streamby-core 0.33.0 → 0.35.0

package/dist/middleware/routes/storageConnection.js

@@ -40,9 +40,6 @@ function storageConnectionRouter(config) {
     router.post('/projects/:id/connections/storage', async (req, res) => {
         try {
             const auth = req.auth;
-            if (auth.role !== 'admin' && auth.role !== 'editor') {
-                return res.status(403).json({ message: 'Permission denied' });
-            }
             const { name, type, credential, integrationId, description } = req.body;
             if (!name || !type) {
                 return res.status(400).json({ message: 'name and type are required' });
@@ -59,7 +56,7 @@ function storageConnectionRouter(config) {
             const project = await Project.findOne({ _id: req.params.id });
             if (!project)
                 return res.status(404).json({ message: 'Project not found' });
-            if (!(0, auth_1.isProjectMember)(project, auth.userId))
+            if (!(0, auth_1.canEditProject)(project, auth.userId))
                 return res.status(403).json({ message: 'Unauthorized project access' });
             let encryptedCredential;
             if (integrationId) {
@@ -98,13 +95,10 @@ function storageConnectionRouter(config) {
         try {
             const { connId } = req.params;
             const auth = req.auth;
-            if (auth.role !== 'admin' && auth.role !== 'editor') {
-                return res.status(403).json({ message: 'Permission denied' });
-            }
             const project = await Project.findOne({ _id: req.params.id });
             if (!project)
                 return res.status(404).json({ message: 'Project not found' });
-            if (!(0, auth_1.isProjectMember)(project, auth.userId))
+            if (!(0, auth_1.canEditProject)(project, auth.userId))
                 return res.status(403).json({ message: 'Unauthorized project access' });
             const conn = project.storageConnections?.find((c) => c.id === connId);
             if (!conn)

package/dist/middleware/routes/workflow.js

@@ -38,7 +38,7 @@ function workflowRouter(config) {
                 return res.status(401).json({ message: 'Unauthorized' });
             const projectId = req.params.id;
             const project = await Project.findOne({ _id: projectId });
-            if (!project || !(0, auth_1.isProjectMember)(project, auth.userId)) {
+            if (!project || !(0, auth_1.canEditProject)(project, auth.userId)) {
                 return res.status(403).json({ message: 'Unauthorized project access' });
             }
             const now = new Date();

package/dist/services/apiTokens.d.ts

@@ -0,0 +1,47 @@
+import { ApiTokenAccess, ApiTokenScope, StreamByConfig } from '../types';
+export declare const API_TOKEN_PREFIX = "sbt_";
+export declare const API_TOKEN_EXPIRY_DAYS: readonly [7, 30, 90, 365];
+export interface ApiTokenRecord {
+    id: string;
+    userId: string;
+    name: string;
+    prefix: string;
+    hash: string;
+    access: ApiTokenAccess;
+    projectIds: string[];
+    createdAt: Date;
+    expiresAt: Date | null;
+    lastUsedAt: Date | null;
+}
+/** What a token's owner sees of it. */
+export type ApiTokenInfo = Omit<ApiTokenRecord, 'hash' | 'userId' | 'projectIds'> & {
+    projectIds: string[] | '*';
+};
+export declare class ApiTokenError extends Error {
+    status: number;
+    constructor(message: string, status?: number);
+}
+export interface CreateApiTokenInput {
+    name: string;
+    access: ApiTokenAccess;
+    projectIds: string[] | '*';
+    expiresInDays: number | null;
+}
+/** A new token for `userId`: the token itself, shown only now, and what's kept of it. */
+export declare function createApiToken(userId: string, input: CreateApiTokenInput, config: StreamByConfig): Promise<{
+    token: string;
+    info: ApiTokenInfo;
+}>;
+/** The tokens `userId` has. */
+export declare function listApiTokens(userId: string): Promise<ApiTokenInfo[]>;
+/** Revokes one of `userId`'s tokens: it stops working at once. Whether there was one. */
+export declare function revokeApiToken(userId: string, tokenId: string): Promise<boolean>;
+export interface ResolvedApiToken {
+    userId: string;
+    scope: ApiTokenScope;
+}
+/**
+ * The token's owner and scope, for the host's authProvider; null when it isn't a token, isn't
+ * known (revoked), or has expired. Marks when it was last used.
+ */
+export declare function resolveApiToken(token: unknown): Promise<ResolvedApiToken | null>;

package/dist/services/apiTokens.js

@@ -0,0 +1,110 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ApiTokenError = exports.API_TOKEN_EXPIRY_DAYS = exports.API_TOKEN_PREFIX = void 0;
+exports.createApiToken = createApiToken;
+exports.listApiTokens = listApiTokens;
+exports.revokeApiToken = revokeApiToken;
+exports.resolveApiToken = resolveApiToken;
+const crypto_1 = __importDefault(require("crypto"));
+const manager_1 = require("../models/manager");
+// API tokens: how an agent or a service works with StreamBy as a user, without their browser
+// session. A token is "sbt_" and 32 random bytes; only its hash is stored, with a prefix to
+// tell it apart in a list. It's sent as `Authorization: Bearer sbt_...` and the host's
+// authProvider resolves it (resolveApiToken), so the request is its owner's -- limited by the
+// token's scope (read or write, which projects), and never more than its owner can do: the
+// owner's role in each project still decides.
+exports.API_TOKEN_PREFIX = 'sbt_';
+const PREFIX_SHOWN = exports.API_TOKEN_PREFIX.length + 8;
+exports.API_TOKEN_EXPIRY_DAYS = [7, 30, 90, 365];
+const ALL_PROJECTS = '*';
+class ApiTokenError extends Error {
+    constructor(message, status = 400) {
+        super(message);
+        this.status = status;
+    }
+}
+exports.ApiTokenError = ApiTokenError;
+const hashOf = (token) => crypto_1.default.createHash('sha256').update(token).digest('hex');
+const infoOf = ({ hash: _hash, userId: _userId, ...info }) => ({
+    ...info,
+    projectIds: parseProjectIds(info.projectIds),
+});
+// As stored (a list, read back from SQL JSON as a list or its text): ['*'] is every project.
+const parseProjectIds = (value) => {
+    if (typeof value === 'string') {
+        try {
+            return parseProjectIds(JSON.parse(value));
+        }
+        catch {
+            return [];
+        }
+    }
+    if (!Array.isArray(value))
+        return [];
+    const ids = value.map(String);
+    return ids.includes(ALL_PROJECTS) ? '*' : ids;
+};
+const mainDbType = (config) => config.databases?.find(db => db.main)?.type ?? 'nosql';
+/** A new token for `userId`: the token itself, shown only now, and what's kept of it. */
+async function createApiToken(userId, input, config) {
+    const name = typeof input.name === 'string' ? input.name.trim() : '';
+    if (!name)
+        throw new ApiTokenError('A token needs a name.');
+    if (input.access !== 'read' && input.access !== 'write')
+        throw new ApiTokenError("access must be 'read' or 'write'.");
+    if (input.projectIds !== '*' && (!Array.isArray(input.projectIds) || !input.projectIds.length || !input.projectIds.every(id => typeof id === 'string' && id && id !== ALL_PROJECTS))) {
+        throw new ApiTokenError("projectIds must be '*' or a list of project ids.");
+    }
+    if (input.expiresInDays !== null && !exports.API_TOKEN_EXPIRY_DAYS.includes(input.expiresInDays)) {
+        throw new ApiTokenError(`expiresInDays must be one of ${exports.API_TOKEN_EXPIRY_DAYS.join(', ')}, or null.`);
+    }
+    const token = exports.API_TOKEN_PREFIX + crypto_1.default.randomBytes(32).toString('base64url');
+    const now = new Date();
+    const record = {
+        id: crypto_1.default.randomUUID(),
+        userId,
+        name,
+        prefix: token.slice(0, PREFIX_SHOWN),
+        hash: hashOf(token),
+        access: input.access,
+        projectIds: input.projectIds === '*' ? [ALL_PROJECTS] : [...new Set(input.projectIds)],
+        createdAt: now,
+        expiresAt: input.expiresInDays === null ? null : new Date(now.getTime() + input.expiresInDays * 86400000),
+        lastUsedAt: null,
+    };
+    await (0, manager_1.getModel)('api_tokens').create({ ...record, dbType: mainDbType(config) });
+    return { token, info: infoOf(record) };
+}
+/** The tokens `userId` has. */
+async function listApiTokens(userId) {
+    const records = (await (0, manager_1.getModel)('api_tokens').find({ userId }));
+    return records
+        .map(infoOf)
+        .sort((a, b) => new Date(b.createdAt).getTime() - new Date(a.createdAt).getTime());
+}
+/** Revokes one of `userId`'s tokens: it stops working at once. Whether there was one. */
+async function revokeApiToken(userId, tokenId) {
+    return (await (0, manager_1.getModel)('api_tokens').delete({ id: tokenId, userId })) > 0;
+}
+/**
+ * The token's owner and scope, for the host's authProvider; null when it isn't a token, isn't
+ * known (revoked), or has expired. Marks when it was last used.
+ */
+async function resolveApiToken(token) {
+    if (typeof token !== 'string' || !token.startsWith(exports.API_TOKEN_PREFIX))
+        return null;
+    const ApiTokens = (0, manager_1.getModel)('api_tokens');
+    const record = (await ApiTokens.findOne({ hash: hashOf(token) }));
+    if (!record)
+        return null;
+    if (record.expiresAt && new Date(record.expiresAt).getTime() <= Date.now())
+        return null;
+    ApiTokens.update({ id: record.id }, { lastUsedAt: new Date() }).catch(() => { });
+    return {
+        userId: record.userId,
+        scope: { tokenId: record.id, access: record.access, projectIds: parseProjectIds(record.projectIds) },
+    };
+}

package/dist/services/auth.d.ts

@@ -1,5 +1,7 @@
-import { Auth } from '../types';
 import { Request, Response, NextFunction } from 'express';
-import { StreamByConfig } from '../types';
+import { Auth, StreamByConfig } from '../types';
+export declare const isPublicRoute: (method: string, path: string) => boolean;
+/** Whether a token's scope reaches a project. */
+export declare const scopeReachesProject: (scope: Auth["apiToken"], projectId: string) => boolean;
+export declare const enforceApiTokenScope: (req: Request, res: Response, next: NextFunction) => void | Response<any, Record<string, any>>;
 export declare const authenticate: (config: StreamByConfig) => (req: Request, res: Response, next: NextFunction) => Promise<void | Response<any, Record<string, any>>>;
-export declare function checkRole(auth: Auth, required: 'viewer' | 'editor' | 'admin'): void;

package/dist/services/auth.js

@@ -1,9 +1,55 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.authenticate = void 0;
-exports.checkRole = checkRole;
+exports.authenticate = exports.enforceApiTokenScope = exports.scopeReachesProject = exports.isPublicRoute = void 0;
+// The one route open without a session: a project's public export, read
+// (GET /:projectId/export/:exportName, see routes/export). Exactly that path -- not any path
+// that has an "export" segment somewhere.
+const PUBLIC_EXPORT = /^\/[^/]+\/export\/[^/]+\/?$/;
+const READ_METHODS = ['GET', 'HEAD', 'OPTIONS'];
+const isPublicRoute = (method, path) => READ_METHODS.includes(method.toUpperCase()) && PUBLIC_EXPORT.test(path);
+exports.isPublicRoute = isPublicRoute;
+// ── API tokens ──
+// A request made with an API token reaches only what the token's scope does: no writes with a
+// read token, no project outside its projects (as if it didn't exist), no managing tokens, and
+// of the routes outside a project only the few below. Its owner's role in each project still
+// decides on top (the routes' own checks).
+// The project a route acts on, by its path.
+const PROJECT_PATHS = [/^\/projects\/([^/]+)/, /^\/(?:upload|delete)-project-image-url\/([^/]+)/];
+const NOT_A_PROJECT = new Set(['create', 'explore']);
+const projectIdOf = (path) => {
+    for (const pattern of PROJECT_PATHS) {
+        const id = pattern.exec(path)?.[1];
+        if (id && !NOT_A_PROJECT.has(id))
+            return decodeURIComponent(id);
+    }
+    return undefined;
+};
+// Outside a project, a token reaches only these reads (each limited to its scope there).
+const OUTSIDE_A_PROJECT = [/^\/auth\/?$/, /^\/projects\/?$/, /^\/jobs\/[^/]+\/?$/, /^\/user\/subscription\/?$/, /^\/users\/search\/?$/];
+/** Whether a token's scope reaches a project. */
+const scopeReachesProject = (scope, projectId) => !scope || scope.projectIds === '*' || scope.projectIds.includes(projectId);
+exports.scopeReachesProject = scopeReachesProject;
+const enforceApiTokenScope = (req, res, next) => {
+    const scope = req.auth?.apiToken;
+    if (!scope)
+        return next();
+    if (/^\/user\/api-tokens(\/|$)/.test(req.path)) {
+        return res.status(403).json({ error: 'API tokens are managed with a session, not with a token' });
+    }
+    if (!READ_METHODS.includes(req.method.toUpperCase()) && scope.access !== 'write') {
+        return res.status(403).json({ error: 'This API token can only read' });
+    }
+    const projectId = projectIdOf(req.path);
+    if (projectId) {
+        return (0, exports.scopeReachesProject)(scope, projectId) ? next() : res.status(404).json({ message: 'Project not found' });
+    }
+    if (READ_METHODS.includes(req.method.toUpperCase()) && OUTSIDE_A_PROJECT.some(route => route.test(req.path)))
+        return next();
+    return res.status(403).json({ error: 'Not available with an API token' });
+};
+exports.enforceApiTokenScope = enforceApiTokenScope;
 const authenticate = (config) => async (req, res, next) => {
-    if (req.path.includes('/export/')) {
+    if ((0, exports.isPublicRoute)(req.method, req.path)) {
         return next();
     }
     try {
@@ -20,11 +66,3 @@ const authenticate = (config) => async (req, res, next) => {
     }
 };
 exports.authenticate = authenticate;
-function checkRole(auth, required) {
-    const roles = ['viewer', 'editor', 'admin'];
-    const userIdx = roles.indexOf(auth.role);
-    const requiredIdx = roles.indexOf(required);
-    if (userIdx < requiredIdx) {
-        throw new Error(`Insufficient role: requires ${required}, found ${auth.role}`);
-    }
-}

package/dist/services/connectionResolver.js

@@ -52,7 +52,7 @@ async function resolveDbConnectionClient(project, connId, config, auth) {
     if (conn.source === 'integration') {
         if (!conn.integrationId)
             return { error: 'Connection is missing its integrationId', status: 500 };
-        const resolved = await (0, userIntegration_1.getDecryptedIntegrationCredentialById)(conn.integrationId, config);
+        const resolved = await (0, userIntegration_1.getDecryptedIntegrationCredentialById)(conn.integrationId, config, project);
         if (!resolved)
             return { error: 'Integration not found', status: 400 };
         connectionString = resolved.credential;
@@ -109,7 +109,7 @@ async function resolveStorageAdapter(project, connId, config, auth) {
         if (!conn.integrationId)
             return { error: 'Connection is missing its integrationId', status: 500 };
         try {
-            const resolved = await (0, userIntegration_1.getDecryptedIntegrationCredentialById)(conn.integrationId, config);
+            const resolved = await (0, userIntegration_1.getDecryptedIntegrationCredentialById)(conn.integrationId, config, project);
             if (!resolved)
                 return { error: 'Integration not found', status: 400 };
             return new s3_1.S3Adapter(resolved.credential);

package/dist/services/executor.d.ts

@@ -4,4 +4,7 @@ export declare class NodeExecutionError extends Error {
     nodeType: string;
     constructor(nodeId: string, nodeType: string, message: string);
 }
-export declare function executeExport(nodeSchema: NodeSchema, project: any, config: StreamByConfig): Promise<any>;
+export interface ExecuteExportOptions {
+    public?: boolean;
+}
+export declare function executeExport(nodeSchema: NodeSchema, project: any, config: StreamByConfig, { public: isPublic }?: ExecuteExportOptions): Promise<any>;

package/dist/services/executor.js

@@ -12,6 +12,7 @@ const mediaProcessor_1 = require("./mediaProcessor");
 const vfxProcessor_1 = require("./vfxProcessor");
 const aiProcessor_1 = require("./aiProcessor");
 const storage_1 = require("../providers/storage");
+const serviceEndpoints_1 = require("../utils/serviceEndpoints");
 function applyFilterConfig(payload, config) {
     const isArr = Array.isArray(payload);
     let r = isArr ? [...payload] : payload;
@@ -87,13 +88,19 @@ class NodeExecutionError extends Error {
     }
 }
 exports.NodeExecutionError = NodeExecutionError;
-// Export execution is public (gated by allowedOrigin, not user identity — see
-// export.ts:339) — there is no real Auth to pass through. This sentinel satisfies
-// resolveDbConnectionClient's signature without adding a gate that never existed;
-// canUseBuiltin gating is for connection *management* by a user, not for serving an
-// already-published export.
+// Export execution has no user behind it (a public export is read without a session -- see
+// routes/export) -- there is no real Auth to pass through. This sentinel satisfies
+// resolveDbConnectionClient's signature; canUseBuiltin gating is for connection *management*
+// by a user, not for serving an already-published export.
 const SYSTEM_AUTH = { userId: 'system', username: 'system', role: 'admin' };
-async function executeExport(nodeSchema, project, config) {
+// Nodes that start a job (transcoding, rendering, generating...): work, and cost, on the
+// server or a provider, for whoever asks.
+const JOB_NODES = new Set([
+    'transcodeNode', 'captionNode', 'thumbnailNode', 'ingestNode', 'renderJobNode', 'formatConvertNode',
+    'lodNode', 'transcriptionNode', 'upscaleNode', 'proceduralAssetNode',
+]);
+const notPublic = (node) => new NodeExecutionError(node.id, node.type, `Node '${node.id}' (${node.type}) can't run in a public export.`);
+async function executeExport(nodeSchema, project, config, { public: isPublic = true } = {}) {
     const nodes = nodeSchema.nodes;
     const edges = nodeSchema.edges;
     // 1. Data layer — nodes connected to streamby in-bottom
@@ -119,6 +126,8 @@ async function executeExport(nodeSchema, project, config) {
             if (!connectionId) {
                 throw new NodeExecutionError(node.id, node.type, `Node '${node.id}' (${node.type}) has no database connection — connect one on the node.`);
             }
+            if (isPublic && (0, connectionResolver_1.findDbConnection)(project, connectionId)?.source === 'integration')
+                throw notPublic(node);
             const recordId = node.data?.recordId;
             const projectIdentifier = project._id?.toString() ?? project.id;
             const resolved = await (0, connectionResolver_1.resolveDbConnectionClient)(project, connectionId, config, SYSTEM_AUTH);
@@ -158,6 +167,8 @@ async function executeExport(nodeSchema, project, config) {
             // NodeExecutionError (matching dataSourceNode/ingestNode's intentional pattern), since
             // a silently-skipped service action would produce a workflow that "succeeds" while
             // quietly missing the one thing the node exists to do.
+            if (isPublic)
+                throw notPublic(node);
             const connectionId = node.data?.connectionId;
             if (!connectionId) {
                 throw new NodeExecutionError(node.id, node.type, `Node '${node.id}' (${node.type}) has no integration connection — connect one on the node.`);
@@ -166,21 +177,26 @@ async function executeExport(nodeSchema, project, config) {
             if (!connection) {
                 throw new NodeExecutionError(node.id, node.type, `Node '${node.id}' (${node.type}): integration connection not found on this project.`);
             }
-            const resolved = await (0, userIntegration_1.getDecryptedIntegrationCredentialById)(connection.integrationId, config);
-            if (!resolved) {
-                throw new NodeExecutionError(node.id, node.type, `Node '${node.id}' (${node.type}): integration credential could not be resolved — it may have been disconnected.`);
-            }
             const endpoint = node.data?.endpoint;
             if (!endpoint) {
                 throw new NodeExecutionError(node.id, node.type, `Node '${node.id}' (${node.type}) has no endpoint configured.`);
             }
+            // Checked before the credential is even resolved: it's only ever sent to its provider.
+            if (!(0, serviceEndpoints_1.isServiceEndpoint)(connection.provider, endpoint)) {
+                throw new NodeExecutionError(node.id, node.type, `Node '${node.id}' (${node.type}): ${endpoint} is not a ${connection.provider} endpoint.`);
+            }
+            const resolved = await (0, userIntegration_1.getDecryptedIntegrationCredentialById)(connection.integrationId, config, project);
+            if (!resolved) {
+                throw new NodeExecutionError(node.id, node.type, `Node '${node.id}' (${node.type}): integration credential could not be resolved — it may have been disconnected.`);
+            }
             const method = node.data?.method ?? 'GET';
             const headers = {
                 'Content-Type': 'application/json',
                 ...(0, oauthClient_1.buildServiceAuthHeaders)(connection.provider, resolved.credential),
             };
             const body = node.data?.body ? JSON.stringify(node.data.body) : undefined;
-            const response = await fetch(endpoint, { method, headers, body });
+            // A redirect would carry the credential's headers on to wherever it points.
+            const response = await fetch(endpoint, { method, headers, body, redirect: 'error' });
             if (!response.ok) {
                 throw new NodeExecutionError(node.id, node.type, `Node '${node.id}' (${node.type}): integration action failed (${response.statusText}).`);
             }
@@ -197,6 +213,8 @@ async function executeExport(nodeSchema, project, config) {
     while (processNode) {
         const nodeData = processNode.data ?? {};
         const fileId = nodeData.fileId;
+        if (isPublic && JOB_NODES.has(processNode.type))
+            throw notPublic(processNode);
         if (processNode.type === 'transcodeNode' && fileId) {
             const job = (0, jobQueue_1.createJob)('transcode', systemUserId, projectId, nodeData);
             setImmediate(() => (0, mediaProcessor_1.runTranscodeJob)(job.jobId, fileId, projectId, {

package/dist/services/reencryptCredentials.d.ts

@@ -0,0 +1,5 @@
+export interface ReencryptResult {
+    updated: number;
+    failed: number;
+}
+export declare function reencryptStoredCredentials(): Promise<ReencryptResult>;

package/dist/services/reencryptCredentials.js

@@ -0,0 +1,74 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.reencryptStoredCredentials = reencryptStoredCredentials;
+const manager_1 = require("../models/manager");
+const encryption_1 = require("../utils/encryption");
+// Brings every stored credential to the current encryption (AES-256-GCM with the current key,
+// see utils/encryption): those encrypted before (CBC, or GCM with a previous key) are
+// re-encrypted, and the distribution and render farm credentials, stored as they were sent,
+// are encrypted. Non-destructive: a value is replaced only by its own re-encryption; one that
+// can't be decrypted is left as it is (and counted). Runs at startup; once everything is
+// current, it changes nothing.
+// A project's lists of connections with a credential each, encrypted before.
+const ENCRYPTED_LISTS = ['connections', 'dbConnections', 'storageConnections', 'exports'];
+// The ones whose credentials were stored as sent, never encrypted.
+const PLAIN_LISTS = ['distributionConnections', 'renderFarmConnections'];
+const INTEGRATION_FIELDS = ['encryptedCredential', 'encryptedAccessToken', 'encryptedRefreshToken'];
+async function reencryptStoredCredentials() {
+    const result = { updated: 0, failed: 0 };
+    if (!(0, encryption_1.isEncryptionKeySet)())
+        return result;
+    // The current encryption of a stored value, or undefined when it's current already or
+    // can't be read (left as it is).
+    const upgrade = (value, storedPlain) => {
+        if (typeof value !== 'string' || !value || (0, encryption_1.isCurrentEncryption)(value))
+            return undefined;
+        if (storedPlain && !(0, encryption_1.isVersionedEncryption)(value))
+            return (0, encryption_1.encrypt)(value);
+        try {
+            return (0, encryption_1.encrypt)((0, encryption_1.decrypt)(value));
+        }
+        catch {
+            result.failed++;
+            return undefined;
+        }
+    };
+    const Project = (0, manager_1.getModel)('projects');
+    for (const project of (await Project.find({}))) {
+        const changes = {};
+        for (const list of [...ENCRYPTED_LISTS, ...PLAIN_LISTS]) {
+            const entries = project[list];
+            if (!Array.isArray(entries))
+                continue;
+            const storedPlain = PLAIN_LISTS.includes(list);
+            let changed = false;
+            const next = entries.map((entry) => {
+                const upgraded = upgrade(entry?.encryptedCredential, storedPlain);
+                if (upgraded === undefined)
+                    return entry;
+                changed = true;
+                return { ...entry, encryptedCredential: upgraded };
+            });
+            if (changed)
+                changes[list] = next;
+        }
+        if (Object.keys(changes).length) {
+            await Project.update({ _id: project._id ?? project.id }, changes);
+            result.updated++;
+        }
+    }
+    const UserIntegration = (0, manager_1.getModel)('user_integrations');
+    for (const integration of (await UserIntegration.find({}))) {
+        const changes = {};
+        for (const field of INTEGRATION_FIELDS) {
+            const upgraded = upgrade(integration[field], false);
+            if (upgraded !== undefined)
+                changes[field] = upgraded;
+        }
+        if (Object.keys(changes).length) {
+            await UserIntegration.update({ id: integration.id }, changes);
+            result.updated++;
+        }
+    }
+    return result;
+}

package/dist/services/userIntegration.d.ts

@@ -1,4 +1,4 @@
-import { IntegrationKind, ServiceProviderType, StreamByConfig, UserIntegration } from '../types';
+import { IntegrationKind, ProjectInfo, ServiceProviderType, StreamByConfig, UserIntegration } from '../types';
 export declare function isOAuthServiceProvider(provider: string): boolean;
 export declare class OAuthRefreshError extends Error {
     provider: string;
@@ -34,4 +34,4 @@ export interface ResolvedCredential {
     credential: unknown;
 }
 export declare function getDecryptedIntegrationCredential(userId: string, integrationId: string, config: StreamByConfig): Promise<ResolvedCredential | null>;
-export declare function getDecryptedIntegrationCredentialById(integrationId: string, config: StreamByConfig): Promise<ResolvedCredential | null>;
+export declare function getDecryptedIntegrationCredentialById(integrationId: string, config: StreamByConfig, project: Pick<ProjectInfo, 'members'>): Promise<ResolvedCredential | null>;

package/dist/services/userIntegration.js

@@ -15,6 +15,7 @@ exports.getDecryptedIntegrationCredentialById = getDecryptedIntegrationCredentia
 const crypto_1 = __importDefault(require("crypto"));
 const manager_1 = require("../models/manager");
 const encryption_1 = require("../utils/encryption");
+const auth_1 = require("../utils/auth");
 const oauthClient_1 = require("./oauthClient");
 const OAUTH_SERVICE_PROVIDERS = new Set(['jira', 'google']);
 function isOAuthServiceProvider(provider) {
@@ -157,9 +158,14 @@ async function getDecryptedIntegrationCredential(userId, integrationId, config)
 // stored on the connection itself. `config` is required (not just for OAuth's sake) so a
 // near-expiry jira/google token can be refreshed using the host-injected client
 // credentials in config.oauthProviders.
-async function getDecryptedIntegrationCredentialById(integrationId, config) {
+// A member's own integration, used by a project it was connected to: it resolves only while its
+// owner is an active member of that project. A project its owner isn't in (never was, left it,
+// or a connection pointing at someone else's integration) never gets the credential.
+async function getDecryptedIntegrationCredentialById(integrationId, config, project) {
     const UserIntegrationModel = (0, manager_1.getModel)('user_integrations');
     const integration = await UserIntegrationModel.findOne({ id: integrationId });
+    if (!integration || !(0, auth_1.activeMemberOf)(project, integration.userId))
+        return null;
     return resolveCredential(integration, config);
 }
 async function decryptIntegration(integration) {

package/dist/services/wsHub.js

@@ -15,6 +15,12 @@ function initWsHub(wss, config) {
                 ws.close(1008, 'Unauthorized');
                 return;
             }
+            // The WebSocket is the browser session's: it gets every event of its user, whatever the
+            // project, so an API token (scoped to some projects, maybe read-only) never opens it.
+            if (auth.apiToken) {
+                ws.close(1008, "API tokens can't open the WebSocket");
+                return;
+            }
             userId = auth.userId;
         }
         catch (err) {

package/dist/types/index.d.ts

@@ -63,6 +63,7 @@ export interface ProjectInfo {
         role: 'viewer' | 'editor' | 'admin';
         userId: string;
         archived?: boolean;
+        status?: 'active' | 'pending';
     }[];
     description?: string;
     exports?: {
@@ -131,6 +132,7 @@ export interface StreamByConfig {
     databases?: DatabaseCredential[];
     adapter?: StorageAdapter;
     encrypt?: string;
+    encryptPreviousKeys?: string[];
     websocket?: {
         server: WebSocketServer;
     };
@@ -156,6 +158,13 @@ export interface Auth {
     userId: string;
     username: string;
     role: 'viewer' | 'editor' | 'admin';
+    apiToken?: ApiTokenScope;
+}
+export type ApiTokenAccess = 'read' | 'write';
+export interface ApiTokenScope {
+    tokenId: string;
+    access: ApiTokenAccess;
+    projectIds: string[] | '*';
 }
 export type AuthProvider = (req: Request) => Promise<Auth>;
 export type UserPlan = 'freemium' | 'subscriber' | 'admin';

package/dist/utils/auth.d.ts

@@ -1,2 +1,16 @@
 import { ProjectInfo } from '../types';
-export declare function isProjectMember(project: ProjectInfo, userId: string): boolean;
+type ProjectMembers = Pick<ProjectInfo, 'members'> | null | undefined;
+export declare function activeMemberOf(project: ProjectMembers, userId: string | undefined): {
+    role: "viewer" | "editor" | "admin";
+    userId: string;
+    archived?: boolean;
+    status?: "active" | "pending";
+} | undefined;
+export declare const projectRoleOf: (project: ProjectMembers, userId: string | undefined) => "viewer" | "editor" | "admin" | undefined;
+/** An active member, whatever their role: can see the project. */
+export declare const isProjectMember: (project: ProjectMembers, userId: string | undefined) => boolean;
+/** An editor or an admin of the project: can change it (its content, its connections). */
+export declare const canEditProject: (project: ProjectMembers, userId: string | undefined) => boolean;
+/** An admin of the project: can manage its members, and delete it. */
+export declare const isProjectAdmin: (project: ProjectMembers, userId: string | undefined) => boolean;
+export {};

package/dist/utils/auth.js

@@ -1,9 +1,24 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.isProjectMember = isProjectMember;
-function isProjectMember(project, userId) {
-    if (!project || !project.members) {
-        return false;
-    }
-    return project.members.some(member => member.userId === userId);
+exports.isProjectAdmin = exports.canEditProject = exports.isProjectMember = exports.projectRoleOf = void 0;
+exports.activeMemberOf = activeMemberOf;
+// A project's member who's in it now: invited and accepted (status 'active'). (A member's
+// `archived` is only that member having archived the project in their own list.)
+function activeMemberOf(project, userId) {
+    if (!project?.members || !userId)
+        return undefined;
+    return project.members.find(member => member.userId?.toString() === userId && member.status === 'active');
 }
+// What a user can do in a project is their role in it, as an active member -- never their
+// role on the platform (Auth.role): a pending invitation is no access yet.
+const projectRoleOf = (project, userId) => activeMemberOf(project, userId)?.role;
+exports.projectRoleOf = projectRoleOf;
+/** An active member, whatever their role: can see the project. */
+const isProjectMember = (project, userId) => !!(0, exports.projectRoleOf)(project, userId);
+exports.isProjectMember = isProjectMember;
+/** An editor or an admin of the project: can change it (its content, its connections). */
+const canEditProject = (project, userId) => ['editor', 'admin'].includes((0, exports.projectRoleOf)(project, userId) ?? '');
+exports.canEditProject = canEditProject;
+/** An admin of the project: can manage its members, and delete it. */
+const isProjectAdmin = (project, userId) => (0, exports.projectRoleOf)(project, userId) === 'admin';
+exports.isProjectAdmin = isProjectAdmin;

package/dist/utils/encryption.d.ts

@@ -1,4 +1,9 @@
-export declare const setEncryptionKey: (key: string) => void;
+/** The key credentials are encrypted with, and the previous ones they may still be in. */
+export declare const setEncryptionKey: (key: string, previousKeys?: string[]) => void;
 export declare const encrypt: (text: string) => string;
 export declare const decrypt: (text: string) => string;
+/** Whether a stored value is encrypted the current way (GCM, with the current key). */
+export declare const isCurrentEncryption: (text: string) => boolean;
+/** Whether a stored value is in this module's own format (GCM, any key). */
+export declare const isVersionedEncryption: (text: string) => boolean;
 export declare const isEncryptionKeySet: () => boolean;