_1 = require("./routes/credential");
 const connection_1 = require("./routes/connection");
 const dbConnection_1 = require("./routes/dbConnection");
 const storageConnection_1 = require("./routes/storageConnection");
+const userIntegration_1 = require("./routes/userIntegration");
 const notification_1 = require("./routes/notification");
 const subscription_1 = require("./routes/subscription");
 const media_1 = require("./routes/media");
@@ -46,6 +48,10 @@ function createStreamByRouter(config) {
     const readyPromise = (0, connectionManager_1.initConnections)(config.databases || [])
         .catch((err) => {
         console.error('❌ StreamBy: failed to initialize database connections:', err);
+    })
+        .then(() => (0, backfillBuiltinConnections_1.backfillBuiltinConnections)(config))
+        .catch((err) => {
+        console.error('❌ StreamBy: failed to backfill built-in connections:', err);
     })
         .finally(() => {
         ready = true;
@@ -77,6 +83,7 @@ function createStreamByRouter(config) {
         if (mainDb) {
             (0, manager_1.registerModel)('users', [mainDb.id], 'users', 'accounts');
             (0, manager_1.registerModel)('user_subscriptions', [mainDb.id], 'user_subscriptions', 'streamby');
+            (0, manager_1.registerModel)('user_integrations', [mainDb.id], 'user_integrations', streambySchema);
         }
     }
     if (config.websocket?.server) {
@@ -95,6 +102,7 @@ function createStreamByRouter(config) {
     router.use((0, connection_1.connectionRouter)(config));
     router.use((0, dbConnection_1.dbConnectionRouter)(config));
     router.use((0, storageConnection_1.storageConnectionRouter)(config));
+    router.use((0, userIntegration_1.userIntegrationRouter)(config));
     router.use((0, notification_1.notificationRouter)(config));
     router.use((0, subscription_1.subscriptionRouter)(config));
     router.use((0, media_1.mediaRouter)(config));

package/dist/middleware/routes/dbConnection.js

@@ -39,11 +39,9 @@ const mongodb_1 = require("mongodb");
 const manager_1 = require("../../models/manager");
 const auth_1 = require("../../utils/auth");
 const connectionManager_1 = require("../../adapters/database/connectionManager");
+const builtinAccess_1 = require("../../utils/builtinAccess");
 const dbConnection_1 = require("../../services/dbConnection");
 const VALID_DB_TYPES = ['postgresql', 'mongodb'];
-function isBuiltinDb(connId, config) {
-    return (config.databases ?? []).some(db => db.id === connId);
-}
 function resolveBuiltinConnection(connId, config) {
     const db = (config.databases ?? []).find(d => d.id === connId);
     if (!db)
@@ -127,7 +125,7 @@ function dbConnectionRouter(config) {
     // ─── Delete DB connection ─────────────────────────────────────────────────
     router.delete('/projects/:id/connections/db/:connId', async (req, res) => {
         try {
-            if (isBuiltinDb(req.params.connId, config)) {
+            if ((0, builtinAccess_1.isBuiltinDb)(req.params.connId, config)) {
                 return res.status(403).json({ message: 'Cannot delete a built-in database connection' });
             }
             const auth = req.auth;
@@ -158,7 +156,10 @@ function dbConnectionRouter(config) {
                 return res.status(404).json({ message: 'Project not found' });
             if (!(0, auth_1.isProjectMember)(project, auth.userId))
                 return res.status(403).json({ message: 'Unauthorized project access' });
-            if (isBuiltinDb(req.params.connId, config)) {
+            if ((0, builtinAccess_1.isBuiltinDb)(req.params.connId, config)) {
+                if (!(await (0, builtinAccess_1.assertBuiltinAccess)(auth, req.params.connId, config, 'database'))) {
+                    return res.status(403).json({ message: 'Access to this built-in database is not permitted' });
+                }
                 const internal = resolveBuiltinConnection(req.params.connId, config);
                 if ('error' in internal)
                     return res.status(internal.status).json({ message: internal.error });
@@ -190,7 +191,10 @@ function dbConnectionRouter(config) {
             const schema = req.body;
             if (!schema.tableName)
                 return res.status(400).json({ message: 'tableName is required' });
-            if (isBuiltinDb(req.params.connId, config)) {
+            if ((0, builtinAccess_1.isBuiltinDb)(req.params.connId, config)) {
+                if (!(await (0, builtinAccess_1.assertBuiltinAccess)(auth, req.params.connId, config, 'database'))) {
+                    return res.status(403).json({ message: 'Access to this built-in database is not permitted' });
+                }
                 const internal = resolveBuiltinConnection(req.params.connId, config);
                 if ('error' in internal)
                     return res.status(internal.status).json({ message: internal.error });
@@ -225,7 +229,10 @@ function dbConnectionRouter(config) {
                 return res.status(404).json({ message: 'Project not found' });
             if (!(0, auth_1.isProjectMember)(project, auth.userId))
                 return res.status(403).json({ message: 'Unauthorized project access' });
-            if (isBuiltinDb(req.params.connId, config)) {
+            if ((0, builtinAccess_1.isBuiltinDb)(req.params.connId, config)) {
+                if (!(await (0, builtinAccess_1.assertBuiltinAccess)(auth, req.params.connId, config, 'database'))) {
+                    return res.status(403).json({ message: 'Access to this built-in database is not permitted' });
+                }
                 const internal = resolveBuiltinConnection(req.params.connId, config);
                 if ('error' in internal)
                     return res.status(internal.status).json({ message: internal.error });
@@ -253,7 +260,10 @@ function dbConnectionRouter(config) {
                 return res.status(403).json({ message: 'Unauthorized project access' });
             const limit = Math.min(parseInt(String(req.query.limit ?? 50), 10), 500);
             const offset = Math.max(parseInt(String(req.query.offset ?? 0), 10), 0);
-            if (isBuiltinDb(req.params.connId, config)) {
+            if ((0, builtinAccess_1.isBuiltinDb)(req.params.connId, config)) {
+                if (!(await (0, builtinAccess_1.assertBuiltinAccess)(auth, req.params.connId, config, 'database'))) {
+                    return res.status(403).json({ message: 'Access to this built-in database is not permitted' });
+                }
                 const internal = resolveBuiltinConnection(req.params.connId, config);
                 if ('error' in internal)
                     return res.status(internal.status).json({ message: internal.error });
@@ -286,7 +296,10 @@ function dbConnectionRouter(config) {
             if (!record || typeof record !== 'object' || Array.isArray(record)) {
                 return res.status(400).json({ message: 'Request body must be a JSON object' });
             }
-            if (isBuiltinDb(req.params.connId, config)) {
+            if ((0, builtinAccess_1.isBuiltinDb)(req.params.connId, config)) {
+                if (!(await (0, builtinAccess_1.assertBuiltinAccess)(auth, req.params.connId, config, 'database'))) {
+                    return res.status(403).json({ message: 'Access to this built-in database is not permitted' });
+                }
                 const internal = resolveBuiltinConnection(req.params.connId, config);
                 if ('error' in internal)
                     return res.status(internal.status).json({ message: internal.error });
@@ -318,7 +331,10 @@ function dbConnectionRouter(config) {
             if (!updates || typeof updates !== 'object' || Array.isArray(updates)) {
                 return res.status(400).json({ message: 'Request body must be a JSON object' });
             }
-            if (isBuiltinDb(req.params.connId, config)) {
+            if ((0, builtinAccess_1.isBuiltinDb)(req.params.connId, config)) {
+                if (!(await (0, builtinAccess_1.assertBuiltinAccess)(auth, req.params.connId, config, 'database'))) {
+                    return res.status(403).json({ message: 'Access to this built-in database is not permitted' });
+                }
                 const internal = resolveBuiltinConnection(req.params.connId, config);
                 if ('error' in internal)
                     return res.status(internal.status).json({ message: internal.error });
@@ -346,7 +362,10 @@ function dbConnectionRouter(config) {
                 return res.status(404).json({ message: 'Project not found' });
             if (!(0, auth_1.isProjectMember)(project, auth.userId))
                 return res.status(403).json({ message: 'Unauthorized project access' });
-            if (isBuiltinDb(req.params.connId, config)) {
+            if ((0, builtinAccess_1.isBuiltinDb)(req.params.connId, config)) {
+                if (!(await (0, builtinAccess_1.assertBuiltinAccess)(auth, req.params.connId, config, 'database'))) {
+                    return res.status(403).json({ message: 'Access to this built-in database is not permitted' });
+                }
                 const internal = resolveBuiltinConnection(req.params.connId, config);
                 if ('error' in internal)
                     return res.status(internal.status).json({ message: internal.error });

package/dist/middleware/routes/project.js

@@ -1,12 +1,17 @@
 "use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.projectRouter = projectRouter;
 const express_1 = require("express");
+const crypto_1 = __importDefault(require("crypto"));
 const manager_1 = require("../../models/manager");
 const auth_1 = require("../../utils/auth");
 const connectionManager_1 = require("../../adapters/database/connectionManager");
 const sql_1 = require("../../adapters/database/sql");
 const sanitize_1 = require("../../utils/sanitize");
+const builtinAccess_1 = require("../../utils/builtinAccess");
 function projectRouter(config) {
     const router = (0, express_1.Router)();
     const Project = (0, manager_1.getModel)('projects');
@@ -74,7 +79,7 @@ function projectRouter(config) {
             if (auth.role !== 'admin' && auth.role !== 'editor') {
                 return res.status(403).json({ message: 'Permission denied' });
             }
-            const { name, description, image, allowedOrigin, public: isPublic = true, category } = req.body;
+            const { name, description, image, allowedOrigin, public: isPublic = true, category, integrationIds } = req.body;
             if (isPublic === false && req.subscription === 'freemium') {
                 return res.status(403).json({ error: 'Private projects require a subscriber plan' });
             }
@@ -88,7 +93,55 @@ function projectRouter(config) {
             if (!user) {
                 return res.status(404).json({ message: 'User not found' });
             }
-            const newProject = await Project.create({
+            // Classify + revalidate every integrationId server-side — never trust a client-supplied
+            // builtin id. Any invalid id rejects the whole request (no project is created).
+            const dbConnections = [];
+            const storageConnections = [];
+            if (Array.isArray(integrationIds)) {
+                const UserIntegrationModel = (0, manager_1.getModel)('user_integrations');
+                for (const id of integrationIds) {
+                    const now = new Date();
+                    if ((0, builtinAccess_1.isBuiltinDb)(id, config)) {
+                        if (!(await (0, builtinAccess_1.assertBuiltinAccess)(auth, id, config, 'database'))) {
+                            return res.status(403).json({ message: `Access to built-in database '${id}' is not permitted` });
+                        }
+                        const db = config.databases.find(d => d.id === id);
+                        dbConnections.push({
+                            id: crypto_1.default.randomUUID(), name: id, dbType: db.type === 'sql' ? 'postgresql' : 'mongodb',
+                            credentialId: '', projectId: '', createdAt: now, isBuiltin: true, integrationId: id, source: 'builtin',
+                        });
+                    }
+                    else if ((0, builtinAccess_1.isBuiltinStorageId)(id, config)) {
+                        if (!(await (0, builtinAccess_1.assertBuiltinAccess)(auth, id, config, 'storage'))) {
+                            return res.status(403).json({ message: `Access to built-in storage '${id}' is not permitted` });
+                        }
+                        const provider = config.storageProviders.find(p => p.id === id);
+                        storageConnections.push({
+                            id: crypto_1.default.randomUUID(), name: id, type: provider.type,
+                            credentialId: '', projectId: '', createdAt: now, isBuiltin: true, integrationId: id, source: 'builtin',
+                        });
+                    }
+                    else {
+                        const integration = await UserIntegrationModel.findOne({ id, userId: auth.userId });
+                        if (!integration) {
+                            return res.status(403).json({ message: `Integration '${id}' is not valid or does not belong to you` });
+                        }
+                        if (integration.kind === 'database') {
+                            dbConnections.push({
+                                id: crypto_1.default.randomUUID(), name: integration.name, dbType: integration.provider,
+                                credentialId: '', projectId: '', createdAt: now, isBuiltin: false, integrationId: id, source: 'integration',
+                            });
+                        }
+                        else {
+                            storageConnections.push({
+                                id: crypto_1.default.randomUUID(), name: integration.name, type: integration.provider,
+                                credentialId: '', projectId: '', createdAt: now, isBuiltin: false, integrationId: id, source: 'integration',
+                            });
+                        }
+                    }
+                }
+            }
+            let newProject = await Project.create({
                 dbType,
                 name,
                 description: description || '',
@@ -97,7 +150,18 @@ function projectRouter(config) {
                 public: isPublic,
                 category: category || null,
                 members: [{ userId: auth.userId, username: user.username, role: "admin", status: "active", archived: false }],
+                dbConnections: [],
+                storageConnections: [],
             });
+            const newProjectId = newProject._id || newProject.id;
+            if (dbConnections.length || storageConnections.length) {
+                const stamped = await Project.update({ _id: newProjectId }, {
+                    dbConnections: dbConnections.map(c => ({ ...c, projectId: newProjectId })),
+                    storageConnections: storageConnections.map(c => ({ ...c, projectId: newProjectId })),
+                });
+                if (stamped)
+                    newProject = stamped;
+            }
             const allProjects = await Project.find({});
             const projects = allProjects
                 .filter(project => {

package/dist/middleware/routes/storage.js

@@ -13,6 +13,7 @@ const manager_1 = require("../../models/manager");
 const connectionManager_1 = require("../../adapters/database/connectionManager");
 const auth_1 = require("../../utils/auth");
 const encryption_1 = require("../../utils/encryption");
+const builtinAccess_1 = require("../../utils/builtinAccess");
 const mongodb_1 = require("mongodb");
 const crypto_1 = __importDefault(require("crypto"));
 const VALID_CATEGORIES = ['images', 'audios', 'videos', '3d-models'];
@@ -46,36 +47,43 @@ function getRawFoldersCollection() {
         return null;
     return (0, connectionManager_1.getConnection)(activeId).client.db().collection('storage_folders');
 }
-function connFilter(projectId, connId, extra) {
-    const isBuiltin = connId === 'builtin' || connId.startsWith('builtin-');
-    const connMatch = isBuiltin
-        ? { $or: [{ storageConnectionId: connId }, { storageConnectionId: { $exists: false } }] }
-        : { storageConnectionId: connId };
-    return { projectId, ...connMatch, ...(extra ?? {}) };
-}
-async function resolveConnAdapter(connId, project, globalAdapter) {
-    if (connId === 'builtin' || connId.startsWith('builtin-'))
-        return globalAdapter;
-    const conn = project.storageConnections?.find((c) => c.id === connId);
-    if (!conn)
-        return { error: 'Storage connection not found', status: 404 };
-    if (!(0, encryption_1.isEncryptionKeySet)())
-        return { error: 'Encryption key not set', status: 500 };
-    const credential = project.credentials?.find((c) => c.id === conn.credentialId);
-    if (!credential)
-        return { error: 'Credential not found in project', status: 400 };
-    try {
-        const s3Config = JSON.parse((0, encryption_1.decrypt)(credential.encryptedValue));
-        return new s3_1.S3Adapter(s3Config);
-    }
-    catch (e) {
-        return { error: `Failed to initialize storage adapter: ${e.message}`, status: 500 };
-    }
-}
 function storageRouter(config) {
     const router = (0, express_1.Router)();
     const adapter = config.adapter || (0, storage_1.createStorageProvider)(config.storageProviders);
     const Project = (0, manager_1.getModel)('projects');
+    function connFilter(projectId, connId, extra) {
+        const isBuiltin = (0, builtinAccess_1.isBuiltinStorageId)(connId, config);
+        const connMatch = isBuiltin
+            ? { $or: [{ storageConnectionId: connId }, { storageConnectionId: { $exists: false } }] }
+            : { storageConnectionId: connId };
+        return { projectId, ...connMatch, ...(extra ?? {}) };
+    }
+    async function resolveConnAdapter(connId, project, auth) {
+        if ((0, builtinAccess_1.isBuiltinStorageId)(connId, config)) {
+            if (!(await (0, builtinAccess_1.assertBuiltinAccess)(auth, connId, config, 'storage'))) {
+                return { error: 'Access to this built-in storage is not permitted', status: 403 };
+            }
+            const provider = config.storageProviders.find(p => p.id === connId);
+            if (!provider)
+                return { error: 'Storage provider not found', status: 404 };
+            return provider.type === 's3' ? new s3_1.S3Adapter(provider.config) : adapter;
+        }
+        const conn = project.storageConnections?.find((c) => c.id === connId);
+        if (!conn)
+            return { error: 'Storage connection not found', status: 404 };
+        if (!(0, encryption_1.isEncryptionKeySet)())
+            return { error: 'Encryption key not set', status: 500 };
+        const credential = project.credentials?.find((c) => c.id === conn.credentialId);
+        if (!credential)
+            return { error: 'Credential not found in project', status: 400 };
+        try {
+            const s3Config = JSON.parse((0, encryption_1.decrypt)(credential.encryptedValue));
+            return new s3_1.S3Adapter(s3Config);
+        }
+        catch (e) {
+            return { error: `Failed to initialize storage adapter: ${e.message}`, status: 500 };
+        }
+    }
     router.get('/upload-project-image-url/:id', async (req, res) => {
         try {
             const auth = req.auth;
@@ -301,7 +309,7 @@ function storageRouter(config) {
                 return res.status(404).json({ message: 'Project not found' });
             if (!(0, auth_1.isProjectMember)(project, auth.userId))
                 return res.status(403).json({ message: 'Unauthorized access' });
-            const connAdapter = await resolveConnAdapter(connId, project, adapter);
+            const connAdapter = await resolveConnAdapter(connId, project, auth);
             if ('error' in connAdapter)
                 return res.status(connAdapter.status).json({ message: connAdapter.error });
             if (!connAdapter.getPresignedUploadUrl)
@@ -340,7 +348,7 @@ function storageRouter(config) {
                 return res.status(404).json({ message: 'Project not found' });
             if (!(0, auth_1.isProjectMember)(project, auth.userId))
                 return res.status(403).json({ message: 'Unauthorized access' });
-            const connAdapter = await resolveConnAdapter(connId, project, adapter);
+            const connAdapter = await resolveConnAdapter(connId, project, auth);
             if ('error' in connAdapter)
                 return res.status(connAdapter.status).json({ message: connAdapter.error });
             const collection = getRawFilesCollection();
@@ -366,7 +374,7 @@ function storageRouter(config) {
                 return res.status(404).json({ message: 'Project not found' });
             if (!(0, auth_1.isProjectMember)(project, auth.userId))
                 return res.status(403).json({ message: 'Unauthorized access' });
-            const connAdapter = await resolveConnAdapter(connId, project, adapter);
+            const connAdapter = await resolveConnAdapter(connId, project, auth);
             if ('error' in connAdapter)
                 return res.status(connAdapter.status).json({ message: connAdapter.error });
             const collection = getRawFilesCollection();
@@ -402,7 +410,7 @@ function storageRouter(config) {
             if (!validateContentType(contentType, fileName, fileDoc.category)) {
                 return res.status(400).json({ message: `File does not match category ${fileDoc.category}` });
             }
-            const connAdapter = await resolveConnAdapter(connId, project, adapter);
+            const connAdapter = await resolveConnAdapter(connId, project, auth);
             if ('error' in connAdapter)
                 return res.status(connAdapter.status).json({ message: connAdapter.error });
             if (!connAdapter.getPresignedUploadUrl) {
@@ -450,7 +458,7 @@ function storageRouter(config) {
                 return res.status(404).json({ message: 'Project not found' });
             if (!(0, auth_1.isProjectMember)(project, auth.userId))
                 return res.status(403).json({ message: 'Unauthorized access' });
-            const connAdapter = await resolveConnAdapter(connId, project, adapter);
+            const connAdapter = await resolveConnAdapter(connId, project, auth);
             if ('error' in connAdapter)
                 return res.status(connAdapter.status).json({ message: connAdapter.error });
             const collection = getRawFilesCollection();
@@ -549,11 +557,14 @@ function storageRouter(config) {
                 return res.status(404).json({ message: 'Project not found' });
             if (!(0, auth_1.isProjectMember)(project, auth.userId))
                 return res.status(403).json({ message: 'Unauthorized access' });
+            const isBuiltin = (0, builtinAccess_1.isBuiltinStorageId)(connId, config);
+            if (isBuiltin && !(await (0, builtinAccess_1.assertBuiltinAccess)(auth, connId, config, 'storage'))) {
+                return res.status(403).json({ message: 'Access to this built-in storage is not permitted' });
+            }
             const collection = getRawFoldersCollection();
             if (!collection)
                 return res.status(500).json({ message: 'Database not available' });
             const folderId = crypto_1.default.randomUUID();
-            const isBuiltin = connId === 'builtin' || connId.startsWith('builtin-');
             const folderDoc = {
                 _id: new mongodb_1.ObjectId(),
                 folderId,
@@ -717,6 +728,7 @@ function storageRouter(config) {
                 r2: { value: 'cloudflare-r2', name: 'Cloudflare R2' },
             };
             const storages = (config.storageProviders || []).map(provider => ({
+                id: provider.id,
                 ...STORAGE_DISPLAY[provider.type],
                 type: provider.type,
             }));

package/dist/middleware/routes/storageConnection.js

@@ -5,13 +5,8 @@ const express_1 = require("express");
 const mongodb_1 = require("mongodb");
 const manager_1 = require("../../models/manager");
 const auth_1 = require("../../utils/auth");
+const builtinAccess_1 = require("../../utils/builtinAccess");
 const VALID_STORAGE_TYPES = ['s3', 'gcs', 'r2', 'azure'];
-const STORAGE_DISPLAY = {
-    s3: 'AWS S3',
-    gcs: 'Google Cloud Storage',
-    r2: 'Cloudflare R2',
-    azure: 'Azure Blob Storage',
-};
 function storageConnectionRouter(config) {
     const router = (0, express_1.Router)();
     const Project = (0, manager_1.getModel)('projects');
@@ -24,17 +19,16 @@ function storageConnectionRouter(config) {
                 return res.status(404).json({ message: 'Project not found' });
             if (!(0, auth_1.isProjectMember)(project, auth.userId))
                 return res.status(403).json({ message: 'Unauthorized project access' });
-            const builtinConnections = (config.storageProviders || []).map((provider, i) => ({
-                id: i === 0 ? 'builtin' : `builtin-${i}`,
-                name: STORAGE_DISPLAY[provider.type] || provider.type,
-                type: provider.type,
-                credentialId: '',
-                projectId: req.params.id,
-                createdAt: new Date(0),
-                isBuiltin: true,
+            const connections = project.storageConnections || [];
+            // Recompute availability live for builtins — never trust a stored flag, per
+            // "validate on every use" (TCORE-69). BYOC (source: 'integration') is always available.
+            const data = await Promise.all(connections.map(async (conn) => {
+                if (conn.source !== 'builtin')
+                    return conn;
+                const available = await (0, builtinAccess_1.assertBuiltinAccess)(auth, conn.integrationId ?? conn.id, config, 'storage');
+                return { ...conn, isBuiltin: true, available };
             }));
-            const projectConnections = project.storageConnections || [];
-            return res.status(200).json({ data: [...builtinConnections, ...projectConnections] });
+            return res.status(200).json({ data });
         }
         catch (err) {
             res.status(500).json({ message: 'Failed to fetch storage connections', details: err.message });
@@ -82,7 +76,7 @@ function storageConnectionRouter(config) {
     router.delete('/projects/:id/connections/storage/:connId', async (req, res) => {
         try {
             const { connId } = req.params;
-            if (connId === 'builtin' || connId.startsWith('builtin-')) {
+            if ((0, builtinAccess_1.isBuiltinStorageId)(connId, config)) {
                 return res.status(403).json({ message: 'Cannot delete a built-in storage connection' });
             }
             const auth = req.auth;

package/dist/middleware/routes/userIntegration.d.ts

@@ -0,0 +1,3 @@
+import { Router } from 'express';
+import { StreamByConfig } from '../../types';
+export declare function userIntegrationRouter(config: StreamByConfig): Router;

package/dist/middleware/routes/userIntegration.js

@@ -0,0 +1,93 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.userIntegrationRouter = userIntegrationRouter;
+const express_1 = require("express");
+const builtinAccess_1 = require("../../utils/builtinAccess");
+const userIntegration_1 = require("../../services/userIntegration");
+const sanitize_1 = require("../../utils/sanitize");
+const VALID_KINDS = ['database', 'storage'];
+const VALID_DB_PROVIDERS = ['postgresql', 'mongodb'];
+const VALID_STORAGE_PROVIDERS = ['s3', 'gcs', 'r2', 'azure'];
+function userIntegrationRouter(config) {
+    const router = (0, express_1.Router)();
+    // ─── Combined pool: account integrations + built-ins the user can access ─────
+    router.get('/user/integrations', async (req, res) => {
+        try {
+            const auth = req.auth;
+            const owned = await (0, userIntegration_1.listUserIntegrations)(auth.userId);
+            const pool = owned.map(i => ({
+                id: i.id, kind: i.kind, name: i.name, provider: i.provider, source: 'integration', available: true,
+            }));
+            for (const db of config.databases ?? []) {
+                // requiredPlan is not populated here — canUseBuiltin only returns a boolean today,
+                // so there's no plan-level detail to surface without a hook-signature change.
+                const available = await (0, builtinAccess_1.assertBuiltinAccess)(auth, db.id, config, 'database');
+                pool.push({ id: db.id, kind: 'database', name: db.id, provider: db.type, source: 'builtin', available });
+            }
+            for (const provider of config.storageProviders ?? []) {
+                const available = await (0, builtinAccess_1.assertBuiltinAccess)(auth, provider.id, config, 'storage');
+                pool.push({ id: provider.id, kind: 'storage', name: provider.id, provider: provider.type, source: 'builtin', available });
+            }
+            res.json({ data: pool });
+        }
+        catch (err) {
+            res.status(500).json({ message: 'Failed to list integrations', details: err.message });
+        }
+    });
+    // ─── Create ────────────────────────────────────────────────────────────────
+    router.post('/user/integrations', async (req, res) => {
+        try {
+            const auth = req.auth;
+            const { kind, provider, name, description, credential } = req.body;
+            if (!kind || !VALID_KINDS.includes(kind)) {
+                return res.status(400).json({ message: `kind must be one of: ${VALID_KINDS.join(', ')}` });
+            }
+            const validProviders = kind === 'database' ? VALID_DB_PROVIDERS : VALID_STORAGE_PROVIDERS;
+            if (!provider || !validProviders.includes(provider)) {
+                return res.status(400).json({ message: `provider must be one of: ${validProviders.join(', ')}` });
+            }
+            if (!name)
+                return res.status(400).json({ message: 'name is required' });
+            if (credential === undefined || credential === null) {
+                return res.status(400).json({ message: 'credential is required' });
+            }
+            const integration = await (0, userIntegration_1.createUserIntegration)(auth.userId, {
+                kind, provider, name, description, credentialValue: credential,
+            });
+            res.status(201).json({ data: (0, sanitize_1.sanitizeUserIntegration)(integration) });
+        }
+        catch (err) {
+            res.status(500).json({ message: 'Failed to create integration', details: err.message });
+        }
+    });
+    // ─── Update ────────────────────────────────────────────────────────────────
+    router.patch('/user/integrations/:integrationId', async (req, res) => {
+        try {
+            const auth = req.auth;
+            const { name, description, credential } = req.body;
+            const updated = await (0, userIntegration_1.updateUserIntegration)(auth.userId, req.params.integrationId, {
+                name, description, credentialValue: credential,
+            });
+            if (!updated)
+                return res.status(404).json({ message: 'Integration not found' });
+            res.json({ data: (0, sanitize_1.sanitizeUserIntegration)(updated) });
+        }
+        catch (err) {
+            res.status(500).json({ message: 'Failed to update integration', details: err.message });
+        }
+    });
+    // ─── Delete ────────────────────────────────────────────────────────────────
+    router.delete('/user/integrations/:integrationId', async (req, res) => {
+        try {
+            const auth = req.auth;
+            const deleted = await (0, userIntegration_1.deleteUserIntegration)(auth.userId, req.params.integrationId);
+            if (!deleted)
+                return res.status(404).json({ message: 'Integration not found' });
+            res.json({ message: 'Integration deleted' });
+        }
+        catch (err) {
+            res.status(500).json({ message: 'Failed to delete integration', details: err.message });
+        }
+    });
+    return router;
+}

package/dist/services/backfillBuiltinConnections.d.ts

@@ -0,0 +1,2 @@
+import { StreamByConfig } from '../types';
+export declare function backfillBuiltinConnections(config: StreamByConfig): Promise<void>;

package/dist/services/backfillBuiltinConnections.js

@@ -0,0 +1,56 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.backfillBuiltinConnections = backfillBuiltinConnections;
+const crypto_1 = __importDefault(require("crypto"));
+const manager_1 = require("../models/manager");
+// Pre-BYOC, every project appeared connected to every configured builtin because
+// storageConnection.ts/dbConnection.ts SYNTHESIZED builtins at read time instead of
+// persisting them (see storageConnection.ts's old GET handler). Now that connections must
+// be real rows on the project, this seeds those rows once for projects that predate the
+// change — so existing projects don't silently lose access on deploy.
+//
+// Guarded by ProjectInfo.builtinBackfilledAt: runs once per project, ever. An admin who
+// later disconnects a builtin on purpose won't have it silently reappear on the next boot.
+async function backfillBuiltinConnections(config) {
+    if (!config.databases?.length && !config.storageProviders?.length)
+        return;
+    const Project = (0, manager_1.getModel)('projects');
+    const allProjects = await Project.find({});
+    const pending = allProjects.filter(p => !p.builtinBackfilledAt);
+    if (!pending.length)
+        return;
+    for (const project of pending) {
+        const now = new Date();
+        const dbConnections = (config.databases ?? []).map(db => ({
+            id: crypto_1.default.randomUUID(),
+            name: db.id,
+            dbType: db.type === 'sql' ? 'postgresql' : 'mongodb',
+            credentialId: '',
+            projectId: project.id,
+            createdAt: now,
+            isBuiltin: true,
+            integrationId: db.id,
+            source: 'builtin',
+        }));
+        const storageConnections = (config.storageProviders ?? []).map(provider => ({
+            id: crypto_1.default.randomUUID(),
+            name: provider.id,
+            type: provider.type,
+            credentialId: '',
+            projectId: project.id,
+            createdAt: now,
+            isBuiltin: true,
+            integrationId: provider.id,
+            source: 'builtin',
+        }));
+        await Project.update({ _id: project.id }, {
+            dbConnections: [...(project.dbConnections ?? []), ...dbConnections],
+            storageConnections: [...(project.storageConnections ?? []), ...storageConnections],
+            builtinBackfilledAt: now,
+        });
+    }
+    console.log(`✅ Backfilled built-in connections for ${pending.length} project(s).`);
+}

package/dist/services/userIntegration.d.ts

@@ -0,0 +1,16 @@
+import { IntegrationKind, UserIntegration } from '../types';
+export declare function listUserIntegrations(userId: string): Promise<UserIntegration[]>;
+export declare function createUserIntegration(userId: string, input: {
+    kind: IntegrationKind;
+    provider: string;
+    name: string;
+    description?: string;
+    credentialValue: unknown;
+}): Promise<UserIntegration>;
+export declare function updateUserIntegration(userId: string, integrationId: string, updates: {
+    name?: string;
+    description?: string;
+    credentialValue?: unknown;
+}): Promise<UserIntegration | null>;
+export declare function deleteUserIntegration(userId: string, integrationId: string): Promise<boolean>;
+export declare function getDecryptedIntegrationCredential(userId: string, integrationId: string): Promise<unknown | null>;

package/dist/services/userIntegration.js

@@ -0,0 +1,73 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.listUserIntegrations = listUserIntegrations;
+exports.createUserIntegration = createUserIntegration;
+exports.updateUserIntegration = updateUserIntegration;
+exports.deleteUserIntegration = deleteUserIntegration;
+exports.getDecryptedIntegrationCredential = getDecryptedIntegrationCredential;
+const crypto_1 = __importDefault(require("crypto"));
+const manager_1 = require("../models/manager");
+const encryption_1 = require("../utils/encryption");
+function encryptCredential(kind, value) {
+    return kind === 'storage' ? (0, encryption_1.encrypt)(JSON.stringify(value)) : (0, encryption_1.encrypt)(String(value));
+}
+async function listUserIntegrations(userId) {
+    const UserIntegrationModel = (0, manager_1.getModel)('user_integrations');
+    return UserIntegrationModel.find({ userId });
+}
+async function createUserIntegration(userId, input) {
+    if (!(0, encryption_1.isEncryptionKeySet)()) {
+        throw new Error('Encryption key is not set. Cannot create integration.');
+    }
+    const UserIntegrationModel = (0, manager_1.getModel)('user_integrations');
+    const now = new Date();
+    const integration = {
+        id: crypto_1.default.randomUUID(),
+        userId,
+        kind: input.kind,
+        provider: input.provider,
+        name: input.name,
+        description: input.description,
+        encryptedCredential: encryptCredential(input.kind, input.credentialValue),
+        createdAt: now,
+        updatedAt: now,
+    };
+    return UserIntegrationModel.create(integration);
+}
+async function updateUserIntegration(userId, integrationId, updates) {
+    const UserIntegrationModel = (0, manager_1.getModel)('user_integrations');
+    const existing = await UserIntegrationModel.findOne({ id: integrationId, userId });
+    if (!existing)
+        return null;
+    const $set = { updatedAt: new Date() };
+    if (updates.name !== undefined)
+        $set.name = updates.name;
+    if (updates.description !== undefined)
+        $set.description = updates.description;
+    if (updates.credentialValue !== undefined) {
+        if (!(0, encryption_1.isEncryptionKeySet)()) {
+            throw new Error('Encryption key is not set. Cannot update integration.');
+        }
+        $set.encryptedCredential = encryptCredential(existing.kind, updates.credentialValue);
+    }
+    return UserIntegrationModel.update({ id: integrationId, userId }, $set);
+}
+async function deleteUserIntegration(userId, integrationId) {
+    const UserIntegrationModel = (0, manager_1.getModel)('user_integrations');
+    const deletedCount = await UserIntegrationModel.delete({ id: integrationId, userId });
+    return deletedCount > 0;
+}
+async function getDecryptedIntegrationCredential(userId, integrationId) {
+    const UserIntegrationModel = (0, manager_1.getModel)('user_integrations');
+    const integration = await UserIntegrationModel.findOne({ id: integrationId, userId });
+    if (!integration)
+        return null;
+    if (!(0, encryption_1.isEncryptionKeySet)()) {
+        throw new Error('Encryption key is not set. Cannot decrypt integration credential.');
+    }
+    const decrypted = (0, encryption_1.decrypt)(integration.encryptedCredential);
+    return integration.kind === 'storage' ? JSON.parse(decrypted) : decrypted;
+}

package/dist/types/index.d.ts

@@ -17,8 +17,12 @@ export interface StorageConnection {
     createdAt: Date;
     description?: string;
     isBuiltin?: boolean;
+    integrationId?: string;
+    source?: 'builtin' | 'integration';
+    available?: boolean;
 }
 export type StorageProvider = {
+    id: string;
     type: StorageProviderType;
     config: S3Config;
 };
@@ -74,6 +78,7 @@ export interface ProjectInfo {
     dbConnections?: DbConnection[];
     storageConnections?: StorageConnection[];
     pipelines?: PipelineRef[];
+    builtinBackfilledAt?: Date;
 }
 export interface Credential {
     id: string;
@@ -107,10 +112,7 @@ export interface DatabaseCredential {
     main?: boolean;
 }
 export interface StreamByConfig {
-    storageProviders: {
-        type: StorageProviderType;
-        config: S3Config;
-    }[];
+    storageProviders: StorageProvider[];
     authProvider: AuthProvider;
     databases?: DatabaseCredential[];
     adapter?: StorageAdapter;
@@ -118,6 +120,7 @@ export interface StreamByConfig {
     websocket?: {
         server: WebSocketServer;
     };
+    canUseBuiltin?: (auth: Auth, builtinId: string, kind: 'database' | 'storage') => boolean | Promise<boolean>;
 }
 export interface Notification {
     _id?: string;
@@ -154,6 +157,21 @@ export interface DbConnection {
     projectId: string;
     createdAt: Date;
     description?: string;
+    isBuiltin?: boolean;
+    integrationId?: string;
+    source?: 'builtin' | 'integration';
+}
+export type IntegrationKind = 'database' | 'storage';
+export interface UserIntegration {
+    id: string;
+    userId: string;
+    kind: IntegrationKind;
+    provider: ExternalDbType | StorageProviderType;
+    name: string;
+    description?: string;
+    encryptedCredential: string;
+    createdAt: Date;
+    updatedAt: Date;
 }
 export interface ColumnDefinition {
     name: string;

package/dist/utils/builtinAccess.d.ts

@@ -0,0 +1,4 @@
+import { Auth, StreamByConfig } from '../types';
+export declare function assertBuiltinAccess(auth: Auth, builtinId: string, config: StreamByConfig, kind: 'database' | 'storage'): Promise<boolean>;
+export declare function isBuiltinStorageId(id: string, config: StreamByConfig): boolean;
+export declare function isBuiltinDb(id: string, config: StreamByConfig): boolean;

package/dist/utils/builtinAccess.js

@@ -0,0 +1,19 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.assertBuiltinAccess = assertBuiltinAccess;
+exports.isBuiltinStorageId = isBuiltinStorageId;
+exports.isBuiltinDb = isBuiltinDb;
+// Gates access to a built-in database/storage provider. Delegates to config.canUseBuiltin
+// when the mounting app implements it (e.g. Nhexa-API checking user_subscriptions);
+// defaults to allow when absent, preserving pre-BYOC behavior for deploys without gating.
+async function assertBuiltinAccess(auth, builtinId, config, kind) {
+    if (!config.canUseBuiltin)
+        return true;
+    return config.canUseBuiltin(auth, builtinId, kind);
+}
+function isBuiltinStorageId(id, config) {
+    return (config.storageProviders ?? []).some(p => p.id === id);
+}
+function isBuiltinDb(id, config) {
+    return (config.databases ?? []).some(db => db.id === id);
+}

package/dist/utils/sanitize.d.ts

@@ -1 +1,2 @@
 export declare function sanitizeProject(project: any): any;
+export declare function sanitizeUserIntegration(integration: any): any;

package/dist/utils/sanitize.js

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.sanitizeProject = sanitizeProject;
+exports.sanitizeUserIntegration = sanitizeUserIntegration;
 function sanitizeProject(project) {
     if (!project)
         return project;
@@ -9,3 +10,9 @@ function sanitizeProject(project) {
         credentials: project.credentials?.map(({ id, key }) => ({ id, key })) ?? [],
     };
 }
+function sanitizeUserIntegration(integration) {
+    if (!integration)
+        return integration;
+    const { encryptedCredential, ...rest } = integration;
+    return rest;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "streamby-core",
-  "version": "0.29.8",
+  "version": "0.29.9",
   "description": "StreamBy middleware framework for media storage management",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",