streamby-core 0.32.1 → 0.34.0

package/README.md

@@ -1,5 +1,7 @@
 # @streamby/core
 
+[![License: AGPL v3](https://img.shields.io/badge/License-AGPLv3-blue.svg)](https://www.gnu.org/licenses/agpl-3.0)
+
 Middleware framework for building storage-agnostic media APIs.  
 Part of the [StreamBy](https://streamby.nhexa.cl) ecosystem by TerminalCore Labs.
 
@@ -59,7 +61,7 @@ app.use('/streamby', express.json(), createStreamByRouter({
       },
     },
   ],
-  encrypt: process.env.STREAMBY_ENCRYPTION_KEY,
+  encrypt: process.env.STREAMBY_ENCRYPTION_KEY, // 64 hex characters; see "Encryption and key rotation"
   websocket: { server: wss },
 }));
 
@@ -71,6 +73,51 @@ server.listen(3000);
 
 ---
 
+## 🔑 Encryption and key rotation
+
+Credentials stored by StreamBy (connection secrets, export credentials, user integrations,
+distribution and render farm credentials) are encrypted with the key you pass as `encrypt`:
+32 bytes, written as 64 hexadecimal characters. Each stored value records the id of the key
+that encrypted it (a fingerprint, never the key itself), so you can rotate the key:
+
+1. Generate a new key, for example with `openssl rand -hex 32`.
+2. Pass the new key as `encrypt` and the previous one in `encryptPreviousKeys`.
+3. Restart. Values encrypted with a previous key still decrypt, and at startup StreamBy
+   re-encrypts all of them with the new key.
+4. Once that's done (the startup log says how many records it re-encrypted, and none are left
+   on the old key), you can remove the old key from `encryptPreviousKeys`.
+
+```ts
+createStreamByRouter({
+  // ...
+  encrypt: process.env.STREAMBY_ENCRYPTION_KEY,               // the current key
+  encryptPreviousKeys: [process.env.STREAMBY_PREVIOUS_KEY!],  // only while rotating
+});
+```
+
+> Upgrading from a version before 0.34.0: deploy with your current key first, and rotate only
+> after that deploy (see the [changelog](CHANGELOG.md)).
+
+---
+
+## 👥 Project roles
+
+What a user can do in a project depends on their role in that project, as an active member
+(an invitation counts once it's accepted). It never depends on the platform role your
+`authProvider` returns.
+
+| Role | Can |
+|---|---|
+| `viewer` | See the project and its content, and archive the project in their own list. |
+| `editor` | Everything a viewer can, plus change the project: its details, connections, exports, files and folders, workflow, pipelines, production, reviews, rights, and start jobs. |
+| `admin` | Everything an editor can, plus manage the project's members and delete the project. |
+
+A project's public exports (`GET /streamby/:projectId/export/:exportName`) are read without a
+session. They only run nodes that read data: never a node that uses an account's credential,
+nor one that starts a job.
+
+---
+
 ## 🗄️ Database Schema Setup
 
 `@streamby/core` requires a pre-configured database schema for its internal operations. It does not manage database connections directly; instead, it expects the host application to provide initialized connection instances. This ensures full control and flexibility for the host environment.
@@ -279,5 +326,9 @@ Visit us [here](https://terminalcore.cl)
 
 ## 📟 License
 
-[MIT](./LICENSE)
+Copyright (C) 2026 TerminalCore Labs
+
+Licensed under the [GNU Affero General Public License v3.0](./LICENSE) (AGPL-3.0-only).
+
+> **Note for consumers:** unlike most installable packages, this one is intentionally AGPL rather than MIT. AGPL's copyleft applies to any project that depends on it -- if you install `@streamby/core`, your own project must also be licensed under AGPL-3.0 (or a compatible copyleft license). Confirm this is acceptable for your use case before adding this dependency.
 

package/dist/middleware/createRouter.js

@@ -9,6 +9,7 @@ const manager_1 = require("../models/manager");
 const storage_1 = require("../providers/storage");
 const connectionManager_1 = require("../adapters/database/connectionManager");
 const backfillBuiltinConnections_1 = require("../services/backfillBuiltinConnections");
+const reencryptCredentials_1 = require("../services/reencryptCredentials");
 const wsHub_1 = require("../services/wsHub");
 const auth_1 = require("../services/auth");
 const encryption_1 = require("../utils/encryption");
@@ -23,6 +24,7 @@ const connection_1 = require("./routes/connection");
 const dbConnection_1 = require("./routes/dbConnection");
 const storageConnection_1 = require("./routes/storageConnection");
 const userIntegration_1 = require("./routes/userIntegration");
+const oauth_1 = require("./routes/oauth");
 const notification_1 = require("./routes/notification");
 const subscription_1 = require("./routes/subscription");
 const media_1 = require("./routes/media");
@@ -37,7 +39,7 @@ const pipeline_1 = require("./routes/pipeline");
 function createStreamByRouter(config) {
     const router = express_1.default.Router();
     if (config.encrypt)
-        (0, encryption_1.setEncryptionKey)(config.encrypt);
+        (0, encryption_1.setEncryptionKey)(config.encrypt, config.encryptPreviousKeys);
     // Establish DB connections asynchronously (Postgres/Mongo + schema migrations).
     // Until they're ready, HOLD incoming requests instead of letting them through —
     // route handlers resolve projects/exports (e.g. the /menu-list export) against a
@@ -51,6 +53,16 @@ function createStreamByRouter(config) {
         .then(() => (0, backfillBuiltinConnections_1.backfillBuiltinConnections)(config))
         .catch((err) => {
         console.error('❌ StreamBy: failed to backfill built-in connections:', err);
+    })
+        .then(() => (0, reencryptCredentials_1.reencryptStoredCredentials)())
+        .then(({ updated, failed }) => {
+        if (updated)
+            console.log(`✅ StreamBy: re-encrypted the credentials of ${updated} record(s).`);
+        if (failed)
+            console.error(`❌ StreamBy: ${failed} stored credential(s) could not be decrypted with the configured keys; left as they are.`);
+    })
+        .catch((err) => {
+        console.error('❌ StreamBy: failed to re-encrypt stored credentials:', err);
     })
         .finally(() => {
         ready = true;
@@ -88,10 +100,12 @@ function createStreamByRouter(config) {
     if (config.websocket?.server) {
         (0, wsHub_1.initWsHub)(config.websocket.server, config);
     }
-    router.use((0, user_1.userRouter)(config));
+    // /auth answers whether there's a session (it reads it itself); everything after needs one,
+    // but for the public export route (see authenticate).
     router.use((0, auth_2.authRouter)(config));
     router.use((0, auth_1.authenticate)(config));
     router.use(subscription_1.ensureSubscription);
+    router.use((0, user_1.userRouter)(config));
     router.use((0, export_1.exportRouter)(config));
     router.use((0, member_1.memberRouter)(config));
     router.use((0, storage_2.storageRouter)(config));
@@ -101,6 +115,7 @@ function createStreamByRouter(config) {
     router.use((0, dbConnection_1.dbConnectionRouter)(config));
     router.use((0, storageConnection_1.storageConnectionRouter)(config));
     router.use((0, userIntegration_1.userIntegrationRouter)(config));
+    router.use((0, oauth_1.oauthRouter)(config));
     router.use((0, notification_1.notificationRouter)(config));
     router.use((0, subscription_1.subscriptionRouter)(config));
     router.use((0, media_1.mediaRouter)(config));

package/dist/middleware/routes/ai.js

@@ -29,7 +29,7 @@ function aiRouter(_config) {
             const project = await Project.findOne({ _id: projectId });
             if (!project)
                 return res.status(404).json({ message: 'Project not found' });
-            if (!(0, auth_1.isProjectMember)(project, auth.userId))
+            if (!(0, auth_1.canEditProject)(project, auth.userId))
                 return res.status(403).json({ message: 'Unauthorized' });
             const job = (0, jobQueue_1.createJob)('transcription', auth.userId, projectId, { fileId, model, sourceLanguage, outputFormats, provider, credentialId });
             setImmediate(() => (0, aiProcessor_1.runTranscriptionJob)(job.jobId, fileId, projectId, { model, sourceLanguage, outputFormats, provider, credentialId }));
@@ -50,7 +50,7 @@ function aiRouter(_config) {
             const project = await Project.findOne({ _id: projectId });
             if (!project)
                 return res.status(404).json({ message: 'Project not found' });
-            if (!(0, auth_1.isProjectMember)(project, auth.userId))
+            if (!(0, auth_1.canEditProject)(project, auth.userId))
                 return res.status(403).json({ message: 'Unauthorized' });
             const job = (0, jobQueue_1.createJob)('upscale', auth.userId, projectId, { fileId, scale, model, mode, credentialId });
             setImmediate(() => (0, aiProcessor_1.runUpscaleJob)(job.jobId, fileId, projectId, { scale, model, mode, credentialId }));
@@ -71,7 +71,7 @@ function aiRouter(_config) {
             const project = await Project.findOne({ _id: projectId });
             if (!project)
                 return res.status(404).json({ message: 'Project not found' });
-            if (!(0, auth_1.isProjectMember)(project, auth.userId))
+            if (!(0, auth_1.canEditProject)(project, auth.userId))
                 return res.status(403).json({ message: 'Unauthorized' });
             const job = (0, jobQueue_1.createJob)('generate-asset', auth.userId, projectId, { assetType, provider, prompt, seed, credentialId });
             setImmediate(() => (0, aiProcessor_1.runGenerateAssetJob)(job.jobId, projectId, { assetType, provider, prompt, seed, credentialId }));

package/dist/middleware/routes/connection.js

@@ -65,9 +65,6 @@ function connectionRouter(config) {
     router.post('/projects/:id/connections', async (req, res) => {
         try {
             const auth = req.auth;
-            if (auth.role !== 'admin' && auth.role !== 'editor') {
-                return res.status(403).json({ message: 'Permission denied' });
-            }
             const projectId = req.params.id;
             const { name, apiUrl, method, description, token, prefix } = req.body;
             if (!name || !apiUrl) {
@@ -80,7 +77,7 @@ function connectionRouter(config) {
             if (!project) {
                 return res.status(404).json({ message: 'Project not found' });
             }
-            if (!(0, auth_1.isProjectMember)(project, auth.userId)) {
+            if (!(0, auth_1.canEditProject)(project, auth.userId)) {
                 return res.status(403).json({ message: 'Unauthorized project access' });
             }
             const connection = await (0, connection_1.addConnection)(config, projectId, {
@@ -101,9 +98,6 @@ function connectionRouter(config) {
     router.patch('/projects/:id/connections/:connectionId', async (req, res) => {
         try {
             const auth = req.auth;
-            if (auth.role !== 'admin' && auth.role !== 'editor') {
-                return res.status(403).json({ message: 'Permission denied' });
-            }
             const { id: projectId, connectionId } = req.params;
             const { name, apiUrl, method, description, token, prefix } = req.body;
             if (method && !VALID_METHODS.includes(method)) {
@@ -112,7 +106,7 @@ function connectionRouter(config) {
             const project = await Project.findOne({ _id: projectId });
             if (!project)
                 return res.status(404).json({ message: 'Project not found' });
-            if (!(0, auth_1.isProjectMember)(project, auth.userId)) {
+            if (!(0, auth_1.canEditProject)(project, auth.userId)) {
                 return res.status(403).json({ message: 'Unauthorized project access' });
             }
             const updated = await (0, connection_1.updateConnection)(config, projectId, connectionId, {
@@ -170,16 +164,13 @@ function connectionRouter(config) {
     router.delete('/projects/:id/connections/:connectionId', async (req, res) => {
         try {
             const auth = req.auth;
-            if (auth.role !== 'admin' && auth.role !== 'editor') {
-                return res.status(403).json({ message: 'Permission denied' });
-            }
             const projectId = req.params.id;
             const { connectionId } = req.params;
             const project = await Project.findOne({ _id: projectId });
             if (!project) {
                 return res.status(404).json({ message: 'Project not found' });
             }
-            if (!(0, auth_1.isProjectMember)(project, auth.userId)) {
+            if (!(0, auth_1.canEditProject)(project, auth.userId)) {
                 return res.status(403).json({ message: 'Unauthorized project access' });
             }
             const exists = project.connections?.some((c) => c.id === connectionId);

package/dist/middleware/routes/dbConnection.js

@@ -49,9 +49,6 @@ function dbConnectionRouter(config) {
     router.post('/projects/:id/connections/db', async (req, res) => {
         try {
             const auth = req.auth;
-            if (auth.role !== 'admin' && auth.role !== 'editor') {
-                return res.status(403).json({ message: 'Permission denied' });
-            }
             const { name, dbType, credential, integrationId, description } = req.body;
             if (!name || !dbType) {
                 return res.status(400).json({ message: 'name and dbType are required' });
@@ -68,7 +65,7 @@ function dbConnectionRouter(config) {
             const project = await Project.findOne({ _id: req.params.id });
             if (!project)
                 return res.status(404).json({ message: 'Project not found' });
-            if (!(0, auth_1.isProjectMember)(project, auth.userId))
+            if (!(0, auth_1.canEditProject)(project, auth.userId))
                 return res.status(403).json({ message: 'Unauthorized project access' });
             let encryptedCredential;
             if (integrationId) {
@@ -106,13 +103,10 @@ function dbConnectionRouter(config) {
     router.delete('/projects/:id/connections/db/:connId', async (req, res) => {
         try {
             const auth = req.auth;
-            if (auth.role !== 'admin' && auth.role !== 'editor') {
-                return res.status(403).json({ message: 'Permission denied' });
-            }
             const project = await Project.findOne({ _id: req.params.id });
             if (!project)
                 return res.status(404).json({ message: 'Project not found' });
-            if (!(0, auth_1.isProjectMember)(project, auth.userId))
+            if (!(0, auth_1.canEditProject)(project, auth.userId))
                 return res.status(403).json({ message: 'Unauthorized project access' });
             const conn = (0, connectionResolver_1.findDbConnection)(project, req.params.connId);
             if (!conn)
@@ -149,13 +143,10 @@ function dbConnectionRouter(config) {
     router.post('/projects/:id/connections/db/:connId/tables', async (req, res) => {
         try {
             const auth = req.auth;
-            if (auth.role !== 'admin' && auth.role !== 'editor') {
-                return res.status(403).json({ message: 'Permission denied' });
-            }
             const project = await Project.findOne({ _id: req.params.id });
             if (!project)
                 return res.status(404).json({ message: 'Project not found' });
-            if (!(0, auth_1.isProjectMember)(project, auth.userId))
+            if (!(0, auth_1.canEditProject)(project, auth.userId))
                 return res.status(403).json({ message: 'Unauthorized project access' });
             const schema = req.body;
             if (!schema.tableName)
@@ -177,13 +168,10 @@ function dbConnectionRouter(config) {
     router.delete('/projects/:id/connections/db/:connId/tables/:tableName', async (req, res) => {
         try {
             const auth = req.auth;
-            if (auth.role !== 'admin' && auth.role !== 'editor') {
-                return res.status(403).json({ message: 'Permission denied' });
-            }
             const project = await Project.findOne({ _id: req.params.id });
             if (!project)
                 return res.status(404).json({ message: 'Project not found' });
-            if (!(0, auth_1.isProjectMember)(project, auth.userId))
+            if (!(0, auth_1.canEditProject)(project, auth.userId))
                 return res.status(403).json({ message: 'Unauthorized project access' });
             await withResolvedDbClient(project, req.params.connId, config, auth, res, async (resolved) => {
                 await (0, dbConnection_1.deleteTableOrCollectionInternal)(resolved.client, resolved.type, req.params.tableName, req.params.id);
@@ -218,13 +206,10 @@ function dbConnectionRouter(config) {
     router.post('/projects/:id/connections/db/:connId/tables/:tableName', async (req, res) => {
         try {
             const auth = req.auth;
-            if (auth.role !== 'admin' && auth.role !== 'editor') {
-                return res.status(403).json({ message: 'Permission denied' });
-            }
             const project = await Project.findOne({ _id: req.params.id });
             if (!project)
                 return res.status(404).json({ message: 'Project not found' });
-            if (!(0, auth_1.isProjectMember)(project, auth.userId))
+            if (!(0, auth_1.canEditProject)(project, auth.userId))
                 return res.status(403).json({ message: 'Unauthorized project access' });
             const record = req.body;
             if (!record || typeof record !== 'object' || Array.isArray(record)) {
@@ -243,12 +228,10 @@ function dbConnectionRouter(config) {
     router.put('/projects/:id/connections/db/:connId/tables/:tableName/:recordId', async (req, res) => {
         try {
             const auth = req.auth;
-            if (auth.role !== 'admin' && auth.role !== 'editor')
-                return res.status(403).json({ message: 'Permission denied' });
             const project = await Project.findOne({ _id: req.params.id });
             if (!project)
                 return res.status(404).json({ message: 'Project not found' });
-            if (!(0, auth_1.isProjectMember)(project, auth.userId))
+            if (!(0, auth_1.canEditProject)(project, auth.userId))
                 return res.status(403).json({ message: 'Unauthorized project access' });
             const updates = req.body;
             if (!updates || typeof updates !== 'object' || Array.isArray(updates)) {
@@ -267,12 +250,10 @@ function dbConnectionRouter(config) {
     router.delete('/projects/:id/connections/db/:connId/tables/:tableName/:recordId', async (req, res) => {
         try {
             const auth = req.auth;
-            if (auth.role !== 'admin' && auth.role !== 'editor')
-                return res.status(403).json({ message: 'Permission denied' });
             const project = await Project.findOne({ _id: req.params.id });
             if (!project)
                 return res.status(404).json({ message: 'Project not found' });
-            if (!(0, auth_1.isProjectMember)(project, auth.userId))
+            if (!(0, auth_1.canEditProject)(project, auth.userId))
                 return res.status(403).json({ message: 'Unauthorized project access' });
             await withResolvedDbClient(project, req.params.connId, config, auth, res, async (resolved) => {
                 await (0, dbConnection_1.deleteRecordInternal)(resolved.client, resolved.type, req.params.tableName, req.params.recordId, req.params.id);

package/dist/middleware/routes/distribution.js

@@ -11,6 +11,7 @@ const wsHub_1 = require("../../services/wsHub");
 const connectionManager_1 = require("../../adapters/database/connectionManager");
 const sanitize_1 = require("../../utils/sanitize");
 const crypto_1 = __importDefault(require("crypto"));
+const encryption_1 = require("../../utils/encryption");
 function getDb() {
     const ids = (0, connectionManager_1.getConnectedIds)().filter(id => (0, connectionManager_1.getConnection)(id).type === 'nosql');
     if (!ids.length)
@@ -44,13 +45,19 @@ function distributionRouter(_config) {
         try {
             const auth = req.auth;
             const { projectId } = req.params;
-            const { name, target, encryptedCredential, config, description } = req.body;
+            const { name, target, credential: credentialValue, encryptedCredential: legacyCredential, config, description } = req.body;
+            // The credential, as given (`encryptedCredential` was its old name: it was always the
+            // value itself), stored encrypted.
+            const credential = credentialValue ?? legacyCredential;
+            if (credential && !(0, encryption_1.isEncryptionKeySet)())
+                return res.status(500).json({ message: 'Encryption key is not set' });
+            const encryptedCredential = credential ? (0, encryption_1.encrypt)(String(credential)) : undefined;
             if (!name || !target)
                 return res.status(400).json({ message: 'name and target are required' });
             const project = await Project.findOne({ _id: projectId });
             if (!project)
                 return res.status(404).json({ message: 'Project not found' });
-            if (!(0, auth_1.isProjectMember)(project, auth.userId))
+            if (!(0, auth_1.canEditProject)(project, auth.userId))
                 return res.status(403).json({ message: 'Unauthorized' });
             const connection = {
                 id: crypto_1.default.randomUUID(),
@@ -76,7 +83,7 @@ function distributionRouter(_config) {
             const project = await Project.findOne({ _id: projectId });
             if (!project)
                 return res.status(404).json({ message: 'Project not found' });
-            if (!(0, auth_1.isProjectMember)(project, auth.userId))
+            if (!(0, auth_1.canEditProject)(project, auth.userId))
                 return res.status(403).json({ message: 'Unauthorized' });
             await Project.update({ _id: projectId }, { $pull: { distributionConnections: { id: connectionId } } });
             res.json({ message: 'Connection deleted' });
@@ -96,7 +103,7 @@ function distributionRouter(_config) {
             const project = await Project.findOne({ _id: projectId });
             if (!project)
                 return res.status(404).json({ message: 'Project not found' });
-            if (!(0, auth_1.isProjectMember)(project, auth.userId))
+            if (!(0, auth_1.canEditProject)(project, auth.userId))
                 return res.status(403).json({ message: 'Unauthorized' });
             const exportDoc = await Export.findOne({ id: exportId, projectId });
             if (!exportDoc)
@@ -169,7 +176,7 @@ function distributionRouter(_config) {
             const project = await Project.findOne({ _id: projectId });
             if (!project)
                 return res.status(404).json({ message: 'Project not found' });
-            if (!(0, auth_1.isProjectMember)(project, auth.userId))
+            if (!(0, auth_1.canEditProject)(project, auth.userId))
                 return res.status(403).json({ message: 'Unauthorized' });
             const db = getDb();
             if (!db)

package/dist/middleware/routes/export.js

@@ -237,7 +237,7 @@ function exportRouter(config) {
             const resolvedNodeSchema = nodeSchema ?? DEFAULT_NODE_SCHEMA;
             const exportType = useConnections ? 'externalApi' : 'json';
             const project = await Project.findOne({ _id: projectId });
-            if (!project || !(0, auth_1.isProjectMember)(project, auth.userId)) {
+            if (!project || !(0, auth_1.canEditProject)(project, auth.userId)) {
                 return res.status(403).json({ message: 'Unauthorized project access' });
             }
             const mainDb = config.databases?.find(db => db.main) ?? config.databases?.[0];
@@ -258,7 +258,7 @@ function exportRouter(config) {
             const { id: projectId, export_id: exportId } = req.params;
             const { name, description, isPrivate, allowedOrigin, devMode, devPorts, useConnections, useCredentials, nodeSchema } = req.body;
             const project = await Project.findOne({ _id: projectId });
-            if (!project || !(0, auth_1.isProjectMember)(project, auth.userId)) {
+            if (!project || !(0, auth_1.canEditProject)(project, auth.userId)) {
                 return res.status(403).json({ message: 'Unauthorized project access' });
             }
             const exportMetadata = project.exports?.find((e) => e.id.toString() === exportId);
@@ -284,7 +284,7 @@ function exportRouter(config) {
             }
             const { id: projectId, export_id: exportId } = req.params;
             const project = await Project.findOne({ _id: projectId });
-            if (!project || !(0, auth_1.isProjectMember)(project, auth.userId)) {
+            if (!project || !(0, auth_1.canEditProject)(project, auth.userId)) {
                 return res.status(403).json({ message: 'Unauthorized project access' });
             }
             const exportMetadata = project.exports.find((e) => e.id.toString() === exportId);
@@ -352,7 +352,8 @@ function exportRouter(config) {
             }
             let data;
             if (exportMetadata.nodeSchema) {
-                data = await (0, executor_1.executeExport)(exportMetadata.nodeSchema, project, config);
+                // Read without a session: only the nodes that read data run (see executeExport).
+                data = await (0, executor_1.executeExport)(exportMetadata.nodeSchema, project, config, { public: true });
                 return res.json(data ?? null);
             }
             // Legacy path: raw JSON or external API export

package/dist/middleware/routes/media.js

@@ -25,11 +25,24 @@ function mediaRouter(config) {
     const adapter = config.adapter || (0, storage_1.createStorageProvider)(config.storageProviders);
     const Project = (0, manager_1.getModel)('projects');
     // GET /jobs/:jobId — poll job status
-    router.get('/jobs/:jobId', (req, res) => {
-        const job = (0, jobQueue_1.getJob)(req.params.jobId);
-        if (!job)
-            return res.status(404).json({ message: 'Job not found' });
-        res.json({ job });
+    // Only for whoever started it, or a member of its project: someone else's job is as if it
+    // didn't exist.
+    router.get('/jobs/:jobId', async (req, res) => {
+        try {
+            const auth = req.auth;
+            const job = (0, jobQueue_1.getJob)(req.params.jobId);
+            if (!job)
+                return res.status(404).json({ message: 'Job not found' });
+            if (job.userId !== auth.userId) {
+                const project = await Project.findOne({ _id: job.projectId });
+                if (!(0, auth_1.isProjectMember)(project, auth.userId))
+                    return res.status(404).json({ message: 'Job not found' });
+            }
+            res.json({ job });
+        }
+        catch (err) {
+            res.status(500).json({ message: 'Failed to fetch job', details: err.message });
+        }
     });
     // POST /projects/:projectId/jobs/ingest — queue an ingest job for an already-uploaded file
     router.post('/projects/:projectId/jobs/ingest', async (req, res) => {
@@ -42,7 +55,7 @@ function mediaRouter(config) {
             const project = await Project.findOne({ _id: projectId });
             if (!project)
                 return res.status(404).json({ message: 'Project not found' });
-            if (!(0, auth_1.isProjectMember)(project, auth.userId))
+            if (!(0, auth_1.canEditProject)(project, auth.userId))
                 return res.status(403).json({ message: 'Unauthorized' });
             const job = (0, jobQueue_1.createJob)('ingest', auth.userId, projectId, { fileId });
             // Run async — response returns immediately with jobId
@@ -64,7 +77,7 @@ function mediaRouter(config) {
             const project = await Project.findOne({ _id: projectId });
             if (!project)
                 return res.status(404).json({ message: 'Project not found' });
-            if (!(0, auth_1.isProjectMember)(project, auth.userId))
+            if (!(0, auth_1.canEditProject)(project, auth.userId))
                 return res.status(403).json({ message: 'Unauthorized' });
             const job = (0, jobQueue_1.createJob)('transcode', auth.userId, projectId, {
                 fileId, codec, resolution, outputFormat, bitrate, audioCodec,
@@ -87,7 +100,7 @@ function mediaRouter(config) {
             const project = await Project.findOne({ _id: projectId });
             if (!project)
                 return res.status(404).json({ message: 'Project not found' });
-            if (!(0, auth_1.isProjectMember)(project, auth.userId))
+            if (!(0, auth_1.canEditProject)(project, auth.userId))
                 return res.status(403).json({ message: 'Unauthorized' });
             const job = (0, jobQueue_1.createJob)('thumbnail', auth.userId, projectId, { fileId, timecode, resolution, strategy });
             setImmediate(() => (0, mediaProcessor_1.runThumbnailJob)(job.jobId, fileId, projectId, { timecode, resolution, strategy }));
@@ -108,7 +121,7 @@ function mediaRouter(config) {
             const project = await Project.findOne({ _id: projectId });
             if (!project)
                 return res.status(404).json({ message: 'Project not found' });
-            if (!(0, auth_1.isProjectMember)(project, auth.userId))
+            if (!(0, auth_1.canEditProject)(project, auth.userId))
                 return res.status(403).json({ message: 'Unauthorized' });
             const job = (0, jobQueue_1.createJob)('caption', auth.userId, projectId, { fileId, sourceLanguage, outputFormat, provider });
             setImmediate(() => (0, mediaProcessor_1.runCaptionJob)(job.jobId, fileId, projectId, { sourceLanguage, outputFormat, provider }));
@@ -150,7 +163,7 @@ function mediaRouter(config) {
             const project = await Project.findOne({ _id: projectId });
             if (!project)
                 return res.status(404).json({ message: 'Project not found' });
-            if (!(0, auth_1.isProjectMember)(project, auth.userId))
+            if (!(0, auth_1.canEditProject)(project, auth.userId))
                 return res.status(403).json({ message: 'Unauthorized' });
             const col = getMetadataCollection();
             if (!col)

package/dist/middleware/routes/member.js

@@ -52,9 +52,6 @@ function memberRouter(config) {
     router.post('/projects/:id/members', async (req, res) => {
         try {
             const auth = req.auth;
-            if (auth.role !== 'admin') {
-                return res.status(403).json({ message: 'Only admins can invite members' });
-            }
             const projectId = req.params.id;
             const { userId, role } = req.body;
             if (!userId || !role) {
@@ -67,7 +64,7 @@ function memberRouter(config) {
             if (!project) {
                 return res.status(404).json({ message: 'Project not found' });
             }
-            if (!(0, auth_1.isProjectMember)(project, auth.userId)) {
+            if (!(0, auth_1.isProjectAdmin)(project, auth.userId)) {
                 return res.status(403).json({ message: 'Unauthorized project access' });
             }
             const alreadyMember = project.members?.some((m) => m.userId?.toString() === userId?.toString());
@@ -107,9 +104,6 @@ function memberRouter(config) {
     router.patch('/projects/:id/members/:userId', async (req, res) => {
         try {
             const auth = req.auth;
-            if (auth.role !== 'admin') {
-                return res.status(403).json({ message: 'Only admins can update member roles' });
-            }
             const projectId = req.params.id;
             const targetUserId = req.params.userId;
             const { role } = req.body;
@@ -120,7 +114,7 @@ function memberRouter(config) {
             if (!project) {
                 return res.status(404).json({ message: 'Project not found' });
             }
-            if (!(0, auth_1.isProjectMember)(project, auth.userId)) {
+            if (!(0, auth_1.isProjectAdmin)(project, auth.userId)) {
                 return res.status(403).json({ message: 'Unauthorized project access' });
             }
             const memberExists = project.members?.some((m) => m.userId?.toString() === targetUserId?.toString());
@@ -282,9 +276,6 @@ function memberRouter(config) {
     router.delete('/projects/:id/members/:userId', async (req, res) => {
         try {
             const auth = req.auth;
-            if (auth.role !== 'admin') {
-                return res.status(403).json({ message: 'Only admins can remove members' });
-            }
             const projectId = req.params.id;
             const targetUserId = req.params.userId;
             if (targetUserId === auth.userId) {
@@ -294,7 +285,7 @@ function memberRouter(config) {
             if (!project) {
                 return res.status(404).json({ message: 'Project not found' });
             }
-            if (!(0, auth_1.isProjectMember)(project, auth.userId)) {
+            if (!(0, auth_1.isProjectAdmin)(project, auth.userId)) {
                 return res.status(403).json({ message: 'Unauthorized project access' });
             }
             const memberExists = project.members?.some((m) => m.userId?.toString() === targetUserId?.toString());

package/dist/middleware/routes/{credential.d.ts → oauth.d.ts}

@@ -1,3 +1,3 @@
 import { Router } from 'express';
 import { StreamByConfig } from '../../types';
-export declare function credentialRouter(config: StreamByConfig): Router;
+export declare function oauthRouter(config: StreamByConfig): Router;