streamby-core 0.32.0 → 0.33.0

package/dist/middleware/createRouter.js

@@ -23,6 +23,7 @@ const connection_1 = require("./routes/connection");
 const dbConnection_1 = require("./routes/dbConnection");
 const storageConnection_1 = require("./routes/storageConnection");
 const userIntegration_1 = require("./routes/userIntegration");
+const oauth_1 = require("./routes/oauth");
 const notification_1 = require("./routes/notification");
 const subscription_1 = require("./routes/subscription");
 const media_1 = require("./routes/media");
@@ -101,6 +102,7 @@ function createStreamByRouter(config) {
     router.use((0, dbConnection_1.dbConnectionRouter)(config));
     router.use((0, storageConnection_1.storageConnectionRouter)(config));
     router.use((0, userIntegration_1.userIntegrationRouter)(config));
+    router.use((0, oauth_1.oauthRouter)(config));
     router.use((0, notification_1.notificationRouter)(config));
     router.use((0, subscription_1.subscriptionRouter)(config));
     router.use((0, media_1.mediaRouter)(config));

package/dist/middleware/routes/oauth.d.ts

@@ -0,0 +1,3 @@
+import { Router } from 'express';
+import { StreamByConfig } from '../../types';
+export declare function oauthRouter(config: StreamByConfig): Router;

package/dist/middleware/routes/oauth.js

@@ -0,0 +1,101 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.oauthRouter = oauthRouter;
+const express_1 = require("express");
+const crypto_1 = __importDefault(require("crypto"));
+const oauthClient_1 = require("../../services/oauthClient");
+const userIntegration_1 = require("../../services/userIntegration");
+const OAUTH_PROVIDERS = new Set(['jira', 'google']);
+const PROVIDER_DISPLAY_NAME = {
+    jira: 'Jira',
+    google: 'Google',
+};
+// In-memory, single-process state store — the OAuth dance completes within a few minutes
+// of the same request cycle, so no DB collection is needed. A restart mid-flow just means
+// the user retries /start, which is harmless.
+const pendingOAuthStates = new Map();
+const STATE_TTL_MS = 10 * 60 * 1000;
+function sweepExpiredStates() {
+    const cutoff = Date.now() - STATE_TTL_MS;
+    for (const [state, entry] of pendingOAuthStates) {
+        if (entry.issuedAt < cutoff)
+            pendingOAuthStates.delete(state);
+    }
+}
+function isOAuthProvider(value) {
+    return OAUTH_PROVIDERS.has(value);
+}
+function oauthRouter(config) {
+    const router = (0, express_1.Router)();
+    router.get('/user/integrations/oauth/:provider/start', async (req, res) => {
+        try {
+            const auth = req.auth;
+            const { provider } = req.params;
+            if (!isOAuthProvider(provider)) {
+                return res.status(400).json({ message: `Provider '${provider}' does not support OAuth.` });
+            }
+            const oauthConfig = config.oauthProviders?.[provider];
+            if (!oauthConfig) {
+                return res.status(503).json({ message: `OAuth for '${provider}' is not configured on this deployment.` });
+            }
+            sweepExpiredStates();
+            const state = crypto_1.default.randomBytes(32).toString('hex');
+            pendingOAuthStates.set(state, { userId: auth.userId, provider, issuedAt: Date.now() });
+            res.redirect((0, oauthClient_1.buildAuthorizeUrl)(provider, oauthConfig, state));
+        }
+        catch (err) {
+            res.status(500).json({ message: 'Failed to start OAuth flow', details: err.message });
+        }
+    });
+    router.get('/user/integrations/oauth/:provider/callback', async (req, res) => {
+        const { provider: providerParam } = req.params;
+        const provider = isOAuthProvider(providerParam) ? providerParam : null;
+        const oauthConfig = provider ? config.oauthProviders?.[provider] : undefined;
+        const failureRedirect = (reason) => {
+            const failureUrl = oauthConfig?.failureRedirectUrl;
+            if (!failureUrl)
+                return res.status(400).json({ message: `OAuth failed: ${reason}` });
+            const url = new URL(failureUrl);
+            url.searchParams.set('oauthError', reason);
+            if (provider)
+                url.searchParams.set('provider', provider);
+            return res.redirect(url.toString());
+        };
+        try {
+            const auth = req.auth;
+            if (!provider)
+                return res.status(400).json({ message: `Provider '${providerParam}' does not support OAuth.` });
+            if (!oauthConfig)
+                return res.status(503).json({ message: `OAuth for '${provider}' is not configured on this deployment.` });
+            if (req.query.error)
+                return failureRedirect(String(req.query.error));
+            const code = req.query.code;
+            const state = req.query.state;
+            if (!code || !state)
+                return failureRedirect('missing_code');
+            const pending = pendingOAuthStates.get(state);
+            pendingOAuthStates.delete(state); // single-use, regardless of outcome below
+            if (!pending || pending.provider !== provider || pending.userId !== auth.userId) {
+                return failureRedirect(pending ? 'state_mismatch' : 'invalid_state');
+            }
+            let tokens;
+            try {
+                tokens = await (0, oauthClient_1.exchangeCodeForTokens)(provider, oauthConfig, code);
+            }
+            catch {
+                return failureRedirect('token_exchange_failed');
+            }
+            await (0, userIntegration_1.upsertOAuthServiceIntegration)(auth.userId, provider, PROVIDER_DISPLAY_NAME[provider], tokens);
+            const url = new URL(oauthConfig.successRedirectUrl);
+            url.searchParams.set('connected', provider);
+            res.redirect(url.toString());
+        }
+        catch (err) {
+            failureRedirect('unexpected_error');
+        }
+    });
+    return router;
+}

package/dist/middleware/routes/project.js

@@ -93,6 +93,7 @@ function projectRouter(config) {
             // builtin id. Any invalid id rejects the whole request (no project is created).
             const dbConnections = [];
             const storageConnections = [];
+            const integrationConnections = [];
             if (Array.isArray(integrationIds)) {
                 for (const id of integrationIds) {
                     const result = await (0, projectIntegration_1.classifyIntegrationId)(id, auth, config, '');
@@ -100,8 +101,10 @@ function projectRouter(config) {
                         return res.status(result.status).json({ message: result.error });
                     if (result.kind === 'database')
                         dbConnections.push(result.connection);
-                    else
+                    else if (result.kind === 'storage')
                         storageConnections.push(result.connection);
+                    else
+                        integrationConnections.push(result.connection);
                 }
             }
             let newProject = await Project.create({
@@ -115,12 +118,14 @@ function projectRouter(config) {
                 members: [{ userId: auth.userId, username: user.username, role: "admin", status: "active", archived: false }],
                 dbConnections: [],
                 storageConnections: [],
+                integrationConnections: [],
             });
             const newProjectId = newProject._id || newProject.id;
-            if (dbConnections.length || storageConnections.length) {
+            if (dbConnections.length || storageConnections.length || integrationConnections.length) {
                 const stamped = await Project.update({ _id: newProjectId }, {
                     dbConnections: dbConnections.map(c => ({ ...c, projectId: newProjectId })),
                     storageConnections: storageConnections.map(c => ({ ...c, projectId: newProjectId })),
+                    integrationConnections: integrationConnections.map(c => ({ ...c, projectId: newProjectId })),
                 });
                 if (stamped)
                     newProject = stamped;
@@ -409,7 +414,7 @@ function projectRouter(config) {
                 return res.status(404).json({ message: 'Project not found' });
             if (!(0, auth_1.isProjectMember)(project, auth.userId))
                 return res.status(403).json({ message: 'Unauthorized project access' });
-            const alreadyConnected = [...(project.dbConnections ?? []), ...(project.storageConnections ?? [])]
+            const alreadyConnected = [...(project.dbConnections ?? []), ...(project.storageConnections ?? []), ...(project.integrationConnections ?? [])]
                 .some((c) => c.integrationId === integrationId);
             if (alreadyConnected)
                 return res.status(400).json({ message: 'This integration is already connected to the project' });
@@ -418,7 +423,9 @@ function projectRouter(config) {
                 return res.status(result.status).json({ message: result.error });
             const updated = result.kind === 'database'
                 ? await Project.update({ _id: projectId }, { $push: { dbConnections: result.connection } })
-                : await Project.update({ _id: projectId }, { $push: { storageConnections: result.connection } });
+                : result.kind === 'storage'
+                    ? await Project.update({ _id: projectId }, { $push: { storageConnections: result.connection } })
+                    : await Project.update({ _id: projectId }, { $push: { integrationConnections: result.connection } });
             if (!updated)
                 return res.status(404).json({ message: 'Project not found or not updated' });
             res.status(201).json({ data: result.connection, project: (0, sanitize_1.sanitizeProject)(updated) });
@@ -443,11 +450,14 @@ function projectRouter(config) {
                 return res.status(403).json({ message: 'Unauthorized project access' });
             const dbConn = (project.dbConnections ?? []).find((c) => c.integrationId === integrationId);
             const storageConn = (project.storageConnections ?? []).find((c) => c.integrationId === integrationId);
-            if (!dbConn && !storageConn)
+            const integrationConn = (project.integrationConnections ?? []).find((c) => c.integrationId === integrationId);
+            if (!dbConn && !storageConn && !integrationConn)
                 return res.status(404).json({ message: 'Integration not connected to this project' });
             const updated = dbConn
                 ? await Project.update({ _id: projectId }, { $pull: { dbConnections: { id: dbConn.id } } })
-                : await Project.update({ _id: projectId }, { $pull: { storageConnections: { id: storageConn.id } } });
+                : storageConn
+                    ? await Project.update({ _id: projectId }, { $pull: { storageConnections: { id: storageConn.id } } })
+                    : await Project.update({ _id: projectId }, { $pull: { integrationConnections: { id: integrationConn.id } } });
             if (!updated)
                 return res.status(404).json({ message: 'Project not found or not updated' });
             res.status(200).json({ message: 'Integration removed', project: (0, sanitize_1.sanitizeProject)(updated) });

package/dist/middleware/routes/userIntegration.js

@@ -5,9 +5,10 @@ const express_1 = require("express");
 const builtinAccess_1 = require("../../utils/builtinAccess");
 const userIntegration_1 = require("../../services/userIntegration");
 const sanitize_1 = require("../../utils/sanitize");
-const VALID_KINDS = ['database', 'storage'];
+const VALID_KINDS = ['database', 'storage', 'service'];
 const VALID_DB_PROVIDERS = ['postgresql', 'mongodb'];
 const VALID_STORAGE_PROVIDERS = ['s3', 'gcs', 'r2', 'azure'];
+const VALID_SERVICE_PROVIDERS = ['claude', 'jira', 'google'];
 function userIntegrationRouter(config) {
     const router = (0, express_1.Router)();
     // ─── Combined pool: account integrations + built-ins the user can access ─────
@@ -42,10 +43,18 @@ function userIntegrationRouter(config) {
             if (!kind || !VALID_KINDS.includes(kind)) {
                 return res.status(400).json({ message: `kind must be one of: ${VALID_KINDS.join(', ')}` });
             }
-            const validProviders = kind === 'database' ? VALID_DB_PROVIDERS : VALID_STORAGE_PROVIDERS;
+            const validProviders = kind === 'database' ? VALID_DB_PROVIDERS : kind === 'storage' ? VALID_STORAGE_PROVIDERS : VALID_SERVICE_PROVIDERS;
             if (!provider || !validProviders.includes(provider)) {
                 return res.status(400).json({ message: `provider must be one of: ${validProviders.join(', ')}` });
             }
+            // jira/google have no upfront credential to supply — they can only be linked via the
+            // OAuth consent flow, which mints the token itself. Claude (API key) goes through the
+            // normal path below unchanged.
+            if (kind === 'service' && (0, userIntegration_1.isOAuthServiceProvider)(provider)) {
+                return res.status(400).json({
+                    message: `Provider '${provider}' requires OAuth — start at GET /user/integrations/oauth/${provider}/start instead of POST /user/integrations`,
+                });
+            }
             if (!name)
                 return res.status(400).json({ message: 'name is required' });
             if (credential === undefined || credential === null) {
@@ -57,6 +66,9 @@ function userIntegrationRouter(config) {
             res.status(201).json({ data: (0, sanitize_1.sanitizeUserIntegration)(integration) });
         }
         catch (err) {
+            if (err instanceof userIntegration_1.InvalidCredentialUpdateError) {
+                return res.status(400).json({ message: err.message });
+            }
             res.status(500).json({ message: 'Failed to create integration', details: err.message });
         }
     });
@@ -73,6 +85,9 @@ function userIntegrationRouter(config) {
             res.json({ data: (0, sanitize_1.sanitizeUserIntegration)(updated) });
         }
         catch (err) {
+            if (err instanceof userIntegration_1.InvalidCredentialUpdateError) {
+                return res.status(400).json({ message: err.message });
+            }
             res.status(500).json({ message: 'Failed to update integration', details: err.message });
         }
     });

package/dist/services/connectionResolver.js

@@ -13,11 +13,16 @@ const userIntegration_1 = require("./userIntegration");
 const encryption_1 = require("../utils/encryption");
 const storage_1 = require("../providers/storage");
 const s3_1 = require("../adapters/storage/s3");
+// Matches by row id first; falls back to matching a builtin row by integrationId (the
+// config id, e.g. 'mongo') for nodes/connections saved before TCORE-69 gave builtin rows
+// their own generated id — same legacy-id class as connFilter in storage.ts.
 function findDbConnection(project, connId) {
-    return project.dbConnections?.find((c) => c.id === connId);
+    return project.dbConnections?.find((c) => c.id === connId)
+        ?? project.dbConnections?.find((c) => c.source === 'builtin' && c.integrationId === connId);
 }
 function findStorageConnection(project, connId) {
-    return project.storageConnections?.find((c) => c.id === connId);
+    return project.storageConnections?.find((c) => c.id === connId)
+        ?? project.storageConnections?.find((c) => c.source === 'builtin' && c.integrationId === connId);
 }
 // `connId` must be the `id` of a real row in project.dbConnections — never a bare
 // config id (config.databases[].id). Builtin rows reuse the shared pooled client keyed by
@@ -47,10 +52,10 @@ async function resolveDbConnectionClient(project, connId, config, auth) {
     if (conn.source === 'integration') {
         if (!conn.integrationId)
             return { error: 'Connection is missing its integrationId', status: 500 };
-        const credential = await (0, userIntegration_1.getDecryptedIntegrationCredentialById)(conn.integrationId);
-        if (!credential)
+        const resolved = await (0, userIntegration_1.getDecryptedIntegrationCredentialById)(conn.integrationId, config);
+        if (!resolved)
             return { error: 'Integration not found', status: 400 };
-        connectionString = credential;
+        connectionString = resolved.credential;
     }
     else {
         if (!(0, encryption_1.isEncryptionKeySet)())
@@ -104,10 +109,10 @@ async function resolveStorageAdapter(project, connId, config, auth) {
         if (!conn.integrationId)
             return { error: 'Connection is missing its integrationId', status: 500 };
         try {
-            const s3Config = await (0, userIntegration_1.getDecryptedIntegrationCredentialById)(conn.integrationId);
-            if (!s3Config)
+            const resolved = await (0, userIntegration_1.getDecryptedIntegrationCredentialById)(conn.integrationId, config);
+            if (!resolved)
                 return { error: 'Integration not found', status: 400 };
-            return new s3_1.S3Adapter(s3Config);
+            return new s3_1.S3Adapter(resolved.credential);
         }
         catch (e) {
             return { error: `Failed to initialize storage adapter: ${e.message}`, status: 500 };

package/dist/services/executor.js

@@ -5,6 +5,8 @@ exports.executeExport = executeExport;
 const encryption_1 = require("../utils/encryption");
 const dbConnection_1 = require("./dbConnection");
 const connectionResolver_1 = require("./connectionResolver");
+const userIntegration_1 = require("./userIntegration");
+const oauthClient_1 = require("./oauthClient");
 const jobQueue_1 = require("./jobQueue");
 const mediaProcessor_1 = require("./mediaProcessor");
 const vfxProcessor_1 = require("./vfxProcessor");
@@ -147,6 +149,43 @@ async function executeExport(nodeSchema, project, config) {
                 throw new Error(`Connection fetch failed: ${response.statusText}`);
             dataResults.push(await response.json());
         }
+        else if (node.type === 'integrationConnectionNode') {
+            // Generic action over a project-level IntegrationConnection (Claude/Jira/Google) — the
+            // node's data carries the endpoint/method/body to invoke, same shape family as
+            // connectionNode's apiUrl/method, but the auth header comes from the resolved
+            // account-level integration credential instead of a static per-connection secret.
+            // Diverges from connectionNode's silent-skip: a missing connection/credential throws
+            // NodeExecutionError (matching dataSourceNode/ingestNode's intentional pattern), since
+            // a silently-skipped service action would produce a workflow that "succeeds" while
+            // quietly missing the one thing the node exists to do.
+            const connectionId = node.data?.connectionId;
+            if (!connectionId) {
+                throw new NodeExecutionError(node.id, node.type, `Node '${node.id}' (${node.type}) has no integration connection — connect one on the node.`);
+            }
+            const connection = (project.integrationConnections ?? []).find((c) => c.id === connectionId);
+            if (!connection) {
+                throw new NodeExecutionError(node.id, node.type, `Node '${node.id}' (${node.type}): integration connection not found on this project.`);
+            }
+            const resolved = await (0, userIntegration_1.getDecryptedIntegrationCredentialById)(connection.integrationId, config);
+            if (!resolved) {
+                throw new NodeExecutionError(node.id, node.type, `Node '${node.id}' (${node.type}): integration credential could not be resolved — it may have been disconnected.`);
+            }
+            const endpoint = node.data?.endpoint;
+            if (!endpoint) {
+                throw new NodeExecutionError(node.id, node.type, `Node '${node.id}' (${node.type}) has no endpoint configured.`);
+            }
+            const method = node.data?.method ?? 'GET';
+            const headers = {
+                'Content-Type': 'application/json',
+                ...(0, oauthClient_1.buildServiceAuthHeaders)(connection.provider, resolved.credential),
+            };
+            const body = node.data?.body ? JSON.stringify(node.data.body) : undefined;
+            const response = await fetch(endpoint, { method, headers, body });
+            if (!response.ok) {
+                throw new NodeExecutionError(node.id, node.type, `Node '${node.id}' (${node.type}): integration action failed (${response.statusText}).`);
+            }
+            dataResults.push(await response.json());
+        }
     }
     let payload = dataResults.length === 1 ? dataResults[0] : dataResults;
     // 2. Process layer — chain from streamby out-top → processNode in-process → out-process → ...

package/dist/services/oauthClient.d.ts

@@ -0,0 +1,10 @@
+import { OAuthClientConfig, ServiceProviderType } from '../types';
+export interface ExchangedTokens {
+    accessToken: string;
+    refreshToken: string;
+    expiresAt: Date;
+}
+export declare function buildAuthorizeUrl(provider: 'jira' | 'google', config: OAuthClientConfig, state: string): string;
+export declare function exchangeCodeForTokens(provider: 'jira' | 'google', config: OAuthClientConfig, code: string): Promise<ExchangedTokens>;
+export declare function refreshTokens(provider: 'jira' | 'google', config: OAuthClientConfig, refreshToken: string): Promise<ExchangedTokens>;
+export declare function buildServiceAuthHeaders(provider: ServiceProviderType, credential: string): Record<string, string>;

package/dist/services/oauthClient.js

@@ -0,0 +1,134 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.buildAuthorizeUrl = buildAuthorizeUrl;
+exports.exchangeCodeForTokens = exchangeCodeForTokens;
+exports.refreshTokens = refreshTokens;
+exports.buildServiceAuthHeaders = buildServiceAuthHeaders;
+// TODO: adjust once a real Google OAuth app is registered — see TCORE-73 plan §4.
+const GOOGLE_OAUTH_SCOPES = 'openid email profile';
+// MUST include offline_access to receive a refresh token from Atlassian.
+const JIRA_OAUTH_SCOPES = 'offline_access read:jira-user read:jira-work';
+function buildAuthorizeUrl(provider, config, state) {
+    if (provider === 'google') {
+        const params = new URLSearchParams({
+            client_id: config.clientId,
+            redirect_uri: config.redirectUri,
+            response_type: 'code',
+            scope: GOOGLE_OAUTH_SCOPES,
+            access_type: 'offline',
+            prompt: 'consent',
+            state,
+        });
+        return `https://accounts.google.com/o/oauth2/v2/auth?${params.toString()}`;
+    }
+    const params = new URLSearchParams({
+        audience: 'api.atlassian.com',
+        client_id: config.clientId,
+        scope: JIRA_OAUTH_SCOPES,
+        redirect_uri: config.redirectUri,
+        state,
+        response_type: 'code',
+        prompt: 'consent',
+    });
+    return `https://auth.atlassian.com/authorize?${params.toString()}`;
+}
+async function parseTokenResponse(response) {
+    if (!response.ok) {
+        const body = await response.text().catch(() => '');
+        throw new Error(`Token endpoint returned ${response.status}: ${body}`);
+    }
+    return response.json();
+}
+async function exchangeCodeForTokens(provider, config, code) {
+    if (provider === 'google') {
+        const body = new URLSearchParams({
+            code,
+            client_id: config.clientId,
+            client_secret: config.clientSecret,
+            redirect_uri: config.redirectUri,
+            grant_type: 'authorization_code',
+        });
+        const response = await fetch('https://oauth2.googleapis.com/token', {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+            body: body.toString(),
+        });
+        const json = await parseTokenResponse(response);
+        if (!json.refresh_token)
+            throw new Error('Google did not return a refresh_token — retry with access_type=offline&prompt=consent');
+        return {
+            accessToken: json.access_token,
+            refreshToken: json.refresh_token,
+            expiresAt: new Date(Date.now() + json.expires_in * 1000),
+        };
+    }
+    const response = await fetch('https://auth.atlassian.com/oauth/token', {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({
+            grant_type: 'authorization_code',
+            client_id: config.clientId,
+            client_secret: config.clientSecret,
+            code,
+            redirect_uri: config.redirectUri,
+        }),
+    });
+    const json = await parseTokenResponse(response);
+    if (!json.refresh_token)
+        throw new Error('Atlassian did not return a refresh_token — ensure the offline_access scope is requested');
+    return {
+        accessToken: json.access_token,
+        refreshToken: json.refresh_token,
+        expiresAt: new Date(Date.now() + json.expires_in * 1000),
+    };
+}
+// Google's refresh response usually omits refresh_token (the original stays valid);
+// Atlassian ROTATES the refresh token on every use (a new one is returned every time).
+// Callers must preserve the existing refreshToken when this returns undefined for it.
+async function refreshTokens(provider, config, refreshToken) {
+    if (provider === 'google') {
+        const body = new URLSearchParams({
+            refresh_token: refreshToken,
+            client_id: config.clientId,
+            client_secret: config.clientSecret,
+            grant_type: 'refresh_token',
+        });
+        const response = await fetch('https://oauth2.googleapis.com/token', {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+            body: body.toString(),
+        });
+        const json = await parseTokenResponse(response);
+        return {
+            accessToken: json.access_token,
+            refreshToken: json.refresh_token ?? refreshToken,
+            expiresAt: new Date(Date.now() + json.expires_in * 1000),
+        };
+    }
+    const response = await fetch('https://auth.atlassian.com/oauth/token', {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({
+            grant_type: 'refresh_token',
+            client_id: config.clientId,
+            client_secret: config.clientSecret,
+            refresh_token: refreshToken,
+        }),
+    });
+    const json = await parseTokenResponse(response);
+    if (!json.refresh_token)
+        throw new Error('Atlassian refresh response did not include a rotated refresh_token');
+    return {
+        accessToken: json.access_token,
+        refreshToken: json.refresh_token,
+        expiresAt: new Date(Date.now() + json.expires_in * 1000),
+    };
+}
+// Claude uses a dedicated x-api-key header (plus anthropic-version), not Authorization:
+// Bearer — Jira/Google's OAuth access tokens use the standard Bearer scheme.
+function buildServiceAuthHeaders(provider, credential) {
+    if (provider === 'claude') {
+        return { 'x-api-key': credential, 'anthropic-version': '2023-06-01' };
+    }
+    return { Authorization: `Bearer ${credential}` };
+}

package/dist/services/projectIntegration.d.ts

@@ -1,10 +1,13 @@
-import { Auth, DbConnection, StorageConnection, StreamByConfig } from '../types';
+import { Auth, DbConnection, StorageConnection, IntegrationConnection, StreamByConfig } from '../types';
 type ClassifyResult = {
     kind: 'database';
     connection: DbConnection;
 } | {
     kind: 'storage';
     connection: StorageConnection;
+} | {
+    kind: 'service';
+    connection: IntegrationConnection;
 } | {
     error: string;
     status: number;

package/dist/services/projectIntegration.js

@@ -53,11 +53,21 @@ async function classifyIntegrationId(id, auth, config, projectId) {
             },
         };
     }
+    if (integration.kind === 'storage') {
+        return {
+            kind: 'storage',
+            connection: {
+                id: crypto_1.default.randomUUID(), name: integration.name, type: integration.provider,
+                projectId, createdAt: now, isBuiltin: false, integrationId: id, source: 'integration',
+            },
+        };
+    }
+    // kind === 'service' — the only remaining IntegrationKind value.
     return {
-        kind: 'storage',
+        kind: 'service',
         connection: {
-            id: crypto_1.default.randomUUID(), name: integration.name, type: integration.provider,
-            projectId, createdAt: now, isBuiltin: false, integrationId: id, source: 'integration',
+            id: crypto_1.default.randomUUID(), name: integration.name, provider: integration.provider,
+            projectId, createdAt: now, integrationId: id, source: 'integration',
         },
     };
 }

package/dist/services/userIntegration.d.ts

@@ -1,4 +1,18 @@
-import { IntegrationKind, UserIntegration } from '../types';
+import { IntegrationKind, ServiceProviderType, StreamByConfig, UserIntegration } from '../types';
+export declare function isOAuthServiceProvider(provider: string): boolean;
+export declare class OAuthRefreshError extends Error {
+    provider: string;
+    integrationId: string;
+    constructor(provider: string, integrationId: string, message: string);
+}
+export declare class InvalidCredentialUpdateError extends Error {
+    constructor(message: string);
+}
+export interface OAuthTokenSet {
+    accessToken: string;
+    refreshToken: string;
+    expiresAt: Date;
+}
 export declare function listUserIntegrations(userId: string): Promise<UserIntegration[]>;
 export declare function createUserIntegration(userId: string, input: {
     kind: IntegrationKind;
@@ -7,11 +21,17 @@ export declare function createUserIntegration(userId: string, input: {
     description?: string;
     credentialValue: unknown;
 }): Promise<UserIntegration>;
+export declare function upsertOAuthServiceIntegration(userId: string, provider: Extract<ServiceProviderType, 'jira' | 'google'>, name: string, tokens: OAuthTokenSet): Promise<UserIntegration>;
 export declare function updateUserIntegration(userId: string, integrationId: string, updates: {
     name?: string;
     description?: string;
     credentialValue?: unknown;
 }): Promise<UserIntegration | null>;
 export declare function deleteUserIntegration(userId: string, integrationId: string): Promise<boolean>;
-export declare function getDecryptedIntegrationCredential(userId: string, integrationId: string): Promise<unknown | null>;
-export declare function getDecryptedIntegrationCredentialById(integrationId: string): Promise<unknown | null>;
+export interface ResolvedCredential {
+    provider: string;
+    kind: IntegrationKind;
+    credential: unknown;
+}
+export declare function getDecryptedIntegrationCredential(userId: string, integrationId: string, config: StreamByConfig): Promise<ResolvedCredential | null>;
+export declare function getDecryptedIntegrationCredentialById(integrationId: string, config: StreamByConfig): Promise<ResolvedCredential | null>;

package/dist/services/userIntegration.js

@@ -3,8 +3,11 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.InvalidCredentialUpdateError = exports.OAuthRefreshError = void 0;
+exports.isOAuthServiceProvider = isOAuthServiceProvider;
 exports.listUserIntegrations = listUserIntegrations;
 exports.createUserIntegration = createUserIntegration;
+exports.upsertOAuthServiceIntegration = upsertOAuthServiceIntegration;
 exports.updateUserIntegration = updateUserIntegration;
 exports.deleteUserIntegration = deleteUserIntegration;
 exports.getDecryptedIntegrationCredential = getDecryptedIntegrationCredential;
@@ -12,9 +15,54 @@ exports.getDecryptedIntegrationCredentialById = getDecryptedIntegrationCredentia
 const crypto_1 = __importDefault(require("crypto"));
 const manager_1 = require("../models/manager");
 const encryption_1 = require("../utils/encryption");
+const oauthClient_1 = require("./oauthClient");
+const OAUTH_SERVICE_PROVIDERS = new Set(['jira', 'google']);
+function isOAuthServiceProvider(provider) {
+    return OAUTH_SERVICE_PROVIDERS.has(provider);
+}
+// Refresh if the token expires within this window — a small buffer against clock skew and
+// request latency so a caller never receives a token that expires mid-flight.
+const REFRESH_SKEW_MS = 60000;
+class OAuthRefreshError extends Error {
+    constructor(provider, integrationId, message) {
+        super(message);
+        this.provider = provider;
+        this.integrationId = integrationId;
+        this.name = 'OAuthRefreshError';
+    }
+}
+exports.OAuthRefreshError = OAuthRefreshError;
+// Thrown when a client tries to set/overwrite the credential of an OAuth-backed (jira/
+// google) integration directly — those can only be linked/relinked via the OAuth flow.
+class InvalidCredentialUpdateError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'InvalidCredentialUpdateError';
+    }
+}
+exports.InvalidCredentialUpdateError = InvalidCredentialUpdateError;
 function encryptCredential(kind, value) {
     return kind === 'storage' ? (0, encryption_1.encrypt)(JSON.stringify(value)) : (0, encryption_1.encrypt)(String(value));
 }
+// OAuth tokens never go through encryptCredential/decryptIntegration (those stay unchanged,
+// used only for database/storage/claude's single encryptedCredential field) — each token is
+// encrypted independently via the existing single-string encrypt()/decrypt() primitives.
+function encryptOAuthTokens(tokens) {
+    return {
+        encryptedAccessToken: (0, encryption_1.encrypt)(tokens.accessToken),
+        encryptedRefreshToken: (0, encryption_1.encrypt)(tokens.refreshToken),
+        tokenExpiresAt: tokens.expiresAt,
+    };
+}
+function decryptOAuthTokens(integration) {
+    if (!integration.encryptedAccessToken || !integration.encryptedRefreshToken || !integration.tokenExpiresAt)
+        return null;
+    return {
+        accessToken: (0, encryption_1.decrypt)(integration.encryptedAccessToken),
+        refreshToken: (0, encryption_1.decrypt)(integration.encryptedRefreshToken),
+        expiresAt: integration.tokenExpiresAt,
+    };
+}
 async function listUserIntegrations(userId) {
     const UserIntegrationModel = (0, manager_1.getModel)('user_integrations');
     return UserIntegrationModel.find({ userId });
@@ -23,6 +71,12 @@ async function createUserIntegration(userId, input) {
     if (!(0, encryption_1.isEncryptionKeySet)()) {
         throw new Error('Encryption key is not set. Cannot create integration.');
     }
+    // Defense in depth — the router rejects direct jira/google creation before this is ever
+    // called (see userIntegration.ts route's POST handler), but guard here too rather than
+    // silently mis-encrypting an OAuth provider's value into the wrong (single-string) field.
+    if (isOAuthServiceProvider(input.provider)) {
+        throw new InvalidCredentialUpdateError(`Provider '${input.provider}' requires OAuth — cannot be created with a direct credential.`);
+    }
     const UserIntegrationModel = (0, manager_1.getModel)('user_integrations');
     const now = new Date();
     const integration = {
@@ -38,6 +92,34 @@ async function createUserIntegration(userId, input) {
     };
     return UserIntegrationModel.create(integration);
 }
+// Creates or updates the OAuth-backed UserIntegration for (userId, provider) — called only
+// from the OAuth callback (oauth.ts), never from the generic CRUD router. Upserts rather
+// than always inserting, so a user re-consenting (e.g. after revoking access on the
+// provider's side) re-links the same integration instead of creating a duplicate.
+async function upsertOAuthServiceIntegration(userId, provider, name, tokens) {
+    if (!(0, encryption_1.isEncryptionKeySet)()) {
+        throw new Error('Encryption key is not set. Cannot store integration tokens.');
+    }
+    const UserIntegrationModel = (0, manager_1.getModel)('user_integrations');
+    const existing = await UserIntegrationModel.findOne({ userId, kind: 'service', provider });
+    const encryptedTokens = encryptOAuthTokens(tokens);
+    const now = new Date();
+    if (existing) {
+        const updated = await UserIntegrationModel.update({ id: existing.id, userId }, { ...encryptedTokens, updatedAt: now });
+        return updated ?? existing;
+    }
+    const integration = {
+        id: crypto_1.default.randomUUID(),
+        userId,
+        kind: 'service',
+        provider,
+        name,
+        ...encryptedTokens,
+        createdAt: now,
+        updatedAt: now,
+    };
+    return UserIntegrationModel.create(integration);
+}
 async function updateUserIntegration(userId, integrationId, updates) {
     const UserIntegrationModel = (0, manager_1.getModel)('user_integrations');
     const existing = await UserIntegrationModel.findOne({ id: integrationId, userId });
@@ -49,6 +131,9 @@ async function updateUserIntegration(userId, integrationId, updates) {
     if (updates.description !== undefined)
         $set.description = updates.description;
     if (updates.credentialValue !== undefined) {
+        if (existing.kind === 'service' && isOAuthServiceProvider(existing.provider)) {
+            throw new InvalidCredentialUpdateError('OAuth-backed integrations cannot have their credential set directly — reconnect via OAuth.');
+        }
         if (!(0, encryption_1.isEncryptionKeySet)()) {
             throw new Error('Encryption key is not set. Cannot update integration.');
         }
@@ -61,26 +146,58 @@ async function deleteUserIntegration(userId, integrationId) {
     const deletedCount = await UserIntegrationModel.delete({ id: integrationId, userId });
     return deletedCount > 0;
 }
-async function getDecryptedIntegrationCredential(userId, integrationId) {
+async function getDecryptedIntegrationCredential(userId, integrationId, config) {
     const UserIntegrationModel = (0, manager_1.getModel)('user_integrations');
     const integration = await UserIntegrationModel.findOne({ id: integrationId, userId });
-    return decryptIntegration(integration);
+    return resolveCredential(integration, config);
 }
 // Used when resolving a project connection's `integrationId` at connection-use time — the
 // project already validated ownership when the connection was created (see project.ts /
 // dbConnection.ts POST), so there's no userId to filter by here, only the integrationId
-// stored on the connection itself.
-async function getDecryptedIntegrationCredentialById(integrationId) {
+// stored on the connection itself. `config` is required (not just for OAuth's sake) so a
+// near-expiry jira/google token can be refreshed using the host-injected client
+// credentials in config.oauthProviders.
+async function getDecryptedIntegrationCredentialById(integrationId, config) {
     const UserIntegrationModel = (0, manager_1.getModel)('user_integrations');
     const integration = await UserIntegrationModel.findOne({ id: integrationId });
-    return decryptIntegration(integration);
+    return resolveCredential(integration, config);
 }
 async function decryptIntegration(integration) {
-    if (!integration)
-        return null;
     if (!(0, encryption_1.isEncryptionKeySet)()) {
         throw new Error('Encryption key is not set. Cannot decrypt integration credential.');
     }
     const decrypted = (0, encryption_1.decrypt)(integration.encryptedCredential);
     return integration.kind === 'storage' ? JSON.parse(decrypted) : decrypted;
 }
+// OAuth-backed integrations (jira/google) transparently refresh-and-repersist their access
+// token when it's expired or near-expiry, before returning it — callers never see a stale
+// token or have to think about refresh themselves.
+async function resolveCredential(integration, config) {
+    if (!integration)
+        return null;
+    if (integration.kind === 'service' && isOAuthServiceProvider(integration.provider)) {
+        const tokens = decryptOAuthTokens(integration);
+        if (!tokens) {
+            throw new OAuthRefreshError(integration.provider, integration.id, `The ${integration.provider} connection for this integration is incomplete — reconnect it from account integrations.`);
+        }
+        if (tokens.expiresAt.getTime() > Date.now() + REFRESH_SKEW_MS) {
+            return { provider: integration.provider, kind: integration.kind, credential: tokens.accessToken };
+        }
+        const provider = integration.provider;
+        const oauthConfig = config.oauthProviders?.[provider];
+        if (!oauthConfig) {
+            throw new OAuthRefreshError(integration.provider, integration.id, `OAuth for '${provider}' is not configured on this deployment — cannot refresh the token.`);
+        }
+        try {
+            const refreshed = await (0, oauthClient_1.refreshTokens)(provider, oauthConfig, tokens.refreshToken);
+            const encryptedTokens = encryptOAuthTokens(refreshed);
+            const UserIntegrationModel = (0, manager_1.getModel)('user_integrations');
+            await UserIntegrationModel.update({ id: integration.id }, { ...encryptedTokens, updatedAt: new Date() });
+            return { provider: integration.provider, kind: integration.kind, credential: refreshed.accessToken };
+        }
+        catch (e) {
+            throw new OAuthRefreshError(integration.provider, integration.id, `The ${integration.provider} connection for this integration has expired — reconnect it from account integrations.`);
+        }
+    }
+    return { provider: integration.provider, kind: integration.kind, credential: await decryptIntegration(integration) };
+}

package/dist/types/index.d.ts

@@ -76,6 +76,7 @@ export interface ProjectInfo {
     connections?: Connection[];
     dbConnections?: DbConnection[];
     storageConnections?: StorageConnection[];
+    integrationConnections?: IntegrationConnection[];
     pipelines?: PipelineRef[];
     builtinBackfilledAt?: Date;
     workflow?: Workflow;
@@ -117,6 +118,13 @@ export interface DatabaseCredential {
     connectionString?: string;
     main?: boolean;
 }
+export interface OAuthClientConfig {
+    clientId: string;
+    clientSecret: string;
+    redirectUri: string;
+    successRedirectUrl: string;
+    failureRedirectUrl: string;
+}
 export interface StreamByConfig {
     storageProviders: StorageProvider[];
     authProvider: AuthProvider;
@@ -127,6 +135,10 @@ export interface StreamByConfig {
         server: WebSocketServer;
     };
     canUseBuiltin?: (auth: Auth, builtinId: string, kind: 'database' | 'storage') => boolean | Promise<boolean>;
+    oauthProviders?: {
+        jira?: OAuthClientConfig;
+        google?: OAuthClientConfig;
+    };
 }
 export interface Notification {
     _id?: string;
@@ -167,15 +179,29 @@ export interface DbConnection {
     integrationId?: string;
     source?: 'builtin' | 'integration' | 'manual';
 }
-export type IntegrationKind = 'database' | 'storage';
+export interface IntegrationConnection {
+    id: string;
+    name: string;
+    provider: ServiceProviderType;
+    projectId: string;
+    createdAt: Date;
+    description?: string;
+    integrationId: string;
+    source: 'integration';
+}
+export type IntegrationKind = 'database' | 'storage' | 'service';
+export type ServiceProviderType = 'claude' | 'jira' | 'google';
 export interface UserIntegration {
     id: string;
     userId: string;
     kind: IntegrationKind;
-    provider: ExternalDbType | StorageProviderType;
+    provider: ExternalDbType | StorageProviderType | ServiceProviderType;
     name: string;
     description?: string;
-    encryptedCredential: string;
+    encryptedCredential?: string;
+    encryptedAccessToken?: string;
+    encryptedRefreshToken?: string;
+    tokenExpiresAt?: Date;
     createdAt: Date;
     updatedAt: Date;
 }

package/dist/utils/sanitize.d.ts

@@ -8,5 +8,11 @@ export declare function sanitizeConnections<T extends {
 }>(conns: T[] | undefined): (Omit<T, 'encryptedCredential'> & {
     hasCredential: boolean;
 })[];
+export declare function sanitizeIntegrationConnection<T extends object>(conn: T): T & {
+    hasCredential: true;
+};
+export declare function sanitizeIntegrationConnections<T extends object>(conns: T[] | undefined): (T & {
+    hasCredential: true;
+})[];
 export declare function sanitizeProject(project: any): any;
 export declare function sanitizeUserIntegration(integration: any): any;

package/dist/utils/sanitize.js

@@ -2,6 +2,8 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.sanitizeConnection = sanitizeConnection;
 exports.sanitizeConnections = sanitizeConnections;
+exports.sanitizeIntegrationConnection = sanitizeIntegrationConnection;
+exports.sanitizeIntegrationConnections = sanitizeIntegrationConnections;
 exports.sanitizeProject = sanitizeProject;
 exports.sanitizeUserIntegration = sanitizeUserIntegration;
 function sanitizeConnection(conn) {
@@ -11,6 +13,16 @@ function sanitizeConnection(conn) {
 function sanitizeConnections(conns) {
     return (conns ?? []).map(sanitizeConnection);
 }
+// IntegrationConnection has no encryptedCredential field at all — credentials never live on
+// the connection, only integrationId does, resolved on-demand from the account-level
+// UserIntegration. hasCredential is hardcoded true (never derived from a local field) for
+// API shape parity with the other three connection types.
+function sanitizeIntegrationConnection(conn) {
+    return { ...conn, hasCredential: true };
+}
+function sanitizeIntegrationConnections(conns) {
+    return (conns ?? []).map(sanitizeIntegrationConnection);
+}
 function sanitizeProject(project) {
     if (!project)
         return project;
@@ -20,14 +32,19 @@ function sanitizeProject(project) {
         connections: sanitizeConnections(project.connections),
         storageConnections: sanitizeConnections(project.storageConnections),
         dbConnections: sanitizeConnections(project.dbConnections),
+        integrationConnections: sanitizeIntegrationConnections(project.integrationConnections),
         distributionConnections: sanitizeConnections(project.distributionConnections),
         renderFarmConnections: sanitizeConnections(project.renderFarmConnections),
         exports: project.exports?.map((e) => e && 'encryptedCredential' in e ? sanitizeConnection(e) : e),
     };
 }
+// Strips every raw secret an OAuth-backed integration might carry — encryptedCredential
+// (db/storage/claude) plus encryptedAccessToken/encryptedRefreshToken (jira/google).
+// tokenExpiresAt is deliberately kept: it's not secret, and its presence lets a future UI
+// show "reconnect needed" without a decrypt round-trip.
 function sanitizeUserIntegration(integration) {
     if (!integration)
         return integration;
-    const { encryptedCredential, ...rest } = integration;
+    const { encryptedCredential, encryptedAccessToken, encryptedRefreshToken, ...rest } = integration;
     return rest;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "streamby-core",
-  "version": "0.32.0",
+  "version": "0.33.0",
   "description": "StreamBy middleware framework for media storage management",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",