streamby-core 0.33.0 → 0.35.0

package/dist/utils/encryption.js

@@ -33,43 +33,96 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.isEncryptionKeySet = exports.decrypt = exports.encrypt = exports.setEncryptionKey = void 0;
+exports.isEncryptionKeySet = exports.isVersionedEncryption = exports.isCurrentEncryption = exports.decrypt = exports.encrypt = exports.setEncryptionKey = void 0;
 const crypto = __importStar(require("crypto"));
-const ALGORITHM = 'aes-256-cbc';
-const IV_LENGTH = 16; // For AES, this is always 16
-let ENCRYPTION_KEY = undefined;
-const setEncryptionKey = (key) => {
-    if (key.length !== 64) { // 32 bytes * 2 hex characters per byte
+// Stored credentials, encrypted with AES-256-GCM (authenticated: an altered value fails to
+// decrypt instead of decrypting to garbage), each value naming the key it was encrypted with:
+//
+//   v2:<key id>:<iv>:<auth tag>:<ciphertext>      (base64url parts; a 12-byte iv)
+//
+// A key's id is a fingerprint of it, so rotating is only configuring the new key as the
+// current one and the old ones as previous keys: what's stored keeps decrypting, and is
+// re-encrypted with the current key (see services/reencryptCredentials).
+//
+// Values stored before (AES-256-CBC, "<iv hex>:<ciphertext hex>", no key id) still decrypt,
+// with the current key or a previous one.
+const GCM = 'aes-256-gcm';
+const GCM_IV_LENGTH = 12;
+const LEGACY_CBC = 'aes-256-cbc';
+const VERSION = 'v2';
+let currentKey;
+const keysById = new Map();
+const keyBuffer = (hex) => {
+    if (typeof hex !== 'string' || !/^[0-9a-fA-F]{64}$/.test(hex)) {
         throw new Error('Invalid encryption key length. Key must be 32 bytes (64 hexadecimal characters).');
     }
-    ENCRYPTION_KEY = key;
+    return Buffer.from(hex, 'hex');
+};
+// A key's id: a fingerprint of it (never the key, nor enough to find it).
+const keyIdOf = (key) => crypto.createHash('sha256').update('streamby-encryption-key:').update(key).digest('hex').slice(0, 16);
+/** The key credentials are encrypted with, and the previous ones they may still be in. */
+const setEncryptionKey = (key, previousKeys = []) => {
+    const current = keyBuffer(key);
+    const previous = previousKeys.map(keyBuffer);
+    keysById.clear();
+    for (const k of [...previous, current])
+        keysById.set(keyIdOf(k), k);
+    currentKey = { id: keyIdOf(current), key: current };
 };
 exports.setEncryptionKey = setEncryptionKey;
+const requireKey = () => {
+    if (!currentKey)
+        throw new Error('Encryption key is not set. Cannot encrypt or decrypt credentials.');
+    return currentKey;
+};
 const encrypt = (text) => {
-    if (!ENCRYPTION_KEY) {
-        throw new Error('Encryption key is not set. Cannot encrypt credentials.');
-    }
-    const iv = crypto.randomBytes(IV_LENGTH);
-    const cipher = crypto.createCipheriv(ALGORITHM, Buffer.from(ENCRYPTION_KEY, 'hex'), iv);
-    let encrypted = cipher.update(text);
-    encrypted = Buffer.concat([encrypted, cipher.final()]);
-    return iv.toString('hex') + ':' + encrypted.toString('hex');
+    const { id, key } = requireKey();
+    const iv = crypto.randomBytes(GCM_IV_LENGTH);
+    const cipher = crypto.createCipheriv(GCM, key, iv);
+    const encrypted = Buffer.concat([cipher.update(text, 'utf8'), cipher.final()]);
+    const tag = cipher.getAuthTag();
+    return [VERSION, id, iv.toString('base64url'), tag.toString('base64url'), encrypted.toString('base64url')].join(':');
 };
 exports.encrypt = encrypt;
+const decryptLegacy = (text, key) => {
+    const [ivHex, ...rest] = text.split(':');
+    const decipher = crypto.createDecipheriv(LEGACY_CBC, key, Buffer.from(ivHex, 'hex'));
+    return Buffer.concat([decipher.update(Buffer.from(rest.join(':'), 'hex')), decipher.final()]).toString();
+};
 const decrypt = (text) => {
-    if (!ENCRYPTION_KEY) {
-        throw new Error('Encryption key is not set. Cannot decrypt credentials.');
+    requireKey();
+    if (text.startsWith(`${VERSION}:`)) {
+        const [, id, iv, tag, encrypted] = text.split(':');
+        const key = keysById.get(id);
+        if (!key)
+            throw new Error('This credential was encrypted with a key that is not configured.');
+        const decipher = crypto.createDecipheriv(GCM, key, Buffer.from(iv, 'base64url'));
+        decipher.setAuthTag(Buffer.from(tag, 'base64url'));
+        try {
+            return Buffer.concat([decipher.update(Buffer.from(encrypted, 'base64url')), decipher.final()]).toString('utf8');
+        }
+        catch {
+            throw new Error('This credential could not be decrypted: it was altered or damaged.');
+        }
+    }
+    // Stored before: CBC, with whichever configured key it was encrypted with.
+    let lastError;
+    for (const key of [currentKey.key, ...[...keysById.values()].filter(k => k !== currentKey.key)]) {
+        try {
+            return decryptLegacy(text, key);
+        }
+        catch (err) {
+            lastError = err;
+        }
     }
-    const textParts = text.split(':');
-    const iv = Buffer.from(textParts.shift(), 'hex');
-    const encryptedText = Buffer.from(textParts.join(':'), 'hex');
-    const decipher = crypto.createDecipheriv(ALGORITHM, Buffer.from(ENCRYPTION_KEY, 'hex'), iv);
-    let decrypted = decipher.update(encryptedText);
-    decrypted = Buffer.concat([decrypted, decipher.final()]);
-    return decrypted.toString();
+    throw lastError instanceof Error ? lastError : new Error('This credential could not be decrypted.');
 };
 exports.decrypt = decrypt;
-const isEncryptionKeySet = () => {
-    return !!ENCRYPTION_KEY;
-};
+/** Whether a stored value is encrypted the current way (GCM, with the current key). */
+const isCurrentEncryption = (text) => !!currentKey && text.startsWith(`${VERSION}:${currentKey.id}:`);
+exports.isCurrentEncryption = isCurrentEncryption;
+/** Whether a stored value is in this module's own format (GCM, any key). */
+const isVersionedEncryption = (text) => text.startsWith(`${VERSION}:`);
+exports.isVersionedEncryption = isVersionedEncryption;
+const isEncryptionKeySet = () => !!currentKey;
 exports.isEncryptionKeySet = isEncryptionKeySet;

package/dist/utils/serviceEndpoints.d.ts

@@ -0,0 +1,2 @@
+import { ServiceProviderType } from '../types';
+export declare function isServiceEndpoint(provider: ServiceProviderType, endpoint: unknown): endpoint is string;

package/dist/utils/serviceEndpoints.js

@@ -0,0 +1,26 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isServiceEndpoint = isServiceEndpoint;
+// Where a service integration's credential may be sent: its own provider's API, over https.
+// A node chooses the endpoint it calls, and anyone who can edit the node could otherwise point
+// it at a server of their own and receive the credential of whoever connected the integration.
+const PROVIDER_HOSTS = {
+    claude: (host) => host === 'api.anthropic.com',
+    jira: (host) => host === 'api.atlassian.com' || host.endsWith('.atlassian.net'),
+    google: (host) => host === 'googleapis.com' || host.endsWith('.googleapis.com'),
+};
+function isServiceEndpoint(provider, endpoint) {
+    if (typeof endpoint !== 'string')
+        return false;
+    let url;
+    try {
+        url = new URL(endpoint);
+    }
+    catch {
+        return false;
+    }
+    if (url.protocol !== 'https:' || url.username || url.password || url.port)
+        return false;
+    const allowed = PROVIDER_HOSTS[provider];
+    return !!allowed && allowed(url.hostname.toLowerCase());
+}

package/package.json

@@ -1,11 +1,12 @@
 {
   "name": "streamby-core",
-  "version": "0.33.0",
+  "version": "0.35.0",
   "description": "StreamBy middleware framework for media storage management",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
   "files": [
-    "dist"
+    "dist",
+    "CHANGELOG.md"
   ],
   "scripts": {
     "build": "tsc",
@@ -27,7 +28,7 @@
     "typescript"
   ],
   "author": "TerminalCore Labs",
-  "license": "MIT",
+  "license": "AGPL-3.0-only",
   "dependencies": {
     "@aws-sdk/client-s3": "^3.528.0",
     "@aws-sdk/s3-request-presigner": "^3.787.0",

package/dist/middleware/routes/apiConnection.d.ts

@@ -1,3 +0,0 @@
-import { Router } from 'express';
-import { StreamByConfig } from '../../types';
-export declare function apiConnectionRouter(config: StreamByConfig): Router;

package/dist/middleware/routes/apiConnection.js

@@ -1,100 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.apiConnectionRouter = apiConnectionRouter;
-const express_1 = require("express");
-const manager_1 = require("../../models/manager");
-const auth_1 = require("../../utils/auth");
-const apiConnection_1 = require("../../services/apiConnection");
-const VALID_METHODS = ['GET', 'POST', 'PATCH', 'PUT', 'DELETE'];
-function apiConnectionRouter(config) {
-    const router = (0, express_1.Router)();
-    const Project = (0, manager_1.getModel)('projects');
-    // List API connections for a project
-    router.get('/projects/:id/api/connections', async (req, res) => {
-        try {
-            const auth = req.auth;
-            const projectId = req.params.id;
-            const project = await Project.findOne({ _id: projectId });
-            if (!project) {
-                return res.status(404).json({ message: 'Project not found' });
-            }
-            if (!(0, auth_1.isProjectMember)(project, auth.userId)) {
-                return res.status(403).json({ message: 'Unauthorized project access' });
-            }
-            return res.status(200).json({ data: project.apiConnections || [] });
-        }
-        catch (err) {
-            res.status(500).json({ message: 'Failed to fetch API connections', details: err.message });
-        }
-    });
-    // Add a new API connection to a project
-    router.post('/projects/:id/api/connections', async (req, res) => {
-        try {
-            const auth = req.auth;
-            if (auth.role !== 'admin' && auth.role !== 'editor') {
-                return res.status(403).json({ message: 'Permission denied' });
-            }
-            const projectId = req.params.id;
-            const { name, baseUrl, method, description, credentialId, prefix } = req.body;
-            if (!name || !baseUrl) {
-                return res.status(400).json({ message: 'name and baseUrl are required' });
-            }
-            if (!VALID_METHODS.includes(method)) {
-                return res.status(400).json({ message: `method must be one of: ${VALID_METHODS.join(', ')}` });
-            }
-            const project = await Project.findOne({ _id: projectId });
-            if (!project) {
-                return res.status(404).json({ message: 'Project not found' });
-            }
-            if (!(0, auth_1.isProjectMember)(project, auth.userId)) {
-                return res.status(403).json({ message: 'Unauthorized project access' });
-            }
-            if (credentialId) {
-                const credExists = project.credentials?.some((c) => c.id === credentialId);
-                if (!credExists) {
-                    return res.status(400).json({ message: 'Credential not found in project' });
-                }
-            }
-            const connection = await (0, apiConnection_1.addApiConnection)(config, projectId, {
-                name,
-                baseUrl,
-                method,
-                prefix,
-                ...(description !== undefined && { description }),
-                ...(credentialId !== undefined && { credentialId }),
-            });
-            return res.status(201).json({ data: connection });
-        }
-        catch (err) {
-            res.status(500).json({ message: 'Failed to add API connection', details: err.message });
-        }
-    });
-    // Delete an API connection from a project
-    router.delete('/projects/:id/api/connections/:connectionId', async (req, res) => {
-        try {
-            const auth = req.auth;
-            if (auth.role !== 'admin' && auth.role !== 'editor') {
-                return res.status(403).json({ message: 'Permission denied' });
-            }
-            const projectId = req.params.id;
-            const { connectionId } = req.params;
-            const project = await Project.findOne({ _id: projectId });
-            if (!project) {
-                return res.status(404).json({ message: 'Project not found' });
-            }
-            if (!(0, auth_1.isProjectMember)(project, auth.userId)) {
-                return res.status(403).json({ message: 'Unauthorized project access' });
-            }
-            const exists = project.apiConnections?.some((c) => c.id === connectionId);
-            if (!exists) {
-                return res.status(404).json({ message: 'API connection not found' });
-            }
-            await (0, apiConnection_1.deleteApiConnection)(config, projectId, connectionId);
-            return res.status(200).json({ message: 'API connection deleted successfully.' });
-        }
-        catch (err) {
-            res.status(500).json({ message: 'Failed to delete API connection', details: err.message });
-        }
-    });
-    return router;
-}

package/dist/middleware/routes/credential.js

@@ -1,80 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.credentialRouter = credentialRouter;
-const express_1 = require("express");
-const manager_1 = require("../../models/manager");
-const auth_1 = require("../../utils/auth");
-const sanitize_1 = require("../../utils/sanitize");
-const credential_1 = require("../../services/credential");
-function credentialRouter(config) {
-    const router = (0, express_1.Router)();
-    const Project = (0, manager_1.getModel)('projects');
-    // Add a new credential to a project
-    router.post('/projects/:id/credentials', async (req, res) => {
-        try {
-            const auth = req.auth;
-            if (auth.role !== 'admin' && auth.role !== 'editor') {
-                return res.status(403).json({ message: 'Permission denied' });
-            }
-            const projectId = req.params.id;
-            const { id, key, value } = req.body;
-            if (!key || !value) {
-                return res.status(400).json({ message: 'Missing credential key or value' });
-            }
-            const project = await Project.findOne({ _id: projectId });
-            if (!project || !(0, auth_1.isProjectMember)(project, auth.userId)) {
-                return res.status(403).json({ message: 'Unauthorized project access' });
-            }
-            const updatedProject = await (0, credential_1.addCredential)(config, projectId, { id, key, value });
-            res.status(201).json({ message: 'Credential added successfully', project: (0, sanitize_1.sanitizeProject)(updatedProject) });
-        }
-        catch (err) {
-            res.status(500).json({ message: 'Failed to add credential', details: err.message });
-        }
-    });
-    // Update an existing credential in a project
-    router.patch('/projects/:id/credentials/:credentialId', async (req, res) => {
-        try {
-            const auth = req.auth;
-            if (auth.role !== 'admin' && auth.role !== 'editor') {
-                return res.status(403).json({ message: 'Permission denied' });
-            }
-            const projectId = req.params.id;
-            const credentialId = req.params.credentialId;
-            const { key, value } = req.body;
-            if (!key && !value) {
-                return res.status(400).json({ message: 'No update fields provided' });
-            }
-            const project = await Project.findOne({ _id: projectId });
-            if (!project || !(0, auth_1.isProjectMember)(project, auth.userId)) {
-                return res.status(403).json({ message: 'Unauthorized project access' });
-            }
-            const updatedProject = await (0, credential_1.updateCredential)(config, projectId, credentialId, { key, value });
-            res.status(200).json({ message: 'Credential updated successfully', project: (0, sanitize_1.sanitizeProject)(updatedProject) });
-        }
-        catch (err) {
-            res.status(500).json({ message: 'Failed to update credential', details: err.message });
-        }
-    });
-    // Delete a credential from a project
-    router.delete('/projects/:id/credentials/:credentialId', async (req, res) => {
-        try {
-            const auth = req.auth;
-            if (auth.role !== 'admin' && auth.role !== 'editor') {
-                return res.status(403).json({ message: 'Permission denied' });
-            }
-            const projectId = req.params.id;
-            const credentialId = req.params.credentialId;
-            const project = await Project.findOne({ _id: projectId });
-            if (!project || !(0, auth_1.isProjectMember)(project, auth.userId)) {
-                return res.status(403).json({ message: 'Unauthorized project access' });
-            }
-            const updatedProject = await (0, credential_1.deleteCredential)(config, projectId, credentialId);
-            res.status(200).json({ message: 'Credential deleted successfully', project: (0, sanitize_1.sanitizeProject)(updatedProject) });
-        }
-        catch (err) {
-            res.status(500).json({ message: 'Failed to delete credential', details: err.message });
-        }
-    });
-    return router;
-}

package/dist/services/apiConnection.d.ts

@@ -1,18 +0,0 @@
-import { StreamByConfig, ApiConnection, ApiConnectionMethod } from '../types';
-export declare function addApiConnection(config: StreamByConfig, projectId: string, data: {
-    name: string;
-    apiUrl: string;
-    method: ApiConnectionMethod;
-    prefix?: string;
-    description?: string;
-    credentialId?: string;
-}): Promise<ApiConnection>;
-export declare function updateApiConnection(config: StreamByConfig, projectId: string, connectionId: string, data: {
-    name?: string;
-    apiUrl?: string;
-    method?: ApiConnectionMethod;
-    prefix?: string;
-    description?: string;
-    credentialId?: string;
-}): Promise<ApiConnection>;
-export declare function deleteApiConnection(config: StreamByConfig, projectId: string, connectionId: string): Promise<void>;

package/dist/services/apiConnection.js

@@ -1,65 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.addApiConnection = addApiConnection;
-exports.updateApiConnection = updateApiConnection;
-exports.deleteApiConnection = deleteApiConnection;
-const mongodb_1 = require("mongodb");
-const manager_1 = require("../models/manager");
-async function addApiConnection(config, projectId, data) {
-    const ProjectModel = (0, manager_1.getModel)('projects');
-    const project = await ProjectModel.findOne({ _id: projectId });
-    if (!project) {
-        throw new Error('Project not found.');
-    }
-    const connection = {
-        id: new mongodb_1.ObjectId().toHexString(),
-        name: data.name,
-        prefix: data.prefix,
-        apiUrl: data.apiUrl,
-        method: data.method,
-        projectId,
-        createdAt: new Date(),
-        ...(data.description !== undefined && { description: data.description }),
-        ...(data.credentialId !== undefined && { credentialId: data.credentialId }),
-    };
-    const updatedProject = await ProjectModel.update({ _id: projectId }, { $push: { apiConnections: connection } });
-    if (!updatedProject) {
-        throw new Error('Failed to add API connection to project.');
-    }
-    return connection;
-}
-async function updateApiConnection(config, projectId, connectionId, data) {
-    const ProjectModel = (0, manager_1.getModel)('projects');
-    const project = await ProjectModel.findOne({ _id: projectId });
-    if (!project)
-        throw new Error('Project not found.');
-    const connections = project.apiConnections ?? [];
-    const index = connections.findIndex((c) => c.id === connectionId);
-    if (index === -1)
-        throw new Error('API connection not found.');
-    const updated = {
-        ...connections[index],
-        ...(data.name !== undefined && { name: data.name }),
-        ...(data.apiUrl !== undefined && { apiUrl: data.apiUrl }),
-        ...(data.method !== undefined && { method: data.method }),
-        ...(data.prefix !== undefined && { prefix: data.prefix }),
-        ...(data.description !== undefined && { description: data.description }),
-        ...(data.credentialId !== undefined && { credentialId: data.credentialId }),
-    };
-    connections[index] = updated;
-    const result = await ProjectModel.update({ _id: projectId }, { $set: { apiConnections: connections } });
-    if (!result)
-        throw new Error('Failed to update API connection.');
-    return updated;
-}
-async function deleteApiConnection(config, projectId, connectionId) {
-    const ProjectModel = (0, manager_1.getModel)('projects');
-    const project = await ProjectModel.findOne({ _id: projectId });
-    if (!project) {
-        throw new Error('Project not found.');
-    }
-    const updatedProject = await ProjectModel.update({ _id: projectId }, { $pull: { apiConnections: { id: connectionId } } });
-    if (!updatedProject) {
-        throw new Error('Failed to delete API connection from project.');
-    }
-}

package/dist/services/credential.d.ts

@@ -1,8 +0,0 @@
-import { StreamByConfig, Credential, ProjectInfo } from '../types';
-export declare function addCredential(config: StreamByConfig, projectId: string, newCredential: Omit<Credential, 'encryptedValue'> & {
-    value: string;
-}): Promise<ProjectInfo>;
-export declare function updateCredential(config: StreamByConfig, projectId: string, credentialId: string, updates: Partial<Omit<Credential, 'encryptedValue'> & {
-    value: string;
-}>): Promise<ProjectInfo>;
-export declare function deleteCredential(config: StreamByConfig, projectId: string, credentialId: string): Promise<ProjectInfo>;

package/dist/services/credential.js

@@ -1,70 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.addCredential = addCredential;
-exports.updateCredential = updateCredential;
-exports.deleteCredential = deleteCredential;
-const manager_1 = require("../models/manager");
-const encryption_1 = require("../utils/encryption");
-const mongodb_1 = require("mongodb");
-async function addCredential(config, projectId, newCredential) {
-    if (!(0, encryption_1.isEncryptionKeySet)()) {
-        throw new Error('Encryption key is not set. Cannot add credentials.');
-    }
-    const ProjectModel = (0, manager_1.getModel)('projects');
-    const project = await ProjectModel.findOne({ _id: projectId });
-    if (!project) {
-        throw new Error('Project not found.');
-    }
-    const encryptedValue = (0, encryption_1.encrypt)(newCredential.value);
-    const credentialToSave = {
-        id: newCredential.id || new mongodb_1.ObjectId().toHexString(), // Generate ID if not provided
-        key: newCredential.key,
-        encryptedValue: encryptedValue,
-    };
-    const updatedProject = await ProjectModel.update({ _id: projectId }, { $push: { credentials: credentialToSave } });
-    if (!updatedProject) {
-        throw new Error('Failed to add credential to project.');
-    }
-    return updatedProject;
-}
-async function updateCredential(config, projectId, credentialId, updates) {
-    if (!(0, encryption_1.isEncryptionKeySet)()) {
-        throw new Error('Encryption key is not set. Cannot update credentials.');
-    }
-    const ProjectModel = (0, manager_1.getModel)('projects');
-    const project = await ProjectModel.findOne({ _id: projectId });
-    if (!project) {
-        throw new Error('Project not found.');
-    }
-    const credentialIndex = project.credentials?.findIndex(cred => cred.id === credentialId);
-    if (credentialIndex === undefined || credentialIndex === -1) {
-        throw new Error(`Credential with ID ${credentialId} not found.`);
-    }
-    const currentCredential = project.credentials[credentialIndex];
-    let encryptedValue = currentCredential.encryptedValue;
-    if (updates.value !== undefined) {
-        encryptedValue = (0, encryption_1.encrypt)(updates.value);
-    }
-    const updatedCredential = {
-        ...currentCredential,
-        key: updates.key || currentCredential.key,
-        encryptedValue: encryptedValue,
-    };
-    const updatedProject = await ProjectModel.update({ _id: projectId, 'credentials.id': credentialId }, { $set: { 'credentials.$': updatedCredential } });
-    if (!updatedProject) {
-        throw new Error('Failed to update credential in project.');
-    }
-    return updatedProject;
-}
-async function deleteCredential(config, projectId, credentialId) {
-    const ProjectModel = (0, manager_1.getModel)('projects');
-    const project = await ProjectModel.findOne({ _id: projectId });
-    if (!project) {
-        throw new Error('Project not found.');
-    }
-    const updatedProject = await ProjectModel.update({ _id: projectId }, { $pull: { credentials: { id: credentialId } } });
-    if (!updatedProject) {
-        throw new Error('Failed to delete credential from project.');
-    }
-    return updatedProject;
-}

package/dist/services/pipeline.d.ts

@@ -1,2 +0,0 @@
-import { NodeSchema, StreamByConfig } from '../types';
-export declare function executePipeline(nodeSchema: NodeSchema, project: any, config: StreamByConfig): Promise<any>;