streamby-core 0.36.0 → 0.38.0

package/dist/middleware/routes/storage.js

@@ -15,6 +15,9 @@ const builtinAccess_1 = require("../../utils/builtinAccess");
 const connectionResolver_1 = require("../../services/connectionResolver");
 const mongodb_1 = require("mongodb");
 const crypto_1 = __importDefault(require("crypto"));
+const signedUrls_1 = require("../../services/signedUrls");
+const assetVersions_1 = require("../../services/assetVersions");
+const deliverables_1 = require("../../services/deliverables");
 const VALID_CATEGORIES = ['images', 'audios', 'videos', '3d-models'];
 const VALID_3D_EXTENSIONS = new Set(['.glb', '.gltf', '.obj', '.fbx', '.stl', '.ply']);
 function validateContentType(contentType, filename, category) {
@@ -135,7 +138,7 @@ function storageRouter(config) {
             const storageKey = `${projectId}/${category}/${fileId}${ext}`;
             const collection = getRawFilesCollection();
             if (collection) {
-                await collection.insertOne({
+                const fileDoc = {
                     _id: new mongodb_1.ObjectId(),
                     fileId,
                     projectId,
@@ -145,10 +148,13 @@ function storageRouter(config) {
                     contentType,
                     uploadedBy: auth.userId,
                     createdAt: new Date(),
-                });
+                };
+                await collection.insertOne(fileDoc);
+                await (0, assetVersions_1.recordFirstVersion)(fileDoc);
             }
-            const url = await adapter.getPresignedUploadUrl(storageKey, contentType);
-            res.json({ url, fileId, storageKey, displayName: fileName });
+            const expiresIn = (0, signedUrls_1.signedUrlTtl)(auth, config, 'upload');
+            const url = await adapter.getPresignedUploadUrl(storageKey, contentType, expiresIn);
+            res.json({ url, fileId, storageKey, displayName: fileName, ...expiry(expiresIn) });
         }
         catch (err) {
             res.status(500).json({ message: 'Failed to generate upload URL', details: err.message });
@@ -165,7 +171,7 @@ function storageRouter(config) {
             const project = await Project.findOne({ _id: projectId });
             if (!project)
                 return res.status(404).json({ message: 'Project not found' });
-            if (!(0, auth_1.isProjectMember)(project, auth.userId))
+            if (!(0, auth_1.canEditProject)(project, auth.userId))
                 return res.status(403).json({ message: 'Unauthorized access' });
             const collection = getRawFilesCollection();
             if (!collection)
@@ -179,9 +185,21 @@ function storageRouter(config) {
             if (!adapter.getPresignedUploadUrl) {
                 return res.status(501).json({ message: 'Storage adapter does not support presigned uploads' });
             }
-            const url = await adapter.getPresignedUploadUrl(fileDoc.storageKey, contentType);
+            // The new version goes to the asset's own key, so its URL doesn't change; the current
+            // one is archived first, and without a way to archive it nothing is replaced.
+            if (!adapter.copyFile)
+                return res.status(501).json({ message: 'Storage adapter cannot keep versions' });
+            let version;
+            try {
+                version = await (0, assetVersions_1.archiveCurrentVersion)(fileDoc, { fileName, contentType, userId: auth.userId }, adapter.copyFile.bind(adapter));
+            }
+            catch (err) {
+                return res.status(502).json({ message: 'Failed to archive the current version; nothing was replaced', details: err.message });
+            }
+            const expiresIn = (0, signedUrls_1.signedUrlTtl)(auth, config, 'upload');
+            const url = await adapter.getPresignedUploadUrl(fileDoc.storageKey, contentType, expiresIn);
             await collection.updateOne({ fileId, projectId }, { $set: { contentType, updatedAt: new Date() } });
-            res.json({ url, storageKey: fileDoc.storageKey, fileId });
+            res.json({ url, storageKey: fileDoc.storageKey, fileId, versionId: version.versionId, version: version.version, ...expiry(expiresIn) });
         }
         catch (err) {
             res.status(500).json({ message: 'Failed to generate replace URL', details: err.message });
@@ -227,8 +245,7 @@ function storageRouter(config) {
             const fileDoc = await collection.findOne({ fileId, projectId });
             if (!fileDoc)
                 return res.status(404).json({ message: 'File not found' });
-            if (adapter.deleteFile)
-                await adapter.deleteFile(fileDoc.storageKey);
+            await deleteAsset(fileDoc, adapter);
             await collection.deleteOne({ fileId, projectId });
             res.json({ message: 'File deleted successfully' });
         }
@@ -249,7 +266,7 @@ function storageRouter(config) {
             if (!collection)
                 return res.status(500).json({ message: 'Database not available' });
             const files = await collection.find({ projectId }).sort({ createdAt: -1 }).limit(12).toArray();
-            const data = await Promise.all(files.map(f => resolveFileUrl(f, adapter)));
+            const data = await Promise.all(files.map(f => resolveFileUrl(f, adapter, (0, signedUrls_1.signedUrlTtl)(auth, config, 'download'))));
             res.json({ data });
         }
         catch (err) {
@@ -272,13 +289,61 @@ function storageRouter(config) {
             if (!collection)
                 return res.status(500).json({ message: 'Database not available' });
             const files = await collection.find({ projectId, category }).sort({ createdAt: -1 }).toArray();
-            const data = await Promise.all(files.map(f => resolveFileUrl(f, adapter)));
+            const data = await Promise.all(files.map(f => resolveFileUrl(f, adapter, (0, signedUrls_1.signedUrlTtl)(auth, config, 'download'))));
             res.json({ data });
         }
         catch (err) {
             res.status(500).json({ message: 'Failed to list files', details: err.message });
         }
     });
+    // A short-lived URL to download an asset, or one of its versions, wherever it's stored
+    // (the built-in storage or one of the project's storage connections). It's for that file
+    // only, and downloads it with its name.
+    router.get('/projects/:projectId/assets/:fileId/download-url', async (req, res) => {
+        try {
+            const auth = req.auth;
+            const { projectId, fileId } = req.params;
+            const { versionId } = req.query;
+            const project = await Project.findOne({ _id: projectId });
+            if (!project)
+                return res.status(404).json({ message: 'Project not found' });
+            if (!(0, auth_1.isProjectMember)(project, auth.userId))
+                return res.status(403).json({ message: 'Unauthorized access' });
+            const collection = getRawFilesCollection();
+            if (!collection)
+                return res.status(500).json({ message: 'Database not available' });
+            const fileDoc = await collection.findOne({ fileId, projectId });
+            if (!fileDoc)
+                return res.status(404).json({ message: 'File not found' });
+            let storageKey = fileDoc.storageKey;
+            let fileName = fileDoc.displayName;
+            let contentType = fileDoc.contentType;
+            let version;
+            if (versionId) {
+                const found = await (0, assetVersions_1.findVersion)(projectId, fileId, versionId);
+                if (!found)
+                    return res.status(404).json({ message: 'Version not found' });
+                storageKey = found.storageKey;
+                fileName = found.fileName ?? fileName;
+                contentType = found.contentType ?? contentType;
+                version = found.version;
+            }
+            // Its storage connection's adapter; files stored before connections had their own row
+            // (no connection, or the built-in provider's id) are in the default storage.
+            const connId = fileDoc.storageConnectionId;
+            const fileAdapter = connId && findStorageConn(project, connId) ? await resolveConnAdapter(connId, project, auth) : adapter;
+            if ('error' in fileAdapter)
+                return res.status(fileAdapter.status).json({ message: fileAdapter.error });
+            if (!fileAdapter.getPresignedGetUrl)
+                return res.status(501).json({ message: 'Storage adapter does not support download URLs' });
+            const expiresIn = (0, signedUrls_1.signedUrlTtl)(auth, config, 'download') ?? 3600;
+            const url = await fileAdapter.getPresignedGetUrl(storageKey, expiresIn, fileName);
+            res.json({ url, fileId, fileName, contentType: contentType ?? null, ...(version ? { versionId, version } : {}), ...expiry(expiresIn) });
+        }
+        catch (err) {
+            res.status(500).json({ message: 'Failed to generate download URL', details: err.message });
+        }
+    });
     // ─── Per-connection file routes ───────────────────────────────────────────
     router.get('/projects/:projectId/connections/storage/:connId/upload-url', async (req, res) => {
         try {
@@ -309,7 +374,7 @@ function storageRouter(config) {
             const storageKey = `${projectId}/${category}/${fileId}${ext}`;
             const collection = getRawFilesCollection();
             if (collection) {
-                await collection.insertOne({
+                const fileDoc = {
                     _id: new mongodb_1.ObjectId(),
                     fileId,
                     projectId,
@@ -320,10 +385,13 @@ function storageRouter(config) {
                     contentType,
                     uploadedBy: auth.userId,
                     createdAt: new Date(),
-                });
+                };
+                await collection.insertOne(fileDoc);
+                await (0, assetVersions_1.recordFirstVersion)(fileDoc);
             }
-            const url = await connAdapter.getPresignedUploadUrl(storageKey, contentType);
-            res.json({ url, fileId, storageKey, displayName: fileName });
+            const expiresIn = (0, signedUrls_1.signedUrlTtl)(auth, config, 'upload');
+            const url = await connAdapter.getPresignedUploadUrl(storageKey, contentType, expiresIn);
+            res.json({ url, fileId, storageKey, displayName: fileName, ...expiry(expiresIn) });
         }
         catch (err) {
             res.status(500).json({ message: 'Failed to generate upload URL', details: err.message });
@@ -345,7 +413,7 @@ function storageRouter(config) {
             if (!collection)
                 return res.status(500).json({ message: 'Database not available' });
             const files = await collection.find(connFilter(projectId, connId, project)).sort({ createdAt: -1 }).limit(12).toArray();
-            const data = await Promise.all(files.map(f => resolveFileUrl(f, connAdapter)));
+            const data = await Promise.all(files.map(f => resolveFileUrl(f, connAdapter, (0, signedUrls_1.signedUrlTtl)(auth, config, 'download'))));
             res.json({ data });
         }
         catch (err) {
@@ -371,7 +439,7 @@ function storageRouter(config) {
             if (!collection)
                 return res.status(500).json({ message: 'Database not available' });
             const files = await collection.find(connFilter(projectId, connId, project, { category })).sort({ createdAt: -1 }).toArray();
-            const data = await Promise.all(files.map(f => resolveFileUrl(f, connAdapter)));
+            const data = await Promise.all(files.map(f => resolveFileUrl(f, connAdapter, (0, signedUrls_1.signedUrlTtl)(auth, config, 'download'))));
             res.json({ data });
         }
         catch (err) {
@@ -389,7 +457,7 @@ function storageRouter(config) {
             const project = await Project.findOne({ _id: projectId });
             if (!project)
                 return res.status(404).json({ message: 'Project not found' });
-            if (!(0, auth_1.isProjectMember)(project, auth.userId))
+            if (!(0, auth_1.canEditProject)(project, auth.userId))
                 return res.status(403).json({ message: 'Unauthorized access' });
             const collection = getRawFilesCollection();
             if (!collection)
@@ -406,9 +474,21 @@ function storageRouter(config) {
             if (!connAdapter.getPresignedUploadUrl) {
                 return res.status(501).json({ message: 'Storage adapter does not support presigned uploads' });
             }
-            const url = await connAdapter.getPresignedUploadUrl(fileDoc.storageKey, contentType);
+            // The new version goes to the asset's own key, so its URL doesn't change; the current
+            // one is archived first, and without a way to archive it nothing is replaced.
+            if (!connAdapter.copyFile)
+                return res.status(501).json({ message: 'Storage adapter cannot keep versions' });
+            let version;
+            try {
+                version = await (0, assetVersions_1.archiveCurrentVersion)(fileDoc, { fileName, contentType, userId: auth.userId }, connAdapter.copyFile.bind(connAdapter));
+            }
+            catch (err) {
+                return res.status(502).json({ message: 'Failed to archive the current version; nothing was replaced', details: err.message });
+            }
+            const expiresIn = (0, signedUrls_1.signedUrlTtl)(auth, config, 'upload');
+            const url = await connAdapter.getPresignedUploadUrl(fileDoc.storageKey, contentType, expiresIn);
             await collection.updateOne(connFilter(projectId, connId, project, { fileId }), { $set: { contentType, updatedAt: new Date() } });
-            res.json({ url, storageKey: fileDoc.storageKey, fileId });
+            res.json({ url, storageKey: fileDoc.storageKey, fileId, versionId: version.versionId, version: version.version, ...expiry(expiresIn) });
         }
         catch (err) {
             res.status(500).json({ message: 'Failed to generate replace URL', details: err.message });
@@ -457,8 +537,7 @@ function storageRouter(config) {
             const fileDoc = await collection.findOne(connFilter(projectId, connId, project, { fileId }));
             if (!fileDoc)
                 return res.status(404).json({ message: 'File not found' });
-            if (connAdapter.deleteFile)
-                await connAdapter.deleteFile(fileDoc.storageKey);
+            await deleteAsset(fileDoc, connAdapter);
             await collection.deleteOne(connFilter(projectId, connId, project, { fileId }));
             res.json({ message: 'File deleted successfully' });
         }
@@ -731,11 +810,11 @@ function storageRouter(config) {
     });
     return router;
 }
-async function resolveFileUrl(file, adapter) {
+async function resolveFileUrl(file, adapter, expiresIn) {
     let url = null;
     if (adapter.getPresignedGetUrl) {
         try {
-            url = await adapter.getPresignedGetUrl(file.storageKey);
+            url = await adapter.getPresignedGetUrl(file.storageKey, expiresIn);
         }
         catch { /* leave null */ }
     }
@@ -751,3 +830,15 @@ async function resolveFileUrl(file, adapter) {
         url,
     };
 }
+// When a signed URL stops working, for a client to know (only when it's short-lived).
+const expiry = (expiresIn) => expiresIn ? { expiresAt: new Date(Date.now() + expiresIn * 1000).toISOString() } : {};
+// An asset's files (every version), its versions and its deliverables. Its record is the
+// caller's to delete.
+async function deleteAsset(fileDoc, adapter) {
+    const keys = await (0, assetVersions_1.versionStorageKeys)(fileDoc.projectId, fileDoc.fileId, fileDoc.storageKey);
+    if (adapter.deleteFile)
+        for (const key of keys)
+            await adapter.deleteFile(key);
+    await (0, assetVersions_1.deleteVersions)(fileDoc.projectId, fileDoc.fileId);
+    await (0, deliverables_1.deleteDeliverablesOf)(fileDoc.projectId, { assetId: fileDoc.fileId });
+}

package/dist/middleware/routes/subscription.js

@@ -18,6 +18,9 @@ const ensureSubscription = async (req, res, next) => {
         const auth = req.auth;
         if (!auth)
             return next();
+        // A project's token is no user: it has no plan of its own.
+        if (auth.apiToken?.kind === 'project')
+            return next();
         const plan = await resolveSubscription(auth);
         req.subscription = plan;
         next();

package/dist/services/apiTokenPermissions.d.ts

@@ -0,0 +1,16 @@
+/** Permissions on a project, for the projects a token reaches. */
+export declare const PROJECT_PERMISSIONS: readonly ["project:read", "project:update", "project:delete", "members:read", "members:manage", "assets:read", "assets:write", "assets:delete", "production:read", "production:write", "production:delete", "workflow:read", "workflow:write", "exports:read", "exports:write", "rights:read", "rights:write", "jobs:read", "jobs:run"];
+/** Permissions on the account: only a user's token has them. */
+export declare const ACCOUNT_PERMISSIONS: readonly ["projects:create"];
+export type ProjectPermission = typeof PROJECT_PERMISSIONS[number];
+export type AccountPermission = typeof ACCOUNT_PERMISSIONS[number];
+export type ApiTokenPermission = ProjectPermission | AccountPermission;
+export declare const isProjectPermission: (value: unknown) => value is ProjectPermission;
+export declare const isAccountPermission: (value: unknown) => value is AccountPermission;
+/** What a route needs of a token: a permission, or only being a token (`null`). */
+export interface RouteRule {
+    permission: ApiTokenPermission | null;
+    userTokenOnly?: boolean;
+}
+/** The rule for a request made with an API token, or undefined: not reachable with one. */
+export declare function routeRuleFor(method: string, path: string): RouteRule | undefined;

package/dist/services/apiTokenPermissions.js

@@ -0,0 +1,102 @@
+"use strict";
+// What an API token may do: a list of permissions, each a resource and an action. A request
+// made with a token goes through only when its route's permission is among the token's (see
+// enforceApiTokenScope), and a route without one isn't reachable with a token at all.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isAccountPermission = exports.isProjectPermission = exports.ACCOUNT_PERMISSIONS = exports.PROJECT_PERMISSIONS = void 0;
+exports.routeRuleFor = routeRuleFor;
+/** Permissions on a project, for the projects a token reaches. */
+exports.PROJECT_PERMISSIONS = [
+    'project:read', 'project:update', 'project:delete',
+    'members:read', 'members:manage',
+    'assets:read', 'assets:write', 'assets:delete',
+    'production:read', 'production:write', 'production:delete',
+    'workflow:read', 'workflow:write',
+    'exports:read', 'exports:write',
+    'rights:read', 'rights:write',
+    'jobs:read', 'jobs:run',
+];
+/** Permissions on the account: only a user's token has them. */
+exports.ACCOUNT_PERMISSIONS = ['projects:create'];
+const isProjectPermission = (value) => exports.PROJECT_PERMISSIONS.includes(value);
+exports.isProjectPermission = isProjectPermission;
+const isAccountPermission = (value) => exports.ACCOUNT_PERMISSIONS.includes(value);
+exports.isAccountPermission = isAccountPermission;
+const READ = ['GET', 'HEAD', 'OPTIONS'];
+const methodsOf = (methods) => methods === 'read' ? READ : methods === 'write' ? ['POST', 'PUT', 'PATCH'] : methods === 'delete' ? ['DELETE'] : methods;
+// A project's own path (not /projects/create nor /projects/explore).
+const P = '^/projects/(?!(?:create|explore)/?$)[^/]+';
+const rule = (methods, path, permission, extra = {}) => ({ methods: methodsOf(methods), pattern: new RegExp(`${path}/?$`), permission, ...extra });
+// The first rule that matches a request decides it; a request no rule matches is refused.
+// Connections, integrations and allowed origins are the project's settings (project:*);
+// reviews, QC reports and dependency graphs are of its assets; pipelines are workflow.
+const RULES = [
+    // Outside a project.
+    rule('read', '^/auth', null),
+    rule('read', '^/projects', null),
+    rule(['POST'], '^/projects/create', 'projects:create'),
+    rule('read', '^/user/subscription', null, { userTokenOnly: true }),
+    rule('read', '^/users/search', 'members:manage'),
+    rule('read', '^/jobs/[^/]+', 'jobs:read'),
+    // The project itself and its settings.
+    rule('read', `${P}(/preview)?`, 'project:read'),
+    rule(['PATCH'], P, 'project:update'),
+    rule('delete', P, 'project:delete'),
+    rule(['PATCH'], `${P}/(archive|unarchive)`, 'project:update', { userTokenOnly: true }),
+    rule(['POST'], `${P}/image`, 'project:update'),
+    rule(['PATCH'], `${P}/origins`, 'project:update'),
+    rule(['POST'], `${P}/integrations`, 'project:update'),
+    rule('delete', `${P}/integrations/[^/]+`, 'project:update'),
+    rule('read', '^/upload-project-image-url/[^/]+', 'project:update'),
+    rule('delete', '^/delete-project-image-url/[^/]+', 'project:update'),
+    // Members.
+    rule('read', `${P}/members`, 'members:read'),
+    rule(['POST'], `${P}/members`, 'members:manage'),
+    rule(['PATCH'], `${P}/members/[^/]+(/approve)?`, 'members:manage'),
+    rule('delete', `${P}/members/[^/]+`, 'members:manage'),
+    // Assets: the built-in storage, and a storage connection's files and folders.
+    rule('read', `${P}/(storage|connections/storage/[^/]+)/(.+/)?(upload-url|replace-url)`, 'assets:write'),
+    rule('read', `${P}/storage/.+`, 'assets:read'),
+    rule(['PATCH'], `${P}/storage/files/[^/]+`, 'assets:write'),
+    rule('delete', `${P}/storage/files/[^/]+`, 'assets:delete'),
+    rule('read', `${P}/connections/storage/[^/]+/(files|folders)(/.+)?`, 'assets:read'),
+    rule(['POST', 'PATCH'], `${P}/connections/storage/[^/]+/(files|folders)(/.+)?`, 'assets:write'),
+    rule('delete', `${P}/connections/storage/[^/]+/(files|folders)/[^/]+`, 'assets:delete'),
+    rule('read', `${P}/assets/[^/]+/(metadata|versions|qc-report|dependency-graph|download-url)`, 'assets:read'),
+    rule(['PATCH'], `${P}/assets/[^/]+/metadata`, 'assets:write'),
+    rule(['POST'], `${P}/assets/[^/]+/qc-report`, 'assets:write'),
+    rule('read', `${P}/(reviews(/[^/]+)?|assets/[^/]+/versions/[^/]+/annotations)`, 'assets:read'),
+    rule(['POST', 'PATCH'], `${P}/(reviews(/[^/]+/decision)?|assets/[^/]+/versions/[^/]+/annotations(/[^/]+/resolve)?)`, 'assets:write'),
+    // Deliverables: an asset (or a version) delivered for a shot or an export.
+    rule('read', `${P}/deliverables`, 'assets:read'),
+    rule(['POST'], `${P}/deliverables`, 'assets:write'),
+    rule('delete', `${P}/deliverables/[^/]+`, 'assets:write'),
+    // Rights.
+    rule('read', `${P}/assets/[^/]+/rights`, 'rights:read'),
+    rule(['PUT'], `${P}/assets/[^/]+/rights`, 'rights:write'),
+    // Connections (API, database, storage, distribution, render farm): the project's settings.
+    rule('read', `${P}/(connections|get-connection|distribution-connections|render-farm-connections)(/.+)?`, 'project:read'),
+    rule('write', `${P}/(connections|distribution-connections|render-farm-connections)(/.+)?`, 'project:update'),
+    rule('delete', `${P}/(connections|distribution-connections|render-farm-connections)/.+`, 'project:update'),
+    // Production.
+    rule('read', `${P}/production/.+`, 'production:read'),
+    rule('write', `${P}/production/.+`, 'production:write'),
+    rule('delete', `${P}/production/.+`, 'production:delete'),
+    // Workflow and pipelines.
+    rule('read', `${P}/(workflow|pipelines(/[^/]+)?)`, 'workflow:read'),
+    rule(['PATCH'], `${P}/workflow`, 'workflow:write'),
+    rule(['POST'], `${P}/pipelines`, 'workflow:write'),
+    rule(['PATCH', 'DELETE'], `${P}/pipelines/[^/]+`, 'workflow:write'),
+    // Exports.
+    rule('read', `${P}/exports/[^/]+`, 'exports:read'),
+    rule(['POST'], `${P}/exports`, 'exports:write'),
+    rule(['PATCH', 'DELETE'], `${P}/exports/[^/]+`, 'exports:write'),
+    // Jobs: transcoding, rendering, AI, publishing a deliverable.
+    rule(['POST'], `${P}/(jobs/[^/]+|pipeline-suggest|deliverables/[^/]+/publish)`, 'jobs:run'),
+];
+/** The rule for a request made with an API token, or undefined: not reachable with one. */
+function routeRuleFor(method, path) {
+    const upper = method.toUpperCase();
+    const found = RULES.find(r => r.methods.includes(upper) && r.pattern.test(path));
+    return found && { permission: found.permission, userTokenOnly: found.userTokenOnly };
+}

package/dist/services/apiTokens.d.ts

@@ -1,21 +1,28 @@
-import { ApiTokenAccess, ApiTokenScope, StreamByConfig } from '../types';
+import { ApiTokenKind, ApiTokenScope, StreamByConfig } from '../types';
+import { ApiTokenPermission } from './apiTokenPermissions';
 export declare const API_TOKEN_PREFIX = "sbt_";
 export declare const API_TOKEN_EXPIRY_DAYS: readonly [7, 30, 90, 365];
 export interface ApiTokenRecord {
     id: string;
+    kind: ApiTokenKind;
     userId: string;
+    createdByName: string | null;
     name: string;
     prefix: string;
     hash: string;
-    access: ApiTokenAccess;
+    permissions: ApiTokenPermission[];
     projectIds: string[];
     createdAt: Date;
     expiresAt: Date | null;
     lastUsedAt: Date | null;
 }
-/** What a token's owner sees of it. */
-export type ApiTokenInfo = Omit<ApiTokenRecord, 'hash' | 'userId' | 'projectIds'> & {
+/** What's shown of a token: never its hash. */
+export type ApiTokenInfo = Omit<ApiTokenRecord, 'hash' | 'userId' | 'projectIds' | 'createdByName'> & {
     projectIds: string[] | '*';
+    createdBy: {
+        userId: string;
+        username: string | null;
+    };
 };
 export declare class ApiTokenError extends Error {
     status: number;
@@ -23,25 +30,42 @@ export declare class ApiTokenError extends Error {
 }
 export interface CreateApiTokenInput {
     name: string;
-    access: ApiTokenAccess;
-    projectIds: string[] | '*';
+    permissions: ApiTokenPermission[];
+    projectIds?: string[] | '*';
     expiresInDays: number | null;
 }
-/** A new token for `userId`: the token itself, shown only now, and what's kept of it. */
-export declare function createApiToken(userId: string, input: CreateApiTokenInput, config: StreamByConfig): Promise<{
+export interface ApiTokenOwner {
+    kind: ApiTokenKind;
+    userId: string;
+    username?: string | null;
+    projectId?: string;
+}
+/** A new token: the token itself, shown only now, and what's kept of it. */
+export declare function createApiToken(owner: ApiTokenOwner, input: CreateApiTokenInput, config: StreamByConfig): Promise<{
     token: string;
     info: ApiTokenInfo;
 }>;
-/** The tokens `userId` has. */
-export declare function listApiTokens(userId: string): Promise<ApiTokenInfo[]>;
-/** Revokes one of `userId`'s tokens: it stops working at once. Whether there was one. */
-export declare function revokeApiToken(userId: string, tokenId: string): Promise<boolean>;
+/** A user's own tokens. */
+export declare function listUserApiTokens(userId: string): Promise<ApiTokenInfo[]>;
+/** A project's tokens. */
+export declare function listProjectApiTokens(projectId: string): Promise<ApiTokenInfo[]>;
+/** Revokes a user's own token: it stops working at once. Whether there was one. */
+export declare function revokeUserApiToken(userId: string, tokenId: string): Promise<boolean>;
+/** Revokes a project's token. Whether there was one. */
+export declare function revokeProjectApiToken(projectId: string, tokenId: string): Promise<boolean>;
+/** A project's tokens that `userId` made (to tell its admins they keep working once they leave). */
+export declare function projectApiTokensMadeBy(projectId: string, userId: string): Promise<ApiTokenInfo[]>;
+/** Ends a deleted project's tokens. */
+export declare function deleteProjectApiTokens(projectId: string): Promise<void>;
+/** A project a user's token made: it reaches it from now on (one reaching every project already does). */
+export declare function addProjectToApiToken(tokenId: string, projectId: string): Promise<void>;
 export interface ResolvedApiToken {
     userId: string;
+    name: string;
     scope: ApiTokenScope;
 }
 /**
- * The token's owner and scope, for the host's authProvider; null when it isn't a token, isn't
- * known (revoked), or has expired. Marks when it was last used.
+ * The token's request: who it is and what it may do, for the host's authProvider; null when
+ * it isn't a token, isn't known (revoked), or has expired. Marks when it was last used.
  */
 export declare function resolveApiToken(token: unknown): Promise<ResolvedApiToken | null>;