streamby-core 0.36.0 → 0.38.0

package/dist/services/productionFields.js

@@ -0,0 +1,80 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TASK_PRIORITIES = exports.PRODUCTION_STATUSES = void 0;
+exports.checkProductionFields = checkProductionFields;
+const auth_1 = require("../utils/auth");
+// What a production sequence, shot or task may be given, checked before it's saved: a name
+// that isn't blank, a known status and priority, assignees who are members of the project, a
+// due date that is a date.
+exports.PRODUCTION_STATUSES = ['todo', 'in_progress', 'review', 'done'];
+exports.TASK_PRIORITIES = ['low', 'medium', 'high'];
+const MAX_NAME = 200;
+const MAX_TEXT = 5000;
+/**
+ * The fields of `body` that `allowed` lists, checked and ready to save (`assignees` and
+ * `assignee` are saved as `assignedTo`). With `creating`, a name is required.
+ */
+function checkProductionFields(body, allowed, project, { creating = false } = {}) {
+    const values = {};
+    const given = (field) => body?.[field] !== undefined;
+    const has = (field) => allowed.includes(field);
+    if (creating && !given('name'))
+        return { error: 'name is required' };
+    if (has('name') && given('name')) {
+        if (typeof body.name !== 'string' || !body.name.trim())
+            return { error: 'name must not be blank' };
+        if (body.name.trim().length > MAX_NAME)
+            return { error: `name must be at most ${MAX_NAME} characters` };
+        values.name = body.name.trim();
+    }
+    for (const field of ['description', 'notes']) {
+        if (!has(field) || !given(field))
+            continue;
+        const value = body[field];
+        if (value !== null && (typeof value !== 'string' || value.length > MAX_TEXT)) {
+            return { error: `${field} must be text of at most ${MAX_TEXT} characters, or null` };
+        }
+        values[field] = value === null || !value.trim() ? null : value;
+    }
+    if (has('status') && given('status')) {
+        if (!exports.PRODUCTION_STATUSES.includes(body.status))
+            return { error: `status must be one of ${exports.PRODUCTION_STATUSES.join(', ')}` };
+        values.status = body.status;
+    }
+    if (has('priority') && given('priority')) {
+        if (!exports.TASK_PRIORITIES.includes(body.priority))
+            return { error: `priority must be one of ${exports.TASK_PRIORITIES.join(', ')}` };
+        values.priority = body.priority;
+    }
+    const isMember = (id) => typeof id === 'string' && !!(0, auth_1.activeMemberOf)(project, id);
+    if (has('assignees') && given('assignedTo')) {
+        const ids = body.assignedTo;
+        if (!Array.isArray(ids) || !ids.every(isMember))
+            return { error: 'assignedTo must be a list of members of the project' };
+        values.assignedTo = [...new Set(ids)];
+    }
+    if (has('assignee') && given('assignedTo')) {
+        if (body.assignedTo !== null && !isMember(body.assignedTo))
+            return { error: 'assignedTo must be a member of the project, or null' };
+        values.assignedTo = body.assignedTo;
+    }
+    if (has('dueDate') && given('dueDate')) {
+        const date = body.dueDate === null || body.dueDate === '' ? null : new Date(body.dueDate);
+        if (date && Number.isNaN(date.getTime()))
+            return { error: 'dueDate must be a date, or null' };
+        values.dueDate = date;
+    }
+    if (has('order') && given('order')) {
+        if (typeof body.order !== 'number' || !Number.isFinite(body.order))
+            return { error: 'order must be a number' };
+        values.order = body.order;
+    }
+    for (const field of ['assetId', 'exportId']) {
+        if (!has(field) || !given(field))
+            continue;
+        if (body[field] !== null && typeof body[field] !== 'string')
+            return { error: `${field} must be an id, or null` };
+        values[field] = body[field] || null;
+    }
+    return { values };
+}

package/dist/services/signedUrls.d.ts

@@ -0,0 +1,6 @@
+import { Auth, StreamByConfig } from '../types';
+export declare const DEFAULT_TOKEN_SIGNED_URL_TTL: {
+    upload: number;
+    download: number;
+};
+export declare const signedUrlTtl: (auth: Auth | undefined, config: StreamByConfig, kind: "upload" | "download") => number | undefined;

package/dist/services/signedUrls.js

@@ -0,0 +1,9 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.signedUrlTtl = exports.DEFAULT_TOKEN_SIGNED_URL_TTL = void 0;
+// How long a signed storage URL works. A request made with an API token (an agent, the MCP
+// server) gets short-lived ones; a browser session, the adapter's own (an hour to upload, a
+// day to read).
+exports.DEFAULT_TOKEN_SIGNED_URL_TTL = { upload: 15 * 60, download: 5 * 60 };
+const signedUrlTtl = (auth, config, kind) => auth?.apiToken ? config.mcp?.signedUrlTtl?.[kind] ?? exports.DEFAULT_TOKEN_SIGNED_URL_TTL[kind] : undefined;
+exports.signedUrlTtl = signedUrlTtl;

package/dist/types/index.d.ts

@@ -1,3 +1,4 @@
+import type { ApiTokenPermission, ProjectPermission, AccountPermission } from '../services/apiTokenPermissions';
 import { Request } from 'express';
 import type { WebSocketServer } from 'ws';
 export interface S3Config {
@@ -41,10 +42,11 @@ export interface StorageAdapter {
     deleteProjectDirectory: (projectId: string) => Promise<any>;
     getPresignedUrl?: (contentType: string, projectId: string) => Promise<any>;
     getPresignedProjectImageUrl?: (projectId: string) => Promise<any>;
-    getPresignedUploadUrl?: (key: string, contentType: string) => Promise<string>;
+    getPresignedUploadUrl?: (key: string, contentType: string, expiresIn?: number) => Promise<string>;
     listFilesByCategory?: (projectId: string, category: string) => Promise<StorageFileInfo[]>;
     deleteFile?: (key: string) => Promise<void>;
-    getPresignedGetUrl?: (key: string) => Promise<string>;
+    copyFile?: (from: string, to: string) => Promise<void>;
+    getPresignedGetUrl?: (key: string, expiresIn?: number, downloadName?: string) => Promise<string>;
 }
 export interface FieldDefinition {
     name: string;
@@ -139,6 +141,10 @@ export interface StreamByConfig {
             windowMs: number;
         };
         apiBaseUrl?: string;
+        signedUrlTtl?: {
+            upload?: number;
+            download?: number;
+        };
     };
     websocket?: {
         server: WebSocketServer;
@@ -167,10 +173,12 @@ export interface Auth {
     role: 'viewer' | 'editor' | 'admin';
     apiToken?: ApiTokenScope;
 }
-export type ApiTokenAccess = 'read' | 'write';
+export type { ApiTokenPermission, ProjectPermission, AccountPermission };
+export type ApiTokenKind = 'user' | 'project';
 export interface ApiTokenScope {
     tokenId: string;
-    access: ApiTokenAccess;
+    kind: ApiTokenKind;
+    permissions: ApiTokenPermission[];
     projectIds: string[] | '*';
 }
 export type AuthProvider = (req: Request) => Promise<Auth>;

package/dist/utils/auth.d.ts

@@ -1,10 +1,21 @@
 import { ProjectInfo } from '../types';
-type ProjectMembers = Pick<ProjectInfo, 'members'> | null | undefined;
+type ProjectMembers = (Pick<ProjectInfo, 'members'> & {
+    _id?: unknown;
+    id?: unknown;
+}) | null | undefined;
+export declare const projectTokenPrincipal: (tokenId: string, projectId: string) => string;
+export declare const isProjectTokenPrincipal: (userId: unknown) => boolean;
 export declare function activeMemberOf(project: ProjectMembers, userId: string | undefined): {
     role: "viewer" | "editor" | "admin";
     userId: string;
     archived?: boolean;
     status?: "active" | "pending";
+} | {
+    userId: string;
+    username: string;
+    role: "admin";
+    status: "active";
+    archived: boolean;
 } | undefined;
 export declare const projectRoleOf: (project: ProjectMembers, userId: string | undefined) => "viewer" | "editor" | "admin" | undefined;
 /** An active member, whatever their role: can see the project. */

package/dist/utils/auth.js

@@ -1,11 +1,32 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.isProjectAdmin = exports.canEditProject = exports.isProjectMember = exports.projectRoleOf = void 0;
+exports.isProjectAdmin = exports.canEditProject = exports.isProjectMember = exports.projectRoleOf = exports.isProjectTokenPrincipal = exports.projectTokenPrincipal = void 0;
 exports.activeMemberOf = activeMemberOf;
+// A project's API token acts on its project as itself, not as a user: its request's userId is
+// this principal, naming the token and its project. In that project it's an admin -- what it
+// may do is only its permissions (see enforceApiTokenScope) -- and in any other, nobody.
+const PROJECT_TOKEN_PRINCIPAL = 'project-token:';
+const projectTokenPrincipal = (tokenId, projectId) => `${PROJECT_TOKEN_PRINCIPAL}${tokenId}:${projectId}`;
+exports.projectTokenPrincipal = projectTokenPrincipal;
+const isProjectTokenPrincipal = (userId) => typeof userId === 'string' && userId.startsWith(PROJECT_TOKEN_PRINCIPAL);
+exports.isProjectTokenPrincipal = isProjectTokenPrincipal;
+const projectOfPrincipal = (userId) => {
+    if (!(0, exports.isProjectTokenPrincipal)(userId))
+        return undefined;
+    const rest = userId.slice(PROJECT_TOKEN_PRINCIPAL.length);
+    return rest.slice(rest.indexOf(':') + 1) || undefined;
+};
 // A project's member who's in it now: invited and accepted (status 'active'). (A member's
 // `archived` is only that member having archived the project in their own list.)
 function activeMemberOf(project, userId) {
-    if (!project?.members || !userId)
+    if (!project || !userId)
+        return undefined;
+    const tokenProject = projectOfPrincipal(userId);
+    if (tokenProject !== undefined) {
+        const id = String(project._id ?? project.id ?? '');
+        return id && id === tokenProject ? { userId, username: 'API token', role: 'admin', status: 'active', archived: false } : undefined;
+    }
+    if (!project.members)
         return undefined;
     return project.members.find(member => member.userId?.toString() === userId && member.status === 'active');
 }

package/dist/utils/nosqlDb.d.ts

@@ -0,0 +1,2 @@
+/** The NoSQL database the project's files and production live in, or null when there's none. */
+export declare function nosqlDb(): import("mongodb").Db | null;

package/dist/utils/nosqlDb.js

@@ -0,0 +1,11 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.nosqlDb = nosqlDb;
+const connectionManager_1 = require("../adapters/database/connectionManager");
+/** The NoSQL database the project's files and production live in, or null when there's none. */
+function nosqlDb() {
+    const ids = (0, connectionManager_1.getConnectedIds)().filter(id => (0, connectionManager_1.getConnection)(id).type === 'nosql');
+    if (!ids.length)
+        return null;
+    return (0, connectionManager_1.getConnection)(ids[0]).client.db();
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "streamby-core",
-  "version": "0.36.0",
+  "version": "0.38.0",
   "description": "StreamBy middleware framework for media storage management",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",