streamby-core 0.35.0 → 0.37.0

package/dist/services/apiTokenPermissions.js

@@ -0,0 +1,98 @@
+"use strict";
+// What an API token may do: a list of permissions, each a resource and an action. A request
+// made with a token goes through only when its route's permission is among the token's (see
+// enforceApiTokenScope), and a route without one isn't reachable with a token at all.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isAccountPermission = exports.isProjectPermission = exports.ACCOUNT_PERMISSIONS = exports.PROJECT_PERMISSIONS = void 0;
+exports.routeRuleFor = routeRuleFor;
+/** Permissions on a project, for the projects a token reaches. */
+exports.PROJECT_PERMISSIONS = [
+    'project:read', 'project:update', 'project:delete',
+    'members:read', 'members:manage',
+    'assets:read', 'assets:write', 'assets:delete',
+    'production:read', 'production:write', 'production:delete',
+    'workflow:read', 'workflow:write',
+    'exports:read', 'exports:write',
+    'rights:read', 'rights:write',
+    'jobs:read', 'jobs:run',
+];
+/** Permissions on the account: only a user's token has them. */
+exports.ACCOUNT_PERMISSIONS = ['projects:create'];
+const isProjectPermission = (value) => exports.PROJECT_PERMISSIONS.includes(value);
+exports.isProjectPermission = isProjectPermission;
+const isAccountPermission = (value) => exports.ACCOUNT_PERMISSIONS.includes(value);
+exports.isAccountPermission = isAccountPermission;
+const READ = ['GET', 'HEAD', 'OPTIONS'];
+const methodsOf = (methods) => methods === 'read' ? READ : methods === 'write' ? ['POST', 'PUT', 'PATCH'] : methods === 'delete' ? ['DELETE'] : methods;
+// A project's own path (not /projects/create nor /projects/explore).
+const P = '^/projects/(?!(?:create|explore)/?$)[^/]+';
+const rule = (methods, path, permission, extra = {}) => ({ methods: methodsOf(methods), pattern: new RegExp(`${path}/?$`), permission, ...extra });
+// The first rule that matches a request decides it; a request no rule matches is refused.
+// Connections, integrations and allowed origins are the project's settings (project:*);
+// reviews, QC reports and dependency graphs are of its assets; pipelines are workflow.
+const RULES = [
+    // Outside a project.
+    rule('read', '^/auth', null),
+    rule('read', '^/projects', null),
+    rule(['POST'], '^/projects/create', 'projects:create'),
+    rule('read', '^/user/subscription', null, { userTokenOnly: true }),
+    rule('read', '^/users/search', 'members:manage'),
+    rule('read', '^/jobs/[^/]+', 'jobs:read'),
+    // The project itself and its settings.
+    rule('read', `${P}(/preview)?`, 'project:read'),
+    rule(['PATCH'], P, 'project:update'),
+    rule('delete', P, 'project:delete'),
+    rule(['PATCH'], `${P}/(archive|unarchive)`, 'project:update', { userTokenOnly: true }),
+    rule(['POST'], `${P}/image`, 'project:update'),
+    rule(['PATCH'], `${P}/origins`, 'project:update'),
+    rule(['POST'], `${P}/integrations`, 'project:update'),
+    rule('delete', `${P}/integrations/[^/]+`, 'project:update'),
+    rule('read', '^/upload-project-image-url/[^/]+', 'project:update'),
+    rule('delete', '^/delete-project-image-url/[^/]+', 'project:update'),
+    // Members.
+    rule('read', `${P}/members`, 'members:read'),
+    rule(['POST'], `${P}/members`, 'members:manage'),
+    rule(['PATCH'], `${P}/members/[^/]+(/approve)?`, 'members:manage'),
+    rule('delete', `${P}/members/[^/]+`, 'members:manage'),
+    // Assets: the built-in storage, and a storage connection's files and folders.
+    rule('read', `${P}/(storage|connections/storage/[^/]+)/(.+/)?(upload-url|replace-url)`, 'assets:write'),
+    rule('read', `${P}/storage/.+`, 'assets:read'),
+    rule(['PATCH'], `${P}/storage/files/[^/]+`, 'assets:write'),
+    rule('delete', `${P}/storage/files/[^/]+`, 'assets:delete'),
+    rule('read', `${P}/connections/storage/[^/]+/(files|folders)(/.+)?`, 'assets:read'),
+    rule(['POST', 'PATCH'], `${P}/connections/storage/[^/]+/(files|folders)(/.+)?`, 'assets:write'),
+    rule('delete', `${P}/connections/storage/[^/]+/(files|folders)/[^/]+`, 'assets:delete'),
+    rule('read', `${P}/assets/[^/]+/(metadata|versions|qc-report|dependency-graph)`, 'assets:read'),
+    rule(['PATCH'], `${P}/assets/[^/]+/metadata`, 'assets:write'),
+    rule(['POST'], `${P}/assets/[^/]+/qc-report`, 'assets:write'),
+    rule('read', `${P}/(reviews(/[^/]+)?|assets/[^/]+/versions/[^/]+/annotations)`, 'assets:read'),
+    rule(['POST', 'PATCH'], `${P}/(reviews(/[^/]+/decision)?|assets/[^/]+/versions/[^/]+/annotations(/[^/]+/resolve)?)`, 'assets:write'),
+    // Rights.
+    rule('read', `${P}/assets/[^/]+/rights`, 'rights:read'),
+    rule(['PUT'], `${P}/assets/[^/]+/rights`, 'rights:write'),
+    // Connections (API, database, storage, distribution, render farm): the project's settings.
+    rule('read', `${P}/(connections|get-connection|distribution-connections|render-farm-connections)(/.+)?`, 'project:read'),
+    rule('write', `${P}/(connections|distribution-connections|render-farm-connections)(/.+)?`, 'project:update'),
+    rule('delete', `${P}/(connections|distribution-connections|render-farm-connections)/.+`, 'project:update'),
+    // Production.
+    rule('read', `${P}/production/.+`, 'production:read'),
+    rule('write', `${P}/production/.+`, 'production:write'),
+    rule('delete', `${P}/production/.+`, 'production:delete'),
+    // Workflow and pipelines.
+    rule('read', `${P}/(workflow|pipelines(/[^/]+)?)`, 'workflow:read'),
+    rule(['PATCH'], `${P}/workflow`, 'workflow:write'),
+    rule(['POST'], `${P}/pipelines`, 'workflow:write'),
+    rule(['PATCH', 'DELETE'], `${P}/pipelines/[^/]+`, 'workflow:write'),
+    // Exports.
+    rule('read', `${P}/exports/[^/]+`, 'exports:read'),
+    rule(['POST'], `${P}/exports`, 'exports:write'),
+    rule(['PATCH', 'DELETE'], `${P}/exports/[^/]+`, 'exports:write'),
+    // Jobs: transcoding, rendering, AI, publishing a deliverable.
+    rule(['POST'], `${P}/(jobs/[^/]+|pipeline-suggest|deliverables/[^/]+/publish)`, 'jobs:run'),
+];
+/** The rule for a request made with an API token, or undefined: not reachable with one. */
+function routeRuleFor(method, path) {
+    const upper = method.toUpperCase();
+    const found = RULES.find(r => r.methods.includes(upper) && r.pattern.test(path));
+    return found && { permission: found.permission, userTokenOnly: found.userTokenOnly };
+}

package/dist/services/apiTokens.d.ts

@@ -1,21 +1,28 @@
-import { ApiTokenAccess, ApiTokenScope, StreamByConfig } from '../types';
+import { ApiTokenKind, ApiTokenScope, StreamByConfig } from '../types';
+import { ApiTokenPermission } from './apiTokenPermissions';
 export declare const API_TOKEN_PREFIX = "sbt_";
 export declare const API_TOKEN_EXPIRY_DAYS: readonly [7, 30, 90, 365];
 export interface ApiTokenRecord {
     id: string;
+    kind: ApiTokenKind;
     userId: string;
+    createdByName: string | null;
     name: string;
     prefix: string;
     hash: string;
-    access: ApiTokenAccess;
+    permissions: ApiTokenPermission[];
     projectIds: string[];
     createdAt: Date;
     expiresAt: Date | null;
     lastUsedAt: Date | null;
 }
-/** What a token's owner sees of it. */
-export type ApiTokenInfo = Omit<ApiTokenRecord, 'hash' | 'userId' | 'projectIds'> & {
+/** What's shown of a token: never its hash. */
+export type ApiTokenInfo = Omit<ApiTokenRecord, 'hash' | 'userId' | 'projectIds' | 'createdByName'> & {
     projectIds: string[] | '*';
+    createdBy: {
+        userId: string;
+        username: string | null;
+    };
 };
 export declare class ApiTokenError extends Error {
     status: number;
@@ -23,25 +30,42 @@ export declare class ApiTokenError extends Error {
 }
 export interface CreateApiTokenInput {
     name: string;
-    access: ApiTokenAccess;
-    projectIds: string[] | '*';
+    permissions: ApiTokenPermission[];
+    projectIds?: string[] | '*';
     expiresInDays: number | null;
 }
-/** A new token for `userId`: the token itself, shown only now, and what's kept of it. */
-export declare function createApiToken(userId: string, input: CreateApiTokenInput, config: StreamByConfig): Promise<{
+export interface ApiTokenOwner {
+    kind: ApiTokenKind;
+    userId: string;
+    username?: string | null;
+    projectId?: string;
+}
+/** A new token: the token itself, shown only now, and what's kept of it. */
+export declare function createApiToken(owner: ApiTokenOwner, input: CreateApiTokenInput, config: StreamByConfig): Promise<{
     token: string;
     info: ApiTokenInfo;
 }>;
-/** The tokens `userId` has. */
-export declare function listApiTokens(userId: string): Promise<ApiTokenInfo[]>;
-/** Revokes one of `userId`'s tokens: it stops working at once. Whether there was one. */
-export declare function revokeApiToken(userId: string, tokenId: string): Promise<boolean>;
+/** A user's own tokens. */
+export declare function listUserApiTokens(userId: string): Promise<ApiTokenInfo[]>;
+/** A project's tokens. */
+export declare function listProjectApiTokens(projectId: string): Promise<ApiTokenInfo[]>;
+/** Revokes a user's own token: it stops working at once. Whether there was one. */
+export declare function revokeUserApiToken(userId: string, tokenId: string): Promise<boolean>;
+/** Revokes a project's token. Whether there was one. */
+export declare function revokeProjectApiToken(projectId: string, tokenId: string): Promise<boolean>;
+/** A project's tokens that `userId` made (to tell its admins they keep working once they leave). */
+export declare function projectApiTokensMadeBy(projectId: string, userId: string): Promise<ApiTokenInfo[]>;
+/** Ends a deleted project's tokens. */
+export declare function deleteProjectApiTokens(projectId: string): Promise<void>;
+/** A project a user's token made: it reaches it from now on (one reaching every project already does). */
+export declare function addProjectToApiToken(tokenId: string, projectId: string): Promise<void>;
 export interface ResolvedApiToken {
     userId: string;
+    name: string;
     scope: ApiTokenScope;
 }
 /**
- * The token's owner and scope, for the host's authProvider; null when it isn't a token, isn't
- * known (revoked), or has expired. Marks when it was last used.
+ * The token's request: who it is and what it may do, for the host's authProvider; null when
+ * it isn't a token, isn't known (revoked), or has expired. Marks when it was last used.
  */
 export declare function resolveApiToken(token: unknown): Promise<ResolvedApiToken | null>;

package/dist/services/apiTokens.js

@@ -5,17 +5,27 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.ApiTokenError = exports.API_TOKEN_EXPIRY_DAYS = exports.API_TOKEN_PREFIX = void 0;
 exports.createApiToken = createApiToken;
-exports.listApiTokens = listApiTokens;
-exports.revokeApiToken = revokeApiToken;
+exports.listUserApiTokens = listUserApiTokens;
+exports.listProjectApiTokens = listProjectApiTokens;
+exports.revokeUserApiToken = revokeUserApiToken;
+exports.revokeProjectApiToken = revokeProjectApiToken;
+exports.projectApiTokensMadeBy = projectApiTokensMadeBy;
+exports.deleteProjectApiTokens = deleteProjectApiTokens;
+exports.addProjectToApiToken = addProjectToApiToken;
 exports.resolveApiToken = resolveApiToken;
 const crypto_1 = __importDefault(require("crypto"));
 const manager_1 = require("../models/manager");
-// API tokens: how an agent or a service works with StreamBy as a user, without their browser
-// session. A token is "sbt_" and 32 random bytes; only its hash is stored, with a prefix to
-// tell it apart in a list. It's sent as `Authorization: Bearer sbt_...` and the host's
-// authProvider resolves it (resolveApiToken), so the request is its owner's -- limited by the
-// token's scope (read or write, which projects), and never more than its owner can do: the
-// owner's role in each project still decides.
+const auth_1 = require("../utils/auth");
+const apiTokenPermissions_1 = require("./apiTokenPermissions");
+// API tokens: how an agent or a service works with StreamBy without a browser session. A token
+// is "sbt_" and 32 random bytes; only its hash is stored, with a prefix to tell it apart in a
+// list. It's sent as `Authorization: Bearer sbt_...` and the host's authProvider resolves it
+// (resolveApiToken). It does only what its permissions allow (see apiTokenPermissions), and:
+//
+// - a user's token acts as its user, on the projects it reaches: never more than its user can,
+//   since their role in each project still decides;
+// - a project's token acts on its project alone, as the project's, not as whoever made it: it
+//   keeps working after they leave the project. Only the project's admins manage it.
 exports.API_TOKEN_PREFIX = 'sbt_';
 const PREFIX_SHOWN = exports.API_TOKEN_PREFIX.length + 8;
 exports.API_TOKEN_EXPIRY_DAYS = [7, 30, 90, 365];
@@ -28,35 +38,72 @@ class ApiTokenError extends Error {
 }
 exports.ApiTokenError = ApiTokenError;
 const hashOf = (token) => crypto_1.default.createHash('sha256').update(token).digest('hex');
-const infoOf = ({ hash: _hash, userId: _userId, ...info }) => ({
-    ...info,
-    projectIds: parseProjectIds(info.projectIds),
-});
-// As stored (a list, read back from SQL JSON as a list or its text): ['*'] is every project.
-const parseProjectIds = (value) => {
+// A list, as stored in SQL JSON: read back as a list or as its text.
+const listOf = (value) => {
     if (typeof value === 'string') {
         try {
-            return parseProjectIds(JSON.parse(value));
+            return listOf(JSON.parse(value));
         }
         catch {
             return [];
         }
     }
-    if (!Array.isArray(value))
-        return [];
-    const ids = value.map(String);
+    return Array.isArray(value) ? value.map(String) : [];
+};
+const parseProjectIds = (value) => {
+    const ids = listOf(value);
     return ids.includes(ALL_PROJECTS) ? '*' : ids;
 };
+// Only the permissions its kind may have: a stored one that isn't known anymore is dropped.
+const parsePermissions = (value, kind) => listOf(value).filter((p) => (0, apiTokenPermissions_1.isProjectPermission)(p) || (kind === 'user' && (0, apiTokenPermissions_1.isAccountPermission)(p)));
+// Tokens made before they had a kind and permissions don't work anymore, nor are listed.
+const isCurrent = (record) => !!record && (record.kind === 'user' || record.kind === 'project');
+const infoOf = (record) => {
+    const { hash: _hash, userId, createdByName, projectIds, permissions, ...info } = record;
+    return {
+        ...info,
+        permissions: parsePermissions(permissions, record.kind),
+        projectIds: parseProjectIds(projectIds),
+        createdBy: { userId, username: createdByName ?? null },
+    };
+};
 const mainDbType = (config) => config.databases?.find(db => db.main)?.type ?? 'nosql';
-/** A new token for `userId`: the token itself, shown only now, and what's kept of it. */
-async function createApiToken(userId, input, config) {
+const validPermissions = (value, kind) => {
+    if (!Array.isArray(value) || !value.length)
+        throw new ApiTokenError('A token needs at least one permission.');
+    for (const p of value) {
+        if ((0, apiTokenPermissions_1.isAccountPermission)(p) && kind === 'project')
+            throw new ApiTokenError(`A project's token can't have '${p}'.`);
+        if (!(0, apiTokenPermissions_1.isProjectPermission)(p) && !(0, apiTokenPermissions_1.isAccountPermission)(p))
+            throw new ApiTokenError(`Unknown permission '${String(p)}'.`);
+    }
+    return [...new Set(value)];
+};
+/** A new token: the token itself, shown only now, and what's kept of it. */
+async function createApiToken(owner, input, config) {
     const name = typeof input.name === 'string' ? input.name.trim() : '';
     if (!name)
         throw new ApiTokenError('A token needs a name.');
-    if (input.access !== 'read' && input.access !== 'write')
-        throw new ApiTokenError("access must be 'read' or 'write'.");
-    if (input.projectIds !== '*' && (!Array.isArray(input.projectIds) || !input.projectIds.length || !input.projectIds.every(id => typeof id === 'string' && id && id !== ALL_PROJECTS))) {
-        throw new ApiTokenError("projectIds must be '*' or a list of project ids.");
+    const permissions = validPermissions(input.permissions, owner.kind);
+    let projectIds;
+    if (owner.kind === 'project') {
+        if (!owner.projectId)
+            throw new ApiTokenError("A project's token needs its project.");
+        projectIds = [owner.projectId];
+    }
+    else if (input.projectIds === '*') {
+        projectIds = [ALL_PROJECTS];
+    }
+    else {
+        const ids = input.projectIds;
+        if (!Array.isArray(ids) || !ids.every(id => typeof id === 'string' && id && id !== ALL_PROJECTS)) {
+            throw new ApiTokenError("projectIds must be '*' or a list of project ids.");
+        }
+        // No project yet only for a token that makes them: it reaches the ones it makes.
+        if (!ids.length && !permissions.includes('projects:create')) {
+            throw new ApiTokenError('A token needs at least one project, or to be able to create them.');
+        }
+        projectIds = [...new Set(ids)];
     }
     if (input.expiresInDays !== null && !exports.API_TOKEN_EXPIRY_DAYS.includes(input.expiresInDays)) {
         throw new ApiTokenError(`expiresInDays must be one of ${exports.API_TOKEN_EXPIRY_DAYS.join(', ')}, or null.`);
@@ -65,12 +112,14 @@ async function createApiToken(userId, input, config) {
     const now = new Date();
     const record = {
         id: crypto_1.default.randomUUID(),
-        userId,
+        kind: owner.kind,
+        userId: owner.userId,
+        createdByName: owner.username ?? null,
         name,
         prefix: token.slice(0, PREFIX_SHOWN),
         hash: hashOf(token),
-        access: input.access,
-        projectIds: input.projectIds === '*' ? [ALL_PROJECTS] : [...new Set(input.projectIds)],
+        permissions,
+        projectIds,
         createdAt: now,
         expiresAt: input.expiresInDays === null ? null : new Date(now.getTime() + input.expiresInDays * 86400000),
         lastUsedAt: null,
@@ -78,33 +127,78 @@ async function createApiToken(userId, input, config) {
     await (0, manager_1.getModel)('api_tokens').create({ ...record, dbType: mainDbType(config) });
     return { token, info: infoOf(record) };
 }
-/** The tokens `userId` has. */
-async function listApiTokens(userId) {
-    const records = (await (0, manager_1.getModel)('api_tokens').find({ userId }));
+const newestFirst = (a, b) => new Date(b.createdAt).getTime() - new Date(a.createdAt).getTime();
+/** A user's own tokens. */
+async function listUserApiTokens(userId) {
+    const records = (await (0, manager_1.getModel)('api_tokens').find({ userId, kind: 'user' }));
+    return records.filter(isCurrent).map(infoOf).sort(newestFirst);
+}
+/** A project's tokens. */
+async function listProjectApiTokens(projectId) {
+    const records = (await (0, manager_1.getModel)('api_tokens').find({ kind: 'project' }));
     return records
+        .filter(r => isCurrent(r) && listOf(r.projectIds)[0] === projectId)
         .map(infoOf)
-        .sort((a, b) => new Date(b.createdAt).getTime() - new Date(a.createdAt).getTime());
+        .sort(newestFirst);
+}
+/** Revokes a user's own token: it stops working at once. Whether there was one. */
+async function revokeUserApiToken(userId, tokenId) {
+    return (await (0, manager_1.getModel)('api_tokens').delete({ id: tokenId, userId, kind: 'user' })) > 0;
+}
+/** Revokes a project's token. Whether there was one. */
+async function revokeProjectApiToken(projectId, tokenId) {
+    const ApiTokens = (0, manager_1.getModel)('api_tokens');
+    const record = (await ApiTokens.findOne({ id: tokenId, kind: 'project' }));
+    if (!record || listOf(record.projectIds)[0] !== projectId)
+        return false;
+    return (await ApiTokens.delete({ id: tokenId })) > 0;
+}
+/** A project's tokens that `userId` made (to tell its admins they keep working once they leave). */
+async function projectApiTokensMadeBy(projectId, userId) {
+    return (await listProjectApiTokens(projectId)).filter(t => t.createdBy.userId === userId);
+}
+/** Ends a deleted project's tokens. */
+async function deleteProjectApiTokens(projectId) {
+    const ApiTokens = (0, manager_1.getModel)('api_tokens');
+    for (const token of await listProjectApiTokens(projectId))
+        await ApiTokens.delete({ id: token.id });
 }
-/** Revokes one of `userId`'s tokens: it stops working at once. Whether there was one. */
-async function revokeApiToken(userId, tokenId) {
-    return (await (0, manager_1.getModel)('api_tokens').delete({ id: tokenId, userId })) > 0;
+/** A project a user's token made: it reaches it from now on (one reaching every project already does). */
+async function addProjectToApiToken(tokenId, projectId) {
+    const ApiTokens = (0, manager_1.getModel)('api_tokens');
+    const record = (await ApiTokens.findOne({ id: tokenId, kind: 'user' }));
+    if (!record)
+        return;
+    const ids = listOf(record.projectIds);
+    if (ids.includes(ALL_PROJECTS) || ids.includes(projectId))
+        return;
+    await ApiTokens.update({ id: tokenId }, { projectIds: [...ids, projectId] });
 }
 /**
- * The token's owner and scope, for the host's authProvider; null when it isn't a token, isn't
- * known (revoked), or has expired. Marks when it was last used.
+ * The token's request: who it is and what it may do, for the host's authProvider; null when
+ * it isn't a token, isn't known (revoked), or has expired. Marks when it was last used.
  */
 async function resolveApiToken(token) {
     if (typeof token !== 'string' || !token.startsWith(exports.API_TOKEN_PREFIX))
         return null;
     const ApiTokens = (0, manager_1.getModel)('api_tokens');
     const record = (await ApiTokens.findOne({ hash: hashOf(token) }));
-    if (!record)
+    if (!isCurrent(record))
         return null;
     if (record.expiresAt && new Date(record.expiresAt).getTime() <= Date.now())
         return null;
     ApiTokens.update({ id: record.id }, { lastUsedAt: new Date() }).catch(() => { });
-    return {
-        userId: record.userId,
-        scope: { tokenId: record.id, access: record.access, projectIds: parseProjectIds(record.projectIds) },
+    const scope = {
+        tokenId: record.id,
+        kind: record.kind,
+        permissions: parsePermissions(record.permissions, record.kind),
+        projectIds: parseProjectIds(record.projectIds),
     };
+    if (record.kind === 'project') {
+        const projectId = listOf(record.projectIds)[0];
+        if (!projectId)
+            return null;
+        return { userId: (0, auth_1.projectTokenPrincipal)(record.id, projectId), name: record.name, scope: { ...scope, projectIds: [projectId] } };
+    }
+    return { userId: record.userId, name: record.name, scope };
 }

package/dist/services/auth.d.ts

@@ -1,7 +1,10 @@
 import { Request, Response, NextFunction } from 'express';
 import { Auth, StreamByConfig } from '../types';
+import { ApiTokenPermission } from './apiTokenPermissions';
 export declare const isPublicRoute: (method: string, path: string) => boolean;
-/** Whether a token's scope reaches a project. */
+/** Whether a token reaches a project. */
 export declare const scopeReachesProject: (scope: Auth["apiToken"], projectId: string) => boolean;
+/** Whether a token has a permission (a request without a token: always). */
+export declare const tokenAllows: (scope: Auth["apiToken"], permission: ApiTokenPermission) => boolean;
 export declare const enforceApiTokenScope: (req: Request, res: Response, next: NextFunction) => void | Response<any, Record<string, any>>;
 export declare const authenticate: (config: StreamByConfig) => (req: Request, res: Response, next: NextFunction) => Promise<void | Response<any, Record<string, any>>>;

package/dist/services/auth.js

@@ -1,6 +1,8 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.authenticate = exports.enforceApiTokenScope = exports.scopeReachesProject = exports.isPublicRoute = void 0;
+exports.authenticate = exports.enforceApiTokenScope = exports.tokenAllows = exports.scopeReachesProject = exports.isPublicRoute = void 0;
+const auth_1 = require("../utils/auth");
+const apiTokenPermissions_1 = require("./apiTokenPermissions");
 // The one route open without a session: a project's public export, read
 // (GET /:projectId/export/:exportName, see routes/export). Exactly that path -- not any path
 // that has an "export" segment somewhere.
@@ -9,10 +11,11 @@ const READ_METHODS = ['GET', 'HEAD', 'OPTIONS'];
 const isPublicRoute = (method, path) => READ_METHODS.includes(method.toUpperCase()) && PUBLIC_EXPORT.test(path);
 exports.isPublicRoute = isPublicRoute;
 // ── API tokens ──
-// A request made with an API token reaches only what the token's scope does: no writes with a
-// read token, no project outside its projects (as if it didn't exist), no managing tokens, and
-// of the routes outside a project only the few below. Its owner's role in each project still
-// decides on top (the routes' own checks).
+// A request made with an API token reaches only what the token does: its route's permission
+// must be among the token's (see apiTokenPermissions), and a project outside its projects is as
+// if it didn't exist. A user's token is also limited by its user's role in each project (the
+// routes' own checks); a project's token acts in its project as an admin, so its permissions
+// are all it has.
 // The project a route acts on, by its path.
 const PROJECT_PATHS = [/^\/projects\/([^/]+)/, /^\/(?:upload|delete)-project-image-url\/([^/]+)/];
 const NOT_A_PROJECT = new Set(['create', 'explore']);
@@ -24,28 +27,30 @@ const projectIdOf = (path) => {
     }
     return undefined;
 };
-// Outside a project, a token reaches only these reads (each limited to its scope there).
-const OUTSIDE_A_PROJECT = [/^\/auth\/?$/, /^\/projects\/?$/, /^\/jobs\/[^/]+\/?$/, /^\/user\/subscription\/?$/, /^\/users\/search\/?$/];
-/** Whether a token's scope reaches a project. */
+/** Whether a token reaches a project. */
 const scopeReachesProject = (scope, projectId) => !scope || scope.projectIds === '*' || scope.projectIds.includes(projectId);
 exports.scopeReachesProject = scopeReachesProject;
+/** Whether a token has a permission (a request without a token: always). */
+const tokenAllows = (scope, permission) => !scope || scope.permissions.includes(permission);
+exports.tokenAllows = tokenAllows;
 const enforceApiTokenScope = (req, res, next) => {
     const scope = req.auth?.apiToken;
     if (!scope)
         return next();
-    if (/^\/user\/api-tokens(\/|$)/.test(req.path)) {
-        return res.status(403).json({ error: 'API tokens are managed with a session, not with a token' });
-    }
-    if (!READ_METHODS.includes(req.method.toUpperCase()) && scope.access !== 'write') {
-        return res.status(403).json({ error: 'This API token can only read' });
+    // The MCP server handles a token itself: its tools call the routes here, each one checked.
+    if (req.path === '/mcp')
+        return next();
+    const rule = (0, apiTokenPermissions_1.routeRuleFor)(req.method, req.path);
+    if (!rule || (rule.userTokenOnly && scope.kind !== 'user')) {
+        return res.status(403).json({ error: 'Not available with an API token' });
     }
     const projectId = projectIdOf(req.path);
-    if (projectId) {
-        return (0, exports.scopeReachesProject)(scope, projectId) ? next() : res.status(404).json({ message: 'Project not found' });
+    if (projectId && !(0, exports.scopeReachesProject)(scope, projectId))
+        return res.status(404).json({ message: 'Project not found' });
+    if (rule.permission && !(0, exports.tokenAllows)(scope, rule.permission)) {
+        return res.status(403).json({ error: `This API token doesn't have the '${rule.permission}' permission` });
     }
-    if (READ_METHODS.includes(req.method.toUpperCase()) && OUTSIDE_A_PROJECT.some(route => route.test(req.path)))
-        return next();
-    return res.status(403).json({ error: 'Not available with an API token' });
+    next();
 };
 exports.enforceApiTokenScope = enforceApiTokenScope;
 const authenticate = (config) => async (req, res, next) => {
@@ -57,6 +62,10 @@ const authenticate = (config) => async (req, res, next) => {
         if (!auth || !auth.userId || !auth.role) {
             return res.status(401).json({ error: 'Unauthorized' });
         }
+        // A project token's principal is only ever a project's token (see utils/auth).
+        if ((0, auth_1.isProjectTokenPrincipal)(auth.userId) && auth.apiToken?.kind !== 'project') {
+            return res.status(401).json({ error: 'Unauthorized' });
+        }
         req.auth = auth;
         next();
     }

package/dist/types/index.d.ts

@@ -1,3 +1,4 @@
+import type { ApiTokenPermission, ProjectPermission, AccountPermission } from '../services/apiTokenPermissions';
 import { Request } from 'express';
 import type { WebSocketServer } from 'ws';
 export interface S3Config {
@@ -133,6 +134,13 @@ export interface StreamByConfig {
     adapter?: StorageAdapter;
     encrypt?: string;
     encryptPreviousKeys?: string[];
+    mcp?: {
+        rateLimit?: {
+            requests: number;
+            windowMs: number;
+        };
+        apiBaseUrl?: string;
+    };
     websocket?: {
         server: WebSocketServer;
     };
@@ -160,10 +168,12 @@ export interface Auth {
     role: 'viewer' | 'editor' | 'admin';
     apiToken?: ApiTokenScope;
 }
-export type ApiTokenAccess = 'read' | 'write';
+export type { ApiTokenPermission, ProjectPermission, AccountPermission };
+export type ApiTokenKind = 'user' | 'project';
 export interface ApiTokenScope {
     tokenId: string;
-    access: ApiTokenAccess;
+    kind: ApiTokenKind;
+    permissions: ApiTokenPermission[];
     projectIds: string[] | '*';
 }
 export type AuthProvider = (req: Request) => Promise<Auth>;

package/dist/utils/auth.d.ts

@@ -1,10 +1,21 @@
 import { ProjectInfo } from '../types';
-type ProjectMembers = Pick<ProjectInfo, 'members'> | null | undefined;
+type ProjectMembers = (Pick<ProjectInfo, 'members'> & {
+    _id?: unknown;
+    id?: unknown;
+}) | null | undefined;
+export declare const projectTokenPrincipal: (tokenId: string, projectId: string) => string;
+export declare const isProjectTokenPrincipal: (userId: unknown) => boolean;
 export declare function activeMemberOf(project: ProjectMembers, userId: string | undefined): {
     role: "viewer" | "editor" | "admin";
     userId: string;
     archived?: boolean;
     status?: "active" | "pending";
+} | {
+    userId: string;
+    username: string;
+    role: "admin";
+    status: "active";
+    archived: boolean;
 } | undefined;
 export declare const projectRoleOf: (project: ProjectMembers, userId: string | undefined) => "viewer" | "editor" | "admin" | undefined;
 /** An active member, whatever their role: can see the project. */

package/dist/utils/auth.js

@@ -1,11 +1,32 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.isProjectAdmin = exports.canEditProject = exports.isProjectMember = exports.projectRoleOf = void 0;
+exports.isProjectAdmin = exports.canEditProject = exports.isProjectMember = exports.projectRoleOf = exports.isProjectTokenPrincipal = exports.projectTokenPrincipal = void 0;
 exports.activeMemberOf = activeMemberOf;
+// A project's API token acts on its project as itself, not as a user: its request's userId is
+// this principal, naming the token and its project. In that project it's an admin -- what it
+// may do is only its permissions (see enforceApiTokenScope) -- and in any other, nobody.
+const PROJECT_TOKEN_PRINCIPAL = 'project-token:';
+const projectTokenPrincipal = (tokenId, projectId) => `${PROJECT_TOKEN_PRINCIPAL}${tokenId}:${projectId}`;
+exports.projectTokenPrincipal = projectTokenPrincipal;
+const isProjectTokenPrincipal = (userId) => typeof userId === 'string' && userId.startsWith(PROJECT_TOKEN_PRINCIPAL);
+exports.isProjectTokenPrincipal = isProjectTokenPrincipal;
+const projectOfPrincipal = (userId) => {
+    if (!(0, exports.isProjectTokenPrincipal)(userId))
+        return undefined;
+    const rest = userId.slice(PROJECT_TOKEN_PRINCIPAL.length);
+    return rest.slice(rest.indexOf(':') + 1) || undefined;
+};
 // A project's member who's in it now: invited and accepted (status 'active'). (A member's
 // `archived` is only that member having archived the project in their own list.)
 function activeMemberOf(project, userId) {
-    if (!project?.members || !userId)
+    if (!project || !userId)
+        return undefined;
+    const tokenProject = projectOfPrincipal(userId);
+    if (tokenProject !== undefined) {
+        const id = String(project._id ?? project.id ?? '');
+        return id && id === tokenProject ? { userId, username: 'API token', role: 'admin', status: 'active', archived: false } : undefined;
+    }
+    if (!project.members)
         return undefined;
     return project.members.find(member => member.userId?.toString() === userId && member.status === 'active');
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "streamby-core",
-  "version": "0.35.0",
+  "version": "0.37.0",
   "description": "StreamBy middleware framework for media storage management",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -32,6 +32,7 @@
   "dependencies": {
     "@aws-sdk/client-s3": "^3.528.0",
     "@aws-sdk/s3-request-presigner": "^3.787.0",
+    "@modelcontextprotocol/sdk": "^1.32.1",
     "@prisma/client": "^6.12.0",
     "bcrypt": "^5.1.1",
     "dotenv": "^16.5.0",
@@ -41,7 +42,8 @@
     "node-fetch": "^3.0.0",
     "pg": "^8.16.3",
     "prisma": "^6.12.0",
-    "ws": "^8.20.0"
+    "ws": "^8.20.0",
+    "zod": "^4.6.7"
   },
   "devDependencies": {
     "@types/bcrypt": "^5.0.2",