streamby-core 0.32.1 → 0.34.0

package/dist/services/userIntegration.js

@@ -3,8 +3,11 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.InvalidCredentialUpdateError = exports.OAuthRefreshError = void 0;
+exports.isOAuthServiceProvider = isOAuthServiceProvider;
 exports.listUserIntegrations = listUserIntegrations;
 exports.createUserIntegration = createUserIntegration;
+exports.upsertOAuthServiceIntegration = upsertOAuthServiceIntegration;
 exports.updateUserIntegration = updateUserIntegration;
 exports.deleteUserIntegration = deleteUserIntegration;
 exports.getDecryptedIntegrationCredential = getDecryptedIntegrationCredential;
@@ -12,9 +15,55 @@ exports.getDecryptedIntegrationCredentialById = getDecryptedIntegrationCredentia
 const crypto_1 = __importDefault(require("crypto"));
 const manager_1 = require("../models/manager");
 const encryption_1 = require("../utils/encryption");
+const auth_1 = require("../utils/auth");
+const oauthClient_1 = require("./oauthClient");
+const OAUTH_SERVICE_PROVIDERS = new Set(['jira', 'google']);
+function isOAuthServiceProvider(provider) {
+    return OAUTH_SERVICE_PROVIDERS.has(provider);
+}
+// Refresh if the token expires within this window — a small buffer against clock skew and
+// request latency so a caller never receives a token that expires mid-flight.
+const REFRESH_SKEW_MS = 60000;
+class OAuthRefreshError extends Error {
+    constructor(provider, integrationId, message) {
+        super(message);
+        this.provider = provider;
+        this.integrationId = integrationId;
+        this.name = 'OAuthRefreshError';
+    }
+}
+exports.OAuthRefreshError = OAuthRefreshError;
+// Thrown when a client tries to set/overwrite the credential of an OAuth-backed (jira/
+// google) integration directly — those can only be linked/relinked via the OAuth flow.
+class InvalidCredentialUpdateError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'InvalidCredentialUpdateError';
+    }
+}
+exports.InvalidCredentialUpdateError = InvalidCredentialUpdateError;
 function encryptCredential(kind, value) {
     return kind === 'storage' ? (0, encryption_1.encrypt)(JSON.stringify(value)) : (0, encryption_1.encrypt)(String(value));
 }
+// OAuth tokens never go through encryptCredential/decryptIntegration (those stay unchanged,
+// used only for database/storage/claude's single encryptedCredential field) — each token is
+// encrypted independently via the existing single-string encrypt()/decrypt() primitives.
+function encryptOAuthTokens(tokens) {
+    return {
+        encryptedAccessToken: (0, encryption_1.encrypt)(tokens.accessToken),
+        encryptedRefreshToken: (0, encryption_1.encrypt)(tokens.refreshToken),
+        tokenExpiresAt: tokens.expiresAt,
+    };
+}
+function decryptOAuthTokens(integration) {
+    if (!integration.encryptedAccessToken || !integration.encryptedRefreshToken || !integration.tokenExpiresAt)
+        return null;
+    return {
+        accessToken: (0, encryption_1.decrypt)(integration.encryptedAccessToken),
+        refreshToken: (0, encryption_1.decrypt)(integration.encryptedRefreshToken),
+        expiresAt: integration.tokenExpiresAt,
+    };
+}
 async function listUserIntegrations(userId) {
     const UserIntegrationModel = (0, manager_1.getModel)('user_integrations');
     return UserIntegrationModel.find({ userId });
@@ -23,6 +72,12 @@ async function createUserIntegration(userId, input) {
     if (!(0, encryption_1.isEncryptionKeySet)()) {
         throw new Error('Encryption key is not set. Cannot create integration.');
     }
+    // Defense in depth — the router rejects direct jira/google creation before this is ever
+    // called (see userIntegration.ts route's POST handler), but guard here too rather than
+    // silently mis-encrypting an OAuth provider's value into the wrong (single-string) field.
+    if (isOAuthServiceProvider(input.provider)) {
+        throw new InvalidCredentialUpdateError(`Provider '${input.provider}' requires OAuth — cannot be created with a direct credential.`);
+    }
     const UserIntegrationModel = (0, manager_1.getModel)('user_integrations');
     const now = new Date();
     const integration = {
@@ -38,6 +93,34 @@ async function createUserIntegration(userId, input) {
     };
     return UserIntegrationModel.create(integration);
 }
+// Creates or updates the OAuth-backed UserIntegration for (userId, provider) — called only
+// from the OAuth callback (oauth.ts), never from the generic CRUD router. Upserts rather
+// than always inserting, so a user re-consenting (e.g. after revoking access on the
+// provider's side) re-links the same integration instead of creating a duplicate.
+async function upsertOAuthServiceIntegration(userId, provider, name, tokens) {
+    if (!(0, encryption_1.isEncryptionKeySet)()) {
+        throw new Error('Encryption key is not set. Cannot store integration tokens.');
+    }
+    const UserIntegrationModel = (0, manager_1.getModel)('user_integrations');
+    const existing = await UserIntegrationModel.findOne({ userId, kind: 'service', provider });
+    const encryptedTokens = encryptOAuthTokens(tokens);
+    const now = new Date();
+    if (existing) {
+        const updated = await UserIntegrationModel.update({ id: existing.id, userId }, { ...encryptedTokens, updatedAt: now });
+        return updated ?? existing;
+    }
+    const integration = {
+        id: crypto_1.default.randomUUID(),
+        userId,
+        kind: 'service',
+        provider,
+        name,
+        ...encryptedTokens,
+        createdAt: now,
+        updatedAt: now,
+    };
+    return UserIntegrationModel.create(integration);
+}
 async function updateUserIntegration(userId, integrationId, updates) {
     const UserIntegrationModel = (0, manager_1.getModel)('user_integrations');
     const existing = await UserIntegrationModel.findOne({ id: integrationId, userId });
@@ -49,6 +132,9 @@ async function updateUserIntegration(userId, integrationId, updates) {
     if (updates.description !== undefined)
         $set.description = updates.description;
     if (updates.credentialValue !== undefined) {
+        if (existing.kind === 'service' && isOAuthServiceProvider(existing.provider)) {
+            throw new InvalidCredentialUpdateError('OAuth-backed integrations cannot have their credential set directly — reconnect via OAuth.');
+        }
         if (!(0, encryption_1.isEncryptionKeySet)()) {
             throw new Error('Encryption key is not set. Cannot update integration.');
         }
@@ -61,26 +147,63 @@ async function deleteUserIntegration(userId, integrationId) {
     const deletedCount = await UserIntegrationModel.delete({ id: integrationId, userId });
     return deletedCount > 0;
 }
-async function getDecryptedIntegrationCredential(userId, integrationId) {
+async function getDecryptedIntegrationCredential(userId, integrationId, config) {
     const UserIntegrationModel = (0, manager_1.getModel)('user_integrations');
     const integration = await UserIntegrationModel.findOne({ id: integrationId, userId });
-    return decryptIntegration(integration);
+    return resolveCredential(integration, config);
 }
 // Used when resolving a project connection's `integrationId` at connection-use time — the
 // project already validated ownership when the connection was created (see project.ts /
 // dbConnection.ts POST), so there's no userId to filter by here, only the integrationId
-// stored on the connection itself.
-async function getDecryptedIntegrationCredentialById(integrationId) {
+// stored on the connection itself. `config` is required (not just for OAuth's sake) so a
+// near-expiry jira/google token can be refreshed using the host-injected client
+// credentials in config.oauthProviders.
+// A member's own integration, used by a project it was connected to: it resolves only while its
+// owner is an active member of that project. A project its owner isn't in (never was, left it,
+// or a connection pointing at someone else's integration) never gets the credential.
+async function getDecryptedIntegrationCredentialById(integrationId, config, project) {
     const UserIntegrationModel = (0, manager_1.getModel)('user_integrations');
     const integration = await UserIntegrationModel.findOne({ id: integrationId });
-    return decryptIntegration(integration);
+    if (!integration || !(0, auth_1.activeMemberOf)(project, integration.userId))
+        return null;
+    return resolveCredential(integration, config);
 }
 async function decryptIntegration(integration) {
-    if (!integration)
-        return null;
     if (!(0, encryption_1.isEncryptionKeySet)()) {
         throw new Error('Encryption key is not set. Cannot decrypt integration credential.');
     }
     const decrypted = (0, encryption_1.decrypt)(integration.encryptedCredential);
     return integration.kind === 'storage' ? JSON.parse(decrypted) : decrypted;
 }
+// OAuth-backed integrations (jira/google) transparently refresh-and-repersist their access
+// token when it's expired or near-expiry, before returning it — callers never see a stale
+// token or have to think about refresh themselves.
+async function resolveCredential(integration, config) {
+    if (!integration)
+        return null;
+    if (integration.kind === 'service' && isOAuthServiceProvider(integration.provider)) {
+        const tokens = decryptOAuthTokens(integration);
+        if (!tokens) {
+            throw new OAuthRefreshError(integration.provider, integration.id, `The ${integration.provider} connection for this integration is incomplete — reconnect it from account integrations.`);
+        }
+        if (tokens.expiresAt.getTime() > Date.now() + REFRESH_SKEW_MS) {
+            return { provider: integration.provider, kind: integration.kind, credential: tokens.accessToken };
+        }
+        const provider = integration.provider;
+        const oauthConfig = config.oauthProviders?.[provider];
+        if (!oauthConfig) {
+            throw new OAuthRefreshError(integration.provider, integration.id, `OAuth for '${provider}' is not configured on this deployment — cannot refresh the token.`);
+        }
+        try {
+            const refreshed = await (0, oauthClient_1.refreshTokens)(provider, oauthConfig, tokens.refreshToken);
+            const encryptedTokens = encryptOAuthTokens(refreshed);
+            const UserIntegrationModel = (0, manager_1.getModel)('user_integrations');
+            await UserIntegrationModel.update({ id: integration.id }, { ...encryptedTokens, updatedAt: new Date() });
+            return { provider: integration.provider, kind: integration.kind, credential: refreshed.accessToken };
+        }
+        catch (e) {
+            throw new OAuthRefreshError(integration.provider, integration.id, `The ${integration.provider} connection for this integration has expired — reconnect it from account integrations.`);
+        }
+    }
+    return { provider: integration.provider, kind: integration.kind, credential: await decryptIntegration(integration) };
+}

package/dist/types/index.d.ts

@@ -63,6 +63,7 @@ export interface ProjectInfo {
         role: 'viewer' | 'editor' | 'admin';
         userId: string;
         archived?: boolean;
+        status?: 'active' | 'pending';
     }[];
     description?: string;
     exports?: {
@@ -76,6 +77,7 @@ export interface ProjectInfo {
     connections?: Connection[];
     dbConnections?: DbConnection[];
     storageConnections?: StorageConnection[];
+    integrationConnections?: IntegrationConnection[];
     pipelines?: PipelineRef[];
     builtinBackfilledAt?: Date;
     workflow?: Workflow;
@@ -117,16 +119,28 @@ export interface DatabaseCredential {
     connectionString?: string;
     main?: boolean;
 }
+export interface OAuthClientConfig {
+    clientId: string;
+    clientSecret: string;
+    redirectUri: string;
+    successRedirectUrl: string;
+    failureRedirectUrl: string;
+}
 export interface StreamByConfig {
     storageProviders: StorageProvider[];
     authProvider: AuthProvider;
     databases?: DatabaseCredential[];
     adapter?: StorageAdapter;
     encrypt?: string;
+    encryptPreviousKeys?: string[];
     websocket?: {
         server: WebSocketServer;
     };
     canUseBuiltin?: (auth: Auth, builtinId: string, kind: 'database' | 'storage') => boolean | Promise<boolean>;
+    oauthProviders?: {
+        jira?: OAuthClientConfig;
+        google?: OAuthClientConfig;
+    };
 }
 export interface Notification {
     _id?: string;
@@ -167,15 +181,29 @@ export interface DbConnection {
     integrationId?: string;
     source?: 'builtin' | 'integration' | 'manual';
 }
-export type IntegrationKind = 'database' | 'storage';
+export interface IntegrationConnection {
+    id: string;
+    name: string;
+    provider: ServiceProviderType;
+    projectId: string;
+    createdAt: Date;
+    description?: string;
+    integrationId: string;
+    source: 'integration';
+}
+export type IntegrationKind = 'database' | 'storage' | 'service';
+export type ServiceProviderType = 'claude' | 'jira' | 'google';
 export interface UserIntegration {
     id: string;
     userId: string;
     kind: IntegrationKind;
-    provider: ExternalDbType | StorageProviderType;
+    provider: ExternalDbType | StorageProviderType | ServiceProviderType;
     name: string;
     description?: string;
-    encryptedCredential: string;
+    encryptedCredential?: string;
+    encryptedAccessToken?: string;
+    encryptedRefreshToken?: string;
+    tokenExpiresAt?: Date;
     createdAt: Date;
     updatedAt: Date;
 }

package/dist/utils/auth.d.ts

@@ -1,2 +1,16 @@
 import { ProjectInfo } from '../types';
-export declare function isProjectMember(project: ProjectInfo, userId: string): boolean;
+type ProjectMembers = Pick<ProjectInfo, 'members'> | null | undefined;
+export declare function activeMemberOf(project: ProjectMembers, userId: string | undefined): {
+    role: "viewer" | "editor" | "admin";
+    userId: string;
+    archived?: boolean;
+    status?: "active" | "pending";
+} | undefined;
+export declare const projectRoleOf: (project: ProjectMembers, userId: string | undefined) => "viewer" | "editor" | "admin" | undefined;
+/** An active member, whatever their role: can see the project. */
+export declare const isProjectMember: (project: ProjectMembers, userId: string | undefined) => boolean;
+/** An editor or an admin of the project: can change it (its content, its connections). */
+export declare const canEditProject: (project: ProjectMembers, userId: string | undefined) => boolean;
+/** An admin of the project: can manage its members, and delete it. */
+export declare const isProjectAdmin: (project: ProjectMembers, userId: string | undefined) => boolean;
+export {};

package/dist/utils/auth.js

@@ -1,9 +1,24 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.isProjectMember = isProjectMember;
-function isProjectMember(project, userId) {
-    if (!project || !project.members) {
-        return false;
-    }
-    return project.members.some(member => member.userId === userId);
+exports.isProjectAdmin = exports.canEditProject = exports.isProjectMember = exports.projectRoleOf = void 0;
+exports.activeMemberOf = activeMemberOf;
+// A project's member who's in it now: invited and accepted (status 'active'). (A member's
+// `archived` is only that member having archived the project in their own list.)
+function activeMemberOf(project, userId) {
+    if (!project?.members || !userId)
+        return undefined;
+    return project.members.find(member => member.userId?.toString() === userId && member.status === 'active');
 }
+// What a user can do in a project is their role in it, as an active member -- never their
+// role on the platform (Auth.role): a pending invitation is no access yet.
+const projectRoleOf = (project, userId) => activeMemberOf(project, userId)?.role;
+exports.projectRoleOf = projectRoleOf;
+/** An active member, whatever their role: can see the project. */
+const isProjectMember = (project, userId) => !!(0, exports.projectRoleOf)(project, userId);
+exports.isProjectMember = isProjectMember;
+/** An editor or an admin of the project: can change it (its content, its connections). */
+const canEditProject = (project, userId) => ['editor', 'admin'].includes((0, exports.projectRoleOf)(project, userId) ?? '');
+exports.canEditProject = canEditProject;
+/** An admin of the project: can manage its members, and delete it. */
+const isProjectAdmin = (project, userId) => (0, exports.projectRoleOf)(project, userId) === 'admin';
+exports.isProjectAdmin = isProjectAdmin;

package/dist/utils/encryption.d.ts

@@ -1,4 +1,9 @@
-export declare const setEncryptionKey: (key: string) => void;
+/** The key credentials are encrypted with, and the previous ones they may still be in. */
+export declare const setEncryptionKey: (key: string, previousKeys?: string[]) => void;
 export declare const encrypt: (text: string) => string;
 export declare const decrypt: (text: string) => string;
+/** Whether a stored value is encrypted the current way (GCM, with the current key). */
+export declare const isCurrentEncryption: (text: string) => boolean;
+/** Whether a stored value is in this module's own format (GCM, any key). */
+export declare const isVersionedEncryption: (text: string) => boolean;
 export declare const isEncryptionKeySet: () => boolean;

package/dist/utils/encryption.js

@@ -33,43 +33,96 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.isEncryptionKeySet = exports.decrypt = exports.encrypt = exports.setEncryptionKey = void 0;
+exports.isEncryptionKeySet = exports.isVersionedEncryption = exports.isCurrentEncryption = exports.decrypt = exports.encrypt = exports.setEncryptionKey = void 0;
 const crypto = __importStar(require("crypto"));
-const ALGORITHM = 'aes-256-cbc';
-const IV_LENGTH = 16; // For AES, this is always 16
-let ENCRYPTION_KEY = undefined;
-const setEncryptionKey = (key) => {
-    if (key.length !== 64) { // 32 bytes * 2 hex characters per byte
+// Stored credentials, encrypted with AES-256-GCM (authenticated: an altered value fails to
+// decrypt instead of decrypting to garbage), each value naming the key it was encrypted with:
+//
+//   v2:<key id>:<iv>:<auth tag>:<ciphertext>      (base64url parts; a 12-byte iv)
+//
+// A key's id is a fingerprint of it, so rotating is only configuring the new key as the
+// current one and the old ones as previous keys: what's stored keeps decrypting, and is
+// re-encrypted with the current key (see services/reencryptCredentials).
+//
+// Values stored before (AES-256-CBC, "<iv hex>:<ciphertext hex>", no key id) still decrypt,
+// with the current key or a previous one.
+const GCM = 'aes-256-gcm';
+const GCM_IV_LENGTH = 12;
+const LEGACY_CBC = 'aes-256-cbc';
+const VERSION = 'v2';
+let currentKey;
+const keysById = new Map();
+const keyBuffer = (hex) => {
+    if (typeof hex !== 'string' || !/^[0-9a-fA-F]{64}$/.test(hex)) {
         throw new Error('Invalid encryption key length. Key must be 32 bytes (64 hexadecimal characters).');
     }
-    ENCRYPTION_KEY = key;
+    return Buffer.from(hex, 'hex');
+};
+// A key's id: a fingerprint of it (never the key, nor enough to find it).
+const keyIdOf = (key) => crypto.createHash('sha256').update('streamby-encryption-key:').update(key).digest('hex').slice(0, 16);
+/** The key credentials are encrypted with, and the previous ones they may still be in. */
+const setEncryptionKey = (key, previousKeys = []) => {
+    const current = keyBuffer(key);
+    const previous = previousKeys.map(keyBuffer);
+    keysById.clear();
+    for (const k of [...previous, current])
+        keysById.set(keyIdOf(k), k);
+    currentKey = { id: keyIdOf(current), key: current };
 };
 exports.setEncryptionKey = setEncryptionKey;
+const requireKey = () => {
+    if (!currentKey)
+        throw new Error('Encryption key is not set. Cannot encrypt or decrypt credentials.');
+    return currentKey;
+};
 const encrypt = (text) => {
-    if (!ENCRYPTION_KEY) {
-        throw new Error('Encryption key is not set. Cannot encrypt credentials.');
-    }
-    const iv = crypto.randomBytes(IV_LENGTH);
-    const cipher = crypto.createCipheriv(ALGORITHM, Buffer.from(ENCRYPTION_KEY, 'hex'), iv);
-    let encrypted = cipher.update(text);
-    encrypted = Buffer.concat([encrypted, cipher.final()]);
-    return iv.toString('hex') + ':' + encrypted.toString('hex');
+    const { id, key } = requireKey();
+    const iv = crypto.randomBytes(GCM_IV_LENGTH);
+    const cipher = crypto.createCipheriv(GCM, key, iv);
+    const encrypted = Buffer.concat([cipher.update(text, 'utf8'), cipher.final()]);
+    const tag = cipher.getAuthTag();
+    return [VERSION, id, iv.toString('base64url'), tag.toString('base64url'), encrypted.toString('base64url')].join(':');
 };
 exports.encrypt = encrypt;
+const decryptLegacy = (text, key) => {
+    const [ivHex, ...rest] = text.split(':');
+    const decipher = crypto.createDecipheriv(LEGACY_CBC, key, Buffer.from(ivHex, 'hex'));
+    return Buffer.concat([decipher.update(Buffer.from(rest.join(':'), 'hex')), decipher.final()]).toString();
+};
 const decrypt = (text) => {
-    if (!ENCRYPTION_KEY) {
-        throw new Error('Encryption key is not set. Cannot decrypt credentials.');
+    requireKey();
+    if (text.startsWith(`${VERSION}:`)) {
+        const [, id, iv, tag, encrypted] = text.split(':');
+        const key = keysById.get(id);
+        if (!key)
+            throw new Error('This credential was encrypted with a key that is not configured.');
+        const decipher = crypto.createDecipheriv(GCM, key, Buffer.from(iv, 'base64url'));
+        decipher.setAuthTag(Buffer.from(tag, 'base64url'));
+        try {
+            return Buffer.concat([decipher.update(Buffer.from(encrypted, 'base64url')), decipher.final()]).toString('utf8');
+        }
+        catch {
+            throw new Error('This credential could not be decrypted: it was altered or damaged.');
+        }
+    }
+    // Stored before: CBC, with whichever configured key it was encrypted with.
+    let lastError;
+    for (const key of [currentKey.key, ...[...keysById.values()].filter(k => k !== currentKey.key)]) {
+        try {
+            return decryptLegacy(text, key);
+        }
+        catch (err) {
+            lastError = err;
+        }
     }
-    const textParts = text.split(':');
-    const iv = Buffer.from(textParts.shift(), 'hex');
-    const encryptedText = Buffer.from(textParts.join(':'), 'hex');
-    const decipher = crypto.createDecipheriv(ALGORITHM, Buffer.from(ENCRYPTION_KEY, 'hex'), iv);
-    let decrypted = decipher.update(encryptedText);
-    decrypted = Buffer.concat([decrypted, decipher.final()]);
-    return decrypted.toString();
+    throw lastError instanceof Error ? lastError : new Error('This credential could not be decrypted.');
 };
 exports.decrypt = decrypt;
-const isEncryptionKeySet = () => {
-    return !!ENCRYPTION_KEY;
-};
+/** Whether a stored value is encrypted the current way (GCM, with the current key). */
+const isCurrentEncryption = (text) => !!currentKey && text.startsWith(`${VERSION}:${currentKey.id}:`);
+exports.isCurrentEncryption = isCurrentEncryption;
+/** Whether a stored value is in this module's own format (GCM, any key). */
+const isVersionedEncryption = (text) => text.startsWith(`${VERSION}:`);
+exports.isVersionedEncryption = isVersionedEncryption;
+const isEncryptionKeySet = () => !!currentKey;
 exports.isEncryptionKeySet = isEncryptionKeySet;

package/dist/utils/sanitize.d.ts

@@ -8,5 +8,11 @@ export declare function sanitizeConnections<T extends {
 }>(conns: T[] | undefined): (Omit<T, 'encryptedCredential'> & {
     hasCredential: boolean;
 })[];
+export declare function sanitizeIntegrationConnection<T extends object>(conn: T): T & {
+    hasCredential: true;
+};
+export declare function sanitizeIntegrationConnections<T extends object>(conns: T[] | undefined): (T & {
+    hasCredential: true;
+})[];
 export declare function sanitizeProject(project: any): any;
 export declare function sanitizeUserIntegration(integration: any): any;

package/dist/utils/sanitize.js

@@ -2,6 +2,8 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.sanitizeConnection = sanitizeConnection;
 exports.sanitizeConnections = sanitizeConnections;
+exports.sanitizeIntegrationConnection = sanitizeIntegrationConnection;
+exports.sanitizeIntegrationConnections = sanitizeIntegrationConnections;
 exports.sanitizeProject = sanitizeProject;
 exports.sanitizeUserIntegration = sanitizeUserIntegration;
 function sanitizeConnection(conn) {
@@ -11,6 +13,16 @@ function sanitizeConnection(conn) {
 function sanitizeConnections(conns) {
     return (conns ?? []).map(sanitizeConnection);
 }
+// IntegrationConnection has no encryptedCredential field at all — credentials never live on
+// the connection, only integrationId does, resolved on-demand from the account-level
+// UserIntegration. hasCredential is hardcoded true (never derived from a local field) for
+// API shape parity with the other three connection types.
+function sanitizeIntegrationConnection(conn) {
+    return { ...conn, hasCredential: true };
+}
+function sanitizeIntegrationConnections(conns) {
+    return (conns ?? []).map(sanitizeIntegrationConnection);
+}
 function sanitizeProject(project) {
     if (!project)
         return project;
@@ -20,14 +32,19 @@ function sanitizeProject(project) {
         connections: sanitizeConnections(project.connections),
         storageConnections: sanitizeConnections(project.storageConnections),
         dbConnections: sanitizeConnections(project.dbConnections),
+        integrationConnections: sanitizeIntegrationConnections(project.integrationConnections),
         distributionConnections: sanitizeConnections(project.distributionConnections),
         renderFarmConnections: sanitizeConnections(project.renderFarmConnections),
         exports: project.exports?.map((e) => e && 'encryptedCredential' in e ? sanitizeConnection(e) : e),
     };
 }
+// Strips every raw secret an OAuth-backed integration might carry — encryptedCredential
+// (db/storage/claude) plus encryptedAccessToken/encryptedRefreshToken (jira/google).
+// tokenExpiresAt is deliberately kept: it's not secret, and its presence lets a future UI
+// show "reconnect needed" without a decrypt round-trip.
 function sanitizeUserIntegration(integration) {
     if (!integration)
         return integration;
-    const { encryptedCredential, ...rest } = integration;
+    const { encryptedCredential, encryptedAccessToken, encryptedRefreshToken, ...rest } = integration;
     return rest;
 }

package/dist/utils/serviceEndpoints.d.ts

@@ -0,0 +1,2 @@
+import { ServiceProviderType } from '../types';
+export declare function isServiceEndpoint(provider: ServiceProviderType, endpoint: unknown): endpoint is string;

package/dist/utils/serviceEndpoints.js

@@ -0,0 +1,26 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isServiceEndpoint = isServiceEndpoint;
+// Where a service integration's credential may be sent: its own provider's API, over https.
+// A node chooses the endpoint it calls, and anyone who can edit the node could otherwise point
+// it at a server of their own and receive the credential of whoever connected the integration.
+const PROVIDER_HOSTS = {
+    claude: (host) => host === 'api.anthropic.com',
+    jira: (host) => host === 'api.atlassian.com' || host.endsWith('.atlassian.net'),
+    google: (host) => host === 'googleapis.com' || host.endsWith('.googleapis.com'),
+};
+function isServiceEndpoint(provider, endpoint) {
+    if (typeof endpoint !== 'string')
+        return false;
+    let url;
+    try {
+        url = new URL(endpoint);
+    }
+    catch {
+        return false;
+    }
+    if (url.protocol !== 'https:' || url.username || url.password || url.port)
+        return false;
+    const allowed = PROVIDER_HOSTS[provider];
+    return !!allowed && allowed(url.hostname.toLowerCase());
+}

package/package.json

@@ -1,11 +1,12 @@
 {
   "name": "streamby-core",
-  "version": "0.32.1",
+  "version": "0.34.0",
   "description": "StreamBy middleware framework for media storage management",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
   "files": [
-    "dist"
+    "dist",
+    "CHANGELOG.md"
   ],
   "scripts": {
     "build": "tsc",
@@ -27,7 +28,7 @@
     "typescript"
   ],
   "author": "TerminalCore Labs",
-  "license": "MIT",
+  "license": "AGPL-3.0-only",
   "dependencies": {
     "@aws-sdk/client-s3": "^3.528.0",
     "@aws-sdk/s3-request-presigner": "^3.787.0",

package/dist/middleware/routes/apiConnection.d.ts

@@ -1,3 +0,0 @@
-import { Router } from 'express';
-import { StreamByConfig } from '../../types';
-export declare function apiConnectionRouter(config: StreamByConfig): Router;