streamby-core 0.33.0 → 0.35.0

package/README.md

@@ -1,4 +1,6 @@
-# @streamby/core
+# streamby-core
+
+[![License: AGPL v3](https://img.shields.io/badge/License-AGPLv3-blue.svg)](https://www.gnu.org/licenses/agpl-3.0)
 
 Middleware framework for building storage-agnostic media APIs.  
 Part of the [StreamBy](https://streamby.nhexa.cl) ecosystem by TerminalCore Labs.
@@ -7,7 +9,7 @@ Part of the [StreamBy](https://streamby.nhexa.cl) ecosystem by TerminalCore Labs
 
 ## 🚀 What is it?
 
-`@streamby/core` is a plug-and-play middleware for Express (or compatible frameworks) that enables file uploads, listings and **multi-project access** over services like:
+`streamby-core` is a plug-and-play middleware for Express (or compatible frameworks) that enables file uploads, listings and **multi-project access** over services like:
 
 - ✅ AWS S3
 - ✅ Google Cloud Storage (soon)
@@ -21,7 +23,7 @@ It's designed to be installed inside your existing API as a library — **no nee
 ## 📦 Installation
 
 ```bash
-npm install @streamby/core ws
+npm install streamby-core ws
 npm install -D @types/ws
 ```
 
@@ -33,7 +35,7 @@ npm install -D @types/ws
 import http from 'http';
 import express from 'express';
 import { WebSocketServer } from 'ws';
-import { createStreamByRouter } from '@streamby/core';
+import { createStreamByRouter } from 'streamby-core';
 
 const app = express();
 const server = http.createServer(app);
@@ -59,7 +61,7 @@ app.use('/streamby', express.json(), createStreamByRouter({
       },
     },
   ],
-  encrypt: process.env.STREAMBY_ENCRYPTION_KEY,
+  encrypt: process.env.STREAMBY_ENCRYPTION_KEY, // 64 hex characters; see "Encryption and key rotation"
   websocket: { server: wss },
 }));
 
@@ -71,9 +73,103 @@ server.listen(3000);
 
 ---
 
+## 🔑 Encryption and key rotation
+
+Credentials stored by StreamBy (connection secrets, export credentials, user integrations,
+distribution and render farm credentials) are encrypted with the key you pass as `encrypt`:
+32 bytes, written as 64 hexadecimal characters. Each stored value records the id of the key
+that encrypted it (a fingerprint, never the key itself), so you can rotate the key:
+
+1. Generate a new key, for example with `openssl rand -hex 32`.
+2. Pass the new key as `encrypt` and the previous one in `encryptPreviousKeys`.
+3. Restart. Values encrypted with a previous key still decrypt, and at startup StreamBy
+   re-encrypts all of them with the new key.
+4. Once that's done (the startup log says how many records it re-encrypted, and none are left
+   on the old key), you can remove the old key from `encryptPreviousKeys`.
+
+```ts
+createStreamByRouter({
+  // ...
+  encrypt: process.env.STREAMBY_ENCRYPTION_KEY,               // the current key
+  encryptPreviousKeys: [process.env.STREAMBY_PREVIOUS_KEY!],  // only while rotating
+});
+```
+
+> Upgrading from a version before 0.34.0: deploy with your current key first, and rotate only
+> after that deploy (see the [changelog](CHANGELOG.md)).
+
+---
+
+## 🎫 API tokens
+
+Agents and services work with StreamBy as a user through API tokens, without the user's
+browser session. A user manages their own tokens (`GET`, `POST` and
+`DELETE /streamby/user/api-tokens`, only with a session). Each token has:
+
+- **an access level**: `read` (only reads) or `write` (reads and writes);
+- **the projects it reaches**: a list of project ids, or `'*'` for every project the user is a
+  member of, including ones they join later;
+- **an expiry**: 7, 30, 90 or 365 days, or none.
+
+A token is `sbt_` followed by 32 random bytes. It's shown once, when it's made. Only its
+SHA-256 hash is stored, with a short prefix to tell it apart.
+
+Requests send it as `Authorization: Bearer sbt_...`. Your `authProvider` resolves it with
+`resolveApiToken` and returns its owner, with the token's scope in `apiToken`:
+
+```ts
+import { createStreamByRouter, resolveApiToken, API_TOKEN_PREFIX } from 'streamby-core';
+
+createStreamByRouter({
+  // ...
+  authProvider: async (req) => {
+    const bearer = req.headers.authorization?.replace(/^Bearer /, '');
+    if (bearer?.startsWith(API_TOKEN_PREFIX)) {
+      const resolved = await resolveApiToken(bearer); // null once revoked or expired
+      if (!resolved) throw new Error('Invalid API token');
+      const user = await findUser(resolved.userId);   // your own user lookup
+      return { userId: user.id, username: user.username, role: user.role, apiToken: resolved.scope };
+    }
+    // ...your session-based authentication
+  },
+});
+```
+
+A request made with a token reaches only what the token's scope allows:
+
+- a `read` token can't write;
+- a project outside the token's projects answers 404, and the project list shows only the
+  token's projects;
+- a token can't manage tokens;
+- outside a project, a token can only make a few reads (`/auth`, `/projects`, `/jobs/:jobId`,
+  `/user/subscription`, `/users/search`).
+
+The owner's role in each project still applies on top of that. A token never does more than
+its owner can, and it stops reaching a project as soon as its owner leaves it.
+
+---
+
+## 👥 Project roles
+
+What a user can do in a project depends on their role in that project, as an active member
+(an invitation counts once it's accepted). It never depends on the platform role your
+`authProvider` returns.
+
+| Role | Can |
+|---|---|
+| `viewer` | See the project and its content, and archive the project in their own list. |
+| `editor` | Everything a viewer can, plus change the project: its details, connections, exports, files and folders, workflow, pipelines, production, reviews, rights, and start jobs. |
+| `admin` | Everything an editor can, plus manage the project's members and delete the project. |
+
+A project's public exports (`GET /streamby/:projectId/export/:exportName`) are read without a
+session. They only run nodes that read data: never a node that uses an account's credential,
+nor one that starts a job.
+
+---
+
 ## 🗄️ Database Schema Setup
 
-`@streamby/core` requires a pre-configured database schema for its internal operations. It does not manage database connections directly; instead, it expects the host application to provide initialized connection instances. This ensures full control and flexibility for the host environment.
+`streamby-core` requires a pre-configured database schema for its internal operations. It does not manage database connections directly; instead, it expects the host application to provide initialized connection instances. This ensures full control and flexibility for the host environment.
 
 The library will only interact with the specified schema and will not touch other schemas in your database. The `reset` option is opt-in and will only drop and recreate the specified `streamby` schema if explicitly set to `true`.
 
@@ -81,7 +177,7 @@ The library will only interact with the specified schema and will not touch othe
 
 ```ts
 import { Pool } from "pg";
-import { setupStreambyPg } from "@streamby/core/pg/setup"; // Adjust path as per your package structure
+import { setupStreambyPg } from "streamby-core/pg/setup"; // Adjust path as per your package structure
 
 const pool = new Pool({ connectionString: process.env.DATABASE_URL });
 
@@ -94,7 +190,7 @@ await setupStreambyPg({ pool, schema: "streamby", reset: false });
 
 ```ts
 import { MongoClient } from "mongodb";
-import { setupStreambyMongo } from "@streamby/core/mongo/setup"; // Adjust path as per your package structure
+import { setupStreambyMongo } from "streamby-core/mongo/setup"; // Adjust path as per your package structure
 
 const client = new MongoClient(process.env.MONGO_URL!);
 
@@ -107,7 +203,7 @@ await setupStreambyMongo({ client, dbName: "streamby" });
 
 ```ts
 import express from 'express';
-import { createStreamByRouter } from '@streamby/core';
+import { createStreamByRouter } from 'streamby-core';
 
 const app = express();
 
@@ -168,7 +264,7 @@ Unit tests use [Vitest](https://vitest.dev) and [Supertest](https://www.npmjs.co
 
 ## 🗺️ API Endpoints
 
-Here's a summary of the key API endpoints provided by `@streamby/core`:
+Here's a summary of the key API endpoints provided by `streamby-core`:
 
 ### `GET /streamby/projects`
 
@@ -279,5 +375,9 @@ Visit us [here](https://terminalcore.cl)
 
 ## 📟 License
 
-[MIT](./LICENSE)
+Copyright (C) 2026 TerminalCore Labs
+
+Licensed under the [GNU Affero General Public License v3.0](./LICENSE) (AGPL-3.0-only).
+
+> **Note for consumers:** unlike most installable packages, this one is intentionally AGPL rather than MIT. AGPL's copyleft applies to any project that depends on it -- if you install `streamby-core`, your own project must also be licensed under AGPL-3.0 (or a compatible copyleft license). Confirm this is acceptable for your use case before adding this dependency.
 

package/dist/adapters/database/connectionManager.js

@@ -147,6 +147,24 @@ const ensureTablesExist = async (pool) => {
       CREATE INDEX IF NOT EXISTS user_integrations_userid_idx ON streamby.user_integrations ("userId");
     `);
         console.log('✅ "user_integrations" table ensured to exist.');
+        // API tokens: only their hash is kept (see services/apiTokens). Main db only, like
+        // user_integrations above.
+        await pool.query(`
+      CREATE TABLE IF NOT EXISTS streamby.api_tokens (
+        id            TEXT PRIMARY KEY DEFAULT uuid_generate_v4()::text,
+        "userId"      VARCHAR(255) NOT NULL,
+        name          VARCHAR(255) NOT NULL,
+        prefix        VARCHAR(32) NOT NULL,
+        hash          CHAR(64) NOT NULL UNIQUE,
+        access        VARCHAR(10) NOT NULL,
+        "projectIds"  JSONB NOT NULL,
+        "createdAt"   TIMESTAMP WITH TIME ZONE DEFAULT NOW(),
+        "expiresAt"   TIMESTAMP WITH TIME ZONE,
+        "lastUsedAt"  TIMESTAMP WITH TIME ZONE
+      );
+      CREATE INDEX IF NOT EXISTS api_tokens_userid_idx ON streamby.api_tokens ("userId");
+    `);
+        console.log('✅ "api_tokens" table ensured to exist.');
     }
     catch (error) {
         console.error('❌ Error ensuring tables exist:', error);

package/dist/index.d.ts

@@ -1,4 +1,6 @@
 export { createStreamByRouter } from './middleware/createRouter';
 export { emitToUser } from './services/wsHub';
 export { createNotification } from './services/notification';
-export type { UserPlan, UserSubscription } from './types';
+export type { UserPlan, UserSubscription, Auth, ApiTokenScope, ApiTokenAccess } from './types';
+export { resolveApiToken, API_TOKEN_PREFIX } from './services/apiTokens';
+export type { ResolvedApiToken } from './services/apiTokens';

package/dist/index.js

@@ -1,9 +1,12 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.createNotification = exports.emitToUser = exports.createStreamByRouter = void 0;
+exports.API_TOKEN_PREFIX = exports.resolveApiToken = exports.createNotification = exports.emitToUser = exports.createStreamByRouter = void 0;
 var createRouter_1 = require("./middleware/createRouter");
 Object.defineProperty(exports, "createStreamByRouter", { enumerable: true, get: function () { return createRouter_1.createStreamByRouter; } });
 var wsHub_1 = require("./services/wsHub");
 Object.defineProperty(exports, "emitToUser", { enumerable: true, get: function () { return wsHub_1.emitToUser; } });
 var notification_1 = require("./services/notification");
 Object.defineProperty(exports, "createNotification", { enumerable: true, get: function () { return notification_1.createNotification; } });
+var apiTokens_1 = require("./services/apiTokens");
+Object.defineProperty(exports, "resolveApiToken", { enumerable: true, get: function () { return apiTokens_1.resolveApiToken; } });
+Object.defineProperty(exports, "API_TOKEN_PREFIX", { enumerable: true, get: function () { return apiTokens_1.API_TOKEN_PREFIX; } });

package/dist/middleware/createRouter.js

@@ -9,8 +9,10 @@ const manager_1 = require("../models/manager");
 const storage_1 = require("../providers/storage");
 const connectionManager_1 = require("../adapters/database/connectionManager");
 const backfillBuiltinConnections_1 = require("../services/backfillBuiltinConnections");
+const reencryptCredentials_1 = require("../services/reencryptCredentials");
 const wsHub_1 = require("../services/wsHub");
 const auth_1 = require("../services/auth");
+const apiToken_1 = require("./routes/apiToken");
 const encryption_1 = require("../utils/encryption");
 const auth_2 = require("./routes/auth");
 const user_1 = require("./routes/user");
@@ -38,7 +40,7 @@ const pipeline_1 = require("./routes/pipeline");
 function createStreamByRouter(config) {
     const router = express_1.default.Router();
     if (config.encrypt)
-        (0, encryption_1.setEncryptionKey)(config.encrypt);
+        (0, encryption_1.setEncryptionKey)(config.encrypt, config.encryptPreviousKeys);
     // Establish DB connections asynchronously (Postgres/Mongo + schema migrations).
     // Until they're ready, HOLD incoming requests instead of letting them through —
     // route handlers resolve projects/exports (e.g. the /menu-list export) against a
@@ -52,6 +54,16 @@ function createStreamByRouter(config) {
         .then(() => (0, backfillBuiltinConnections_1.backfillBuiltinConnections)(config))
         .catch((err) => {
         console.error('❌ StreamBy: failed to backfill built-in connections:', err);
+    })
+        .then(() => (0, reencryptCredentials_1.reencryptStoredCredentials)())
+        .then(({ updated, failed }) => {
+        if (updated)
+            console.log(`✅ StreamBy: re-encrypted the credentials of ${updated} record(s).`);
+        if (failed)
+            console.error(`❌ StreamBy: ${failed} stored credential(s) could not be decrypted with the configured keys; left as they are.`);
+    })
+        .catch((err) => {
+        console.error('❌ StreamBy: failed to re-encrypt stored credentials:', err);
     })
         .finally(() => {
         ready = true;
@@ -84,15 +96,20 @@ function createStreamByRouter(config) {
             (0, manager_1.registerModel)('users', [mainDb.id], 'users', 'accounts');
             (0, manager_1.registerModel)('user_subscriptions', [mainDb.id], 'user_subscriptions', 'streamby');
             (0, manager_1.registerModel)('user_integrations', [mainDb.id], 'user_integrations', streambySchema);
+            (0, manager_1.registerModel)('api_tokens', [mainDb.id], 'api_tokens', streambySchema);
         }
     }
     if (config.websocket?.server) {
         (0, wsHub_1.initWsHub)(config.websocket.server, config);
     }
-    router.use((0, user_1.userRouter)(config));
+    // /auth answers whether there's a session (it reads it itself); everything after needs one,
+    // but for the public export route (see authenticate).
     router.use((0, auth_2.authRouter)(config));
     router.use((0, auth_1.authenticate)(config));
+    router.use(auth_1.enforceApiTokenScope);
     router.use(subscription_1.ensureSubscription);
+    router.use((0, user_1.userRouter)(config));
+    router.use((0, apiToken_1.apiTokenRouter)(config));
     router.use((0, export_1.exportRouter)(config));
     router.use((0, member_1.memberRouter)(config));
     router.use((0, storage_2.storageRouter)(config));

package/dist/middleware/routes/ai.js

@@ -29,7 +29,7 @@ function aiRouter(_config) {
             const project = await Project.findOne({ _id: projectId });
             if (!project)
                 return res.status(404).json({ message: 'Project not found' });
-            if (!(0, auth_1.isProjectMember)(project, auth.userId))
+            if (!(0, auth_1.canEditProject)(project, auth.userId))
                 return res.status(403).json({ message: 'Unauthorized' });
             const job = (0, jobQueue_1.createJob)('transcription', auth.userId, projectId, { fileId, model, sourceLanguage, outputFormats, provider, credentialId });
             setImmediate(() => (0, aiProcessor_1.runTranscriptionJob)(job.jobId, fileId, projectId, { model, sourceLanguage, outputFormats, provider, credentialId }));
@@ -50,7 +50,7 @@ function aiRouter(_config) {
             const project = await Project.findOne({ _id: projectId });
             if (!project)
                 return res.status(404).json({ message: 'Project not found' });
-            if (!(0, auth_1.isProjectMember)(project, auth.userId))
+            if (!(0, auth_1.canEditProject)(project, auth.userId))
                 return res.status(403).json({ message: 'Unauthorized' });
             const job = (0, jobQueue_1.createJob)('upscale', auth.userId, projectId, { fileId, scale, model, mode, credentialId });
             setImmediate(() => (0, aiProcessor_1.runUpscaleJob)(job.jobId, fileId, projectId, { scale, model, mode, credentialId }));
@@ -71,7 +71,7 @@ function aiRouter(_config) {
             const project = await Project.findOne({ _id: projectId });
             if (!project)
                 return res.status(404).json({ message: 'Project not found' });
-            if (!(0, auth_1.isProjectMember)(project, auth.userId))
+            if (!(0, auth_1.canEditProject)(project, auth.userId))
                 return res.status(403).json({ message: 'Unauthorized' });
             const job = (0, jobQueue_1.createJob)('generate-asset', auth.userId, projectId, { assetType, provider, prompt, seed, credentialId });
             setImmediate(() => (0, aiProcessor_1.runGenerateAssetJob)(job.jobId, projectId, { assetType, provider, prompt, seed, credentialId }));

package/dist/middleware/routes/{credential.d.ts → apiToken.d.ts}

@@ -1,3 +1,3 @@
 import { Router } from 'express';
 import { StreamByConfig } from '../../types';
-export declare function credentialRouter(config: StreamByConfig): Router;
+export declare function apiTokenRouter(config: StreamByConfig): Router;

package/dist/middleware/routes/apiToken.js

@@ -0,0 +1,58 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.apiTokenRouter = apiTokenRouter;
+const express_1 = require("express");
+const manager_1 = require("../../models/manager");
+const auth_1 = require("../../utils/auth");
+const apiTokens_1 = require("../../services/apiTokens");
+// The signed-in user's own API tokens (see services/apiTokens): listed, made, revoked. Only
+// with a session: a token can't manage tokens (see enforceApiTokenScope).
+function apiTokenRouter(config) {
+    const router = (0, express_1.Router)();
+    const Project = (0, manager_1.getModel)('projects');
+    router.get('/user/api-tokens', async (req, res) => {
+        try {
+            const auth = req.auth;
+            res.json({ apiTokens: await (0, apiTokens_1.listApiTokens)(auth.userId) });
+        }
+        catch (err) {
+            res.status(500).json({ message: 'Failed to list API tokens', details: err.message });
+        }
+    });
+    // The token itself is in this response only: it's never stored, nor shown again.
+    router.post('/user/api-tokens', async (req, res) => {
+        try {
+            const auth = req.auth;
+            const { name, access, projectIds, expiresInDays } = req.body ?? {};
+            // A token reaches only projects its owner is in.
+            if (Array.isArray(projectIds)) {
+                for (const id of projectIds) {
+                    const project = typeof id === 'string' ? await Project.findOne({ _id: id }) : null;
+                    if (!(0, auth_1.isProjectMember)(project, auth.userId)) {
+                        return res.status(400).json({ message: `You are not a member of project '${id}'` });
+                    }
+                }
+            }
+            const { token, info } = await (0, apiTokens_1.createApiToken)(auth.userId, { name, access, projectIds, expiresInDays: expiresInDays ?? null }, config);
+            res.status(201).json({ token, apiToken: info, message: 'Copy the token now: it will not be shown again' });
+        }
+        catch (err) {
+            if (err instanceof apiTokens_1.ApiTokenError)
+                return res.status(err.status).json({ message: err.message });
+            res.status(500).json({ message: 'Failed to create API token', details: err.message });
+        }
+    });
+    router.delete('/user/api-tokens/:tokenId', async (req, res) => {
+        try {
+            const auth = req.auth;
+            const revoked = await (0, apiTokens_1.revokeApiToken)(auth.userId, req.params.tokenId);
+            if (!revoked)
+                return res.status(404).json({ message: 'API token not found' });
+            res.status(204).end();
+        }
+        catch (err) {
+            res.status(500).json({ message: 'Failed to revoke API token', details: err.message });
+        }
+    });
+    return router;
+}

package/dist/middleware/routes/connection.js

@@ -65,9 +65,6 @@ function connectionRouter(config) {
     router.post('/projects/:id/connections', async (req, res) => {
         try {
             const auth = req.auth;
-            if (auth.role !== 'admin' && auth.role !== 'editor') {
-                return res.status(403).json({ message: 'Permission denied' });
-            }
             const projectId = req.params.id;
             const { name, apiUrl, method, description, token, prefix } = req.body;
             if (!name || !apiUrl) {
@@ -80,7 +77,7 @@ function connectionRouter(config) {
             if (!project) {
                 return res.status(404).json({ message: 'Project not found' });
             }
-            if (!(0, auth_1.isProjectMember)(project, auth.userId)) {
+            if (!(0, auth_1.canEditProject)(project, auth.userId)) {
                 return res.status(403).json({ message: 'Unauthorized project access' });
             }
             const connection = await (0, connection_1.addConnection)(config, projectId, {
@@ -101,9 +98,6 @@ function connectionRouter(config) {
     router.patch('/projects/:id/connections/:connectionId', async (req, res) => {
         try {
             const auth = req.auth;
-            if (auth.role !== 'admin' && auth.role !== 'editor') {
-                return res.status(403).json({ message: 'Permission denied' });
-            }
             const { id: projectId, connectionId } = req.params;
             const { name, apiUrl, method, description, token, prefix } = req.body;
             if (method && !VALID_METHODS.includes(method)) {
@@ -112,7 +106,7 @@ function connectionRouter(config) {
             const project = await Project.findOne({ _id: projectId });
             if (!project)
                 return res.status(404).json({ message: 'Project not found' });
-            if (!(0, auth_1.isProjectMember)(project, auth.userId)) {
+            if (!(0, auth_1.canEditProject)(project, auth.userId)) {
                 return res.status(403).json({ message: 'Unauthorized project access' });
             }
             const updated = await (0, connection_1.updateConnection)(config, projectId, connectionId, {
@@ -170,16 +164,13 @@ function connectionRouter(config) {
     router.delete('/projects/:id/connections/:connectionId', async (req, res) => {
         try {
             const auth = req.auth;
-            if (auth.role !== 'admin' && auth.role !== 'editor') {
-                return res.status(403).json({ message: 'Permission denied' });
-            }
             const projectId = req.params.id;
             const { connectionId } = req.params;
             const project = await Project.findOne({ _id: projectId });
             if (!project) {
                 return res.status(404).json({ message: 'Project not found' });
             }
-            if (!(0, auth_1.isProjectMember)(project, auth.userId)) {
+            if (!(0, auth_1.canEditProject)(project, auth.userId)) {
                 return res.status(403).json({ message: 'Unauthorized project access' });
             }
             const exists = project.connections?.some((c) => c.id === connectionId);

package/dist/middleware/routes/dbConnection.js

@@ -49,9 +49,6 @@ function dbConnectionRouter(config) {
     router.post('/projects/:id/connections/db', async (req, res) => {
         try {
             const auth = req.auth;
-            if (auth.role !== 'admin' && auth.role !== 'editor') {
-                return res.status(403).json({ message: 'Permission denied' });
-            }
             const { name, dbType, credential, integrationId, description } = req.body;
             if (!name || !dbType) {
                 return res.status(400).json({ message: 'name and dbType are required' });
@@ -68,7 +65,7 @@ function dbConnectionRouter(config) {
             const project = await Project.findOne({ _id: req.params.id });
             if (!project)
                 return res.status(404).json({ message: 'Project not found' });
-            if (!(0, auth_1.isProjectMember)(project, auth.userId))
+            if (!(0, auth_1.canEditProject)(project, auth.userId))
                 return res.status(403).json({ message: 'Unauthorized project access' });
             let encryptedCredential;
             if (integrationId) {
@@ -106,13 +103,10 @@ function dbConnectionRouter(config) {
     router.delete('/projects/:id/connections/db/:connId', async (req, res) => {
         try {
             const auth = req.auth;
-            if (auth.role !== 'admin' && auth.role !== 'editor') {
-                return res.status(403).json({ message: 'Permission denied' });
-            }
             const project = await Project.findOne({ _id: req.params.id });
             if (!project)
                 return res.status(404).json({ message: 'Project not found' });
-            if (!(0, auth_1.isProjectMember)(project, auth.userId))
+            if (!(0, auth_1.canEditProject)(project, auth.userId))
                 return res.status(403).json({ message: 'Unauthorized project access' });
             const conn = (0, connectionResolver_1.findDbConnection)(project, req.params.connId);
             if (!conn)
@@ -149,13 +143,10 @@ function dbConnectionRouter(config) {
     router.post('/projects/:id/connections/db/:connId/tables', async (req, res) => {
         try {
             const auth = req.auth;
-            if (auth.role !== 'admin' && auth.role !== 'editor') {
-                return res.status(403).json({ message: 'Permission denied' });
-            }
             const project = await Project.findOne({ _id: req.params.id });
             if (!project)
                 return res.status(404).json({ message: 'Project not found' });
-            if (!(0, auth_1.isProjectMember)(project, auth.userId))
+            if (!(0, auth_1.canEditProject)(project, auth.userId))
                 return res.status(403).json({ message: 'Unauthorized project access' });
             const schema = req.body;
             if (!schema.tableName)
@@ -177,13 +168,10 @@ function dbConnectionRouter(config) {
     router.delete('/projects/:id/connections/db/:connId/tables/:tableName', async (req, res) => {
         try {
             const auth = req.auth;
-            if (auth.role !== 'admin' && auth.role !== 'editor') {
-                return res.status(403).json({ message: 'Permission denied' });
-            }
             const project = await Project.findOne({ _id: req.params.id });
             if (!project)
                 return res.status(404).json({ message: 'Project not found' });
-            if (!(0, auth_1.isProjectMember)(project, auth.userId))
+            if (!(0, auth_1.canEditProject)(project, auth.userId))
                 return res.status(403).json({ message: 'Unauthorized project access' });
             await withResolvedDbClient(project, req.params.connId, config, auth, res, async (resolved) => {
                 await (0, dbConnection_1.deleteTableOrCollectionInternal)(resolved.client, resolved.type, req.params.tableName, req.params.id);
@@ -218,13 +206,10 @@ function dbConnectionRouter(config) {
     router.post('/projects/:id/connections/db/:connId/tables/:tableName', async (req, res) => {
         try {
             const auth = req.auth;
-            if (auth.role !== 'admin' && auth.role !== 'editor') {
-                return res.status(403).json({ message: 'Permission denied' });
-            }
             const project = await Project.findOne({ _id: req.params.id });
             if (!project)
                 return res.status(404).json({ message: 'Project not found' });
-            if (!(0, auth_1.isProjectMember)(project, auth.userId))
+            if (!(0, auth_1.canEditProject)(project, auth.userId))
                 return res.status(403).json({ message: 'Unauthorized project access' });
             const record = req.body;
             if (!record || typeof record !== 'object' || Array.isArray(record)) {
@@ -243,12 +228,10 @@ function dbConnectionRouter(config) {
     router.put('/projects/:id/connections/db/:connId/tables/:tableName/:recordId', async (req, res) => {
         try {
             const auth = req.auth;
-            if (auth.role !== 'admin' && auth.role !== 'editor')
-                return res.status(403).json({ message: 'Permission denied' });
             const project = await Project.findOne({ _id: req.params.id });
             if (!project)
                 return res.status(404).json({ message: 'Project not found' });
-            if (!(0, auth_1.isProjectMember)(project, auth.userId))
+            if (!(0, auth_1.canEditProject)(project, auth.userId))
                 return res.status(403).json({ message: 'Unauthorized project access' });
             const updates = req.body;
             if (!updates || typeof updates !== 'object' || Array.isArray(updates)) {
@@ -267,12 +250,10 @@ function dbConnectionRouter(config) {
     router.delete('/projects/:id/connections/db/:connId/tables/:tableName/:recordId', async (req, res) => {
         try {
             const auth = req.auth;
-            if (auth.role !== 'admin' && auth.role !== 'editor')
-                return res.status(403).json({ message: 'Permission denied' });
             const project = await Project.findOne({ _id: req.params.id });
             if (!project)
                 return res.status(404).json({ message: 'Project not found' });
-            if (!(0, auth_1.isProjectMember)(project, auth.userId))
+            if (!(0, auth_1.canEditProject)(project, auth.userId))
                 return res.status(403).json({ message: 'Unauthorized project access' });
             await withResolvedDbClient(project, req.params.connId, config, auth, res, async (resolved) => {
                 await (0, dbConnection_1.deleteRecordInternal)(resolved.client, resolved.type, req.params.tableName, req.params.recordId, req.params.id);

package/dist/middleware/routes/distribution.js

@@ -11,6 +11,7 @@ const wsHub_1 = require("../../services/wsHub");
 const connectionManager_1 = require("../../adapters/database/connectionManager");
 const sanitize_1 = require("../../utils/sanitize");
 const crypto_1 = __importDefault(require("crypto"));
+const encryption_1 = require("../../utils/encryption");
 function getDb() {
     const ids = (0, connectionManager_1.getConnectedIds)().filter(id => (0, connectionManager_1.getConnection)(id).type === 'nosql');
     if (!ids.length)
@@ -44,13 +45,19 @@ function distributionRouter(_config) {
         try {
             const auth = req.auth;
             const { projectId } = req.params;
-            const { name, target, encryptedCredential, config, description } = req.body;
+            const { name, target, credential: credentialValue, encryptedCredential: legacyCredential, config, description } = req.body;
+            // The credential, as given (`encryptedCredential` was its old name: it was always the
+            // value itself), stored encrypted.
+            const credential = credentialValue ?? legacyCredential;
+            if (credential && !(0, encryption_1.isEncryptionKeySet)())
+                return res.status(500).json({ message: 'Encryption key is not set' });
+            const encryptedCredential = credential ? (0, encryption_1.encrypt)(String(credential)) : undefined;
             if (!name || !target)
                 return res.status(400).json({ message: 'name and target are required' });
             const project = await Project.findOne({ _id: projectId });
             if (!project)
                 return res.status(404).json({ message: 'Project not found' });
-            if (!(0, auth_1.isProjectMember)(project, auth.userId))
+            if (!(0, auth_1.canEditProject)(project, auth.userId))
                 return res.status(403).json({ message: 'Unauthorized' });
             const connection = {
                 id: crypto_1.default.randomUUID(),
@@ -76,7 +83,7 @@ function distributionRouter(_config) {
             const project = await Project.findOne({ _id: projectId });
             if (!project)
                 return res.status(404).json({ message: 'Project not found' });
-            if (!(0, auth_1.isProjectMember)(project, auth.userId))
+            if (!(0, auth_1.canEditProject)(project, auth.userId))
                 return res.status(403).json({ message: 'Unauthorized' });
             await Project.update({ _id: projectId }, { $pull: { distributionConnections: { id: connectionId } } });
             res.json({ message: 'Connection deleted' });
@@ -96,7 +103,7 @@ function distributionRouter(_config) {
             const project = await Project.findOne({ _id: projectId });
             if (!project)
                 return res.status(404).json({ message: 'Project not found' });
-            if (!(0, auth_1.isProjectMember)(project, auth.userId))
+            if (!(0, auth_1.canEditProject)(project, auth.userId))
                 return res.status(403).json({ message: 'Unauthorized' });
             const exportDoc = await Export.findOne({ id: exportId, projectId });
             if (!exportDoc)
@@ -169,7 +176,7 @@ function distributionRouter(_config) {
             const project = await Project.findOne({ _id: projectId });
             if (!project)
                 return res.status(404).json({ message: 'Project not found' });
-            if (!(0, auth_1.isProjectMember)(project, auth.userId))
+            if (!(0, auth_1.canEditProject)(project, auth.userId))
                 return res.status(403).json({ message: 'Unauthorized' });
             const db = getDb();
             if (!db)

package/dist/middleware/routes/export.js

@@ -237,7 +237,7 @@ function exportRouter(config) {
             const resolvedNodeSchema = nodeSchema ?? DEFAULT_NODE_SCHEMA;
             const exportType = useConnections ? 'externalApi' : 'json';
             const project = await Project.findOne({ _id: projectId });
-            if (!project || !(0, auth_1.isProjectMember)(project, auth.userId)) {
+            if (!project || !(0, auth_1.canEditProject)(project, auth.userId)) {
                 return res.status(403).json({ message: 'Unauthorized project access' });
             }
             const mainDb = config.databases?.find(db => db.main) ?? config.databases?.[0];
@@ -258,7 +258,7 @@ function exportRouter(config) {
             const { id: projectId, export_id: exportId } = req.params;
             const { name, description, isPrivate, allowedOrigin, devMode, devPorts, useConnections, useCredentials, nodeSchema } = req.body;
             const project = await Project.findOne({ _id: projectId });
-            if (!project || !(0, auth_1.isProjectMember)(project, auth.userId)) {
+            if (!project || !(0, auth_1.canEditProject)(project, auth.userId)) {
                 return res.status(403).json({ message: 'Unauthorized project access' });
             }
             const exportMetadata = project.exports?.find((e) => e.id.toString() === exportId);
@@ -284,7 +284,7 @@ function exportRouter(config) {
             }
             const { id: projectId, export_id: exportId } = req.params;
             const project = await Project.findOne({ _id: projectId });
-            if (!project || !(0, auth_1.isProjectMember)(project, auth.userId)) {
+            if (!project || !(0, auth_1.canEditProject)(project, auth.userId)) {
                 return res.status(403).json({ message: 'Unauthorized project access' });
             }
             const exportMetadata = project.exports.find((e) => e.id.toString() === exportId);
@@ -352,7 +352,8 @@ function exportRouter(config) {
             }
             let data;
             if (exportMetadata.nodeSchema) {
-                data = await (0, executor_1.executeExport)(exportMetadata.nodeSchema, project, config);
+                // Read without a session: only the nodes that read data run (see executeExport).
+                data = await (0, executor_1.executeExport)(exportMetadata.nodeSchema, project, config, { public: true });
                 return res.json(data ?? null);
             }
             // Legacy path: raw JSON or external API export