streamby-core 0.33.0 → 0.34.0

package/dist/middleware/routes/project.js

@@ -72,9 +72,6 @@ function projectRouter(config) {
             if (req.subscription === 'freemium') {
                 return res.status(403).json({ error: 'Freemium users cannot create projects' });
             }
-            if (auth.role !== 'admin' && auth.role !== 'editor') {
-                return res.status(403).json({ message: 'Permission denied' });
-            }
             const { name, description, image, allowedOrigin, public: isPublic = true, category, integrationIds } = req.body;
             if (isPublic === false && req.subscription === 'freemium') {
                 return res.status(403).json({ error: 'Private projects require a subscriber plan' });
@@ -208,9 +205,6 @@ function projectRouter(config) {
     router.patch('/projects/:id', async (req, res) => {
         try {
             const auth = req.auth;
-            if (auth.role !== 'admin' && auth.role !== 'editor') {
-                return res.status(403).json({ message: 'Permission denied' });
-            }
             const projectId = req.params.id;
             const updates = req.body;
             const project = await Project.findOne({ _id: projectId });
@@ -220,7 +214,7 @@ function projectRouter(config) {
             if (!updates || typeof updates !== 'object') {
                 return res.status(400).json({ message: 'Missing updates payload' });
             }
-            if (!(0, auth_1.isProjectMember)(project, auth.userId)) {
+            if (!(0, auth_1.canEditProject)(project, auth.userId)) {
                 return res.status(403).json({ message: 'Unauthorized project access' });
             }
             const updated = await Project.update({ _id: projectId }, updates);
@@ -250,8 +244,9 @@ function projectRouter(config) {
             if (!project) {
                 return res.status(404).json({ message: 'Project not found' });
             }
-            if (!(0, auth_1.isProjectMember)(project, auth.userId)) {
-                return res.status(403).json({ message: 'Unauthorized project access' });
+            // Only an admin of the project deletes it.
+            if (!(0, auth_1.isProjectAdmin)(project, auth.userId)) {
+                return res.status(403).json({ message: 'Only a project admin can delete it' });
             }
             await Project.useDbType(project.dbType).delete({ _id: projectId });
             const allProjects = await Project.find({});
@@ -348,9 +343,6 @@ function projectRouter(config) {
     router.post('/projects/:id/image', async (req, res) => {
         try {
             const auth = req.auth;
-            if (auth.role !== 'admin' && auth.role !== 'editor') {
-                return res.status(403).json({ message: 'Permission denied' });
-            }
             const projectId = req.params.id;
             const { imageUrl } = req.body;
             if (!projectId || !imageUrl) {
@@ -360,7 +352,7 @@ function projectRouter(config) {
             if (!project) {
                 return res.status(404).json({ message: 'Project not found' });
             }
-            if (!(0, auth_1.isProjectMember)(project, auth.userId)) {
+            if (!(0, auth_1.canEditProject)(project, auth.userId)) {
                 return res.status(403).json({ message: 'Unauthorized project access' });
             }
             const updatedProject = await Project.update({ _id: projectId }, { image: imageUrl });
@@ -376,16 +368,13 @@ function projectRouter(config) {
     router.patch('/projects/:id/origins', async (req, res) => {
         try {
             const auth = req.auth;
-            if (auth.role !== 'admin' && auth.role !== 'editor') {
-                return res.status(403).json({ message: 'Permission denied' });
-            }
             const projectId = req.params.id;
             const { origins } = req.body;
             const project = await Project.findOne({ _id: projectId });
             if (!project) {
                 return res.status(404).json({ message: 'Project not found' });
             }
-            if (!(0, auth_1.isProjectMember)(project, auth.userId)) {
+            if (!(0, auth_1.canEditProject)(project, auth.userId)) {
                 return res.status(403).json({ message: 'Unauthorized project access' });
             }
             const updated = await Project.update({ _id: projectId }, { allowedOrigin: origins });
@@ -402,9 +391,6 @@ function projectRouter(config) {
     router.post('/projects/:id/integrations', async (req, res) => {
         try {
             const auth = req.auth;
-            if (auth.role !== 'admin' && auth.role !== 'editor') {
-                return res.status(403).json({ message: 'Permission denied' });
-            }
             const projectId = req.params.id;
             const { integrationId } = req.body;
             if (!integrationId)
@@ -412,7 +398,7 @@ function projectRouter(config) {
             const project = await Project.findOne({ _id: projectId });
             if (!project)
                 return res.status(404).json({ message: 'Project not found' });
-            if (!(0, auth_1.isProjectMember)(project, auth.userId))
+            if (!(0, auth_1.canEditProject)(project, auth.userId))
                 return res.status(403).json({ message: 'Unauthorized project access' });
             const alreadyConnected = [...(project.dbConnections ?? []), ...(project.storageConnections ?? []), ...(project.integrationConnections ?? [])]
                 .some((c) => c.integrationId === integrationId);
@@ -438,15 +424,12 @@ function projectRouter(config) {
     router.delete('/projects/:id/integrations/:integrationId', async (req, res) => {
         try {
             const auth = req.auth;
-            if (auth.role !== 'admin' && auth.role !== 'editor') {
-                return res.status(403).json({ message: 'Permission denied' });
-            }
             const projectId = req.params.id;
             const { integrationId } = req.params;
             const project = await Project.findOne({ _id: projectId });
             if (!project)
                 return res.status(404).json({ message: 'Project not found' });
-            if (!(0, auth_1.isProjectMember)(project, auth.userId))
+            if (!(0, auth_1.canEditProject)(project, auth.userId))
                 return res.status(403).json({ message: 'Unauthorized project access' });
             const dbConn = (project.dbConnections ?? []).find((c) => c.integrationId === integrationId);
             const storageConn = (project.storageConnections ?? []).find((c) => c.integrationId === integrationId);

package/dist/middleware/routes/renderFarm.js

@@ -11,6 +11,7 @@ const jobQueue_1 = require("../../services/jobQueue");
 const vfxProcessor_1 = require("../../services/vfxProcessor");
 const sanitize_1 = require("../../utils/sanitize");
 const crypto_1 = __importDefault(require("crypto"));
+const encryption_1 = require("../../utils/encryption");
 function renderFarmRouter(_config) {
     const router = (0, express_1.Router)();
     const Project = (0, manager_1.getModel)('projects');
@@ -34,14 +35,20 @@ function renderFarmRouter(_config) {
         try {
             const auth = req.auth;
             const { projectId } = req.params;
-            const { name, provider, apiUrl, encryptedCredential, description } = req.body;
+            const { name, provider, apiUrl, credential: credentialValue, encryptedCredential: legacyCredential, description } = req.body;
+            // The credential, as given (`encryptedCredential` was its old name: it was always the
+            // value itself), stored encrypted.
+            const credential = credentialValue ?? legacyCredential;
+            if (credential && !(0, encryption_1.isEncryptionKeySet)())
+                return res.status(500).json({ message: 'Encryption key is not set' });
+            const encryptedCredential = credential ? (0, encryption_1.encrypt)(String(credential)) : undefined;
             if (!name || !provider || !apiUrl) {
                 return res.status(400).json({ message: 'name, provider and apiUrl are required' });
             }
             const project = await Project.findOne({ _id: projectId });
             if (!project)
                 return res.status(404).json({ message: 'Project not found' });
-            if (!(0, auth_1.isProjectMember)(project, auth.userId))
+            if (!(0, auth_1.canEditProject)(project, auth.userId))
                 return res.status(403).json({ message: 'Unauthorized' });
             const connection = {
                 id: crypto_1.default.randomUUID(),
@@ -67,7 +74,7 @@ function renderFarmRouter(_config) {
             const project = await Project.findOne({ _id: projectId });
             if (!project)
                 return res.status(404).json({ message: 'Project not found' });
-            if (!(0, auth_1.isProjectMember)(project, auth.userId))
+            if (!(0, auth_1.canEditProject)(project, auth.userId))
                 return res.status(403).json({ message: 'Unauthorized' });
             await Project.update({ _id: projectId }, { $pull: { renderFarmConnections: { id: connectionId } } });
             res.json({ message: 'Connection deleted' });
@@ -87,7 +94,7 @@ function renderFarmRouter(_config) {
             const project = await Project.findOne({ _id: projectId });
             if (!project)
                 return res.status(404).json({ message: 'Project not found' });
-            if (!(0, auth_1.isProjectMember)(project, auth.userId))
+            if (!(0, auth_1.canEditProject)(project, auth.userId))
                 return res.status(403).json({ message: 'Unauthorized' });
             const job = (0, jobQueue_1.createJob)('render', auth.userId, projectId, { fileId, renderer, renderFarmConnectionId, frameRange, resolution, samples, outputFormat });
             setImmediate(() => (0, vfxProcessor_1.runRenderJob)(job.jobId, fileId, projectId, { renderer, renderFarmConnectionId, frameRange, resolution, samples, outputFormat }));
@@ -107,7 +114,7 @@ function renderFarmRouter(_config) {
             const project = await Project.findOne({ _id: projectId });
             if (!project)
                 return res.status(404).json({ message: 'Project not found' });
-            if (!(0, auth_1.isProjectMember)(project, auth.userId))
+            if (!(0, auth_1.canEditProject)(project, auth.userId))
                 return res.status(403).json({ message: 'Unauthorized' });
             const job = (0, jobQueue_1.createJob)('format-convert', auth.userId, projectId, { fileId, inputFormat, outputFormat, applyTransforms, embedTextures });
             setImmediate(() => (0, vfxProcessor_1.runFormatConvertJob)(job.jobId, fileId, projectId, { inputFormat, outputFormat, applyTransforms, embedTextures }));
@@ -127,7 +134,7 @@ function renderFarmRouter(_config) {
             const project = await Project.findOne({ _id: projectId });
             if (!project)
                 return res.status(404).json({ message: 'Project not found' });
-            if (!(0, auth_1.isProjectMember)(project, auth.userId))
+            if (!(0, auth_1.canEditProject)(project, auth.userId))
                 return res.status(403).json({ message: 'Unauthorized' });
             const job = (0, jobQueue_1.createJob)('lod', auth.userId, projectId, { fileId, levels, reductionRatios, algorithm, outputFormat });
             setImmediate(() => (0, vfxProcessor_1.runLodJob)(job.jobId, fileId, projectId, { levels, reductionRatios, algorithm, outputFormat }));

package/dist/middleware/routes/review.js

@@ -60,7 +60,7 @@ function reviewRouter(_config) {
             const project = await Project.findOne({ _id: projectId });
             if (!project)
                 return res.status(404).json({ message: 'Project not found' });
-            if (!(0, auth_1.isProjectMember)(project, auth.userId))
+            if (!(0, auth_1.canEditProject)(project, auth.userId))
                 return res.status(403).json({ message: 'Unauthorized' });
             const db = getDb();
             if (!db)
@@ -120,7 +120,7 @@ function reviewRouter(_config) {
             const project = await Project.findOne({ _id: projectId });
             if (!project)
                 return res.status(404).json({ message: 'Project not found' });
-            if (!(0, auth_1.isProjectMember)(project, auth.userId))
+            if (!(0, auth_1.canEditProject)(project, auth.userId))
                 return res.status(403).json({ message: 'Unauthorized' });
             const db = getDb();
             if (!db)
@@ -190,7 +190,7 @@ function reviewRouter(_config) {
             const project = await Project.findOne({ _id: projectId });
             if (!project)
                 return res.status(404).json({ message: 'Project not found' });
-            if (!(0, auth_1.isProjectMember)(project, auth.userId))
+            if (!(0, auth_1.canEditProject)(project, auth.userId))
                 return res.status(403).json({ message: 'Unauthorized' });
             const db = getDb();
             if (!db)
@@ -224,7 +224,7 @@ function reviewRouter(_config) {
             const project = await Project.findOne({ _id: projectId });
             if (!project)
                 return res.status(404).json({ message: 'Project not found' });
-            if (!(0, auth_1.isProjectMember)(project, auth.userId))
+            if (!(0, auth_1.canEditProject)(project, auth.userId))
                 return res.status(403).json({ message: 'Unauthorized' });
             const db = getDb();
             if (!db)

package/dist/middleware/routes/rights.js

@@ -42,7 +42,7 @@ function rightsRouter(_config) {
             const project = await Project.findOne({ _id: projectId });
             if (!project)
                 return res.status(404).json({ message: 'Project not found' });
-            if (!(0, auth_1.isProjectMember)(project, auth.userId))
+            if (!(0, auth_1.canEditProject)(project, auth.userId))
                 return res.status(403).json({ message: 'Unauthorized' });
             const db = getDb();
             if (!db)

package/dist/middleware/routes/storage.js

@@ -71,11 +71,14 @@ function storageRouter(config) {
     router.get('/upload-project-image-url/:id', async (req, res) => {
         try {
             const auth = req.auth;
-            if (auth.role !== 'admin' && auth.role !== 'editor')
-                return res.status(403).json({ message: 'Permission denied' });
             const projectId = req.params.id;
             if (!projectId)
                 return res.status(400).json({ message: 'Missing projectId' });
+            const project = await Project.findOne({ _id: projectId });
+            if (!project)
+                return res.status(404).json({ message: 'Project not found' });
+            if (!(0, auth_1.canEditProject)(project, auth.userId))
+                return res.status(403).json({ message: 'Permission denied' });
             const response = await (0, presign_1.getPresignedProjectImageUrl)(adapter, projectId);
             res.status(200).json({ ...response, message: 'Presigned URL generated successfully' });
         }
@@ -86,11 +89,14 @@ function storageRouter(config) {
     router.delete('/delete-project-image-url/:id', async (req, res) => {
         try {
             const auth = req.auth;
-            if (auth.role !== 'admin' && auth.role !== 'editor')
-                return res.status(403).json({ message: 'Permission denied' });
             const projectId = req.params.id;
             if (!projectId)
                 return res.status(400).json({ message: 'Missing projectId' });
+            const project = await Project.findOne({ _id: projectId });
+            if (!project)
+                return res.status(404).json({ message: 'Project not found' });
+            if (!(0, auth_1.canEditProject)(project, auth.userId))
+                return res.status(403).json({ message: 'Permission denied' });
             await (0, file_1.deleteProjectImage)(adapter, projectId);
             const updated = await Project.update({ _id: projectId }, { image: '' });
             res.status(201).json({ ...updated, message: 'Image deleted successfully' });
@@ -119,7 +125,7 @@ function storageRouter(config) {
             const project = await Project.findOne({ _id: projectId });
             if (!project)
                 return res.status(404).json({ message: 'Project not found' });
-            if (!(0, auth_1.isProjectMember)(project, auth.userId))
+            if (!(0, auth_1.canEditProject)(project, auth.userId))
                 return res.status(403).json({ message: 'Unauthorized access' });
             if (!adapter.getPresignedUploadUrl) {
                 return res.status(501).json({ message: 'Storage adapter does not support presigned uploads' });
@@ -192,7 +198,7 @@ function storageRouter(config) {
             const project = await Project.findOne({ _id: projectId });
             if (!project)
                 return res.status(404).json({ message: 'Project not found' });
-            if (!(0, auth_1.isProjectMember)(project, auth.userId))
+            if (!(0, auth_1.canEditProject)(project, auth.userId))
                 return res.status(403).json({ message: 'Unauthorized access' });
             const collection = getRawFilesCollection();
             if (!collection)
@@ -213,7 +219,7 @@ function storageRouter(config) {
             const project = await Project.findOne({ _id: projectId });
             if (!project)
                 return res.status(404).json({ message: 'Project not found' });
-            if (!(0, auth_1.isProjectMember)(project, auth.userId))
+            if (!(0, auth_1.canEditProject)(project, auth.userId))
                 return res.status(403).json({ message: 'Unauthorized access' });
             const collection = getRawFilesCollection();
             if (!collection)
@@ -291,7 +297,7 @@ function storageRouter(config) {
             const project = await Project.findOne({ _id: projectId });
             if (!project)
                 return res.status(404).json({ message: 'Project not found' });
-            if (!(0, auth_1.isProjectMember)(project, auth.userId))
+            if (!(0, auth_1.canEditProject)(project, auth.userId))
                 return res.status(403).json({ message: 'Unauthorized access' });
             const connAdapter = await resolveConnAdapter(connId, project, auth);
             if ('error' in connAdapter)
@@ -419,7 +425,7 @@ function storageRouter(config) {
             const project = await Project.findOne({ _id: projectId });
             if (!project)
                 return res.status(404).json({ message: 'Project not found' });
-            if (!(0, auth_1.isProjectMember)(project, auth.userId))
+            if (!(0, auth_1.canEditProject)(project, auth.userId))
                 return res.status(403).json({ message: 'Unauthorized access' });
             const collection = getRawFilesCollection();
             if (!collection)
@@ -440,7 +446,7 @@ function storageRouter(config) {
             const project = await Project.findOne({ _id: projectId });
             if (!project)
                 return res.status(404).json({ message: 'Project not found' });
-            if (!(0, auth_1.isProjectMember)(project, auth.userId))
+            if (!(0, auth_1.canEditProject)(project, auth.userId))
                 return res.status(403).json({ message: 'Unauthorized access' });
             const connAdapter = await resolveConnAdapter(connId, project, auth);
             if ('error' in connAdapter)
@@ -539,7 +545,7 @@ function storageRouter(config) {
             const project = await Project.findOne({ _id: projectId });
             if (!project)
                 return res.status(404).json({ message: 'Project not found' });
-            if (!(0, auth_1.isProjectMember)(project, auth.userId))
+            if (!(0, auth_1.canEditProject)(project, auth.userId))
                 return res.status(403).json({ message: 'Unauthorized access' });
             const conn = findStorageConn(project, connId);
             const isBuiltin = conn?.source === 'builtin';
@@ -590,7 +596,7 @@ function storageRouter(config) {
             const project = await Project.findOne({ _id: projectId });
             if (!project)
                 return res.status(404).json({ message: 'Project not found' });
-            if (!(0, auth_1.isProjectMember)(project, auth.userId))
+            if (!(0, auth_1.canEditProject)(project, auth.userId))
                 return res.status(403).json({ message: 'Unauthorized access' });
             const collection = getRawFoldersCollection();
             if (!collection)
@@ -624,7 +630,7 @@ function storageRouter(config) {
             const project = await Project.findOne({ _id: projectId });
             if (!project)
                 return res.status(404).json({ message: 'Project not found' });
-            if (!(0, auth_1.isProjectMember)(project, auth.userId))
+            if (!(0, auth_1.canEditProject)(project, auth.userId))
                 return res.status(403).json({ message: 'Unauthorized access' });
             const collection = getRawFoldersCollection();
             if (!collection)
@@ -654,7 +660,7 @@ function storageRouter(config) {
             const project = await Project.findOne({ _id: projectId });
             if (!project)
                 return res.status(404).json({ message: 'Project not found' });
-            if (!(0, auth_1.isProjectMember)(project, auth.userId))
+            if (!(0, auth_1.canEditProject)(project, auth.userId))
                 return res.status(403).json({ message: 'Unauthorized access' });
             const foldersCollection = getRawFoldersCollection();
             if (!foldersCollection)
@@ -682,7 +688,7 @@ function storageRouter(config) {
             const project = await Project.findOne({ _id: projectId });
             if (!project)
                 return res.status(404).json({ message: 'Project not found' });
-            if (!(0, auth_1.isProjectMember)(project, auth.userId))
+            if (!(0, auth_1.canEditProject)(project, auth.userId))
                 return res.status(403).json({ message: 'Unauthorized access' });
             if (folderId != null) {
                 const foldersCollection = getRawFoldersCollection();

package/dist/middleware/routes/storageConnection.js

@@ -40,9 +40,6 @@ function storageConnectionRouter(config) {
     router.post('/projects/:id/connections/storage', async (req, res) => {
         try {
             const auth = req.auth;
-            if (auth.role !== 'admin' && auth.role !== 'editor') {
-                return res.status(403).json({ message: 'Permission denied' });
-            }
             const { name, type, credential, integrationId, description } = req.body;
             if (!name || !type) {
                 return res.status(400).json({ message: 'name and type are required' });
@@ -59,7 +56,7 @@ function storageConnectionRouter(config) {
             const project = await Project.findOne({ _id: req.params.id });
             if (!project)
                 return res.status(404).json({ message: 'Project not found' });
-            if (!(0, auth_1.isProjectMember)(project, auth.userId))
+            if (!(0, auth_1.canEditProject)(project, auth.userId))
                 return res.status(403).json({ message: 'Unauthorized project access' });
             let encryptedCredential;
             if (integrationId) {
@@ -98,13 +95,10 @@ function storageConnectionRouter(config) {
         try {
             const { connId } = req.params;
             const auth = req.auth;
-            if (auth.role !== 'admin' && auth.role !== 'editor') {
-                return res.status(403).json({ message: 'Permission denied' });
-            }
             const project = await Project.findOne({ _id: req.params.id });
             if (!project)
                 return res.status(404).json({ message: 'Project not found' });
-            if (!(0, auth_1.isProjectMember)(project, auth.userId))
+            if (!(0, auth_1.canEditProject)(project, auth.userId))
                 return res.status(403).json({ message: 'Unauthorized project access' });
             const conn = project.storageConnections?.find((c) => c.id === connId);
             if (!conn)

package/dist/middleware/routes/workflow.js

@@ -38,7 +38,7 @@ function workflowRouter(config) {
                 return res.status(401).json({ message: 'Unauthorized' });
             const projectId = req.params.id;
             const project = await Project.findOne({ _id: projectId });
-            if (!project || !(0, auth_1.isProjectMember)(project, auth.userId)) {
+            if (!project || !(0, auth_1.canEditProject)(project, auth.userId)) {
                 return res.status(403).json({ message: 'Unauthorized project access' });
             }
             const now = new Date();

package/dist/services/auth.d.ts

@@ -1,5 +1,4 @@
-import { Auth } from '../types';
 import { Request, Response, NextFunction } from 'express';
 import { StreamByConfig } from '../types';
+export declare const isPublicRoute: (method: string, path: string) => boolean;
 export declare const authenticate: (config: StreamByConfig) => (req: Request, res: Response, next: NextFunction) => Promise<void | Response<any, Record<string, any>>>;
-export declare function checkRole(auth: Auth, required: 'viewer' | 'editor' | 'admin'): void;

package/dist/services/auth.js

@@ -1,9 +1,15 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.authenticate = void 0;
-exports.checkRole = checkRole;
+exports.authenticate = exports.isPublicRoute = void 0;
+// The one route open without a session: a project's public export, read
+// (GET /:projectId/export/:exportName, see routes/export). Exactly that path -- not any path
+// that has an "export" segment somewhere.
+const PUBLIC_EXPORT = /^\/[^/]+\/export\/[^/]+\/?$/;
+const READ_METHODS = ['GET', 'HEAD', 'OPTIONS'];
+const isPublicRoute = (method, path) => READ_METHODS.includes(method.toUpperCase()) && PUBLIC_EXPORT.test(path);
+exports.isPublicRoute = isPublicRoute;
 const authenticate = (config) => async (req, res, next) => {
-    if (req.path.includes('/export/')) {
+    if ((0, exports.isPublicRoute)(req.method, req.path)) {
         return next();
     }
     try {
@@ -20,11 +26,3 @@ const authenticate = (config) => async (req, res, next) => {
     }
 };
 exports.authenticate = authenticate;
-function checkRole(auth, required) {
-    const roles = ['viewer', 'editor', 'admin'];
-    const userIdx = roles.indexOf(auth.role);
-    const requiredIdx = roles.indexOf(required);
-    if (userIdx < requiredIdx) {
-        throw new Error(`Insufficient role: requires ${required}, found ${auth.role}`);
-    }
-}

package/dist/services/connectionResolver.js

@@ -52,7 +52,7 @@ async function resolveDbConnectionClient(project, connId, config, auth) {
     if (conn.source === 'integration') {
         if (!conn.integrationId)
             return { error: 'Connection is missing its integrationId', status: 500 };
-        const resolved = await (0, userIntegration_1.getDecryptedIntegrationCredentialById)(conn.integrationId, config);
+        const resolved = await (0, userIntegration_1.getDecryptedIntegrationCredentialById)(conn.integrationId, config, project);
         if (!resolved)
             return { error: 'Integration not found', status: 400 };
         connectionString = resolved.credential;
@@ -109,7 +109,7 @@ async function resolveStorageAdapter(project, connId, config, auth) {
         if (!conn.integrationId)
             return { error: 'Connection is missing its integrationId', status: 500 };
         try {
-            const resolved = await (0, userIntegration_1.getDecryptedIntegrationCredentialById)(conn.integrationId, config);
+            const resolved = await (0, userIntegration_1.getDecryptedIntegrationCredentialById)(conn.integrationId, config, project);
             if (!resolved)
                 return { error: 'Integration not found', status: 400 };
             return new s3_1.S3Adapter(resolved.credential);

package/dist/services/executor.d.ts

@@ -4,4 +4,7 @@ export declare class NodeExecutionError extends Error {
     nodeType: string;
     constructor(nodeId: string, nodeType: string, message: string);
 }
-export declare function executeExport(nodeSchema: NodeSchema, project: any, config: StreamByConfig): Promise<any>;
+export interface ExecuteExportOptions {
+    public?: boolean;
+}
+export declare function executeExport(nodeSchema: NodeSchema, project: any, config: StreamByConfig, { public: isPublic }?: ExecuteExportOptions): Promise<any>;

package/dist/services/executor.js

@@ -12,6 +12,7 @@ const mediaProcessor_1 = require("./mediaProcessor");
 const vfxProcessor_1 = require("./vfxProcessor");
 const aiProcessor_1 = require("./aiProcessor");
 const storage_1 = require("../providers/storage");
+const serviceEndpoints_1 = require("../utils/serviceEndpoints");
 function applyFilterConfig(payload, config) {
     const isArr = Array.isArray(payload);
     let r = isArr ? [...payload] : payload;
@@ -87,13 +88,19 @@ class NodeExecutionError extends Error {
     }
 }
 exports.NodeExecutionError = NodeExecutionError;
-// Export execution is public (gated by allowedOrigin, not user identity — see
-// export.ts:339) — there is no real Auth to pass through. This sentinel satisfies
-// resolveDbConnectionClient's signature without adding a gate that never existed;
-// canUseBuiltin gating is for connection *management* by a user, not for serving an
-// already-published export.
+// Export execution has no user behind it (a public export is read without a session -- see
+// routes/export) -- there is no real Auth to pass through. This sentinel satisfies
+// resolveDbConnectionClient's signature; canUseBuiltin gating is for connection *management*
+// by a user, not for serving an already-published export.
 const SYSTEM_AUTH = { userId: 'system', username: 'system', role: 'admin' };
-async function executeExport(nodeSchema, project, config) {
+// Nodes that start a job (transcoding, rendering, generating...): work, and cost, on the
+// server or a provider, for whoever asks.
+const JOB_NODES = new Set([
+    'transcodeNode', 'captionNode', 'thumbnailNode', 'ingestNode', 'renderJobNode', 'formatConvertNode',
+    'lodNode', 'transcriptionNode', 'upscaleNode', 'proceduralAssetNode',
+]);
+const notPublic = (node) => new NodeExecutionError(node.id, node.type, `Node '${node.id}' (${node.type}) can't run in a public export.`);
+async function executeExport(nodeSchema, project, config, { public: isPublic = true } = {}) {
     const nodes = nodeSchema.nodes;
     const edges = nodeSchema.edges;
     // 1. Data layer — nodes connected to streamby in-bottom
@@ -119,6 +126,8 @@ async function executeExport(nodeSchema, project, config) {
             if (!connectionId) {
                 throw new NodeExecutionError(node.id, node.type, `Node '${node.id}' (${node.type}) has no database connection — connect one on the node.`);
             }
+            if (isPublic && (0, connectionResolver_1.findDbConnection)(project, connectionId)?.source === 'integration')
+                throw notPublic(node);
             const recordId = node.data?.recordId;
             const projectIdentifier = project._id?.toString() ?? project.id;
             const resolved = await (0, connectionResolver_1.resolveDbConnectionClient)(project, connectionId, config, SYSTEM_AUTH);
@@ -158,6 +167,8 @@ async function executeExport(nodeSchema, project, config) {
             // NodeExecutionError (matching dataSourceNode/ingestNode's intentional pattern), since
             // a silently-skipped service action would produce a workflow that "succeeds" while
             // quietly missing the one thing the node exists to do.
+            if (isPublic)
+                throw notPublic(node);
             const connectionId = node.data?.connectionId;
             if (!connectionId) {
                 throw new NodeExecutionError(node.id, node.type, `Node '${node.id}' (${node.type}) has no integration connection — connect one on the node.`);
@@ -166,21 +177,26 @@ async function executeExport(nodeSchema, project, config) {
             if (!connection) {
                 throw new NodeExecutionError(node.id, node.type, `Node '${node.id}' (${node.type}): integration connection not found on this project.`);
             }
-            const resolved = await (0, userIntegration_1.getDecryptedIntegrationCredentialById)(connection.integrationId, config);
-            if (!resolved) {
-                throw new NodeExecutionError(node.id, node.type, `Node '${node.id}' (${node.type}): integration credential could not be resolved — it may have been disconnected.`);
-            }
             const endpoint = node.data?.endpoint;
             if (!endpoint) {
                 throw new NodeExecutionError(node.id, node.type, `Node '${node.id}' (${node.type}) has no endpoint configured.`);
             }
+            // Checked before the credential is even resolved: it's only ever sent to its provider.
+            if (!(0, serviceEndpoints_1.isServiceEndpoint)(connection.provider, endpoint)) {
+                throw new NodeExecutionError(node.id, node.type, `Node '${node.id}' (${node.type}): ${endpoint} is not a ${connection.provider} endpoint.`);
+            }
+            const resolved = await (0, userIntegration_1.getDecryptedIntegrationCredentialById)(connection.integrationId, config, project);
+            if (!resolved) {
+                throw new NodeExecutionError(node.id, node.type, `Node '${node.id}' (${node.type}): integration credential could not be resolved — it may have been disconnected.`);
+            }
             const method = node.data?.method ?? 'GET';
             const headers = {
                 'Content-Type': 'application/json',
                 ...(0, oauthClient_1.buildServiceAuthHeaders)(connection.provider, resolved.credential),
             };
             const body = node.data?.body ? JSON.stringify(node.data.body) : undefined;
-            const response = await fetch(endpoint, { method, headers, body });
+            // A redirect would carry the credential's headers on to wherever it points.
+            const response = await fetch(endpoint, { method, headers, body, redirect: 'error' });
             if (!response.ok) {
                 throw new NodeExecutionError(node.id, node.type, `Node '${node.id}' (${node.type}): integration action failed (${response.statusText}).`);
             }
@@ -197,6 +213,8 @@ async function executeExport(nodeSchema, project, config) {
     while (processNode) {
         const nodeData = processNode.data ?? {};
         const fileId = nodeData.fileId;
+        if (isPublic && JOB_NODES.has(processNode.type))
+            throw notPublic(processNode);
         if (processNode.type === 'transcodeNode' && fileId) {
             const job = (0, jobQueue_1.createJob)('transcode', systemUserId, projectId, nodeData);
             setImmediate(() => (0, mediaProcessor_1.runTranscodeJob)(job.jobId, fileId, projectId, {

package/dist/services/reencryptCredentials.d.ts

@@ -0,0 +1,5 @@
+export interface ReencryptResult {
+    updated: number;
+    failed: number;
+}
+export declare function reencryptStoredCredentials(): Promise<ReencryptResult>;

package/dist/services/reencryptCredentials.js

@@ -0,0 +1,74 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.reencryptStoredCredentials = reencryptStoredCredentials;
+const manager_1 = require("../models/manager");
+const encryption_1 = require("../utils/encryption");
+// Brings every stored credential to the current encryption (AES-256-GCM with the current key,
+// see utils/encryption): those encrypted before (CBC, or GCM with a previous key) are
+// re-encrypted, and the distribution and render farm credentials, stored as they were sent,
+// are encrypted. Non-destructive: a value is replaced only by its own re-encryption; one that
+// can't be decrypted is left as it is (and counted). Runs at startup; once everything is
+// current, it changes nothing.
+// A project's lists of connections with a credential each, encrypted before.
+const ENCRYPTED_LISTS = ['connections', 'dbConnections', 'storageConnections', 'exports'];
+// The ones whose credentials were stored as sent, never encrypted.
+const PLAIN_LISTS = ['distributionConnections', 'renderFarmConnections'];
+const INTEGRATION_FIELDS = ['encryptedCredential', 'encryptedAccessToken', 'encryptedRefreshToken'];
+async function reencryptStoredCredentials() {
+    const result = { updated: 0, failed: 0 };
+    if (!(0, encryption_1.isEncryptionKeySet)())
+        return result;
+    // The current encryption of a stored value, or undefined when it's current already or
+    // can't be read (left as it is).
+    const upgrade = (value, storedPlain) => {
+        if (typeof value !== 'string' || !value || (0, encryption_1.isCurrentEncryption)(value))
+            return undefined;
+        if (storedPlain && !(0, encryption_1.isVersionedEncryption)(value))
+            return (0, encryption_1.encrypt)(value);
+        try {
+            return (0, encryption_1.encrypt)((0, encryption_1.decrypt)(value));
+        }
+        catch {
+            result.failed++;
+            return undefined;
+        }
+    };
+    const Project = (0, manager_1.getModel)('projects');
+    for (const project of (await Project.find({}))) {
+        const changes = {};
+        for (const list of [...ENCRYPTED_LISTS, ...PLAIN_LISTS]) {
+            const entries = project[list];
+            if (!Array.isArray(entries))
+                continue;
+            const storedPlain = PLAIN_LISTS.includes(list);
+            let changed = false;
+            const next = entries.map((entry) => {
+                const upgraded = upgrade(entry?.encryptedCredential, storedPlain);
+                if (upgraded === undefined)
+                    return entry;
+                changed = true;
+                return { ...entry, encryptedCredential: upgraded };
+            });
+            if (changed)
+                changes[list] = next;
+        }
+        if (Object.keys(changes).length) {
+            await Project.update({ _id: project._id ?? project.id }, changes);
+            result.updated++;
+        }
+    }
+    const UserIntegration = (0, manager_1.getModel)('user_integrations');
+    for (const integration of (await UserIntegration.find({}))) {
+        const changes = {};
+        for (const field of INTEGRATION_FIELDS) {
+            const upgraded = upgrade(integration[field], false);
+            if (upgraded !== undefined)
+                changes[field] = upgraded;
+        }
+        if (Object.keys(changes).length) {
+            await UserIntegration.update({ id: integration.id }, changes);
+            result.updated++;
+        }
+    }
+    return result;
+}