streamby-core 0.33.0 → 0.35.0

package/dist/middleware/routes/media.js

@@ -8,6 +8,7 @@ const jobQueue_1 = require("../../services/jobQueue");
 const mediaProcessor_1 = require("../../services/mediaProcessor");
 const storage_1 = require("../../providers/storage");
 const connectionManager_1 = require("../../adapters/database/connectionManager");
+const auth_2 = require("../../services/auth");
 function getMetadataCollection() {
     const ids = (0, connectionManager_1.getConnectedIds)().filter(id => (0, connectionManager_1.getConnection)(id).type === 'nosql');
     if (!ids.length)
@@ -25,11 +26,27 @@ function mediaRouter(config) {
     const adapter = config.adapter || (0, storage_1.createStorageProvider)(config.storageProviders);
     const Project = (0, manager_1.getModel)('projects');
     // GET /jobs/:jobId — poll job status
-    router.get('/jobs/:jobId', (req, res) => {
-        const job = (0, jobQueue_1.getJob)(req.params.jobId);
-        if (!job)
-            return res.status(404).json({ message: 'Job not found' });
-        res.json({ job });
+    // Only for whoever started it, or a member of its project: someone else's job is as if it
+    // didn't exist.
+    router.get('/jobs/:jobId', async (req, res) => {
+        try {
+            const auth = req.auth;
+            const job = (0, jobQueue_1.getJob)(req.params.jobId);
+            if (!job)
+                return res.status(404).json({ message: 'Job not found' });
+            // With an API token, only a job of a project it reaches.
+            if (!(0, auth_2.scopeReachesProject)(auth.apiToken, job.projectId))
+                return res.status(404).json({ message: 'Job not found' });
+            if (job.userId !== auth.userId) {
+                const project = await Project.findOne({ _id: job.projectId });
+                if (!(0, auth_1.isProjectMember)(project, auth.userId))
+                    return res.status(404).json({ message: 'Job not found' });
+            }
+            res.json({ job });
+        }
+        catch (err) {
+            res.status(500).json({ message: 'Failed to fetch job', details: err.message });
+        }
     });
     // POST /projects/:projectId/jobs/ingest — queue an ingest job for an already-uploaded file
     router.post('/projects/:projectId/jobs/ingest', async (req, res) => {
@@ -42,7 +59,7 @@ function mediaRouter(config) {
             const project = await Project.findOne({ _id: projectId });
             if (!project)
                 return res.status(404).json({ message: 'Project not found' });
-            if (!(0, auth_1.isProjectMember)(project, auth.userId))
+            if (!(0, auth_1.canEditProject)(project, auth.userId))
                 return res.status(403).json({ message: 'Unauthorized' });
             const job = (0, jobQueue_1.createJob)('ingest', auth.userId, projectId, { fileId });
             // Run async — response returns immediately with jobId
@@ -64,7 +81,7 @@ function mediaRouter(config) {
             const project = await Project.findOne({ _id: projectId });
             if (!project)
                 return res.status(404).json({ message: 'Project not found' });
-            if (!(0, auth_1.isProjectMember)(project, auth.userId))
+            if (!(0, auth_1.canEditProject)(project, auth.userId))
                 return res.status(403).json({ message: 'Unauthorized' });
             const job = (0, jobQueue_1.createJob)('transcode', auth.userId, projectId, {
                 fileId, codec, resolution, outputFormat, bitrate, audioCodec,
@@ -87,7 +104,7 @@ function mediaRouter(config) {
             const project = await Project.findOne({ _id: projectId });
             if (!project)
                 return res.status(404).json({ message: 'Project not found' });
-            if (!(0, auth_1.isProjectMember)(project, auth.userId))
+            if (!(0, auth_1.canEditProject)(project, auth.userId))
                 return res.status(403).json({ message: 'Unauthorized' });
             const job = (0, jobQueue_1.createJob)('thumbnail', auth.userId, projectId, { fileId, timecode, resolution, strategy });
             setImmediate(() => (0, mediaProcessor_1.runThumbnailJob)(job.jobId, fileId, projectId, { timecode, resolution, strategy }));
@@ -108,7 +125,7 @@ function mediaRouter(config) {
             const project = await Project.findOne({ _id: projectId });
             if (!project)
                 return res.status(404).json({ message: 'Project not found' });
-            if (!(0, auth_1.isProjectMember)(project, auth.userId))
+            if (!(0, auth_1.canEditProject)(project, auth.userId))
                 return res.status(403).json({ message: 'Unauthorized' });
             const job = (0, jobQueue_1.createJob)('caption', auth.userId, projectId, { fileId, sourceLanguage, outputFormat, provider });
             setImmediate(() => (0, mediaProcessor_1.runCaptionJob)(job.jobId, fileId, projectId, { sourceLanguage, outputFormat, provider }));
@@ -150,7 +167,7 @@ function mediaRouter(config) {
             const project = await Project.findOne({ _id: projectId });
             if (!project)
                 return res.status(404).json({ message: 'Project not found' });
-            if (!(0, auth_1.isProjectMember)(project, auth.userId))
+            if (!(0, auth_1.canEditProject)(project, auth.userId))
                 return res.status(403).json({ message: 'Unauthorized' });
             const col = getMetadataCollection();
             if (!col)

package/dist/middleware/routes/member.js

@@ -52,9 +52,6 @@ function memberRouter(config) {
     router.post('/projects/:id/members', async (req, res) => {
         try {
             const auth = req.auth;
-            if (auth.role !== 'admin') {
-                return res.status(403).json({ message: 'Only admins can invite members' });
-            }
             const projectId = req.params.id;
             const { userId, role } = req.body;
             if (!userId || !role) {
@@ -67,7 +64,7 @@ function memberRouter(config) {
             if (!project) {
                 return res.status(404).json({ message: 'Project not found' });
             }
-            if (!(0, auth_1.isProjectMember)(project, auth.userId)) {
+            if (!(0, auth_1.isProjectAdmin)(project, auth.userId)) {
                 return res.status(403).json({ message: 'Unauthorized project access' });
             }
             const alreadyMember = project.members?.some((m) => m.userId?.toString() === userId?.toString());
@@ -107,9 +104,6 @@ function memberRouter(config) {
     router.patch('/projects/:id/members/:userId', async (req, res) => {
         try {
             const auth = req.auth;
-            if (auth.role !== 'admin') {
-                return res.status(403).json({ message: 'Only admins can update member roles' });
-            }
             const projectId = req.params.id;
             const targetUserId = req.params.userId;
             const { role } = req.body;
@@ -120,7 +114,7 @@ function memberRouter(config) {
             if (!project) {
                 return res.status(404).json({ message: 'Project not found' });
             }
-            if (!(0, auth_1.isProjectMember)(project, auth.userId)) {
+            if (!(0, auth_1.isProjectAdmin)(project, auth.userId)) {
                 return res.status(403).json({ message: 'Unauthorized project access' });
             }
             const memberExists = project.members?.some((m) => m.userId?.toString() === targetUserId?.toString());
@@ -282,9 +276,6 @@ function memberRouter(config) {
     router.delete('/projects/:id/members/:userId', async (req, res) => {
         try {
             const auth = req.auth;
-            if (auth.role !== 'admin') {
-                return res.status(403).json({ message: 'Only admins can remove members' });
-            }
             const projectId = req.params.id;
             const targetUserId = req.params.userId;
             if (targetUserId === auth.userId) {
@@ -294,7 +285,7 @@ function memberRouter(config) {
             if (!project) {
                 return res.status(404).json({ message: 'Project not found' });
             }
-            if (!(0, auth_1.isProjectMember)(project, auth.userId)) {
+            if (!(0, auth_1.isProjectAdmin)(project, auth.userId)) {
                 return res.status(403).json({ message: 'Unauthorized project access' });
             }
             const memberExists = project.members?.some((m) => m.userId?.toString() === targetUserId?.toString());

package/dist/middleware/routes/pipeline.js

@@ -67,7 +67,7 @@ function pipelineRouter(_config) {
             const project = await Project.findOne({ _id: projectId });
             if (!project)
                 return res.status(404).json({ message: 'Project not found' });
-            if (!(0, auth_1.isProjectMember)(project, auth.userId))
+            if (!(0, auth_1.canEditProject)(project, auth.userId))
                 return res.status(403).json({ message: 'Unauthorized' });
             const db = getDb();
             if (!db)
@@ -120,7 +120,7 @@ function pipelineRouter(_config) {
             const project = await Project.findOne({ _id: projectId });
             if (!project)
                 return res.status(404).json({ message: 'Project not found' });
-            if (!(0, auth_1.isProjectMember)(project, auth.userId))
+            if (!(0, auth_1.canEditProject)(project, auth.userId))
                 return res.status(403).json({ message: 'Unauthorized' });
             const db = getDb();
             if (!db)
@@ -154,7 +154,7 @@ function pipelineRouter(_config) {
             const project = await Project.findOne({ _id: projectId });
             if (!project)
                 return res.status(404).json({ message: 'Project not found' });
-            if (!(0, auth_1.isProjectMember)(project, auth.userId))
+            if (!(0, auth_1.canEditProject)(project, auth.userId))
                 return res.status(403).json({ message: 'Unauthorized' });
             const db = getDb();
             if (!db)

package/dist/middleware/routes/production.js

@@ -51,7 +51,7 @@ function productionRouter(_config) {
             const project = await Project.findOne({ _id: projectId });
             if (!project)
                 return res.status(404).json({ message: 'Project not found' });
-            if (!(0, auth_1.isProjectMember)(project, auth.userId))
+            if (!(0, auth_1.canEditProject)(project, auth.userId))
                 return res.status(403).json({ message: 'Unauthorized' });
             const db = getDb();
             if (!db)
@@ -81,7 +81,7 @@ function productionRouter(_config) {
             const project = await Project.findOne({ _id: projectId });
             if (!project)
                 return res.status(404).json({ message: 'Project not found' });
-            if (!(0, auth_1.isProjectMember)(project, auth.userId))
+            if (!(0, auth_1.canEditProject)(project, auth.userId))
                 return res.status(403).json({ message: 'Unauthorized' });
             const db = getDb();
             if (!db)
@@ -110,7 +110,7 @@ function productionRouter(_config) {
             const project = await Project.findOne({ _id: projectId });
             if (!project)
                 return res.status(404).json({ message: 'Project not found' });
-            if (!(0, auth_1.isProjectMember)(project, auth.userId))
+            if (!(0, auth_1.canEditProject)(project, auth.userId))
                 return res.status(403).json({ message: 'Unauthorized' });
             const db = getDb();
             if (!db)
@@ -156,7 +156,7 @@ function productionRouter(_config) {
             const project = await Project.findOne({ _id: projectId });
             if (!project)
                 return res.status(404).json({ message: 'Project not found' });
-            if (!(0, auth_1.isProjectMember)(project, auth.userId))
+            if (!(0, auth_1.canEditProject)(project, auth.userId))
                 return res.status(403).json({ message: 'Unauthorized' });
             const db = getDb();
             if (!db)
@@ -192,7 +192,7 @@ function productionRouter(_config) {
             const project = await Project.findOne({ _id: projectId });
             if (!project)
                 return res.status(404).json({ message: 'Project not found' });
-            if (!(0, auth_1.isProjectMember)(project, auth.userId))
+            if (!(0, auth_1.canEditProject)(project, auth.userId))
                 return res.status(403).json({ message: 'Unauthorized' });
             const db = getDb();
             if (!db)
@@ -231,7 +231,7 @@ function productionRouter(_config) {
             const project = await Project.findOne({ _id: projectId });
             if (!project)
                 return res.status(404).json({ message: 'Project not found' });
-            if (!(0, auth_1.isProjectMember)(project, auth.userId))
+            if (!(0, auth_1.canEditProject)(project, auth.userId))
                 return res.status(403).json({ message: 'Unauthorized' });
             const db = getDb();
             if (!db)
@@ -277,7 +277,7 @@ function productionRouter(_config) {
             const project = await Project.findOne({ _id: projectId });
             if (!project)
                 return res.status(404).json({ message: 'Project not found' });
-            if (!(0, auth_1.isProjectMember)(project, auth.userId))
+            if (!(0, auth_1.canEditProject)(project, auth.userId))
                 return res.status(403).json({ message: 'Unauthorized' });
             const db = getDb();
             if (!db)
@@ -311,7 +311,7 @@ function productionRouter(_config) {
             const project = await Project.findOne({ _id: projectId });
             if (!project)
                 return res.status(404).json({ message: 'Project not found' });
-            if (!(0, auth_1.isProjectMember)(project, auth.userId))
+            if (!(0, auth_1.canEditProject)(project, auth.userId))
                 return res.status(403).json({ message: 'Unauthorized' });
             const db = getDb();
             if (!db)
@@ -346,7 +346,7 @@ function productionRouter(_config) {
             const project = await Project.findOne({ _id: projectId });
             if (!project)
                 return res.status(404).json({ message: 'Project not found' });
-            if (!(0, auth_1.isProjectMember)(project, auth.userId))
+            if (!(0, auth_1.canEditProject)(project, auth.userId))
                 return res.status(403).json({ message: 'Unauthorized' });
             const db = getDb();
             if (!db)

package/dist/middleware/routes/project.js

@@ -8,6 +8,7 @@ const connectionManager_1 = require("../../adapters/database/connectionManager")
 const sql_1 = require("../../adapters/database/sql");
 const sanitize_1 = require("../../utils/sanitize");
 const projectIntegration_1 = require("../../services/projectIntegration");
+const auth_2 = require("../../services/auth");
 function projectRouter(config) {
     const router = (0, express_1.Router)();
     const Project = (0, manager_1.getModel)('projects');
@@ -32,6 +33,9 @@ function projectRouter(config) {
                 const currentUserMember = project.members?.find((m) => m.userId?.toString() === auth.userId?.toString());
                 if (!currentUserMember || currentUserMember.status !== 'active')
                     return false;
+                // With an API token, only the projects it reaches.
+                if (!(0, auth_2.scopeReachesProject)(auth.apiToken, (project._id ?? project.id)?.toString()))
+                    return false;
                 if (filterArchived !== undefined) {
                     return (currentUserMember.archived || false) === filterArchived;
                 }
@@ -72,9 +76,6 @@ function projectRouter(config) {
             if (req.subscription === 'freemium') {
                 return res.status(403).json({ error: 'Freemium users cannot create projects' });
             }
-            if (auth.role !== 'admin' && auth.role !== 'editor') {
-                return res.status(403).json({ message: 'Permission denied' });
-            }
             const { name, description, image, allowedOrigin, public: isPublic = true, category, integrationIds } = req.body;
             if (isPublic === false && req.subscription === 'freemium') {
                 return res.status(403).json({ error: 'Private projects require a subscriber plan' });
@@ -208,9 +209,6 @@ function projectRouter(config) {
     router.patch('/projects/:id', async (req, res) => {
         try {
             const auth = req.auth;
-            if (auth.role !== 'admin' && auth.role !== 'editor') {
-                return res.status(403).json({ message: 'Permission denied' });
-            }
             const projectId = req.params.id;
             const updates = req.body;
             const project = await Project.findOne({ _id: projectId });
@@ -220,7 +218,7 @@ function projectRouter(config) {
             if (!updates || typeof updates !== 'object') {
                 return res.status(400).json({ message: 'Missing updates payload' });
             }
-            if (!(0, auth_1.isProjectMember)(project, auth.userId)) {
+            if (!(0, auth_1.canEditProject)(project, auth.userId)) {
                 return res.status(403).json({ message: 'Unauthorized project access' });
             }
             const updated = await Project.update({ _id: projectId }, updates);
@@ -250,8 +248,9 @@ function projectRouter(config) {
             if (!project) {
                 return res.status(404).json({ message: 'Project not found' });
             }
-            if (!(0, auth_1.isProjectMember)(project, auth.userId)) {
-                return res.status(403).json({ message: 'Unauthorized project access' });
+            // Only an admin of the project deletes it.
+            if (!(0, auth_1.isProjectAdmin)(project, auth.userId)) {
+                return res.status(403).json({ message: 'Only a project admin can delete it' });
             }
             await Project.useDbType(project.dbType).delete({ _id: projectId });
             const allProjects = await Project.find({});
@@ -348,9 +347,6 @@ function projectRouter(config) {
     router.post('/projects/:id/image', async (req, res) => {
         try {
             const auth = req.auth;
-            if (auth.role !== 'admin' && auth.role !== 'editor') {
-                return res.status(403).json({ message: 'Permission denied' });
-            }
             const projectId = req.params.id;
             const { imageUrl } = req.body;
             if (!projectId || !imageUrl) {
@@ -360,7 +356,7 @@ function projectRouter(config) {
             if (!project) {
                 return res.status(404).json({ message: 'Project not found' });
             }
-            if (!(0, auth_1.isProjectMember)(project, auth.userId)) {
+            if (!(0, auth_1.canEditProject)(project, auth.userId)) {
                 return res.status(403).json({ message: 'Unauthorized project access' });
             }
             const updatedProject = await Project.update({ _id: projectId }, { image: imageUrl });
@@ -376,16 +372,13 @@ function projectRouter(config) {
     router.patch('/projects/:id/origins', async (req, res) => {
         try {
             const auth = req.auth;
-            if (auth.role !== 'admin' && auth.role !== 'editor') {
-                return res.status(403).json({ message: 'Permission denied' });
-            }
             const projectId = req.params.id;
             const { origins } = req.body;
             const project = await Project.findOne({ _id: projectId });
             if (!project) {
                 return res.status(404).json({ message: 'Project not found' });
             }
-            if (!(0, auth_1.isProjectMember)(project, auth.userId)) {
+            if (!(0, auth_1.canEditProject)(project, auth.userId)) {
                 return res.status(403).json({ message: 'Unauthorized project access' });
             }
             const updated = await Project.update({ _id: projectId }, { allowedOrigin: origins });
@@ -402,9 +395,6 @@ function projectRouter(config) {
     router.post('/projects/:id/integrations', async (req, res) => {
         try {
             const auth = req.auth;
-            if (auth.role !== 'admin' && auth.role !== 'editor') {
-                return res.status(403).json({ message: 'Permission denied' });
-            }
             const projectId = req.params.id;
             const { integrationId } = req.body;
             if (!integrationId)
@@ -412,7 +402,7 @@ function projectRouter(config) {
             const project = await Project.findOne({ _id: projectId });
             if (!project)
                 return res.status(404).json({ message: 'Project not found' });
-            if (!(0, auth_1.isProjectMember)(project, auth.userId))
+            if (!(0, auth_1.canEditProject)(project, auth.userId))
                 return res.status(403).json({ message: 'Unauthorized project access' });
             const alreadyConnected = [...(project.dbConnections ?? []), ...(project.storageConnections ?? []), ...(project.integrationConnections ?? [])]
                 .some((c) => c.integrationId === integrationId);
@@ -438,15 +428,12 @@ function projectRouter(config) {
     router.delete('/projects/:id/integrations/:integrationId', async (req, res) => {
         try {
             const auth = req.auth;
-            if (auth.role !== 'admin' && auth.role !== 'editor') {
-                return res.status(403).json({ message: 'Permission denied' });
-            }
             const projectId = req.params.id;
             const { integrationId } = req.params;
             const project = await Project.findOne({ _id: projectId });
             if (!project)
                 return res.status(404).json({ message: 'Project not found' });
-            if (!(0, auth_1.isProjectMember)(project, auth.userId))
+            if (!(0, auth_1.canEditProject)(project, auth.userId))
                 return res.status(403).json({ message: 'Unauthorized project access' });
             const dbConn = (project.dbConnections ?? []).find((c) => c.integrationId === integrationId);
             const storageConn = (project.storageConnections ?? []).find((c) => c.integrationId === integrationId);

package/dist/middleware/routes/renderFarm.js

@@ -11,6 +11,7 @@ const jobQueue_1 = require("../../services/jobQueue");
 const vfxProcessor_1 = require("../../services/vfxProcessor");
 const sanitize_1 = require("../../utils/sanitize");
 const crypto_1 = __importDefault(require("crypto"));
+const encryption_1 = require("../../utils/encryption");
 function renderFarmRouter(_config) {
     const router = (0, express_1.Router)();
     const Project = (0, manager_1.getModel)('projects');
@@ -34,14 +35,20 @@ function renderFarmRouter(_config) {
         try {
             const auth = req.auth;
             const { projectId } = req.params;
-            const { name, provider, apiUrl, encryptedCredential, description } = req.body;
+            const { name, provider, apiUrl, credential: credentialValue, encryptedCredential: legacyCredential, description } = req.body;
+            // The credential, as given (`encryptedCredential` was its old name: it was always the
+            // value itself), stored encrypted.
+            const credential = credentialValue ?? legacyCredential;
+            if (credential && !(0, encryption_1.isEncryptionKeySet)())
+                return res.status(500).json({ message: 'Encryption key is not set' });
+            const encryptedCredential = credential ? (0, encryption_1.encrypt)(String(credential)) : undefined;
             if (!name || !provider || !apiUrl) {
                 return res.status(400).json({ message: 'name, provider and apiUrl are required' });
             }
             const project = await Project.findOne({ _id: projectId });
             if (!project)
                 return res.status(404).json({ message: 'Project not found' });
-            if (!(0, auth_1.isProjectMember)(project, auth.userId))
+            if (!(0, auth_1.canEditProject)(project, auth.userId))
                 return res.status(403).json({ message: 'Unauthorized' });
             const connection = {
                 id: crypto_1.default.randomUUID(),
@@ -67,7 +74,7 @@ function renderFarmRouter(_config) {
             const project = await Project.findOne({ _id: projectId });
             if (!project)
                 return res.status(404).json({ message: 'Project not found' });
-            if (!(0, auth_1.isProjectMember)(project, auth.userId))
+            if (!(0, auth_1.canEditProject)(project, auth.userId))
                 return res.status(403).json({ message: 'Unauthorized' });
             await Project.update({ _id: projectId }, { $pull: { renderFarmConnections: { id: connectionId } } });
             res.json({ message: 'Connection deleted' });
@@ -87,7 +94,7 @@ function renderFarmRouter(_config) {
             const project = await Project.findOne({ _id: projectId });
             if (!project)
                 return res.status(404).json({ message: 'Project not found' });
-            if (!(0, auth_1.isProjectMember)(project, auth.userId))
+            if (!(0, auth_1.canEditProject)(project, auth.userId))
                 return res.status(403).json({ message: 'Unauthorized' });
             const job = (0, jobQueue_1.createJob)('render', auth.userId, projectId, { fileId, renderer, renderFarmConnectionId, frameRange, resolution, samples, outputFormat });
             setImmediate(() => (0, vfxProcessor_1.runRenderJob)(job.jobId, fileId, projectId, { renderer, renderFarmConnectionId, frameRange, resolution, samples, outputFormat }));
@@ -107,7 +114,7 @@ function renderFarmRouter(_config) {
             const project = await Project.findOne({ _id: projectId });
             if (!project)
                 return res.status(404).json({ message: 'Project not found' });
-            if (!(0, auth_1.isProjectMember)(project, auth.userId))
+            if (!(0, auth_1.canEditProject)(project, auth.userId))
                 return res.status(403).json({ message: 'Unauthorized' });
             const job = (0, jobQueue_1.createJob)('format-convert', auth.userId, projectId, { fileId, inputFormat, outputFormat, applyTransforms, embedTextures });
             setImmediate(() => (0, vfxProcessor_1.runFormatConvertJob)(job.jobId, fileId, projectId, { inputFormat, outputFormat, applyTransforms, embedTextures }));
@@ -127,7 +134,7 @@ function renderFarmRouter(_config) {
             const project = await Project.findOne({ _id: projectId });
             if (!project)
                 return res.status(404).json({ message: 'Project not found' });
-            if (!(0, auth_1.isProjectMember)(project, auth.userId))
+            if (!(0, auth_1.canEditProject)(project, auth.userId))
                 return res.status(403).json({ message: 'Unauthorized' });
             const job = (0, jobQueue_1.createJob)('lod', auth.userId, projectId, { fileId, levels, reductionRatios, algorithm, outputFormat });
             setImmediate(() => (0, vfxProcessor_1.runLodJob)(job.jobId, fileId, projectId, { levels, reductionRatios, algorithm, outputFormat }));

package/dist/middleware/routes/review.js

@@ -60,7 +60,7 @@ function reviewRouter(_config) {
             const project = await Project.findOne({ _id: projectId });
             if (!project)
                 return res.status(404).json({ message: 'Project not found' });
-            if (!(0, auth_1.isProjectMember)(project, auth.userId))
+            if (!(0, auth_1.canEditProject)(project, auth.userId))
                 return res.status(403).json({ message: 'Unauthorized' });
             const db = getDb();
             if (!db)
@@ -120,7 +120,7 @@ function reviewRouter(_config) {
             const project = await Project.findOne({ _id: projectId });
             if (!project)
                 return res.status(404).json({ message: 'Project not found' });
-            if (!(0, auth_1.isProjectMember)(project, auth.userId))
+            if (!(0, auth_1.canEditProject)(project, auth.userId))
                 return res.status(403).json({ message: 'Unauthorized' });
             const db = getDb();
             if (!db)
@@ -190,7 +190,7 @@ function reviewRouter(_config) {
             const project = await Project.findOne({ _id: projectId });
             if (!project)
                 return res.status(404).json({ message: 'Project not found' });
-            if (!(0, auth_1.isProjectMember)(project, auth.userId))
+            if (!(0, auth_1.canEditProject)(project, auth.userId))
                 return res.status(403).json({ message: 'Unauthorized' });
             const db = getDb();
             if (!db)
@@ -224,7 +224,7 @@ function reviewRouter(_config) {
             const project = await Project.findOne({ _id: projectId });
             if (!project)
                 return res.status(404).json({ message: 'Project not found' });
-            if (!(0, auth_1.isProjectMember)(project, auth.userId))
+            if (!(0, auth_1.canEditProject)(project, auth.userId))
                 return res.status(403).json({ message: 'Unauthorized' });
             const db = getDb();
             if (!db)

package/dist/middleware/routes/rights.js

@@ -42,7 +42,7 @@ function rightsRouter(_config) {
             const project = await Project.findOne({ _id: projectId });
             if (!project)
                 return res.status(404).json({ message: 'Project not found' });
-            if (!(0, auth_1.isProjectMember)(project, auth.userId))
+            if (!(0, auth_1.canEditProject)(project, auth.userId))
                 return res.status(403).json({ message: 'Unauthorized' });
             const db = getDb();
             if (!db)

package/dist/middleware/routes/storage.js

@@ -71,11 +71,14 @@ function storageRouter(config) {
     router.get('/upload-project-image-url/:id', async (req, res) => {
         try {
             const auth = req.auth;
-            if (auth.role !== 'admin' && auth.role !== 'editor')
-                return res.status(403).json({ message: 'Permission denied' });
             const projectId = req.params.id;
             if (!projectId)
                 return res.status(400).json({ message: 'Missing projectId' });
+            const project = await Project.findOne({ _id: projectId });
+            if (!project)
+                return res.status(404).json({ message: 'Project not found' });
+            if (!(0, auth_1.canEditProject)(project, auth.userId))
+                return res.status(403).json({ message: 'Permission denied' });
             const response = await (0, presign_1.getPresignedProjectImageUrl)(adapter, projectId);
             res.status(200).json({ ...response, message: 'Presigned URL generated successfully' });
         }
@@ -86,11 +89,14 @@ function storageRouter(config) {
     router.delete('/delete-project-image-url/:id', async (req, res) => {
         try {
             const auth = req.auth;
-            if (auth.role !== 'admin' && auth.role !== 'editor')
-                return res.status(403).json({ message: 'Permission denied' });
             const projectId = req.params.id;
             if (!projectId)
                 return res.status(400).json({ message: 'Missing projectId' });
+            const project = await Project.findOne({ _id: projectId });
+            if (!project)
+                return res.status(404).json({ message: 'Project not found' });
+            if (!(0, auth_1.canEditProject)(project, auth.userId))
+                return res.status(403).json({ message: 'Permission denied' });
             await (0, file_1.deleteProjectImage)(adapter, projectId);
             const updated = await Project.update({ _id: projectId }, { image: '' });
             res.status(201).json({ ...updated, message: 'Image deleted successfully' });
@@ -119,7 +125,7 @@ function storageRouter(config) {
             const project = await Project.findOne({ _id: projectId });
             if (!project)
                 return res.status(404).json({ message: 'Project not found' });
-            if (!(0, auth_1.isProjectMember)(project, auth.userId))
+            if (!(0, auth_1.canEditProject)(project, auth.userId))
                 return res.status(403).json({ message: 'Unauthorized access' });
             if (!adapter.getPresignedUploadUrl) {
                 return res.status(501).json({ message: 'Storage adapter does not support presigned uploads' });
@@ -192,7 +198,7 @@ function storageRouter(config) {
             const project = await Project.findOne({ _id: projectId });
             if (!project)
                 return res.status(404).json({ message: 'Project not found' });
-            if (!(0, auth_1.isProjectMember)(project, auth.userId))
+            if (!(0, auth_1.canEditProject)(project, auth.userId))
                 return res.status(403).json({ message: 'Unauthorized access' });
             const collection = getRawFilesCollection();
             if (!collection)
@@ -213,7 +219,7 @@ function storageRouter(config) {
             const project = await Project.findOne({ _id: projectId });
             if (!project)
                 return res.status(404).json({ message: 'Project not found' });
-            if (!(0, auth_1.isProjectMember)(project, auth.userId))
+            if (!(0, auth_1.canEditProject)(project, auth.userId))
                 return res.status(403).json({ message: 'Unauthorized access' });
             const collection = getRawFilesCollection();
             if (!collection)
@@ -291,7 +297,7 @@ function storageRouter(config) {
             const project = await Project.findOne({ _id: projectId });
             if (!project)
                 return res.status(404).json({ message: 'Project not found' });
-            if (!(0, auth_1.isProjectMember)(project, auth.userId))
+            if (!(0, auth_1.canEditProject)(project, auth.userId))
                 return res.status(403).json({ message: 'Unauthorized access' });
             const connAdapter = await resolveConnAdapter(connId, project, auth);
             if ('error' in connAdapter)
@@ -419,7 +425,7 @@ function storageRouter(config) {
             const project = await Project.findOne({ _id: projectId });
             if (!project)
                 return res.status(404).json({ message: 'Project not found' });
-            if (!(0, auth_1.isProjectMember)(project, auth.userId))
+            if (!(0, auth_1.canEditProject)(project, auth.userId))
                 return res.status(403).json({ message: 'Unauthorized access' });
             const collection = getRawFilesCollection();
             if (!collection)
@@ -440,7 +446,7 @@ function storageRouter(config) {
             const project = await Project.findOne({ _id: projectId });
             if (!project)
                 return res.status(404).json({ message: 'Project not found' });
-            if (!(0, auth_1.isProjectMember)(project, auth.userId))
+            if (!(0, auth_1.canEditProject)(project, auth.userId))
                 return res.status(403).json({ message: 'Unauthorized access' });
             const connAdapter = await resolveConnAdapter(connId, project, auth);
             if ('error' in connAdapter)
@@ -539,7 +545,7 @@ function storageRouter(config) {
             const project = await Project.findOne({ _id: projectId });
             if (!project)
                 return res.status(404).json({ message: 'Project not found' });
-            if (!(0, auth_1.isProjectMember)(project, auth.userId))
+            if (!(0, auth_1.canEditProject)(project, auth.userId))
                 return res.status(403).json({ message: 'Unauthorized access' });
             const conn = findStorageConn(project, connId);
             const isBuiltin = conn?.source === 'builtin';
@@ -590,7 +596,7 @@ function storageRouter(config) {
             const project = await Project.findOne({ _id: projectId });
             if (!project)
                 return res.status(404).json({ message: 'Project not found' });
-            if (!(0, auth_1.isProjectMember)(project, auth.userId))
+            if (!(0, auth_1.canEditProject)(project, auth.userId))
                 return res.status(403).json({ message: 'Unauthorized access' });
             const collection = getRawFoldersCollection();
             if (!collection)
@@ -624,7 +630,7 @@ function storageRouter(config) {
             const project = await Project.findOne({ _id: projectId });
             if (!project)
                 return res.status(404).json({ message: 'Project not found' });
-            if (!(0, auth_1.isProjectMember)(project, auth.userId))
+            if (!(0, auth_1.canEditProject)(project, auth.userId))
                 return res.status(403).json({ message: 'Unauthorized access' });
             const collection = getRawFoldersCollection();
             if (!collection)
@@ -654,7 +660,7 @@ function storageRouter(config) {
             const project = await Project.findOne({ _id: projectId });
             if (!project)
                 return res.status(404).json({ message: 'Project not found' });
-            if (!(0, auth_1.isProjectMember)(project, auth.userId))
+            if (!(0, auth_1.canEditProject)(project, auth.userId))
                 return res.status(403).json({ message: 'Unauthorized access' });
             const foldersCollection = getRawFoldersCollection();
             if (!foldersCollection)
@@ -682,7 +688,7 @@ function storageRouter(config) {
             const project = await Project.findOne({ _id: projectId });
             if (!project)
                 return res.status(404).json({ message: 'Project not found' });
-            if (!(0, auth_1.isProjectMember)(project, auth.userId))
+            if (!(0, auth_1.canEditProject)(project, auth.userId))
                 return res.status(403).json({ message: 'Unauthorized access' });
             if (folderId != null) {
                 const foldersCollection = getRawFoldersCollection();