streamby-core 0.36.0 → 0.37.0

package/dist/services/auth.d.ts

@@ -1,7 +1,10 @@
 import { Request, Response, NextFunction } from 'express';
 import { Auth, StreamByConfig } from '../types';
+import { ApiTokenPermission } from './apiTokenPermissions';
 export declare const isPublicRoute: (method: string, path: string) => boolean;
-/** Whether a token's scope reaches a project. */
+/** Whether a token reaches a project. */
 export declare const scopeReachesProject: (scope: Auth["apiToken"], projectId: string) => boolean;
+/** Whether a token has a permission (a request without a token: always). */
+export declare const tokenAllows: (scope: Auth["apiToken"], permission: ApiTokenPermission) => boolean;
 export declare const enforceApiTokenScope: (req: Request, res: Response, next: NextFunction) => void | Response<any, Record<string, any>>;
 export declare const authenticate: (config: StreamByConfig) => (req: Request, res: Response, next: NextFunction) => Promise<void | Response<any, Record<string, any>>>;

package/dist/services/auth.js

@@ -1,6 +1,8 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.authenticate = exports.enforceApiTokenScope = exports.scopeReachesProject = exports.isPublicRoute = void 0;
+exports.authenticate = exports.enforceApiTokenScope = exports.tokenAllows = exports.scopeReachesProject = exports.isPublicRoute = void 0;
+const auth_1 = require("../utils/auth");
+const apiTokenPermissions_1 = require("./apiTokenPermissions");
 // The one route open without a session: a project's public export, read
 // (GET /:projectId/export/:exportName, see routes/export). Exactly that path -- not any path
 // that has an "export" segment somewhere.
@@ -9,10 +11,11 @@ const READ_METHODS = ['GET', 'HEAD', 'OPTIONS'];
 const isPublicRoute = (method, path) => READ_METHODS.includes(method.toUpperCase()) && PUBLIC_EXPORT.test(path);
 exports.isPublicRoute = isPublicRoute;
 // ── API tokens ──
-// A request made with an API token reaches only what the token's scope does: no writes with a
-// read token, no project outside its projects (as if it didn't exist), no managing tokens, and
-// of the routes outside a project only the few below. Its owner's role in each project still
-// decides on top (the routes' own checks).
+// A request made with an API token reaches only what the token does: its route's permission
+// must be among the token's (see apiTokenPermissions), and a project outside its projects is as
+// if it didn't exist. A user's token is also limited by its user's role in each project (the
+// routes' own checks); a project's token acts in its project as an admin, so its permissions
+// are all it has.
 // The project a route acts on, by its path.
 const PROJECT_PATHS = [/^\/projects\/([^/]+)/, /^\/(?:upload|delete)-project-image-url\/([^/]+)/];
 const NOT_A_PROJECT = new Set(['create', 'explore']);
@@ -24,11 +27,12 @@ const projectIdOf = (path) => {
     }
     return undefined;
 };
-// Outside a project, a token reaches only these reads (each limited to its scope there).
-const OUTSIDE_A_PROJECT = [/^\/auth\/?$/, /^\/projects\/?$/, /^\/jobs\/[^/]+\/?$/, /^\/user\/subscription\/?$/, /^\/users\/search\/?$/];
-/** Whether a token's scope reaches a project. */
+/** Whether a token reaches a project. */
 const scopeReachesProject = (scope, projectId) => !scope || scope.projectIds === '*' || scope.projectIds.includes(projectId);
 exports.scopeReachesProject = scopeReachesProject;
+/** Whether a token has a permission (a request without a token: always). */
+const tokenAllows = (scope, permission) => !scope || scope.permissions.includes(permission);
+exports.tokenAllows = tokenAllows;
 const enforceApiTokenScope = (req, res, next) => {
     const scope = req.auth?.apiToken;
     if (!scope)
@@ -36,19 +40,17 @@ const enforceApiTokenScope = (req, res, next) => {
     // The MCP server handles a token itself: its tools call the routes here, each one checked.
     if (req.path === '/mcp')
         return next();
-    if (/^\/user\/api-tokens(\/|$)/.test(req.path)) {
-        return res.status(403).json({ error: 'API tokens are managed with a session, not with a token' });
-    }
-    if (!READ_METHODS.includes(req.method.toUpperCase()) && scope.access !== 'write') {
-        return res.status(403).json({ error: 'This API token can only read' });
+    const rule = (0, apiTokenPermissions_1.routeRuleFor)(req.method, req.path);
+    if (!rule || (rule.userTokenOnly && scope.kind !== 'user')) {
+        return res.status(403).json({ error: 'Not available with an API token' });
     }
     const projectId = projectIdOf(req.path);
-    if (projectId) {
-        return (0, exports.scopeReachesProject)(scope, projectId) ? next() : res.status(404).json({ message: 'Project not found' });
+    if (projectId && !(0, exports.scopeReachesProject)(scope, projectId))
+        return res.status(404).json({ message: 'Project not found' });
+    if (rule.permission && !(0, exports.tokenAllows)(scope, rule.permission)) {
+        return res.status(403).json({ error: `This API token doesn't have the '${rule.permission}' permission` });
     }
-    if (READ_METHODS.includes(req.method.toUpperCase()) && OUTSIDE_A_PROJECT.some(route => route.test(req.path)))
-        return next();
-    return res.status(403).json({ error: 'Not available with an API token' });
+    next();
 };
 exports.enforceApiTokenScope = enforceApiTokenScope;
 const authenticate = (config) => async (req, res, next) => {
@@ -60,6 +62,10 @@ const authenticate = (config) => async (req, res, next) => {
         if (!auth || !auth.userId || !auth.role) {
             return res.status(401).json({ error: 'Unauthorized' });
         }
+        // A project token's principal is only ever a project's token (see utils/auth).
+        if ((0, auth_1.isProjectTokenPrincipal)(auth.userId) && auth.apiToken?.kind !== 'project') {
+            return res.status(401).json({ error: 'Unauthorized' });
+        }
         req.auth = auth;
         next();
     }

package/dist/types/index.d.ts

@@ -1,3 +1,4 @@
+import type { ApiTokenPermission, ProjectPermission, AccountPermission } from '../services/apiTokenPermissions';
 import { Request } from 'express';
 import type { WebSocketServer } from 'ws';
 export interface S3Config {
@@ -167,10 +168,12 @@ export interface Auth {
     role: 'viewer' | 'editor' | 'admin';
     apiToken?: ApiTokenScope;
 }
-export type ApiTokenAccess = 'read' | 'write';
+export type { ApiTokenPermission, ProjectPermission, AccountPermission };
+export type ApiTokenKind = 'user' | 'project';
 export interface ApiTokenScope {
     tokenId: string;
-    access: ApiTokenAccess;
+    kind: ApiTokenKind;
+    permissions: ApiTokenPermission[];
     projectIds: string[] | '*';
 }
 export type AuthProvider = (req: Request) => Promise<Auth>;

package/dist/utils/auth.d.ts

@@ -1,10 +1,21 @@
 import { ProjectInfo } from '../types';
-type ProjectMembers = Pick<ProjectInfo, 'members'> | null | undefined;
+type ProjectMembers = (Pick<ProjectInfo, 'members'> & {
+    _id?: unknown;
+    id?: unknown;
+}) | null | undefined;
+export declare const projectTokenPrincipal: (tokenId: string, projectId: string) => string;
+export declare const isProjectTokenPrincipal: (userId: unknown) => boolean;
 export declare function activeMemberOf(project: ProjectMembers, userId: string | undefined): {
     role: "viewer" | "editor" | "admin";
     userId: string;
     archived?: boolean;
     status?: "active" | "pending";
+} | {
+    userId: string;
+    username: string;
+    role: "admin";
+    status: "active";
+    archived: boolean;
 } | undefined;
 export declare const projectRoleOf: (project: ProjectMembers, userId: string | undefined) => "viewer" | "editor" | "admin" | undefined;
 /** An active member, whatever their role: can see the project. */

package/dist/utils/auth.js

@@ -1,11 +1,32 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.isProjectAdmin = exports.canEditProject = exports.isProjectMember = exports.projectRoleOf = void 0;
+exports.isProjectAdmin = exports.canEditProject = exports.isProjectMember = exports.projectRoleOf = exports.isProjectTokenPrincipal = exports.projectTokenPrincipal = void 0;
 exports.activeMemberOf = activeMemberOf;
+// A project's API token acts on its project as itself, not as a user: its request's userId is
+// this principal, naming the token and its project. In that project it's an admin -- what it
+// may do is only its permissions (see enforceApiTokenScope) -- and in any other, nobody.
+const PROJECT_TOKEN_PRINCIPAL = 'project-token:';
+const projectTokenPrincipal = (tokenId, projectId) => `${PROJECT_TOKEN_PRINCIPAL}${tokenId}:${projectId}`;
+exports.projectTokenPrincipal = projectTokenPrincipal;
+const isProjectTokenPrincipal = (userId) => typeof userId === 'string' && userId.startsWith(PROJECT_TOKEN_PRINCIPAL);
+exports.isProjectTokenPrincipal = isProjectTokenPrincipal;
+const projectOfPrincipal = (userId) => {
+    if (!(0, exports.isProjectTokenPrincipal)(userId))
+        return undefined;
+    const rest = userId.slice(PROJECT_TOKEN_PRINCIPAL.length);
+    return rest.slice(rest.indexOf(':') + 1) || undefined;
+};
 // A project's member who's in it now: invited and accepted (status 'active'). (A member's
 // `archived` is only that member having archived the project in their own list.)
 function activeMemberOf(project, userId) {
-    if (!project?.members || !userId)
+    if (!project || !userId)
+        return undefined;
+    const tokenProject = projectOfPrincipal(userId);
+    if (tokenProject !== undefined) {
+        const id = String(project._id ?? project.id ?? '');
+        return id && id === tokenProject ? { userId, username: 'API token', role: 'admin', status: 'active', archived: false } : undefined;
+    }
+    if (!project.members)
         return undefined;
     return project.members.find(member => member.userId?.toString() === userId && member.status === 'active');
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "streamby-core",
-  "version": "0.36.0",
+  "version": "0.37.0",
   "description": "StreamBy middleware framework for media storage management",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",