streamby-core 0.32.1 → 0.34.0

package/dist/middleware/routes/storageConnection.js

@@ -40,9 +40,6 @@ function storageConnectionRouter(config) {
     router.post('/projects/:id/connections/storage', async (req, res) => {
         try {
             const auth = req.auth;
-            if (auth.role !== 'admin' && auth.role !== 'editor') {
-                return res.status(403).json({ message: 'Permission denied' });
-            }
             const { name, type, credential, integrationId, description } = req.body;
             if (!name || !type) {
                 return res.status(400).json({ message: 'name and type are required' });
@@ -59,7 +56,7 @@ function storageConnectionRouter(config) {
             const project = await Project.findOne({ _id: req.params.id });
             if (!project)
                 return res.status(404).json({ message: 'Project not found' });
-            if (!(0, auth_1.isProjectMember)(project, auth.userId))
+            if (!(0, auth_1.canEditProject)(project, auth.userId))
                 return res.status(403).json({ message: 'Unauthorized project access' });
             let encryptedCredential;
             if (integrationId) {
@@ -98,13 +95,10 @@ function storageConnectionRouter(config) {
         try {
             const { connId } = req.params;
             const auth = req.auth;
-            if (auth.role !== 'admin' && auth.role !== 'editor') {
-                return res.status(403).json({ message: 'Permission denied' });
-            }
             const project = await Project.findOne({ _id: req.params.id });
             if (!project)
                 return res.status(404).json({ message: 'Project not found' });
-            if (!(0, auth_1.isProjectMember)(project, auth.userId))
+            if (!(0, auth_1.canEditProject)(project, auth.userId))
                 return res.status(403).json({ message: 'Unauthorized project access' });
             const conn = project.storageConnections?.find((c) => c.id === connId);
             if (!conn)

package/dist/middleware/routes/userIntegration.js

@@ -5,9 +5,10 @@ const express_1 = require("express");
 const builtinAccess_1 = require("../../utils/builtinAccess");
 const userIntegration_1 = require("../../services/userIntegration");
 const sanitize_1 = require("../../utils/sanitize");
-const VALID_KINDS = ['database', 'storage'];
+const VALID_KINDS = ['database', 'storage', 'service'];
 const VALID_DB_PROVIDERS = ['postgresql', 'mongodb'];
 const VALID_STORAGE_PROVIDERS = ['s3', 'gcs', 'r2', 'azure'];
+const VALID_SERVICE_PROVIDERS = ['claude', 'jira', 'google'];
 function userIntegrationRouter(config) {
     const router = (0, express_1.Router)();
     // ─── Combined pool: account integrations + built-ins the user can access ─────
@@ -42,10 +43,18 @@ function userIntegrationRouter(config) {
             if (!kind || !VALID_KINDS.includes(kind)) {
                 return res.status(400).json({ message: `kind must be one of: ${VALID_KINDS.join(', ')}` });
             }
-            const validProviders = kind === 'database' ? VALID_DB_PROVIDERS : VALID_STORAGE_PROVIDERS;
+            const validProviders = kind === 'database' ? VALID_DB_PROVIDERS : kind === 'storage' ? VALID_STORAGE_PROVIDERS : VALID_SERVICE_PROVIDERS;
             if (!provider || !validProviders.includes(provider)) {
                 return res.status(400).json({ message: `provider must be one of: ${validProviders.join(', ')}` });
             }
+            // jira/google have no upfront credential to supply — they can only be linked via the
+            // OAuth consent flow, which mints the token itself. Claude (API key) goes through the
+            // normal path below unchanged.
+            if (kind === 'service' && (0, userIntegration_1.isOAuthServiceProvider)(provider)) {
+                return res.status(400).json({
+                    message: `Provider '${provider}' requires OAuth — start at GET /user/integrations/oauth/${provider}/start instead of POST /user/integrations`,
+                });
+            }
             if (!name)
                 return res.status(400).json({ message: 'name is required' });
             if (credential === undefined || credential === null) {
@@ -57,6 +66,9 @@ function userIntegrationRouter(config) {
             res.status(201).json({ data: (0, sanitize_1.sanitizeUserIntegration)(integration) });
         }
         catch (err) {
+            if (err instanceof userIntegration_1.InvalidCredentialUpdateError) {
+                return res.status(400).json({ message: err.message });
+            }
             res.status(500).json({ message: 'Failed to create integration', details: err.message });
         }
     });
@@ -73,6 +85,9 @@ function userIntegrationRouter(config) {
             res.json({ data: (0, sanitize_1.sanitizeUserIntegration)(updated) });
         }
         catch (err) {
+            if (err instanceof userIntegration_1.InvalidCredentialUpdateError) {
+                return res.status(400).json({ message: err.message });
+            }
             res.status(500).json({ message: 'Failed to update integration', details: err.message });
         }
     });

package/dist/middleware/routes/workflow.js

@@ -38,7 +38,7 @@ function workflowRouter(config) {
                 return res.status(401).json({ message: 'Unauthorized' });
             const projectId = req.params.id;
             const project = await Project.findOne({ _id: projectId });
-            if (!project || !(0, auth_1.isProjectMember)(project, auth.userId)) {
+            if (!project || !(0, auth_1.canEditProject)(project, auth.userId)) {
                 return res.status(403).json({ message: 'Unauthorized project access' });
             }
             const now = new Date();

package/dist/services/auth.d.ts

@@ -1,5 +1,4 @@
-import { Auth } from '../types';
 import { Request, Response, NextFunction } from 'express';
 import { StreamByConfig } from '../types';
+export declare const isPublicRoute: (method: string, path: string) => boolean;
 export declare const authenticate: (config: StreamByConfig) => (req: Request, res: Response, next: NextFunction) => Promise<void | Response<any, Record<string, any>>>;
-export declare function checkRole(auth: Auth, required: 'viewer' | 'editor' | 'admin'): void;

package/dist/services/auth.js

@@ -1,9 +1,15 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.authenticate = void 0;
-exports.checkRole = checkRole;
+exports.authenticate = exports.isPublicRoute = void 0;
+// The one route open without a session: a project's public export, read
+// (GET /:projectId/export/:exportName, see routes/export). Exactly that path -- not any path
+// that has an "export" segment somewhere.
+const PUBLIC_EXPORT = /^\/[^/]+\/export\/[^/]+\/?$/;
+const READ_METHODS = ['GET', 'HEAD', 'OPTIONS'];
+const isPublicRoute = (method, path) => READ_METHODS.includes(method.toUpperCase()) && PUBLIC_EXPORT.test(path);
+exports.isPublicRoute = isPublicRoute;
 const authenticate = (config) => async (req, res, next) => {
-    if (req.path.includes('/export/')) {
+    if ((0, exports.isPublicRoute)(req.method, req.path)) {
         return next();
     }
     try {
@@ -20,11 +26,3 @@ const authenticate = (config) => async (req, res, next) => {
     }
 };
 exports.authenticate = authenticate;
-function checkRole(auth, required) {
-    const roles = ['viewer', 'editor', 'admin'];
-    const userIdx = roles.indexOf(auth.role);
-    const requiredIdx = roles.indexOf(required);
-    if (userIdx < requiredIdx) {
-        throw new Error(`Insufficient role: requires ${required}, found ${auth.role}`);
-    }
-}

package/dist/services/connectionResolver.js

@@ -52,10 +52,10 @@ async function resolveDbConnectionClient(project, connId, config, auth) {
     if (conn.source === 'integration') {
         if (!conn.integrationId)
             return { error: 'Connection is missing its integrationId', status: 500 };
-        const credential = await (0, userIntegration_1.getDecryptedIntegrationCredentialById)(conn.integrationId);
-        if (!credential)
+        const resolved = await (0, userIntegration_1.getDecryptedIntegrationCredentialById)(conn.integrationId, config, project);
+        if (!resolved)
             return { error: 'Integration not found', status: 400 };
-        connectionString = credential;
+        connectionString = resolved.credential;
     }
     else {
         if (!(0, encryption_1.isEncryptionKeySet)())
@@ -109,10 +109,10 @@ async function resolveStorageAdapter(project, connId, config, auth) {
         if (!conn.integrationId)
             return { error: 'Connection is missing its integrationId', status: 500 };
         try {
-            const s3Config = await (0, userIntegration_1.getDecryptedIntegrationCredentialById)(conn.integrationId);
-            if (!s3Config)
+            const resolved = await (0, userIntegration_1.getDecryptedIntegrationCredentialById)(conn.integrationId, config, project);
+            if (!resolved)
                 return { error: 'Integration not found', status: 400 };
-            return new s3_1.S3Adapter(s3Config);
+            return new s3_1.S3Adapter(resolved.credential);
         }
         catch (e) {
             return { error: `Failed to initialize storage adapter: ${e.message}`, status: 500 };

package/dist/services/executor.d.ts

@@ -4,4 +4,7 @@ export declare class NodeExecutionError extends Error {
     nodeType: string;
     constructor(nodeId: string, nodeType: string, message: string);
 }
-export declare function executeExport(nodeSchema: NodeSchema, project: any, config: StreamByConfig): Promise<any>;
+export interface ExecuteExportOptions {
+    public?: boolean;
+}
+export declare function executeExport(nodeSchema: NodeSchema, project: any, config: StreamByConfig, { public: isPublic }?: ExecuteExportOptions): Promise<any>;

package/dist/services/executor.js

@@ -5,11 +5,14 @@ exports.executeExport = executeExport;
 const encryption_1 = require("../utils/encryption");
 const dbConnection_1 = require("./dbConnection");
 const connectionResolver_1 = require("./connectionResolver");
+const userIntegration_1 = require("./userIntegration");
+const oauthClient_1 = require("./oauthClient");
 const jobQueue_1 = require("./jobQueue");
 const mediaProcessor_1 = require("./mediaProcessor");
 const vfxProcessor_1 = require("./vfxProcessor");
 const aiProcessor_1 = require("./aiProcessor");
 const storage_1 = require("../providers/storage");
+const serviceEndpoints_1 = require("../utils/serviceEndpoints");
 function applyFilterConfig(payload, config) {
     const isArr = Array.isArray(payload);
     let r = isArr ? [...payload] : payload;
@@ -85,13 +88,19 @@ class NodeExecutionError extends Error {
     }
 }
 exports.NodeExecutionError = NodeExecutionError;
-// Export execution is public (gated by allowedOrigin, not user identity — see
-// export.ts:339) — there is no real Auth to pass through. This sentinel satisfies
-// resolveDbConnectionClient's signature without adding a gate that never existed;
-// canUseBuiltin gating is for connection *management* by a user, not for serving an
-// already-published export.
+// Export execution has no user behind it (a public export is read without a session -- see
+// routes/export) -- there is no real Auth to pass through. This sentinel satisfies
+// resolveDbConnectionClient's signature; canUseBuiltin gating is for connection *management*
+// by a user, not for serving an already-published export.
 const SYSTEM_AUTH = { userId: 'system', username: 'system', role: 'admin' };
-async function executeExport(nodeSchema, project, config) {
+// Nodes that start a job (transcoding, rendering, generating...): work, and cost, on the
+// server or a provider, for whoever asks.
+const JOB_NODES = new Set([
+    'transcodeNode', 'captionNode', 'thumbnailNode', 'ingestNode', 'renderJobNode', 'formatConvertNode',
+    'lodNode', 'transcriptionNode', 'upscaleNode', 'proceduralAssetNode',
+]);
+const notPublic = (node) => new NodeExecutionError(node.id, node.type, `Node '${node.id}' (${node.type}) can't run in a public export.`);
+async function executeExport(nodeSchema, project, config, { public: isPublic = true } = {}) {
     const nodes = nodeSchema.nodes;
     const edges = nodeSchema.edges;
     // 1. Data layer — nodes connected to streamby in-bottom
@@ -117,6 +126,8 @@ async function executeExport(nodeSchema, project, config) {
             if (!connectionId) {
                 throw new NodeExecutionError(node.id, node.type, `Node '${node.id}' (${node.type}) has no database connection — connect one on the node.`);
             }
+            if (isPublic && (0, connectionResolver_1.findDbConnection)(project, connectionId)?.source === 'integration')
+                throw notPublic(node);
             const recordId = node.data?.recordId;
             const projectIdentifier = project._id?.toString() ?? project.id;
             const resolved = await (0, connectionResolver_1.resolveDbConnectionClient)(project, connectionId, config, SYSTEM_AUTH);
@@ -147,6 +158,50 @@ async function executeExport(nodeSchema, project, config) {
                 throw new Error(`Connection fetch failed: ${response.statusText}`);
             dataResults.push(await response.json());
         }
+        else if (node.type === 'integrationConnectionNode') {
+            // Generic action over a project-level IntegrationConnection (Claude/Jira/Google) — the
+            // node's data carries the endpoint/method/body to invoke, same shape family as
+            // connectionNode's apiUrl/method, but the auth header comes from the resolved
+            // account-level integration credential instead of a static per-connection secret.
+            // Diverges from connectionNode's silent-skip: a missing connection/credential throws
+            // NodeExecutionError (matching dataSourceNode/ingestNode's intentional pattern), since
+            // a silently-skipped service action would produce a workflow that "succeeds" while
+            // quietly missing the one thing the node exists to do.
+            if (isPublic)
+                throw notPublic(node);
+            const connectionId = node.data?.connectionId;
+            if (!connectionId) {
+                throw new NodeExecutionError(node.id, node.type, `Node '${node.id}' (${node.type}) has no integration connection — connect one on the node.`);
+            }
+            const connection = (project.integrationConnections ?? []).find((c) => c.id === connectionId);
+            if (!connection) {
+                throw new NodeExecutionError(node.id, node.type, `Node '${node.id}' (${node.type}): integration connection not found on this project.`);
+            }
+            const endpoint = node.data?.endpoint;
+            if (!endpoint) {
+                throw new NodeExecutionError(node.id, node.type, `Node '${node.id}' (${node.type}) has no endpoint configured.`);
+            }
+            // Checked before the credential is even resolved: it's only ever sent to its provider.
+            if (!(0, serviceEndpoints_1.isServiceEndpoint)(connection.provider, endpoint)) {
+                throw new NodeExecutionError(node.id, node.type, `Node '${node.id}' (${node.type}): ${endpoint} is not a ${connection.provider} endpoint.`);
+            }
+            const resolved = await (0, userIntegration_1.getDecryptedIntegrationCredentialById)(connection.integrationId, config, project);
+            if (!resolved) {
+                throw new NodeExecutionError(node.id, node.type, `Node '${node.id}' (${node.type}): integration credential could not be resolved — it may have been disconnected.`);
+            }
+            const method = node.data?.method ?? 'GET';
+            const headers = {
+                'Content-Type': 'application/json',
+                ...(0, oauthClient_1.buildServiceAuthHeaders)(connection.provider, resolved.credential),
+            };
+            const body = node.data?.body ? JSON.stringify(node.data.body) : undefined;
+            // A redirect would carry the credential's headers on to wherever it points.
+            const response = await fetch(endpoint, { method, headers, body, redirect: 'error' });
+            if (!response.ok) {
+                throw new NodeExecutionError(node.id, node.type, `Node '${node.id}' (${node.type}): integration action failed (${response.statusText}).`);
+            }
+            dataResults.push(await response.json());
+        }
     }
     let payload = dataResults.length === 1 ? dataResults[0] : dataResults;
     // 2. Process layer — chain from streamby out-top → processNode in-process → out-process → ...
@@ -158,6 +213,8 @@ async function executeExport(nodeSchema, project, config) {
     while (processNode) {
         const nodeData = processNode.data ?? {};
         const fileId = nodeData.fileId;
+        if (isPublic && JOB_NODES.has(processNode.type))
+            throw notPublic(processNode);
         if (processNode.type === 'transcodeNode' && fileId) {
             const job = (0, jobQueue_1.createJob)('transcode', systemUserId, projectId, nodeData);
             setImmediate(() => (0, mediaProcessor_1.runTranscodeJob)(job.jobId, fileId, projectId, {

package/dist/services/oauthClient.d.ts

@@ -0,0 +1,10 @@
+import { OAuthClientConfig, ServiceProviderType } from '../types';
+export interface ExchangedTokens {
+    accessToken: string;
+    refreshToken: string;
+    expiresAt: Date;
+}
+export declare function buildAuthorizeUrl(provider: 'jira' | 'google', config: OAuthClientConfig, state: string): string;
+export declare function exchangeCodeForTokens(provider: 'jira' | 'google', config: OAuthClientConfig, code: string): Promise<ExchangedTokens>;
+export declare function refreshTokens(provider: 'jira' | 'google', config: OAuthClientConfig, refreshToken: string): Promise<ExchangedTokens>;
+export declare function buildServiceAuthHeaders(provider: ServiceProviderType, credential: string): Record<string, string>;

package/dist/services/oauthClient.js

@@ -0,0 +1,134 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.buildAuthorizeUrl = buildAuthorizeUrl;
+exports.exchangeCodeForTokens = exchangeCodeForTokens;
+exports.refreshTokens = refreshTokens;
+exports.buildServiceAuthHeaders = buildServiceAuthHeaders;
+// TODO: adjust once a real Google OAuth app is registered — see TCORE-73 plan §4.
+const GOOGLE_OAUTH_SCOPES = 'openid email profile';
+// MUST include offline_access to receive a refresh token from Atlassian.
+const JIRA_OAUTH_SCOPES = 'offline_access read:jira-user read:jira-work';
+function buildAuthorizeUrl(provider, config, state) {
+    if (provider === 'google') {
+        const params = new URLSearchParams({
+            client_id: config.clientId,
+            redirect_uri: config.redirectUri,
+            response_type: 'code',
+            scope: GOOGLE_OAUTH_SCOPES,
+            access_type: 'offline',
+            prompt: 'consent',
+            state,
+        });
+        return `https://accounts.google.com/o/oauth2/v2/auth?${params.toString()}`;
+    }
+    const params = new URLSearchParams({
+        audience: 'api.atlassian.com',
+        client_id: config.clientId,
+        scope: JIRA_OAUTH_SCOPES,
+        redirect_uri: config.redirectUri,
+        state,
+        response_type: 'code',
+        prompt: 'consent',
+    });
+    return `https://auth.atlassian.com/authorize?${params.toString()}`;
+}
+async function parseTokenResponse(response) {
+    if (!response.ok) {
+        const body = await response.text().catch(() => '');
+        throw new Error(`Token endpoint returned ${response.status}: ${body}`);
+    }
+    return response.json();
+}
+async function exchangeCodeForTokens(provider, config, code) {
+    if (provider === 'google') {
+        const body = new URLSearchParams({
+            code,
+            client_id: config.clientId,
+            client_secret: config.clientSecret,
+            redirect_uri: config.redirectUri,
+            grant_type: 'authorization_code',
+        });
+        const response = await fetch('https://oauth2.googleapis.com/token', {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+            body: body.toString(),
+        });
+        const json = await parseTokenResponse(response);
+        if (!json.refresh_token)
+            throw new Error('Google did not return a refresh_token — retry with access_type=offline&prompt=consent');
+        return {
+            accessToken: json.access_token,
+            refreshToken: json.refresh_token,
+            expiresAt: new Date(Date.now() + json.expires_in * 1000),
+        };
+    }
+    const response = await fetch('https://auth.atlassian.com/oauth/token', {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({
+            grant_type: 'authorization_code',
+            client_id: config.clientId,
+            client_secret: config.clientSecret,
+            code,
+            redirect_uri: config.redirectUri,
+        }),
+    });
+    const json = await parseTokenResponse(response);
+    if (!json.refresh_token)
+        throw new Error('Atlassian did not return a refresh_token — ensure the offline_access scope is requested');
+    return {
+        accessToken: json.access_token,
+        refreshToken: json.refresh_token,
+        expiresAt: new Date(Date.now() + json.expires_in * 1000),
+    };
+}
+// Google's refresh response usually omits refresh_token (the original stays valid);
+// Atlassian ROTATES the refresh token on every use (a new one is returned every time).
+// Callers must preserve the existing refreshToken when this returns undefined for it.
+async function refreshTokens(provider, config, refreshToken) {
+    if (provider === 'google') {
+        const body = new URLSearchParams({
+            refresh_token: refreshToken,
+            client_id: config.clientId,
+            client_secret: config.clientSecret,
+            grant_type: 'refresh_token',
+        });
+        const response = await fetch('https://oauth2.googleapis.com/token', {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+            body: body.toString(),
+        });
+        const json = await parseTokenResponse(response);
+        return {
+            accessToken: json.access_token,
+            refreshToken: json.refresh_token ?? refreshToken,
+            expiresAt: new Date(Date.now() + json.expires_in * 1000),
+        };
+    }
+    const response = await fetch('https://auth.atlassian.com/oauth/token', {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({
+            grant_type: 'refresh_token',
+            client_id: config.clientId,
+            client_secret: config.clientSecret,
+            refresh_token: refreshToken,
+        }),
+    });
+    const json = await parseTokenResponse(response);
+    if (!json.refresh_token)
+        throw new Error('Atlassian refresh response did not include a rotated refresh_token');
+    return {
+        accessToken: json.access_token,
+        refreshToken: json.refresh_token,
+        expiresAt: new Date(Date.now() + json.expires_in * 1000),
+    };
+}
+// Claude uses a dedicated x-api-key header (plus anthropic-version), not Authorization:
+// Bearer — Jira/Google's OAuth access tokens use the standard Bearer scheme.
+function buildServiceAuthHeaders(provider, credential) {
+    if (provider === 'claude') {
+        return { 'x-api-key': credential, 'anthropic-version': '2023-06-01' };
+    }
+    return { Authorization: `Bearer ${credential}` };
+}

package/dist/services/projectIntegration.d.ts

@@ -1,10 +1,13 @@
-import { Auth, DbConnection, StorageConnection, StreamByConfig } from '../types';
+import { Auth, DbConnection, StorageConnection, IntegrationConnection, StreamByConfig } from '../types';
 type ClassifyResult = {
     kind: 'database';
     connection: DbConnection;
 } | {
     kind: 'storage';
     connection: StorageConnection;
+} | {
+    kind: 'service';
+    connection: IntegrationConnection;
 } | {
     error: string;
     status: number;

package/dist/services/projectIntegration.js

@@ -53,11 +53,21 @@ async function classifyIntegrationId(id, auth, config, projectId) {
             },
         };
     }
+    if (integration.kind === 'storage') {
+        return {
+            kind: 'storage',
+            connection: {
+                id: crypto_1.default.randomUUID(), name: integration.name, type: integration.provider,
+                projectId, createdAt: now, isBuiltin: false, integrationId: id, source: 'integration',
+            },
+        };
+    }
+    // kind === 'service' — the only remaining IntegrationKind value.
     return {
-        kind: 'storage',
+        kind: 'service',
         connection: {
-            id: crypto_1.default.randomUUID(), name: integration.name, type: integration.provider,
-            projectId, createdAt: now, isBuiltin: false, integrationId: id, source: 'integration',
+            id: crypto_1.default.randomUUID(), name: integration.name, provider: integration.provider,
+            projectId, createdAt: now, integrationId: id, source: 'integration',
         },
     };
 }

package/dist/services/reencryptCredentials.d.ts

@@ -0,0 +1,5 @@
+export interface ReencryptResult {
+    updated: number;
+    failed: number;
+}
+export declare function reencryptStoredCredentials(): Promise<ReencryptResult>;

package/dist/services/reencryptCredentials.js

@@ -0,0 +1,74 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.reencryptStoredCredentials = reencryptStoredCredentials;
+const manager_1 = require("../models/manager");
+const encryption_1 = require("../utils/encryption");
+// Brings every stored credential to the current encryption (AES-256-GCM with the current key,
+// see utils/encryption): those encrypted before (CBC, or GCM with a previous key) are
+// re-encrypted, and the distribution and render farm credentials, stored as they were sent,
+// are encrypted. Non-destructive: a value is replaced only by its own re-encryption; one that
+// can't be decrypted is left as it is (and counted). Runs at startup; once everything is
+// current, it changes nothing.
+// A project's lists of connections with a credential each, encrypted before.
+const ENCRYPTED_LISTS = ['connections', 'dbConnections', 'storageConnections', 'exports'];
+// The ones whose credentials were stored as sent, never encrypted.
+const PLAIN_LISTS = ['distributionConnections', 'renderFarmConnections'];
+const INTEGRATION_FIELDS = ['encryptedCredential', 'encryptedAccessToken', 'encryptedRefreshToken'];
+async function reencryptStoredCredentials() {
+    const result = { updated: 0, failed: 0 };
+    if (!(0, encryption_1.isEncryptionKeySet)())
+        return result;
+    // The current encryption of a stored value, or undefined when it's current already or
+    // can't be read (left as it is).
+    const upgrade = (value, storedPlain) => {
+        if (typeof value !== 'string' || !value || (0, encryption_1.isCurrentEncryption)(value))
+            return undefined;
+        if (storedPlain && !(0, encryption_1.isVersionedEncryption)(value))
+            return (0, encryption_1.encrypt)(value);
+        try {
+            return (0, encryption_1.encrypt)((0, encryption_1.decrypt)(value));
+        }
+        catch {
+            result.failed++;
+            return undefined;
+        }
+    };
+    const Project = (0, manager_1.getModel)('projects');
+    for (const project of (await Project.find({}))) {
+        const changes = {};
+        for (const list of [...ENCRYPTED_LISTS, ...PLAIN_LISTS]) {
+            const entries = project[list];
+            if (!Array.isArray(entries))
+                continue;
+            const storedPlain = PLAIN_LISTS.includes(list);
+            let changed = false;
+            const next = entries.map((entry) => {
+                const upgraded = upgrade(entry?.encryptedCredential, storedPlain);
+                if (upgraded === undefined)
+                    return entry;
+                changed = true;
+                return { ...entry, encryptedCredential: upgraded };
+            });
+            if (changed)
+                changes[list] = next;
+        }
+        if (Object.keys(changes).length) {
+            await Project.update({ _id: project._id ?? project.id }, changes);
+            result.updated++;
+        }
+    }
+    const UserIntegration = (0, manager_1.getModel)('user_integrations');
+    for (const integration of (await UserIntegration.find({}))) {
+        const changes = {};
+        for (const field of INTEGRATION_FIELDS) {
+            const upgraded = upgrade(integration[field], false);
+            if (upgraded !== undefined)
+                changes[field] = upgraded;
+        }
+        if (Object.keys(changes).length) {
+            await UserIntegration.update({ id: integration.id }, changes);
+            result.updated++;
+        }
+    }
+    return result;
+}

package/dist/services/userIntegration.d.ts

@@ -1,4 +1,18 @@
-import { IntegrationKind, UserIntegration } from '../types';
+import { IntegrationKind, ProjectInfo, ServiceProviderType, StreamByConfig, UserIntegration } from '../types';
+export declare function isOAuthServiceProvider(provider: string): boolean;
+export declare class OAuthRefreshError extends Error {
+    provider: string;
+    integrationId: string;
+    constructor(provider: string, integrationId: string, message: string);
+}
+export declare class InvalidCredentialUpdateError extends Error {
+    constructor(message: string);
+}
+export interface OAuthTokenSet {
+    accessToken: string;
+    refreshToken: string;
+    expiresAt: Date;
+}
 export declare function listUserIntegrations(userId: string): Promise<UserIntegration[]>;
 export declare function createUserIntegration(userId: string, input: {
     kind: IntegrationKind;
@@ -7,11 +21,17 @@ export declare function createUserIntegration(userId: string, input: {
     description?: string;
     credentialValue: unknown;
 }): Promise<UserIntegration>;
+export declare function upsertOAuthServiceIntegration(userId: string, provider: Extract<ServiceProviderType, 'jira' | 'google'>, name: string, tokens: OAuthTokenSet): Promise<UserIntegration>;
 export declare function updateUserIntegration(userId: string, integrationId: string, updates: {
     name?: string;
     description?: string;
     credentialValue?: unknown;
 }): Promise<UserIntegration | null>;
 export declare function deleteUserIntegration(userId: string, integrationId: string): Promise<boolean>;
-export declare function getDecryptedIntegrationCredential(userId: string, integrationId: string): Promise<unknown | null>;
-export declare function getDecryptedIntegrationCredentialById(integrationId: string): Promise<unknown | null>;
+export interface ResolvedCredential {
+    provider: string;
+    kind: IntegrationKind;
+    credential: unknown;
+}
+export declare function getDecryptedIntegrationCredential(userId: string, integrationId: string, config: StreamByConfig): Promise<ResolvedCredential | null>;
+export declare function getDecryptedIntegrationCredentialById(integrationId: string, config: StreamByConfig, project: Pick<ProjectInfo, 'members'>): Promise<ResolvedCredential | null>;