streamby-core 0.33.0 → 0.34.0

package/dist/services/userIntegration.d.ts

@@ -1,4 +1,4 @@
-import { IntegrationKind, ServiceProviderType, StreamByConfig, UserIntegration } from '../types';
+import { IntegrationKind, ProjectInfo, ServiceProviderType, StreamByConfig, UserIntegration } from '../types';
 export declare function isOAuthServiceProvider(provider: string): boolean;
 export declare class OAuthRefreshError extends Error {
     provider: string;
@@ -34,4 +34,4 @@ export interface ResolvedCredential {
     credential: unknown;
 }
 export declare function getDecryptedIntegrationCredential(userId: string, integrationId: string, config: StreamByConfig): Promise<ResolvedCredential | null>;
-export declare function getDecryptedIntegrationCredentialById(integrationId: string, config: StreamByConfig): Promise<ResolvedCredential | null>;
+export declare function getDecryptedIntegrationCredentialById(integrationId: string, config: StreamByConfig, project: Pick<ProjectInfo, 'members'>): Promise<ResolvedCredential | null>;

package/dist/services/userIntegration.js

@@ -15,6 +15,7 @@ exports.getDecryptedIntegrationCredentialById = getDecryptedIntegrationCredentia
 const crypto_1 = __importDefault(require("crypto"));
 const manager_1 = require("../models/manager");
 const encryption_1 = require("../utils/encryption");
+const auth_1 = require("../utils/auth");
 const oauthClient_1 = require("./oauthClient");
 const OAUTH_SERVICE_PROVIDERS = new Set(['jira', 'google']);
 function isOAuthServiceProvider(provider) {
@@ -157,9 +158,14 @@ async function getDecryptedIntegrationCredential(userId, integrationId, config)
 // stored on the connection itself. `config` is required (not just for OAuth's sake) so a
 // near-expiry jira/google token can be refreshed using the host-injected client
 // credentials in config.oauthProviders.
-async function getDecryptedIntegrationCredentialById(integrationId, config) {
+// A member's own integration, used by a project it was connected to: it resolves only while its
+// owner is an active member of that project. A project its owner isn't in (never was, left it,
+// or a connection pointing at someone else's integration) never gets the credential.
+async function getDecryptedIntegrationCredentialById(integrationId, config, project) {
     const UserIntegrationModel = (0, manager_1.getModel)('user_integrations');
     const integration = await UserIntegrationModel.findOne({ id: integrationId });
+    if (!integration || !(0, auth_1.activeMemberOf)(project, integration.userId))
+        return null;
     return resolveCredential(integration, config);
 }
 async function decryptIntegration(integration) {

package/dist/types/index.d.ts

@@ -63,6 +63,7 @@ export interface ProjectInfo {
         role: 'viewer' | 'editor' | 'admin';
         userId: string;
         archived?: boolean;
+        status?: 'active' | 'pending';
     }[];
     description?: string;
     exports?: {
@@ -131,6 +132,7 @@ export interface StreamByConfig {
     databases?: DatabaseCredential[];
     adapter?: StorageAdapter;
     encrypt?: string;
+    encryptPreviousKeys?: string[];
     websocket?: {
         server: WebSocketServer;
     };

package/dist/utils/auth.d.ts

@@ -1,2 +1,16 @@
 import { ProjectInfo } from '../types';
-export declare function isProjectMember(project: ProjectInfo, userId: string): boolean;
+type ProjectMembers = Pick<ProjectInfo, 'members'> | null | undefined;
+export declare function activeMemberOf(project: ProjectMembers, userId: string | undefined): {
+    role: "viewer" | "editor" | "admin";
+    userId: string;
+    archived?: boolean;
+    status?: "active" | "pending";
+} | undefined;
+export declare const projectRoleOf: (project: ProjectMembers, userId: string | undefined) => "viewer" | "editor" | "admin" | undefined;
+/** An active member, whatever their role: can see the project. */
+export declare const isProjectMember: (project: ProjectMembers, userId: string | undefined) => boolean;
+/** An editor or an admin of the project: can change it (its content, its connections). */
+export declare const canEditProject: (project: ProjectMembers, userId: string | undefined) => boolean;
+/** An admin of the project: can manage its members, and delete it. */
+export declare const isProjectAdmin: (project: ProjectMembers, userId: string | undefined) => boolean;
+export {};

package/dist/utils/auth.js

@@ -1,9 +1,24 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.isProjectMember = isProjectMember;
-function isProjectMember(project, userId) {
-    if (!project || !project.members) {
-        return false;
-    }
-    return project.members.some(member => member.userId === userId);
+exports.isProjectAdmin = exports.canEditProject = exports.isProjectMember = exports.projectRoleOf = void 0;
+exports.activeMemberOf = activeMemberOf;
+// A project's member who's in it now: invited and accepted (status 'active'). (A member's
+// `archived` is only that member having archived the project in their own list.)
+function activeMemberOf(project, userId) {
+    if (!project?.members || !userId)
+        return undefined;
+    return project.members.find(member => member.userId?.toString() === userId && member.status === 'active');
 }
+// What a user can do in a project is their role in it, as an active member -- never their
+// role on the platform (Auth.role): a pending invitation is no access yet.
+const projectRoleOf = (project, userId) => activeMemberOf(project, userId)?.role;
+exports.projectRoleOf = projectRoleOf;
+/** An active member, whatever their role: can see the project. */
+const isProjectMember = (project, userId) => !!(0, exports.projectRoleOf)(project, userId);
+exports.isProjectMember = isProjectMember;
+/** An editor or an admin of the project: can change it (its content, its connections). */
+const canEditProject = (project, userId) => ['editor', 'admin'].includes((0, exports.projectRoleOf)(project, userId) ?? '');
+exports.canEditProject = canEditProject;
+/** An admin of the project: can manage its members, and delete it. */
+const isProjectAdmin = (project, userId) => (0, exports.projectRoleOf)(project, userId) === 'admin';
+exports.isProjectAdmin = isProjectAdmin;

package/dist/utils/encryption.d.ts

@@ -1,4 +1,9 @@
-export declare const setEncryptionKey: (key: string) => void;
+/** The key credentials are encrypted with, and the previous ones they may still be in. */
+export declare const setEncryptionKey: (key: string, previousKeys?: string[]) => void;
 export declare const encrypt: (text: string) => string;
 export declare const decrypt: (text: string) => string;
+/** Whether a stored value is encrypted the current way (GCM, with the current key). */
+export declare const isCurrentEncryption: (text: string) => boolean;
+/** Whether a stored value is in this module's own format (GCM, any key). */
+export declare const isVersionedEncryption: (text: string) => boolean;
 export declare const isEncryptionKeySet: () => boolean;

package/dist/utils/encryption.js

@@ -33,43 +33,96 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.isEncryptionKeySet = exports.decrypt = exports.encrypt = exports.setEncryptionKey = void 0;
+exports.isEncryptionKeySet = exports.isVersionedEncryption = exports.isCurrentEncryption = exports.decrypt = exports.encrypt = exports.setEncryptionKey = void 0;
 const crypto = __importStar(require("crypto"));
-const ALGORITHM = 'aes-256-cbc';
-const IV_LENGTH = 16; // For AES, this is always 16
-let ENCRYPTION_KEY = undefined;
-const setEncryptionKey = (key) => {
-    if (key.length !== 64) { // 32 bytes * 2 hex characters per byte
+// Stored credentials, encrypted with AES-256-GCM (authenticated: an altered value fails to
+// decrypt instead of decrypting to garbage), each value naming the key it was encrypted with:
+//
+//   v2:<key id>:<iv>:<auth tag>:<ciphertext>      (base64url parts; a 12-byte iv)
+//
+// A key's id is a fingerprint of it, so rotating is only configuring the new key as the
+// current one and the old ones as previous keys: what's stored keeps decrypting, and is
+// re-encrypted with the current key (see services/reencryptCredentials).
+//
+// Values stored before (AES-256-CBC, "<iv hex>:<ciphertext hex>", no key id) still decrypt,
+// with the current key or a previous one.
+const GCM = 'aes-256-gcm';
+const GCM_IV_LENGTH = 12;
+const LEGACY_CBC = 'aes-256-cbc';
+const VERSION = 'v2';
+let currentKey;
+const keysById = new Map();
+const keyBuffer = (hex) => {
+    if (typeof hex !== 'string' || !/^[0-9a-fA-F]{64}$/.test(hex)) {
         throw new Error('Invalid encryption key length. Key must be 32 bytes (64 hexadecimal characters).');
     }
-    ENCRYPTION_KEY = key;
+    return Buffer.from(hex, 'hex');
+};
+// A key's id: a fingerprint of it (never the key, nor enough to find it).
+const keyIdOf = (key) => crypto.createHash('sha256').update('streamby-encryption-key:').update(key).digest('hex').slice(0, 16);
+/** The key credentials are encrypted with, and the previous ones they may still be in. */
+const setEncryptionKey = (key, previousKeys = []) => {
+    const current = keyBuffer(key);
+    const previous = previousKeys.map(keyBuffer);
+    keysById.clear();
+    for (const k of [...previous, current])
+        keysById.set(keyIdOf(k), k);
+    currentKey = { id: keyIdOf(current), key: current };
 };
 exports.setEncryptionKey = setEncryptionKey;
+const requireKey = () => {
+    if (!currentKey)
+        throw new Error('Encryption key is not set. Cannot encrypt or decrypt credentials.');
+    return currentKey;
+};
 const encrypt = (text) => {
-    if (!ENCRYPTION_KEY) {
-        throw new Error('Encryption key is not set. Cannot encrypt credentials.');
-    }
-    const iv = crypto.randomBytes(IV_LENGTH);
-    const cipher = crypto.createCipheriv(ALGORITHM, Buffer.from(ENCRYPTION_KEY, 'hex'), iv);
-    let encrypted = cipher.update(text);
-    encrypted = Buffer.concat([encrypted, cipher.final()]);
-    return iv.toString('hex') + ':' + encrypted.toString('hex');
+    const { id, key } = requireKey();
+    const iv = crypto.randomBytes(GCM_IV_LENGTH);
+    const cipher = crypto.createCipheriv(GCM, key, iv);
+    const encrypted = Buffer.concat([cipher.update(text, 'utf8'), cipher.final()]);
+    const tag = cipher.getAuthTag();
+    return [VERSION, id, iv.toString('base64url'), tag.toString('base64url'), encrypted.toString('base64url')].join(':');
 };
 exports.encrypt = encrypt;
+const decryptLegacy = (text, key) => {
+    const [ivHex, ...rest] = text.split(':');
+    const decipher = crypto.createDecipheriv(LEGACY_CBC, key, Buffer.from(ivHex, 'hex'));
+    return Buffer.concat([decipher.update(Buffer.from(rest.join(':'), 'hex')), decipher.final()]).toString();
+};
 const decrypt = (text) => {
-    if (!ENCRYPTION_KEY) {
-        throw new Error('Encryption key is not set. Cannot decrypt credentials.');
+    requireKey();
+    if (text.startsWith(`${VERSION}:`)) {
+        const [, id, iv, tag, encrypted] = text.split(':');
+        const key = keysById.get(id);
+        if (!key)
+            throw new Error('This credential was encrypted with a key that is not configured.');
+        const decipher = crypto.createDecipheriv(GCM, key, Buffer.from(iv, 'base64url'));
+        decipher.setAuthTag(Buffer.from(tag, 'base64url'));
+        try {
+            return Buffer.concat([decipher.update(Buffer.from(encrypted, 'base64url')), decipher.final()]).toString('utf8');
+        }
+        catch {
+            throw new Error('This credential could not be decrypted: it was altered or damaged.');
+        }
+    }
+    // Stored before: CBC, with whichever configured key it was encrypted with.
+    let lastError;
+    for (const key of [currentKey.key, ...[...keysById.values()].filter(k => k !== currentKey.key)]) {
+        try {
+            return decryptLegacy(text, key);
+        }
+        catch (err) {
+            lastError = err;
+        }
     }
-    const textParts = text.split(':');
-    const iv = Buffer.from(textParts.shift(), 'hex');
-    const encryptedText = Buffer.from(textParts.join(':'), 'hex');
-    const decipher = crypto.createDecipheriv(ALGORITHM, Buffer.from(ENCRYPTION_KEY, 'hex'), iv);
-    let decrypted = decipher.update(encryptedText);
-    decrypted = Buffer.concat([decrypted, decipher.final()]);
-    return decrypted.toString();
+    throw lastError instanceof Error ? lastError : new Error('This credential could not be decrypted.');
 };
 exports.decrypt = decrypt;
-const isEncryptionKeySet = () => {
-    return !!ENCRYPTION_KEY;
-};
+/** Whether a stored value is encrypted the current way (GCM, with the current key). */
+const isCurrentEncryption = (text) => !!currentKey && text.startsWith(`${VERSION}:${currentKey.id}:`);
+exports.isCurrentEncryption = isCurrentEncryption;
+/** Whether a stored value is in this module's own format (GCM, any key). */
+const isVersionedEncryption = (text) => text.startsWith(`${VERSION}:`);
+exports.isVersionedEncryption = isVersionedEncryption;
+const isEncryptionKeySet = () => !!currentKey;
 exports.isEncryptionKeySet = isEncryptionKeySet;

package/dist/utils/serviceEndpoints.d.ts

@@ -0,0 +1,2 @@
+import { ServiceProviderType } from '../types';
+export declare function isServiceEndpoint(provider: ServiceProviderType, endpoint: unknown): endpoint is string;

package/dist/utils/serviceEndpoints.js

@@ -0,0 +1,26 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isServiceEndpoint = isServiceEndpoint;
+// Where a service integration's credential may be sent: its own provider's API, over https.
+// A node chooses the endpoint it calls, and anyone who can edit the node could otherwise point
+// it at a server of their own and receive the credential of whoever connected the integration.
+const PROVIDER_HOSTS = {
+    claude: (host) => host === 'api.anthropic.com',
+    jira: (host) => host === 'api.atlassian.com' || host.endsWith('.atlassian.net'),
+    google: (host) => host === 'googleapis.com' || host.endsWith('.googleapis.com'),
+};
+function isServiceEndpoint(provider, endpoint) {
+    if (typeof endpoint !== 'string')
+        return false;
+    let url;
+    try {
+        url = new URL(endpoint);
+    }
+    catch {
+        return false;
+    }
+    if (url.protocol !== 'https:' || url.username || url.password || url.port)
+        return false;
+    const allowed = PROVIDER_HOSTS[provider];
+    return !!allowed && allowed(url.hostname.toLowerCase());
+}

package/package.json

@@ -1,11 +1,12 @@
 {
   "name": "streamby-core",
-  "version": "0.33.0",
+  "version": "0.34.0",
   "description": "StreamBy middleware framework for media storage management",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
   "files": [
-    "dist"
+    "dist",
+    "CHANGELOG.md"
   ],
   "scripts": {
     "build": "tsc",
@@ -27,7 +28,7 @@
     "typescript"
   ],
   "author": "TerminalCore Labs",
-  "license": "MIT",
+  "license": "AGPL-3.0-only",
   "dependencies": {
     "@aws-sdk/client-s3": "^3.528.0",
     "@aws-sdk/s3-request-presigner": "^3.787.0",

package/dist/middleware/routes/apiConnection.d.ts

@@ -1,3 +0,0 @@
-import { Router } from 'express';
-import { StreamByConfig } from '../../types';
-export declare function apiConnectionRouter(config: StreamByConfig): Router;

package/dist/middleware/routes/apiConnection.js

@@ -1,100 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.apiConnectionRouter = apiConnectionRouter;
-const express_1 = require("express");
-const manager_1 = require("../../models/manager");
-const auth_1 = require("../../utils/auth");
-const apiConnection_1 = require("../../services/apiConnection");
-const VALID_METHODS = ['GET', 'POST', 'PATCH', 'PUT', 'DELETE'];
-function apiConnectionRouter(config) {
-    const router = (0, express_1.Router)();
-    const Project = (0, manager_1.getModel)('projects');
-    // List API connections for a project
-    router.get('/projects/:id/api/connections', async (req, res) => {
-        try {
-            const auth = req.auth;
-            const projectId = req.params.id;
-            const project = await Project.findOne({ _id: projectId });
-            if (!project) {
-                return res.status(404).json({ message: 'Project not found' });
-            }
-            if (!(0, auth_1.isProjectMember)(project, auth.userId)) {
-                return res.status(403).json({ message: 'Unauthorized project access' });
-            }
-            return res.status(200).json({ data: project.apiConnections || [] });
-        }
-        catch (err) {
-            res.status(500).json({ message: 'Failed to fetch API connections', details: err.message });
-        }
-    });
-    // Add a new API connection to a project
-    router.post('/projects/:id/api/connections', async (req, res) => {
-        try {
-            const auth = req.auth;
-            if (auth.role !== 'admin' && auth.role !== 'editor') {
-                return res.status(403).json({ message: 'Permission denied' });
-            }
-            const projectId = req.params.id;
-            const { name, baseUrl, method, description, credentialId, prefix } = req.body;
-            if (!name || !baseUrl) {
-                return res.status(400).json({ message: 'name and baseUrl are required' });
-            }
-            if (!VALID_METHODS.includes(method)) {
-                return res.status(400).json({ message: `method must be one of: ${VALID_METHODS.join(', ')}` });
-            }
-            const project = await Project.findOne({ _id: projectId });
-            if (!project) {
-                return res.status(404).json({ message: 'Project not found' });
-            }
-            if (!(0, auth_1.isProjectMember)(project, auth.userId)) {
-                return res.status(403).json({ message: 'Unauthorized project access' });
-            }
-            if (credentialId) {
-                const credExists = project.credentials?.some((c) => c.id === credentialId);
-                if (!credExists) {
-                    return res.status(400).json({ message: 'Credential not found in project' });
-                }
-            }
-            const connection = await (0, apiConnection_1.addApiConnection)(config, projectId, {
-                name,
-                baseUrl,
-                method,
-                prefix,
-                ...(description !== undefined && { description }),
-                ...(credentialId !== undefined && { credentialId }),
-            });
-            return res.status(201).json({ data: connection });
-        }
-        catch (err) {
-            res.status(500).json({ message: 'Failed to add API connection', details: err.message });
-        }
-    });
-    // Delete an API connection from a project
-    router.delete('/projects/:id/api/connections/:connectionId', async (req, res) => {
-        try {
-            const auth = req.auth;
-            if (auth.role !== 'admin' && auth.role !== 'editor') {
-                return res.status(403).json({ message: 'Permission denied' });
-            }
-            const projectId = req.params.id;
-            const { connectionId } = req.params;
-            const project = await Project.findOne({ _id: projectId });
-            if (!project) {
-                return res.status(404).json({ message: 'Project not found' });
-            }
-            if (!(0, auth_1.isProjectMember)(project, auth.userId)) {
-                return res.status(403).json({ message: 'Unauthorized project access' });
-            }
-            const exists = project.apiConnections?.some((c) => c.id === connectionId);
-            if (!exists) {
-                return res.status(404).json({ message: 'API connection not found' });
-            }
-            await (0, apiConnection_1.deleteApiConnection)(config, projectId, connectionId);
-            return res.status(200).json({ message: 'API connection deleted successfully.' });
-        }
-        catch (err) {
-            res.status(500).json({ message: 'Failed to delete API connection', details: err.message });
-        }
-    });
-    return router;
-}

package/dist/middleware/routes/credential.d.ts

@@ -1,3 +0,0 @@
-import { Router } from 'express';
-import { StreamByConfig } from '../../types';
-export declare function credentialRouter(config: StreamByConfig): Router;

package/dist/middleware/routes/credential.js

@@ -1,80 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.credentialRouter = credentialRouter;
-const express_1 = require("express");
-const manager_1 = require("../../models/manager");
-const auth_1 = require("../../utils/auth");
-const sanitize_1 = require("../../utils/sanitize");
-const credential_1 = require("../../services/credential");
-function credentialRouter(config) {
-    const router = (0, express_1.Router)();
-    const Project = (0, manager_1.getModel)('projects');
-    // Add a new credential to a project
-    router.post('/projects/:id/credentials', async (req, res) => {
-        try {
-            const auth = req.auth;
-            if (auth.role !== 'admin' && auth.role !== 'editor') {
-                return res.status(403).json({ message: 'Permission denied' });
-            }
-            const projectId = req.params.id;
-            const { id, key, value } = req.body;
-            if (!key || !value) {
-                return res.status(400).json({ message: 'Missing credential key or value' });
-            }
-            const project = await Project.findOne({ _id: projectId });
-            if (!project || !(0, auth_1.isProjectMember)(project, auth.userId)) {
-                return res.status(403).json({ message: 'Unauthorized project access' });
-            }
-            const updatedProject = await (0, credential_1.addCredential)(config, projectId, { id, key, value });
-            res.status(201).json({ message: 'Credential added successfully', project: (0, sanitize_1.sanitizeProject)(updatedProject) });
-        }
-        catch (err) {
-            res.status(500).json({ message: 'Failed to add credential', details: err.message });
-        }
-    });
-    // Update an existing credential in a project
-    router.patch('/projects/:id/credentials/:credentialId', async (req, res) => {
-        try {
-            const auth = req.auth;
-            if (auth.role !== 'admin' && auth.role !== 'editor') {
-                return res.status(403).json({ message: 'Permission denied' });
-            }
-            const projectId = req.params.id;
-            const credentialId = req.params.credentialId;
-            const { key, value } = req.body;
-            if (!key && !value) {
-                return res.status(400).json({ message: 'No update fields provided' });
-            }
-            const project = await Project.findOne({ _id: projectId });
-            if (!project || !(0, auth_1.isProjectMember)(project, auth.userId)) {
-                return res.status(403).json({ message: 'Unauthorized project access' });
-            }
-            const updatedProject = await (0, credential_1.updateCredential)(config, projectId, credentialId, { key, value });
-            res.status(200).json({ message: 'Credential updated successfully', project: (0, sanitize_1.sanitizeProject)(updatedProject) });
-        }
-        catch (err) {
-            res.status(500).json({ message: 'Failed to update credential', details: err.message });
-        }
-    });
-    // Delete a credential from a project
-    router.delete('/projects/:id/credentials/:credentialId', async (req, res) => {
-        try {
-            const auth = req.auth;
-            if (auth.role !== 'admin' && auth.role !== 'editor') {
-                return res.status(403).json({ message: 'Permission denied' });
-            }
-            const projectId = req.params.id;
-            const credentialId = req.params.credentialId;
-            const project = await Project.findOne({ _id: projectId });
-            if (!project || !(0, auth_1.isProjectMember)(project, auth.userId)) {
-                return res.status(403).json({ message: 'Unauthorized project access' });
-            }
-            const updatedProject = await (0, credential_1.deleteCredential)(config, projectId, credentialId);
-            res.status(200).json({ message: 'Credential deleted successfully', project: (0, sanitize_1.sanitizeProject)(updatedProject) });
-        }
-        catch (err) {
-            res.status(500).json({ message: 'Failed to delete credential', details: err.message });
-        }
-    });
-    return router;
-}

package/dist/services/apiConnection.d.ts

@@ -1,18 +0,0 @@
-import { StreamByConfig, ApiConnection, ApiConnectionMethod } from '../types';
-export declare function addApiConnection(config: StreamByConfig, projectId: string, data: {
-    name: string;
-    apiUrl: string;
-    method: ApiConnectionMethod;
-    prefix?: string;
-    description?: string;
-    credentialId?: string;
-}): Promise<ApiConnection>;
-export declare function updateApiConnection(config: StreamByConfig, projectId: string, connectionId: string, data: {
-    name?: string;
-    apiUrl?: string;
-    method?: ApiConnectionMethod;
-    prefix?: string;
-    description?: string;
-    credentialId?: string;
-}): Promise<ApiConnection>;
-export declare function deleteApiConnection(config: StreamByConfig, projectId: string, connectionId: string): Promise<void>;

package/dist/services/apiConnection.js

@@ -1,65 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.addApiConnection = addApiConnection;
-exports.updateApiConnection = updateApiConnection;
-exports.deleteApiConnection = deleteApiConnection;
-const mongodb_1 = require("mongodb");
-const manager_1 = require("../models/manager");
-async function addApiConnection(config, projectId, data) {
-    const ProjectModel = (0, manager_1.getModel)('projects');
-    const project = await ProjectModel.findOne({ _id: projectId });
-    if (!project) {
-        throw new Error('Project not found.');
-    }
-    const connection = {
-        id: new mongodb_1.ObjectId().toHexString(),
-        name: data.name,
-        prefix: data.prefix,
-        apiUrl: data.apiUrl,
-        method: data.method,
-        projectId,
-        createdAt: new Date(),
-        ...(data.description !== undefined && { description: data.description }),
-        ...(data.credentialId !== undefined && { credentialId: data.credentialId }),
-    };
-    const updatedProject = await ProjectModel.update({ _id: projectId }, { $push: { apiConnections: connection } });
-    if (!updatedProject) {
-        throw new Error('Failed to add API connection to project.');
-    }
-    return connection;
-}
-async function updateApiConnection(config, projectId, connectionId, data) {
-    const ProjectModel = (0, manager_1.getModel)('projects');
-    const project = await ProjectModel.findOne({ _id: projectId });
-    if (!project)
-        throw new Error('Project not found.');
-    const connections = project.apiConnections ?? [];
-    const index = connections.findIndex((c) => c.id === connectionId);
-    if (index === -1)
-        throw new Error('API connection not found.');
-    const updated = {
-        ...connections[index],
-        ...(data.name !== undefined && { name: data.name }),
-        ...(data.apiUrl !== undefined && { apiUrl: data.apiUrl }),
-        ...(data.method !== undefined && { method: data.method }),
-        ...(data.prefix !== undefined && { prefix: data.prefix }),
-        ...(data.description !== undefined && { description: data.description }),
-        ...(data.credentialId !== undefined && { credentialId: data.credentialId }),
-    };
-    connections[index] = updated;
-    const result = await ProjectModel.update({ _id: projectId }, { $set: { apiConnections: connections } });
-    if (!result)
-        throw new Error('Failed to update API connection.');
-    return updated;
-}
-async function deleteApiConnection(config, projectId, connectionId) {
-    const ProjectModel = (0, manager_1.getModel)('projects');
-    const project = await ProjectModel.findOne({ _id: projectId });
-    if (!project) {
-        throw new Error('Project not found.');
-    }
-    const updatedProject = await ProjectModel.update({ _id: projectId }, { $pull: { apiConnections: { id: connectionId } } });
-    if (!updatedProject) {
-        throw new Error('Failed to delete API connection from project.');
-    }
-}

package/dist/services/credential.d.ts

@@ -1,8 +0,0 @@
-import { StreamByConfig, Credential, ProjectInfo } from '../types';
-export declare function addCredential(config: StreamByConfig, projectId: string, newCredential: Omit<Credential, 'encryptedValue'> & {
-    value: string;
-}): Promise<ProjectInfo>;
-export declare function updateCredential(config: StreamByConfig, projectId: string, credentialId: string, updates: Partial<Omit<Credential, 'encryptedValue'> & {
-    value: string;
-}>): Promise<ProjectInfo>;
-export declare function deleteCredential(config: StreamByConfig, projectId: string, credentialId: string): Promise<ProjectInfo>;