streamby-core 0.36.0 → 0.37.0

package/dist/middleware/routes/apiToken.js

@@ -5,25 +5,34 @@ const express_1 = require("express");
 const manager_1 = require("../../models/manager");
 const auth_1 = require("../../utils/auth");
 const apiTokens_1 = require("../../services/apiTokens");
-// The signed-in user's own API tokens (see services/apiTokens): listed, made, revoked. Only
-// with a session: a token can't manage tokens (see enforceApiTokenScope).
+// API tokens (see services/apiTokens), managed only with a session: no route here is
+// reachable with a token (see apiTokenPermissions).
+//
+// - A user's own: listed, made and revoked by them.
+// - A project's: listed, made and revoked by its admins only.
 function apiTokenRouter(config) {
     const router = (0, express_1.Router)();
     const Project = (0, manager_1.getModel)('projects');
+    const failed = (res, what, err) => {
+        if (err instanceof apiTokens_1.ApiTokenError)
+            return res.status(err.status).json({ message: err.message });
+        res.status(500).json({ message: `Failed to ${what}`, details: err.message });
+    };
+    // The token itself is in the response that makes it only: it's never stored, nor shown again.
+    const created = (res, token, info) => res.status(201).json({ token, apiToken: info, message: 'Copy the token now: it will not be shown again' });
     router.get('/user/api-tokens', async (req, res) => {
         try {
             const auth = req.auth;
-            res.json({ apiTokens: await (0, apiTokens_1.listApiTokens)(auth.userId) });
+            res.json({ apiTokens: await (0, apiTokens_1.listUserApiTokens)(auth.userId) });
         }
         catch (err) {
-            res.status(500).json({ message: 'Failed to list API tokens', details: err.message });
+            failed(res, 'list API tokens', err);
         }
     });
-    // The token itself is in this response only: it's never stored, nor shown again.
     router.post('/user/api-tokens', async (req, res) => {
         try {
             const auth = req.auth;
-            const { name, access, projectIds, expiresInDays } = req.body ?? {};
+            const { name, permissions, projectIds, expiresInDays } = req.body ?? {};
             // A token reaches only projects its owner is in.
             if (Array.isArray(projectIds)) {
                 for (const id of projectIds) {
@@ -33,25 +42,79 @@ function apiTokenRouter(config) {
                     }
                 }
             }
-            const { token, info } = await (0, apiTokens_1.createApiToken)(auth.userId, { name, access, projectIds, expiresInDays: expiresInDays ?? null }, config);
-            res.status(201).json({ token, apiToken: info, message: 'Copy the token now: it will not be shown again' });
+            const { token, info } = await (0, apiTokens_1.createApiToken)({ kind: 'user', userId: auth.userId, username: auth.username }, { name, permissions, projectIds, expiresInDays: expiresInDays ?? null }, config);
+            created(res, token, info);
         }
         catch (err) {
-            if (err instanceof apiTokens_1.ApiTokenError)
-                return res.status(err.status).json({ message: err.message });
-            res.status(500).json({ message: 'Failed to create API token', details: err.message });
+            failed(res, 'create API token', err);
         }
     });
     router.delete('/user/api-tokens/:tokenId', async (req, res) => {
         try {
             const auth = req.auth;
-            const revoked = await (0, apiTokens_1.revokeApiToken)(auth.userId, req.params.tokenId);
-            if (!revoked)
+            if (!(await (0, apiTokens_1.revokeUserApiToken)(auth.userId, req.params.tokenId))) {
                 return res.status(404).json({ message: 'API token not found' });
+            }
+            res.status(204).end();
+        }
+        catch (err) {
+            failed(res, 'revoke API token', err);
+        }
+    });
+    // ── A project's tokens: its admins only ──
+    const adminsProject = async (req, res) => {
+        const auth = req.auth;
+        const project = await Project.findOne({ _id: req.params.id });
+        if (!project) {
+            res.status(404).json({ message: 'Project not found' });
+            return null;
+        }
+        if (!(0, auth_1.isProjectAdmin)(project, auth.userId)) {
+            res.status(403).json({ message: "Only a project admin manages the project's API tokens" });
+            return null;
+        }
+        return project;
+    };
+    router.get('/projects/:id/api-tokens', async (req, res) => {
+        try {
+            const project = await adminsProject(req, res);
+            if (!project)
+                return;
+            // Whether whoever made each one is still in the project: it keeps working if they aren't.
+            const apiTokens = (await (0, apiTokens_1.listProjectApiTokens)(req.params.id)).map(token => ({
+                ...token,
+                createdBy: { ...token.createdBy, isMember: !!(0, auth_1.activeMemberOf)(project, token.createdBy.userId) },
+            }));
+            res.json({ apiTokens });
+        }
+        catch (err) {
+            failed(res, "list the project's API tokens", err);
+        }
+    });
+    router.post('/projects/:id/api-tokens', async (req, res) => {
+        try {
+            const auth = req.auth;
+            if (!(await adminsProject(req, res)))
+                return;
+            const { name, permissions, expiresInDays } = req.body ?? {};
+            const { token, info } = await (0, apiTokens_1.createApiToken)({ kind: 'project', userId: auth.userId, username: auth.username, projectId: req.params.id }, { name, permissions, expiresInDays: expiresInDays ?? null }, config);
+            created(res, token, info);
+        }
+        catch (err) {
+            failed(res, "create the project's API token", err);
+        }
+    });
+    router.delete('/projects/:id/api-tokens/:tokenId', async (req, res) => {
+        try {
+            if (!(await adminsProject(req, res)))
+                return;
+            if (!(await (0, apiTokens_1.revokeProjectApiToken)(req.params.id, req.params.tokenId))) {
+                return res.status(404).json({ message: 'API token not found' });
+            }
             res.status(204).end();
         }
         catch (err) {
-            res.status(500).json({ message: 'Failed to revoke API token', details: err.message });
+            failed(res, "revoke the project's API token", err);
         }
     });
     return router;

package/dist/middleware/routes/member.js

@@ -7,6 +7,7 @@ const auth_1 = require("../../utils/auth");
 const connectionManager_1 = require("../../adapters/database/connectionManager");
 const sql_1 = require("../../adapters/database/sql");
 const notification_1 = require("../../services/notification");
+const apiTokens_1 = require("../../services/apiTokens");
 const VALID_ROLES = ['viewer', 'editor', 'admin'];
 function memberRouter(config) {
     const router = (0, express_1.Router)();
@@ -302,6 +303,13 @@ function memberRouter(config) {
             else {
                 await Project.update({ _id: projectId }, { $pull: { members: { userId: targetUserId } } });
             }
+            // A project's tokens they made keep working: its admins should know.
+            const tokens = await (0, apiTokens_1.projectApiTokensMadeBy)(projectId, targetUserId);
+            if (tokens.length) {
+                const names = tokens.map(t => `"${t.name}"`).join(', ');
+                const admins = (project.members ?? []).filter((m) => m.role === 'admin' && m.status === 'active' && m.userId?.toString() !== targetUserId?.toString());
+                await Promise.all(admins.map((admin) => (0, notification_1.createNotification)(admin.userId.toString(), 'api_token_creator_left', `${tokens.length === 1 ? 'An API token' : `${tokens.length} API tokens`} of "${project.name}" (${names}) made by a member who left keep working until revoked`, { projectId, tokenIds: tokens.map(t => t.id) }).catch(() => { })));
+            }
             res.status(200).json({ message: 'Member removed successfully' });
         }
         catch (err) {

package/dist/middleware/routes/project.js

@@ -9,6 +9,7 @@ const sql_1 = require("../../adapters/database/sql");
 const sanitize_1 = require("../../utils/sanitize");
 const projectIntegration_1 = require("../../services/projectIntegration");
 const auth_2 = require("../../services/auth");
+const apiTokens_1 = require("../../services/apiTokens");
 function projectRouter(config) {
     const router = (0, express_1.Router)();
     const Project = (0, manager_1.getModel)('projects');
@@ -30,8 +31,8 @@ function projectRouter(config) {
             const allProjects = await Project.find({}); // Fetch all projects
             const projects = allProjects
                 .filter(project => {
-                const currentUserMember = project.members?.find((m) => m.userId?.toString() === auth.userId?.toString());
-                if (!currentUserMember || currentUserMember.status !== 'active')
+                const currentUserMember = (0, auth_1.activeMemberOf)(project, auth.userId?.toString());
+                if (!currentUserMember)
                     return false;
                 // With an API token, only the projects it reaches.
                 if (!(0, auth_2.scopeReachesProject)(auth.apiToken, (project._id ?? project.id)?.toString()))
@@ -122,6 +123,9 @@ function projectRouter(config) {
                 integrationConnections: [],
             });
             const newProjectId = newProject._id || newProject.id;
+            // A token that made it reaches it.
+            if (auth.apiToken?.kind === 'user')
+                await (0, apiTokens_1.addProjectToApiToken)(auth.apiToken.tokenId, String(newProjectId));
             if (dbConnections.length || storageConnections.length || integrationConnections.length) {
                 const stamped = await Project.update({ _id: newProjectId }, {
                     dbConnections: dbConnections.map(c => ({ ...c, projectId: newProjectId })),
@@ -253,6 +257,8 @@ function projectRouter(config) {
                 return res.status(403).json({ message: 'Only a project admin can delete it' });
             }
             await Project.useDbType(project.dbType).delete({ _id: projectId });
+            // Its tokens have nothing left to reach.
+            await (0, apiTokens_1.deleteProjectApiTokens)(String(projectId));
             const allProjects = await Project.find({});
             const projects = allProjects
                 .filter(project => {

package/dist/middleware/routes/subscription.js

@@ -18,6 +18,9 @@ const ensureSubscription = async (req, res, next) => {
         const auth = req.auth;
         if (!auth)
             return next();
+        // A project's token is no user: it has no plan of its own.
+        if (auth.apiToken?.kind === 'project')
+            return next();
         const plan = await resolveSubscription(auth);
         req.subscription = plan;
         next();

package/dist/services/apiTokenPermissions.d.ts

@@ -0,0 +1,16 @@
+/** Permissions on a project, for the projects a token reaches. */
+export declare const PROJECT_PERMISSIONS: readonly ["project:read", "project:update", "project:delete", "members:read", "members:manage", "assets:read", "assets:write", "assets:delete", "production:read", "production:write", "production:delete", "workflow:read", "workflow:write", "exports:read", "exports:write", "rights:read", "rights:write", "jobs:read", "jobs:run"];
+/** Permissions on the account: only a user's token has them. */
+export declare const ACCOUNT_PERMISSIONS: readonly ["projects:create"];
+export type ProjectPermission = typeof PROJECT_PERMISSIONS[number];
+export type AccountPermission = typeof ACCOUNT_PERMISSIONS[number];
+export type ApiTokenPermission = ProjectPermission | AccountPermission;
+export declare const isProjectPermission: (value: unknown) => value is ProjectPermission;
+export declare const isAccountPermission: (value: unknown) => value is AccountPermission;
+/** What a route needs of a token: a permission, or only being a token (`null`). */
+export interface RouteRule {
+    permission: ApiTokenPermission | null;
+    userTokenOnly?: boolean;
+}
+/** The rule for a request made with an API token, or undefined: not reachable with one. */
+export declare function routeRuleFor(method: string, path: string): RouteRule | undefined;

package/dist/services/apiTokenPermissions.js

@@ -0,0 +1,98 @@
+"use strict";
+// What an API token may do: a list of permissions, each a resource and an action. A request
+// made with a token goes through only when its route's permission is among the token's (see
+// enforceApiTokenScope), and a route without one isn't reachable with a token at all.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isAccountPermission = exports.isProjectPermission = exports.ACCOUNT_PERMISSIONS = exports.PROJECT_PERMISSIONS = void 0;
+exports.routeRuleFor = routeRuleFor;
+/** Permissions on a project, for the projects a token reaches. */
+exports.PROJECT_PERMISSIONS = [
+    'project:read', 'project:update', 'project:delete',
+    'members:read', 'members:manage',
+    'assets:read', 'assets:write', 'assets:delete',
+    'production:read', 'production:write', 'production:delete',
+    'workflow:read', 'workflow:write',
+    'exports:read', 'exports:write',
+    'rights:read', 'rights:write',
+    'jobs:read', 'jobs:run',
+];
+/** Permissions on the account: only a user's token has them. */
+exports.ACCOUNT_PERMISSIONS = ['projects:create'];
+const isProjectPermission = (value) => exports.PROJECT_PERMISSIONS.includes(value);
+exports.isProjectPermission = isProjectPermission;
+const isAccountPermission = (value) => exports.ACCOUNT_PERMISSIONS.includes(value);
+exports.isAccountPermission = isAccountPermission;
+const READ = ['GET', 'HEAD', 'OPTIONS'];
+const methodsOf = (methods) => methods === 'read' ? READ : methods === 'write' ? ['POST', 'PUT', 'PATCH'] : methods === 'delete' ? ['DELETE'] : methods;
+// A project's own path (not /projects/create nor /projects/explore).
+const P = '^/projects/(?!(?:create|explore)/?$)[^/]+';
+const rule = (methods, path, permission, extra = {}) => ({ methods: methodsOf(methods), pattern: new RegExp(`${path}/?$`), permission, ...extra });
+// The first rule that matches a request decides it; a request no rule matches is refused.
+// Connections, integrations and allowed origins are the project's settings (project:*);
+// reviews, QC reports and dependency graphs are of its assets; pipelines are workflow.
+const RULES = [
+    // Outside a project.
+    rule('read', '^/auth', null),
+    rule('read', '^/projects', null),
+    rule(['POST'], '^/projects/create', 'projects:create'),
+    rule('read', '^/user/subscription', null, { userTokenOnly: true }),
+    rule('read', '^/users/search', 'members:manage'),
+    rule('read', '^/jobs/[^/]+', 'jobs:read'),
+    // The project itself and its settings.
+    rule('read', `${P}(/preview)?`, 'project:read'),
+    rule(['PATCH'], P, 'project:update'),
+    rule('delete', P, 'project:delete'),
+    rule(['PATCH'], `${P}/(archive|unarchive)`, 'project:update', { userTokenOnly: true }),
+    rule(['POST'], `${P}/image`, 'project:update'),
+    rule(['PATCH'], `${P}/origins`, 'project:update'),
+    rule(['POST'], `${P}/integrations`, 'project:update'),
+    rule('delete', `${P}/integrations/[^/]+`, 'project:update'),
+    rule('read', '^/upload-project-image-url/[^/]+', 'project:update'),
+    rule('delete', '^/delete-project-image-url/[^/]+', 'project:update'),
+    // Members.
+    rule('read', `${P}/members`, 'members:read'),
+    rule(['POST'], `${P}/members`, 'members:manage'),
+    rule(['PATCH'], `${P}/members/[^/]+(/approve)?`, 'members:manage'),
+    rule('delete', `${P}/members/[^/]+`, 'members:manage'),
+    // Assets: the built-in storage, and a storage connection's files and folders.
+    rule('read', `${P}/(storage|connections/storage/[^/]+)/(.+/)?(upload-url|replace-url)`, 'assets:write'),
+    rule('read', `${P}/storage/.+`, 'assets:read'),
+    rule(['PATCH'], `${P}/storage/files/[^/]+`, 'assets:write'),
+    rule('delete', `${P}/storage/files/[^/]+`, 'assets:delete'),
+    rule('read', `${P}/connections/storage/[^/]+/(files|folders)(/.+)?`, 'assets:read'),
+    rule(['POST', 'PATCH'], `${P}/connections/storage/[^/]+/(files|folders)(/.+)?`, 'assets:write'),
+    rule('delete', `${P}/connections/storage/[^/]+/(files|folders)/[^/]+`, 'assets:delete'),
+    rule('read', `${P}/assets/[^/]+/(metadata|versions|qc-report|dependency-graph)`, 'assets:read'),
+    rule(['PATCH'], `${P}/assets/[^/]+/metadata`, 'assets:write'),
+    rule(['POST'], `${P}/assets/[^/]+/qc-report`, 'assets:write'),
+    rule('read', `${P}/(reviews(/[^/]+)?|assets/[^/]+/versions/[^/]+/annotations)`, 'assets:read'),
+    rule(['POST', 'PATCH'], `${P}/(reviews(/[^/]+/decision)?|assets/[^/]+/versions/[^/]+/annotations(/[^/]+/resolve)?)`, 'assets:write'),
+    // Rights.
+    rule('read', `${P}/assets/[^/]+/rights`, 'rights:read'),
+    rule(['PUT'], `${P}/assets/[^/]+/rights`, 'rights:write'),
+    // Connections (API, database, storage, distribution, render farm): the project's settings.
+    rule('read', `${P}/(connections|get-connection|distribution-connections|render-farm-connections)(/.+)?`, 'project:read'),
+    rule('write', `${P}/(connections|distribution-connections|render-farm-connections)(/.+)?`, 'project:update'),
+    rule('delete', `${P}/(connections|distribution-connections|render-farm-connections)/.+`, 'project:update'),
+    // Production.
+    rule('read', `${P}/production/.+`, 'production:read'),
+    rule('write', `${P}/production/.+`, 'production:write'),
+    rule('delete', `${P}/production/.+`, 'production:delete'),
+    // Workflow and pipelines.
+    rule('read', `${P}/(workflow|pipelines(/[^/]+)?)`, 'workflow:read'),
+    rule(['PATCH'], `${P}/workflow`, 'workflow:write'),
+    rule(['POST'], `${P}/pipelines`, 'workflow:write'),
+    rule(['PATCH', 'DELETE'], `${P}/pipelines/[^/]+`, 'workflow:write'),
+    // Exports.
+    rule('read', `${P}/exports/[^/]+`, 'exports:read'),
+    rule(['POST'], `${P}/exports`, 'exports:write'),
+    rule(['PATCH', 'DELETE'], `${P}/exports/[^/]+`, 'exports:write'),
+    // Jobs: transcoding, rendering, AI, publishing a deliverable.
+    rule(['POST'], `${P}/(jobs/[^/]+|pipeline-suggest|deliverables/[^/]+/publish)`, 'jobs:run'),
+];
+/** The rule for a request made with an API token, or undefined: not reachable with one. */
+function routeRuleFor(method, path) {
+    const upper = method.toUpperCase();
+    const found = RULES.find(r => r.methods.includes(upper) && r.pattern.test(path));
+    return found && { permission: found.permission, userTokenOnly: found.userTokenOnly };
+}

package/dist/services/apiTokens.d.ts

@@ -1,21 +1,28 @@
-import { ApiTokenAccess, ApiTokenScope, StreamByConfig } from '../types';
+import { ApiTokenKind, ApiTokenScope, StreamByConfig } from '../types';
+import { ApiTokenPermission } from './apiTokenPermissions';
 export declare const API_TOKEN_PREFIX = "sbt_";
 export declare const API_TOKEN_EXPIRY_DAYS: readonly [7, 30, 90, 365];
 export interface ApiTokenRecord {
     id: string;
+    kind: ApiTokenKind;
     userId: string;
+    createdByName: string | null;
     name: string;
     prefix: string;
     hash: string;
-    access: ApiTokenAccess;
+    permissions: ApiTokenPermission[];
     projectIds: string[];
     createdAt: Date;
     expiresAt: Date | null;
     lastUsedAt: Date | null;
 }
-/** What a token's owner sees of it. */
-export type ApiTokenInfo = Omit<ApiTokenRecord, 'hash' | 'userId' | 'projectIds'> & {
+/** What's shown of a token: never its hash. */
+export type ApiTokenInfo = Omit<ApiTokenRecord, 'hash' | 'userId' | 'projectIds' | 'createdByName'> & {
     projectIds: string[] | '*';
+    createdBy: {
+        userId: string;
+        username: string | null;
+    };
 };
 export declare class ApiTokenError extends Error {
     status: number;
@@ -23,25 +30,42 @@ export declare class ApiTokenError extends Error {
 }
 export interface CreateApiTokenInput {
     name: string;
-    access: ApiTokenAccess;
-    projectIds: string[] | '*';
+    permissions: ApiTokenPermission[];
+    projectIds?: string[] | '*';
     expiresInDays: number | null;
 }
-/** A new token for `userId`: the token itself, shown only now, and what's kept of it. */
-export declare function createApiToken(userId: string, input: CreateApiTokenInput, config: StreamByConfig): Promise<{
+export interface ApiTokenOwner {
+    kind: ApiTokenKind;
+    userId: string;
+    username?: string | null;
+    projectId?: string;
+}
+/** A new token: the token itself, shown only now, and what's kept of it. */
+export declare function createApiToken(owner: ApiTokenOwner, input: CreateApiTokenInput, config: StreamByConfig): Promise<{
     token: string;
     info: ApiTokenInfo;
 }>;
-/** The tokens `userId` has. */
-export declare function listApiTokens(userId: string): Promise<ApiTokenInfo[]>;
-/** Revokes one of `userId`'s tokens: it stops working at once. Whether there was one. */
-export declare function revokeApiToken(userId: string, tokenId: string): Promise<boolean>;
+/** A user's own tokens. */
+export declare function listUserApiTokens(userId: string): Promise<ApiTokenInfo[]>;
+/** A project's tokens. */
+export declare function listProjectApiTokens(projectId: string): Promise<ApiTokenInfo[]>;
+/** Revokes a user's own token: it stops working at once. Whether there was one. */
+export declare function revokeUserApiToken(userId: string, tokenId: string): Promise<boolean>;
+/** Revokes a project's token. Whether there was one. */
+export declare function revokeProjectApiToken(projectId: string, tokenId: string): Promise<boolean>;
+/** A project's tokens that `userId` made (to tell its admins they keep working once they leave). */
+export declare function projectApiTokensMadeBy(projectId: string, userId: string): Promise<ApiTokenInfo[]>;
+/** Ends a deleted project's tokens. */
+export declare function deleteProjectApiTokens(projectId: string): Promise<void>;
+/** A project a user's token made: it reaches it from now on (one reaching every project already does). */
+export declare function addProjectToApiToken(tokenId: string, projectId: string): Promise<void>;
 export interface ResolvedApiToken {
     userId: string;
+    name: string;
     scope: ApiTokenScope;
 }
 /**
- * The token's owner and scope, for the host's authProvider; null when it isn't a token, isn't
- * known (revoked), or has expired. Marks when it was last used.
+ * The token's request: who it is and what it may do, for the host's authProvider; null when
+ * it isn't a token, isn't known (revoked), or has expired. Marks when it was last used.
  */
 export declare function resolveApiToken(token: unknown): Promise<ResolvedApiToken | null>;

package/dist/services/apiTokens.js

@@ -5,17 +5,27 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.ApiTokenError = exports.API_TOKEN_EXPIRY_DAYS = exports.API_TOKEN_PREFIX = void 0;
 exports.createApiToken = createApiToken;
-exports.listApiTokens = listApiTokens;
-exports.revokeApiToken = revokeApiToken;
+exports.listUserApiTokens = listUserApiTokens;
+exports.listProjectApiTokens = listProjectApiTokens;
+exports.revokeUserApiToken = revokeUserApiToken;
+exports.revokeProjectApiToken = revokeProjectApiToken;
+exports.projectApiTokensMadeBy = projectApiTokensMadeBy;
+exports.deleteProjectApiTokens = deleteProjectApiTokens;
+exports.addProjectToApiToken = addProjectToApiToken;
 exports.resolveApiToken = resolveApiToken;
 const crypto_1 = __importDefault(require("crypto"));
 const manager_1 = require("../models/manager");
-// API tokens: how an agent or a service works with StreamBy as a user, without their browser
-// session. A token is "sbt_" and 32 random bytes; only its hash is stored, with a prefix to
-// tell it apart in a list. It's sent as `Authorization: Bearer sbt_...` and the host's
-// authProvider resolves it (resolveApiToken), so the request is its owner's -- limited by the
-// token's scope (read or write, which projects), and never more than its owner can do: the
-// owner's role in each project still decides.
+const auth_1 = require("../utils/auth");
+const apiTokenPermissions_1 = require("./apiTokenPermissions");
+// API tokens: how an agent or a service works with StreamBy without a browser session. A token
+// is "sbt_" and 32 random bytes; only its hash is stored, with a prefix to tell it apart in a
+// list. It's sent as `Authorization: Bearer sbt_...` and the host's authProvider resolves it
+// (resolveApiToken). It does only what its permissions allow (see apiTokenPermissions), and:
+//
+// - a user's token acts as its user, on the projects it reaches: never more than its user can,
+//   since their role in each project still decides;
+// - a project's token acts on its project alone, as the project's, not as whoever made it: it
+//   keeps working after they leave the project. Only the project's admins manage it.
 exports.API_TOKEN_PREFIX = 'sbt_';
 const PREFIX_SHOWN = exports.API_TOKEN_PREFIX.length + 8;
 exports.API_TOKEN_EXPIRY_DAYS = [7, 30, 90, 365];
@@ -28,35 +38,72 @@ class ApiTokenError extends Error {
 }
 exports.ApiTokenError = ApiTokenError;
 const hashOf = (token) => crypto_1.default.createHash('sha256').update(token).digest('hex');
-const infoOf = ({ hash: _hash, userId: _userId, ...info }) => ({
-    ...info,
-    projectIds: parseProjectIds(info.projectIds),
-});
-// As stored (a list, read back from SQL JSON as a list or its text): ['*'] is every project.
-const parseProjectIds = (value) => {
+// A list, as stored in SQL JSON: read back as a list or as its text.
+const listOf = (value) => {
     if (typeof value === 'string') {
         try {
-            return parseProjectIds(JSON.parse(value));
+            return listOf(JSON.parse(value));
         }
         catch {
             return [];
         }
     }
-    if (!Array.isArray(value))
-        return [];
-    const ids = value.map(String);
+    return Array.isArray(value) ? value.map(String) : [];
+};
+const parseProjectIds = (value) => {
+    const ids = listOf(value);
     return ids.includes(ALL_PROJECTS) ? '*' : ids;
 };
+// Only the permissions its kind may have: a stored one that isn't known anymore is dropped.
+const parsePermissions = (value, kind) => listOf(value).filter((p) => (0, apiTokenPermissions_1.isProjectPermission)(p) || (kind === 'user' && (0, apiTokenPermissions_1.isAccountPermission)(p)));
+// Tokens made before they had a kind and permissions don't work anymore, nor are listed.
+const isCurrent = (record) => !!record && (record.kind === 'user' || record.kind === 'project');
+const infoOf = (record) => {
+    const { hash: _hash, userId, createdByName, projectIds, permissions, ...info } = record;
+    return {
+        ...info,
+        permissions: parsePermissions(permissions, record.kind),
+        projectIds: parseProjectIds(projectIds),
+        createdBy: { userId, username: createdByName ?? null },
+    };
+};
 const mainDbType = (config) => config.databases?.find(db => db.main)?.type ?? 'nosql';
-/** A new token for `userId`: the token itself, shown only now, and what's kept of it. */
-async function createApiToken(userId, input, config) {
+const validPermissions = (value, kind) => {
+    if (!Array.isArray(value) || !value.length)
+        throw new ApiTokenError('A token needs at least one permission.');
+    for (const p of value) {
+        if ((0, apiTokenPermissions_1.isAccountPermission)(p) && kind === 'project')
+            throw new ApiTokenError(`A project's token can't have '${p}'.`);
+        if (!(0, apiTokenPermissions_1.isProjectPermission)(p) && !(0, apiTokenPermissions_1.isAccountPermission)(p))
+            throw new ApiTokenError(`Unknown permission '${String(p)}'.`);
+    }
+    return [...new Set(value)];
+};
+/** A new token: the token itself, shown only now, and what's kept of it. */
+async function createApiToken(owner, input, config) {
     const name = typeof input.name === 'string' ? input.name.trim() : '';
     if (!name)
         throw new ApiTokenError('A token needs a name.');
-    if (input.access !== 'read' && input.access !== 'write')
-        throw new ApiTokenError("access must be 'read' or 'write'.");
-    if (input.projectIds !== '*' && (!Array.isArray(input.projectIds) || !input.projectIds.length || !input.projectIds.every(id => typeof id === 'string' && id && id !== ALL_PROJECTS))) {
-        throw new ApiTokenError("projectIds must be '*' or a list of project ids.");
+    const permissions = validPermissions(input.permissions, owner.kind);
+    let projectIds;
+    if (owner.kind === 'project') {
+        if (!owner.projectId)
+            throw new ApiTokenError("A project's token needs its project.");
+        projectIds = [owner.projectId];
+    }
+    else if (input.projectIds === '*') {
+        projectIds = [ALL_PROJECTS];
+    }
+    else {
+        const ids = input.projectIds;
+        if (!Array.isArray(ids) || !ids.every(id => typeof id === 'string' && id && id !== ALL_PROJECTS)) {
+            throw new ApiTokenError("projectIds must be '*' or a list of project ids.");
+        }
+        // No project yet only for a token that makes them: it reaches the ones it makes.
+        if (!ids.length && !permissions.includes('projects:create')) {
+            throw new ApiTokenError('A token needs at least one project, or to be able to create them.');
+        }
+        projectIds = [...new Set(ids)];
     }
     if (input.expiresInDays !== null && !exports.API_TOKEN_EXPIRY_DAYS.includes(input.expiresInDays)) {
         throw new ApiTokenError(`expiresInDays must be one of ${exports.API_TOKEN_EXPIRY_DAYS.join(', ')}, or null.`);
@@ -65,12 +112,14 @@ async function createApiToken(userId, input, config) {
     const now = new Date();
     const record = {
         id: crypto_1.default.randomUUID(),
-        userId,
+        kind: owner.kind,
+        userId: owner.userId,
+        createdByName: owner.username ?? null,
         name,
         prefix: token.slice(0, PREFIX_SHOWN),
         hash: hashOf(token),
-        access: input.access,
-        projectIds: input.projectIds === '*' ? [ALL_PROJECTS] : [...new Set(input.projectIds)],
+        permissions,
+        projectIds,
         createdAt: now,
         expiresAt: input.expiresInDays === null ? null : new Date(now.getTime() + input.expiresInDays * 86400000),
         lastUsedAt: null,
@@ -78,33 +127,78 @@ async function createApiToken(userId, input, config) {
     await (0, manager_1.getModel)('api_tokens').create({ ...record, dbType: mainDbType(config) });
     return { token, info: infoOf(record) };
 }
-/** The tokens `userId` has. */
-async function listApiTokens(userId) {
-    const records = (await (0, manager_1.getModel)('api_tokens').find({ userId }));
+const newestFirst = (a, b) => new Date(b.createdAt).getTime() - new Date(a.createdAt).getTime();
+/** A user's own tokens. */
+async function listUserApiTokens(userId) {
+    const records = (await (0, manager_1.getModel)('api_tokens').find({ userId, kind: 'user' }));
+    return records.filter(isCurrent).map(infoOf).sort(newestFirst);
+}
+/** A project's tokens. */
+async function listProjectApiTokens(projectId) {
+    const records = (await (0, manager_1.getModel)('api_tokens').find({ kind: 'project' }));
     return records
+        .filter(r => isCurrent(r) && listOf(r.projectIds)[0] === projectId)
         .map(infoOf)
-        .sort((a, b) => new Date(b.createdAt).getTime() - new Date(a.createdAt).getTime());
+        .sort(newestFirst);
+}
+/** Revokes a user's own token: it stops working at once. Whether there was one. */
+async function revokeUserApiToken(userId, tokenId) {
+    return (await (0, manager_1.getModel)('api_tokens').delete({ id: tokenId, userId, kind: 'user' })) > 0;
+}
+/** Revokes a project's token. Whether there was one. */
+async function revokeProjectApiToken(projectId, tokenId) {
+    const ApiTokens = (0, manager_1.getModel)('api_tokens');
+    const record = (await ApiTokens.findOne({ id: tokenId, kind: 'project' }));
+    if (!record || listOf(record.projectIds)[0] !== projectId)
+        return false;
+    return (await ApiTokens.delete({ id: tokenId })) > 0;
+}
+/** A project's tokens that `userId` made (to tell its admins they keep working once they leave). */
+async function projectApiTokensMadeBy(projectId, userId) {
+    return (await listProjectApiTokens(projectId)).filter(t => t.createdBy.userId === userId);
+}
+/** Ends a deleted project's tokens. */
+async function deleteProjectApiTokens(projectId) {
+    const ApiTokens = (0, manager_1.getModel)('api_tokens');
+    for (const token of await listProjectApiTokens(projectId))
+        await ApiTokens.delete({ id: token.id });
 }
-/** Revokes one of `userId`'s tokens: it stops working at once. Whether there was one. */
-async function revokeApiToken(userId, tokenId) {
-    return (await (0, manager_1.getModel)('api_tokens').delete({ id: tokenId, userId })) > 0;
+/** A project a user's token made: it reaches it from now on (one reaching every project already does). */
+async function addProjectToApiToken(tokenId, projectId) {
+    const ApiTokens = (0, manager_1.getModel)('api_tokens');
+    const record = (await ApiTokens.findOne({ id: tokenId, kind: 'user' }));
+    if (!record)
+        return;
+    const ids = listOf(record.projectIds);
+    if (ids.includes(ALL_PROJECTS) || ids.includes(projectId))
+        return;
+    await ApiTokens.update({ id: tokenId }, { projectIds: [...ids, projectId] });
 }
 /**
- * The token's owner and scope, for the host's authProvider; null when it isn't a token, isn't
- * known (revoked), or has expired. Marks when it was last used.
+ * The token's request: who it is and what it may do, for the host's authProvider; null when
+ * it isn't a token, isn't known (revoked), or has expired. Marks when it was last used.
  */
 async function resolveApiToken(token) {
     if (typeof token !== 'string' || !token.startsWith(exports.API_TOKEN_PREFIX))
         return null;
     const ApiTokens = (0, manager_1.getModel)('api_tokens');
     const record = (await ApiTokens.findOne({ hash: hashOf(token) }));
-    if (!record)
+    if (!isCurrent(record))
         return null;
     if (record.expiresAt && new Date(record.expiresAt).getTime() <= Date.now())
         return null;
     ApiTokens.update({ id: record.id }, { lastUsedAt: new Date() }).catch(() => { });
-    return {
-        userId: record.userId,
-        scope: { tokenId: record.id, access: record.access, projectIds: parseProjectIds(record.projectIds) },
+    const scope = {
+        tokenId: record.id,
+        kind: record.kind,
+        permissions: parsePermissions(record.permissions, record.kind),
+        projectIds: parseProjectIds(record.projectIds),
     };
+    if (record.kind === 'project') {
+        const projectId = listOf(record.projectIds)[0];
+        if (!projectId)
+            return null;
+        return { userId: (0, auth_1.projectTokenPrincipal)(record.id, projectId), name: record.name, scope: { ...scope, projectIds: [projectId] } };
+    }
+    return { userId: record.userId, name: record.name, scope };
 }