streamby-core 0.32.1 → 0.34.0

package/dist/middleware/routes/oauth.js

@@ -0,0 +1,101 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.oauthRouter = oauthRouter;
+const express_1 = require("express");
+const crypto_1 = __importDefault(require("crypto"));
+const oauthClient_1 = require("../../services/oauthClient");
+const userIntegration_1 = require("../../services/userIntegration");
+const OAUTH_PROVIDERS = new Set(['jira', 'google']);
+const PROVIDER_DISPLAY_NAME = {
+    jira: 'Jira',
+    google: 'Google',
+};
+// In-memory, single-process state store — the OAuth dance completes within a few minutes
+// of the same request cycle, so no DB collection is needed. A restart mid-flow just means
+// the user retries /start, which is harmless.
+const pendingOAuthStates = new Map();
+const STATE_TTL_MS = 10 * 60 * 1000;
+function sweepExpiredStates() {
+    const cutoff = Date.now() - STATE_TTL_MS;
+    for (const [state, entry] of pendingOAuthStates) {
+        if (entry.issuedAt < cutoff)
+            pendingOAuthStates.delete(state);
+    }
+}
+function isOAuthProvider(value) {
+    return OAUTH_PROVIDERS.has(value);
+}
+function oauthRouter(config) {
+    const router = (0, express_1.Router)();
+    router.get('/user/integrations/oauth/:provider/start', async (req, res) => {
+        try {
+            const auth = req.auth;
+            const { provider } = req.params;
+            if (!isOAuthProvider(provider)) {
+                return res.status(400).json({ message: `Provider '${provider}' does not support OAuth.` });
+            }
+            const oauthConfig = config.oauthProviders?.[provider];
+            if (!oauthConfig) {
+                return res.status(503).json({ message: `OAuth for '${provider}' is not configured on this deployment.` });
+            }
+            sweepExpiredStates();
+            const state = crypto_1.default.randomBytes(32).toString('hex');
+            pendingOAuthStates.set(state, { userId: auth.userId, provider, issuedAt: Date.now() });
+            res.redirect((0, oauthClient_1.buildAuthorizeUrl)(provider, oauthConfig, state));
+        }
+        catch (err) {
+            res.status(500).json({ message: 'Failed to start OAuth flow', details: err.message });
+        }
+    });
+    router.get('/user/integrations/oauth/:provider/callback', async (req, res) => {
+        const { provider: providerParam } = req.params;
+        const provider = isOAuthProvider(providerParam) ? providerParam : null;
+        const oauthConfig = provider ? config.oauthProviders?.[provider] : undefined;
+        const failureRedirect = (reason) => {
+            const failureUrl = oauthConfig?.failureRedirectUrl;
+            if (!failureUrl)
+                return res.status(400).json({ message: `OAuth failed: ${reason}` });
+            const url = new URL(failureUrl);
+            url.searchParams.set('oauthError', reason);
+            if (provider)
+                url.searchParams.set('provider', provider);
+            return res.redirect(url.toString());
+        };
+        try {
+            const auth = req.auth;
+            if (!provider)
+                return res.status(400).json({ message: `Provider '${providerParam}' does not support OAuth.` });
+            if (!oauthConfig)
+                return res.status(503).json({ message: `OAuth for '${provider}' is not configured on this deployment.` });
+            if (req.query.error)
+                return failureRedirect(String(req.query.error));
+            const code = req.query.code;
+            const state = req.query.state;
+            if (!code || !state)
+                return failureRedirect('missing_code');
+            const pending = pendingOAuthStates.get(state);
+            pendingOAuthStates.delete(state); // single-use, regardless of outcome below
+            if (!pending || pending.provider !== provider || pending.userId !== auth.userId) {
+                return failureRedirect(pending ? 'state_mismatch' : 'invalid_state');
+            }
+            let tokens;
+            try {
+                tokens = await (0, oauthClient_1.exchangeCodeForTokens)(provider, oauthConfig, code);
+            }
+            catch {
+                return failureRedirect('token_exchange_failed');
+            }
+            await (0, userIntegration_1.upsertOAuthServiceIntegration)(auth.userId, provider, PROVIDER_DISPLAY_NAME[provider], tokens);
+            const url = new URL(oauthConfig.successRedirectUrl);
+            url.searchParams.set('connected', provider);
+            res.redirect(url.toString());
+        }
+        catch (err) {
+            failureRedirect('unexpected_error');
+        }
+    });
+    return router;
+}

package/dist/middleware/routes/pipeline.js

@@ -67,7 +67,7 @@ function pipelineRouter(_config) {
             const project = await Project.findOne({ _id: projectId });
             if (!project)
                 return res.status(404).json({ message: 'Project not found' });
-            if (!(0, auth_1.isProjectMember)(project, auth.userId))
+            if (!(0, auth_1.canEditProject)(project, auth.userId))
                 return res.status(403).json({ message: 'Unauthorized' });
             const db = getDb();
             if (!db)
@@ -120,7 +120,7 @@ function pipelineRouter(_config) {
             const project = await Project.findOne({ _id: projectId });
             if (!project)
                 return res.status(404).json({ message: 'Project not found' });
-            if (!(0, auth_1.isProjectMember)(project, auth.userId))
+            if (!(0, auth_1.canEditProject)(project, auth.userId))
                 return res.status(403).json({ message: 'Unauthorized' });
             const db = getDb();
             if (!db)
@@ -154,7 +154,7 @@ function pipelineRouter(_config) {
             const project = await Project.findOne({ _id: projectId });
             if (!project)
                 return res.status(404).json({ message: 'Project not found' });
-            if (!(0, auth_1.isProjectMember)(project, auth.userId))
+            if (!(0, auth_1.canEditProject)(project, auth.userId))
                 return res.status(403).json({ message: 'Unauthorized' });
             const db = getDb();
             if (!db)

package/dist/middleware/routes/production.js

@@ -51,7 +51,7 @@ function productionRouter(_config) {
             const project = await Project.findOne({ _id: projectId });
             if (!project)
                 return res.status(404).json({ message: 'Project not found' });
-            if (!(0, auth_1.isProjectMember)(project, auth.userId))
+            if (!(0, auth_1.canEditProject)(project, auth.userId))
                 return res.status(403).json({ message: 'Unauthorized' });
             const db = getDb();
             if (!db)
@@ -81,7 +81,7 @@ function productionRouter(_config) {
             const project = await Project.findOne({ _id: projectId });
             if (!project)
                 return res.status(404).json({ message: 'Project not found' });
-            if (!(0, auth_1.isProjectMember)(project, auth.userId))
+            if (!(0, auth_1.canEditProject)(project, auth.userId))
                 return res.status(403).json({ message: 'Unauthorized' });
             const db = getDb();
             if (!db)
@@ -110,7 +110,7 @@ function productionRouter(_config) {
             const project = await Project.findOne({ _id: projectId });
             if (!project)
                 return res.status(404).json({ message: 'Project not found' });
-            if (!(0, auth_1.isProjectMember)(project, auth.userId))
+            if (!(0, auth_1.canEditProject)(project, auth.userId))
                 return res.status(403).json({ message: 'Unauthorized' });
             const db = getDb();
             if (!db)
@@ -156,7 +156,7 @@ function productionRouter(_config) {
             const project = await Project.findOne({ _id: projectId });
             if (!project)
                 return res.status(404).json({ message: 'Project not found' });
-            if (!(0, auth_1.isProjectMember)(project, auth.userId))
+            if (!(0, auth_1.canEditProject)(project, auth.userId))
                 return res.status(403).json({ message: 'Unauthorized' });
             const db = getDb();
             if (!db)
@@ -192,7 +192,7 @@ function productionRouter(_config) {
             const project = await Project.findOne({ _id: projectId });
             if (!project)
                 return res.status(404).json({ message: 'Project not found' });
-            if (!(0, auth_1.isProjectMember)(project, auth.userId))
+            if (!(0, auth_1.canEditProject)(project, auth.userId))
                 return res.status(403).json({ message: 'Unauthorized' });
             const db = getDb();
             if (!db)
@@ -231,7 +231,7 @@ function productionRouter(_config) {
             const project = await Project.findOne({ _id: projectId });
             if (!project)
                 return res.status(404).json({ message: 'Project not found' });
-            if (!(0, auth_1.isProjectMember)(project, auth.userId))
+            if (!(0, auth_1.canEditProject)(project, auth.userId))
                 return res.status(403).json({ message: 'Unauthorized' });
             const db = getDb();
             if (!db)
@@ -277,7 +277,7 @@ function productionRouter(_config) {
             const project = await Project.findOne({ _id: projectId });
             if (!project)
                 return res.status(404).json({ message: 'Project not found' });
-            if (!(0, auth_1.isProjectMember)(project, auth.userId))
+            if (!(0, auth_1.canEditProject)(project, auth.userId))
                 return res.status(403).json({ message: 'Unauthorized' });
             const db = getDb();
             if (!db)
@@ -311,7 +311,7 @@ function productionRouter(_config) {
             const project = await Project.findOne({ _id: projectId });
             if (!project)
                 return res.status(404).json({ message: 'Project not found' });
-            if (!(0, auth_1.isProjectMember)(project, auth.userId))
+            if (!(0, auth_1.canEditProject)(project, auth.userId))
                 return res.status(403).json({ message: 'Unauthorized' });
             const db = getDb();
             if (!db)
@@ -346,7 +346,7 @@ function productionRouter(_config) {
             const project = await Project.findOne({ _id: projectId });
             if (!project)
                 return res.status(404).json({ message: 'Project not found' });
-            if (!(0, auth_1.isProjectMember)(project, auth.userId))
+            if (!(0, auth_1.canEditProject)(project, auth.userId))
                 return res.status(403).json({ message: 'Unauthorized' });
             const db = getDb();
             if (!db)

package/dist/middleware/routes/project.js

@@ -72,9 +72,6 @@ function projectRouter(config) {
             if (req.subscription === 'freemium') {
                 return res.status(403).json({ error: 'Freemium users cannot create projects' });
             }
-            if (auth.role !== 'admin' && auth.role !== 'editor') {
-                return res.status(403).json({ message: 'Permission denied' });
-            }
             const { name, description, image, allowedOrigin, public: isPublic = true, category, integrationIds } = req.body;
             if (isPublic === false && req.subscription === 'freemium') {
                 return res.status(403).json({ error: 'Private projects require a subscriber plan' });
@@ -93,6 +90,7 @@ function projectRouter(config) {
             // builtin id. Any invalid id rejects the whole request (no project is created).
             const dbConnections = [];
             const storageConnections = [];
+            const integrationConnections = [];
             if (Array.isArray(integrationIds)) {
                 for (const id of integrationIds) {
                     const result = await (0, projectIntegration_1.classifyIntegrationId)(id, auth, config, '');
@@ -100,8 +98,10 @@ function projectRouter(config) {
                         return res.status(result.status).json({ message: result.error });
                     if (result.kind === 'database')
                         dbConnections.push(result.connection);
-                    else
+                    else if (result.kind === 'storage')
                         storageConnections.push(result.connection);
+                    else
+                        integrationConnections.push(result.connection);
                 }
             }
             let newProject = await Project.create({
@@ -115,12 +115,14 @@ function projectRouter(config) {
                 members: [{ userId: auth.userId, username: user.username, role: "admin", status: "active", archived: false }],
                 dbConnections: [],
                 storageConnections: [],
+                integrationConnections: [],
             });
             const newProjectId = newProject._id || newProject.id;
-            if (dbConnections.length || storageConnections.length) {
+            if (dbConnections.length || storageConnections.length || integrationConnections.length) {
                 const stamped = await Project.update({ _id: newProjectId }, {
                     dbConnections: dbConnections.map(c => ({ ...c, projectId: newProjectId })),
                     storageConnections: storageConnections.map(c => ({ ...c, projectId: newProjectId })),
+                    integrationConnections: integrationConnections.map(c => ({ ...c, projectId: newProjectId })),
                 });
                 if (stamped)
                     newProject = stamped;
@@ -203,9 +205,6 @@ function projectRouter(config) {
     router.patch('/projects/:id', async (req, res) => {
         try {
             const auth = req.auth;
-            if (auth.role !== 'admin' && auth.role !== 'editor') {
-                return res.status(403).json({ message: 'Permission denied' });
-            }
             const projectId = req.params.id;
             const updates = req.body;
             const project = await Project.findOne({ _id: projectId });
@@ -215,7 +214,7 @@ function projectRouter(config) {
             if (!updates || typeof updates !== 'object') {
                 return res.status(400).json({ message: 'Missing updates payload' });
             }
-            if (!(0, auth_1.isProjectMember)(project, auth.userId)) {
+            if (!(0, auth_1.canEditProject)(project, auth.userId)) {
                 return res.status(403).json({ message: 'Unauthorized project access' });
             }
             const updated = await Project.update({ _id: projectId }, updates);
@@ -245,8 +244,9 @@ function projectRouter(config) {
             if (!project) {
                 return res.status(404).json({ message: 'Project not found' });
             }
-            if (!(0, auth_1.isProjectMember)(project, auth.userId)) {
-                return res.status(403).json({ message: 'Unauthorized project access' });
+            // Only an admin of the project deletes it.
+            if (!(0, auth_1.isProjectAdmin)(project, auth.userId)) {
+                return res.status(403).json({ message: 'Only a project admin can delete it' });
             }
             await Project.useDbType(project.dbType).delete({ _id: projectId });
             const allProjects = await Project.find({});
@@ -343,9 +343,6 @@ function projectRouter(config) {
     router.post('/projects/:id/image', async (req, res) => {
         try {
             const auth = req.auth;
-            if (auth.role !== 'admin' && auth.role !== 'editor') {
-                return res.status(403).json({ message: 'Permission denied' });
-            }
             const projectId = req.params.id;
             const { imageUrl } = req.body;
             if (!projectId || !imageUrl) {
@@ -355,7 +352,7 @@ function projectRouter(config) {
             if (!project) {
                 return res.status(404).json({ message: 'Project not found' });
             }
-            if (!(0, auth_1.isProjectMember)(project, auth.userId)) {
+            if (!(0, auth_1.canEditProject)(project, auth.userId)) {
                 return res.status(403).json({ message: 'Unauthorized project access' });
             }
             const updatedProject = await Project.update({ _id: projectId }, { image: imageUrl });
@@ -371,16 +368,13 @@ function projectRouter(config) {
     router.patch('/projects/:id/origins', async (req, res) => {
         try {
             const auth = req.auth;
-            if (auth.role !== 'admin' && auth.role !== 'editor') {
-                return res.status(403).json({ message: 'Permission denied' });
-            }
             const projectId = req.params.id;
             const { origins } = req.body;
             const project = await Project.findOne({ _id: projectId });
             if (!project) {
                 return res.status(404).json({ message: 'Project not found' });
             }
-            if (!(0, auth_1.isProjectMember)(project, auth.userId)) {
+            if (!(0, auth_1.canEditProject)(project, auth.userId)) {
                 return res.status(403).json({ message: 'Unauthorized project access' });
             }
             const updated = await Project.update({ _id: projectId }, { allowedOrigin: origins });
@@ -397,9 +391,6 @@ function projectRouter(config) {
     router.post('/projects/:id/integrations', async (req, res) => {
         try {
             const auth = req.auth;
-            if (auth.role !== 'admin' && auth.role !== 'editor') {
-                return res.status(403).json({ message: 'Permission denied' });
-            }
             const projectId = req.params.id;
             const { integrationId } = req.body;
             if (!integrationId)
@@ -407,9 +398,9 @@ function projectRouter(config) {
             const project = await Project.findOne({ _id: projectId });
             if (!project)
                 return res.status(404).json({ message: 'Project not found' });
-            if (!(0, auth_1.isProjectMember)(project, auth.userId))
+            if (!(0, auth_1.canEditProject)(project, auth.userId))
                 return res.status(403).json({ message: 'Unauthorized project access' });
-            const alreadyConnected = [...(project.dbConnections ?? []), ...(project.storageConnections ?? [])]
+            const alreadyConnected = [...(project.dbConnections ?? []), ...(project.storageConnections ?? []), ...(project.integrationConnections ?? [])]
                 .some((c) => c.integrationId === integrationId);
             if (alreadyConnected)
                 return res.status(400).json({ message: 'This integration is already connected to the project' });
@@ -418,7 +409,9 @@ function projectRouter(config) {
                 return res.status(result.status).json({ message: result.error });
             const updated = result.kind === 'database'
                 ? await Project.update({ _id: projectId }, { $push: { dbConnections: result.connection } })
-                : await Project.update({ _id: projectId }, { $push: { storageConnections: result.connection } });
+                : result.kind === 'storage'
+                    ? await Project.update({ _id: projectId }, { $push: { storageConnections: result.connection } })
+                    : await Project.update({ _id: projectId }, { $push: { integrationConnections: result.connection } });
             if (!updated)
                 return res.status(404).json({ message: 'Project not found or not updated' });
             res.status(201).json({ data: result.connection, project: (0, sanitize_1.sanitizeProject)(updated) });
@@ -431,23 +424,23 @@ function projectRouter(config) {
     router.delete('/projects/:id/integrations/:integrationId', async (req, res) => {
         try {
             const auth = req.auth;
-            if (auth.role !== 'admin' && auth.role !== 'editor') {
-                return res.status(403).json({ message: 'Permission denied' });
-            }
             const projectId = req.params.id;
             const { integrationId } = req.params;
             const project = await Project.findOne({ _id: projectId });
             if (!project)
                 return res.status(404).json({ message: 'Project not found' });
-            if (!(0, auth_1.isProjectMember)(project, auth.userId))
+            if (!(0, auth_1.canEditProject)(project, auth.userId))
                 return res.status(403).json({ message: 'Unauthorized project access' });
             const dbConn = (project.dbConnections ?? []).find((c) => c.integrationId === integrationId);
             const storageConn = (project.storageConnections ?? []).find((c) => c.integrationId === integrationId);
-            if (!dbConn && !storageConn)
+            const integrationConn = (project.integrationConnections ?? []).find((c) => c.integrationId === integrationId);
+            if (!dbConn && !storageConn && !integrationConn)
                 return res.status(404).json({ message: 'Integration not connected to this project' });
             const updated = dbConn
                 ? await Project.update({ _id: projectId }, { $pull: { dbConnections: { id: dbConn.id } } })
-                : await Project.update({ _id: projectId }, { $pull: { storageConnections: { id: storageConn.id } } });
+                : storageConn
+                    ? await Project.update({ _id: projectId }, { $pull: { storageConnections: { id: storageConn.id } } })
+                    : await Project.update({ _id: projectId }, { $pull: { integrationConnections: { id: integrationConn.id } } });
             if (!updated)
                 return res.status(404).json({ message: 'Project not found or not updated' });
             res.status(200).json({ message: 'Integration removed', project: (0, sanitize_1.sanitizeProject)(updated) });

package/dist/middleware/routes/renderFarm.js

@@ -11,6 +11,7 @@ const jobQueue_1 = require("../../services/jobQueue");
 const vfxProcessor_1 = require("../../services/vfxProcessor");
 const sanitize_1 = require("../../utils/sanitize");
 const crypto_1 = __importDefault(require("crypto"));
+const encryption_1 = require("../../utils/encryption");
 function renderFarmRouter(_config) {
     const router = (0, express_1.Router)();
     const Project = (0, manager_1.getModel)('projects');
@@ -34,14 +35,20 @@ function renderFarmRouter(_config) {
         try {
             const auth = req.auth;
             const { projectId } = req.params;
-            const { name, provider, apiUrl, encryptedCredential, description } = req.body;
+            const { name, provider, apiUrl, credential: credentialValue, encryptedCredential: legacyCredential, description } = req.body;
+            // The credential, as given (`encryptedCredential` was its old name: it was always the
+            // value itself), stored encrypted.
+            const credential = credentialValue ?? legacyCredential;
+            if (credential && !(0, encryption_1.isEncryptionKeySet)())
+                return res.status(500).json({ message: 'Encryption key is not set' });
+            const encryptedCredential = credential ? (0, encryption_1.encrypt)(String(credential)) : undefined;
             if (!name || !provider || !apiUrl) {
                 return res.status(400).json({ message: 'name, provider and apiUrl are required' });
             }
             const project = await Project.findOne({ _id: projectId });
             if (!project)
                 return res.status(404).json({ message: 'Project not found' });
-            if (!(0, auth_1.isProjectMember)(project, auth.userId))
+            if (!(0, auth_1.canEditProject)(project, auth.userId))
                 return res.status(403).json({ message: 'Unauthorized' });
             const connection = {
                 id: crypto_1.default.randomUUID(),
@@ -67,7 +74,7 @@ function renderFarmRouter(_config) {
             const project = await Project.findOne({ _id: projectId });
             if (!project)
                 return res.status(404).json({ message: 'Project not found' });
-            if (!(0, auth_1.isProjectMember)(project, auth.userId))
+            if (!(0, auth_1.canEditProject)(project, auth.userId))
                 return res.status(403).json({ message: 'Unauthorized' });
             await Project.update({ _id: projectId }, { $pull: { renderFarmConnections: { id: connectionId } } });
             res.json({ message: 'Connection deleted' });
@@ -87,7 +94,7 @@ function renderFarmRouter(_config) {
             const project = await Project.findOne({ _id: projectId });
             if (!project)
                 return res.status(404).json({ message: 'Project not found' });
-            if (!(0, auth_1.isProjectMember)(project, auth.userId))
+            if (!(0, auth_1.canEditProject)(project, auth.userId))
                 return res.status(403).json({ message: 'Unauthorized' });
             const job = (0, jobQueue_1.createJob)('render', auth.userId, projectId, { fileId, renderer, renderFarmConnectionId, frameRange, resolution, samples, outputFormat });
             setImmediate(() => (0, vfxProcessor_1.runRenderJob)(job.jobId, fileId, projectId, { renderer, renderFarmConnectionId, frameRange, resolution, samples, outputFormat }));
@@ -107,7 +114,7 @@ function renderFarmRouter(_config) {
             const project = await Project.findOne({ _id: projectId });
             if (!project)
                 return res.status(404).json({ message: 'Project not found' });
-            if (!(0, auth_1.isProjectMember)(project, auth.userId))
+            if (!(0, auth_1.canEditProject)(project, auth.userId))
                 return res.status(403).json({ message: 'Unauthorized' });
             const job = (0, jobQueue_1.createJob)('format-convert', auth.userId, projectId, { fileId, inputFormat, outputFormat, applyTransforms, embedTextures });
             setImmediate(() => (0, vfxProcessor_1.runFormatConvertJob)(job.jobId, fileId, projectId, { inputFormat, outputFormat, applyTransforms, embedTextures }));
@@ -127,7 +134,7 @@ function renderFarmRouter(_config) {
             const project = await Project.findOne({ _id: projectId });
             if (!project)
                 return res.status(404).json({ message: 'Project not found' });
-            if (!(0, auth_1.isProjectMember)(project, auth.userId))
+            if (!(0, auth_1.canEditProject)(project, auth.userId))
                 return res.status(403).json({ message: 'Unauthorized' });
             const job = (0, jobQueue_1.createJob)('lod', auth.userId, projectId, { fileId, levels, reductionRatios, algorithm, outputFormat });
             setImmediate(() => (0, vfxProcessor_1.runLodJob)(job.jobId, fileId, projectId, { levels, reductionRatios, algorithm, outputFormat }));

package/dist/middleware/routes/review.js

@@ -60,7 +60,7 @@ function reviewRouter(_config) {
             const project = await Project.findOne({ _id: projectId });
             if (!project)
                 return res.status(404).json({ message: 'Project not found' });
-            if (!(0, auth_1.isProjectMember)(project, auth.userId))
+            if (!(0, auth_1.canEditProject)(project, auth.userId))
                 return res.status(403).json({ message: 'Unauthorized' });
             const db = getDb();
             if (!db)
@@ -120,7 +120,7 @@ function reviewRouter(_config) {
             const project = await Project.findOne({ _id: projectId });
             if (!project)
                 return res.status(404).json({ message: 'Project not found' });
-            if (!(0, auth_1.isProjectMember)(project, auth.userId))
+            if (!(0, auth_1.canEditProject)(project, auth.userId))
                 return res.status(403).json({ message: 'Unauthorized' });
             const db = getDb();
             if (!db)
@@ -190,7 +190,7 @@ function reviewRouter(_config) {
             const project = await Project.findOne({ _id: projectId });
             if (!project)
                 return res.status(404).json({ message: 'Project not found' });
-            if (!(0, auth_1.isProjectMember)(project, auth.userId))
+            if (!(0, auth_1.canEditProject)(project, auth.userId))
                 return res.status(403).json({ message: 'Unauthorized' });
             const db = getDb();
             if (!db)
@@ -224,7 +224,7 @@ function reviewRouter(_config) {
             const project = await Project.findOne({ _id: projectId });
             if (!project)
                 return res.status(404).json({ message: 'Project not found' });
-            if (!(0, auth_1.isProjectMember)(project, auth.userId))
+            if (!(0, auth_1.canEditProject)(project, auth.userId))
                 return res.status(403).json({ message: 'Unauthorized' });
             const db = getDb();
             if (!db)

package/dist/middleware/routes/rights.js

@@ -42,7 +42,7 @@ function rightsRouter(_config) {
             const project = await Project.findOne({ _id: projectId });
             if (!project)
                 return res.status(404).json({ message: 'Project not found' });
-            if (!(0, auth_1.isProjectMember)(project, auth.userId))
+            if (!(0, auth_1.canEditProject)(project, auth.userId))
                 return res.status(403).json({ message: 'Unauthorized' });
             const db = getDb();
             if (!db)

package/dist/middleware/routes/storage.js

@@ -71,11 +71,14 @@ function storageRouter(config) {
     router.get('/upload-project-image-url/:id', async (req, res) => {
         try {
             const auth = req.auth;
-            if (auth.role !== 'admin' && auth.role !== 'editor')
-                return res.status(403).json({ message: 'Permission denied' });
             const projectId = req.params.id;
             if (!projectId)
                 return res.status(400).json({ message: 'Missing projectId' });
+            const project = await Project.findOne({ _id: projectId });
+            if (!project)
+                return res.status(404).json({ message: 'Project not found' });
+            if (!(0, auth_1.canEditProject)(project, auth.userId))
+                return res.status(403).json({ message: 'Permission denied' });
             const response = await (0, presign_1.getPresignedProjectImageUrl)(adapter, projectId);
             res.status(200).json({ ...response, message: 'Presigned URL generated successfully' });
         }
@@ -86,11 +89,14 @@ function storageRouter(config) {
     router.delete('/delete-project-image-url/:id', async (req, res) => {
         try {
             const auth = req.auth;
-            if (auth.role !== 'admin' && auth.role !== 'editor')
-                return res.status(403).json({ message: 'Permission denied' });
             const projectId = req.params.id;
             if (!projectId)
                 return res.status(400).json({ message: 'Missing projectId' });
+            const project = await Project.findOne({ _id: projectId });
+            if (!project)
+                return res.status(404).json({ message: 'Project not found' });
+            if (!(0, auth_1.canEditProject)(project, auth.userId))
+                return res.status(403).json({ message: 'Permission denied' });
             await (0, file_1.deleteProjectImage)(adapter, projectId);
             const updated = await Project.update({ _id: projectId }, { image: '' });
             res.status(201).json({ ...updated, message: 'Image deleted successfully' });
@@ -119,7 +125,7 @@ function storageRouter(config) {
             const project = await Project.findOne({ _id: projectId });
             if (!project)
                 return res.status(404).json({ message: 'Project not found' });
-            if (!(0, auth_1.isProjectMember)(project, auth.userId))
+            if (!(0, auth_1.canEditProject)(project, auth.userId))
                 return res.status(403).json({ message: 'Unauthorized access' });
             if (!adapter.getPresignedUploadUrl) {
                 return res.status(501).json({ message: 'Storage adapter does not support presigned uploads' });
@@ -192,7 +198,7 @@ function storageRouter(config) {
             const project = await Project.findOne({ _id: projectId });
             if (!project)
                 return res.status(404).json({ message: 'Project not found' });
-            if (!(0, auth_1.isProjectMember)(project, auth.userId))
+            if (!(0, auth_1.canEditProject)(project, auth.userId))
                 return res.status(403).json({ message: 'Unauthorized access' });
             const collection = getRawFilesCollection();
             if (!collection)
@@ -213,7 +219,7 @@ function storageRouter(config) {
             const project = await Project.findOne({ _id: projectId });
             if (!project)
                 return res.status(404).json({ message: 'Project not found' });
-            if (!(0, auth_1.isProjectMember)(project, auth.userId))
+            if (!(0, auth_1.canEditProject)(project, auth.userId))
                 return res.status(403).json({ message: 'Unauthorized access' });
             const collection = getRawFilesCollection();
             if (!collection)
@@ -291,7 +297,7 @@ function storageRouter(config) {
             const project = await Project.findOne({ _id: projectId });
             if (!project)
                 return res.status(404).json({ message: 'Project not found' });
-            if (!(0, auth_1.isProjectMember)(project, auth.userId))
+            if (!(0, auth_1.canEditProject)(project, auth.userId))
                 return res.status(403).json({ message: 'Unauthorized access' });
             const connAdapter = await resolveConnAdapter(connId, project, auth);
             if ('error' in connAdapter)
@@ -419,7 +425,7 @@ function storageRouter(config) {
             const project = await Project.findOne({ _id: projectId });
             if (!project)
                 return res.status(404).json({ message: 'Project not found' });
-            if (!(0, auth_1.isProjectMember)(project, auth.userId))
+            if (!(0, auth_1.canEditProject)(project, auth.userId))
                 return res.status(403).json({ message: 'Unauthorized access' });
             const collection = getRawFilesCollection();
             if (!collection)
@@ -440,7 +446,7 @@ function storageRouter(config) {
             const project = await Project.findOne({ _id: projectId });
             if (!project)
                 return res.status(404).json({ message: 'Project not found' });
-            if (!(0, auth_1.isProjectMember)(project, auth.userId))
+            if (!(0, auth_1.canEditProject)(project, auth.userId))
                 return res.status(403).json({ message: 'Unauthorized access' });
             const connAdapter = await resolveConnAdapter(connId, project, auth);
             if ('error' in connAdapter)
@@ -539,7 +545,7 @@ function storageRouter(config) {
             const project = await Project.findOne({ _id: projectId });
             if (!project)
                 return res.status(404).json({ message: 'Project not found' });
-            if (!(0, auth_1.isProjectMember)(project, auth.userId))
+            if (!(0, auth_1.canEditProject)(project, auth.userId))
                 return res.status(403).json({ message: 'Unauthorized access' });
             const conn = findStorageConn(project, connId);
             const isBuiltin = conn?.source === 'builtin';
@@ -590,7 +596,7 @@ function storageRouter(config) {
             const project = await Project.findOne({ _id: projectId });
             if (!project)
                 return res.status(404).json({ message: 'Project not found' });
-            if (!(0, auth_1.isProjectMember)(project, auth.userId))
+            if (!(0, auth_1.canEditProject)(project, auth.userId))
                 return res.status(403).json({ message: 'Unauthorized access' });
             const collection = getRawFoldersCollection();
             if (!collection)
@@ -624,7 +630,7 @@ function storageRouter(config) {
             const project = await Project.findOne({ _id: projectId });
             if (!project)
                 return res.status(404).json({ message: 'Project not found' });
-            if (!(0, auth_1.isProjectMember)(project, auth.userId))
+            if (!(0, auth_1.canEditProject)(project, auth.userId))
                 return res.status(403).json({ message: 'Unauthorized access' });
             const collection = getRawFoldersCollection();
             if (!collection)
@@ -654,7 +660,7 @@ function storageRouter(config) {
             const project = await Project.findOne({ _id: projectId });
             if (!project)
                 return res.status(404).json({ message: 'Project not found' });
-            if (!(0, auth_1.isProjectMember)(project, auth.userId))
+            if (!(0, auth_1.canEditProject)(project, auth.userId))
                 return res.status(403).json({ message: 'Unauthorized access' });
             const foldersCollection = getRawFoldersCollection();
             if (!foldersCollection)
@@ -682,7 +688,7 @@ function storageRouter(config) {
             const project = await Project.findOne({ _id: projectId });
             if (!project)
                 return res.status(404).json({ message: 'Project not found' });
-            if (!(0, auth_1.isProjectMember)(project, auth.userId))
+            if (!(0, auth_1.canEditProject)(project, auth.userId))
                 return res.status(403).json({ message: 'Unauthorized access' });
             if (folderId != null) {
                 const foldersCollection = getRawFoldersCollection();