streamby-core 0.37.0 → 0.39.0

package/dist/middleware/routes/production.js

@@ -9,12 +9,16 @@ const auth_1 = require("../../utils/auth");
 const connectionManager_1 = require("../../adapters/database/connectionManager");
 const manager_1 = require("../../models/manager");
 const crypto_1 = __importDefault(require("crypto"));
+const deliverables_1 = require("../../services/deliverables");
+const productionFields_1 = require("../../services/productionFields");
 function getDb() {
     const ids = (0, connectionManager_1.getConnectedIds)().filter(id => (0, connectionManager_1.getConnection)(id).type === 'nosql');
     if (!ids.length)
         return null;
     return (0, connectionManager_1.getConnection)(ids[0]).client.db();
 }
+const SHOT_FIELDS = ['name', 'description', 'status', 'assignees', 'assetId', 'exportId', 'dueDate', 'order'];
+const TASK_FIELDS = ['name', 'status', 'priority', 'assignee', 'dueDate', 'notes'];
 function productionRouter(_config) {
     const router = (0, express_1.Router)();
     const Project = (0, manager_1.getModel)('projects');
@@ -45,14 +49,15 @@ function productionRouter(_config) {
         try {
             const auth = req.auth;
             const { projectId } = req.params;
-            const { name, description, order } = req.body;
-            if (!name)
-                return res.status(400).json({ message: 'name is required' });
             const project = await Project.findOne({ _id: projectId });
             if (!project)
                 return res.status(404).json({ message: 'Project not found' });
             if (!(0, auth_1.canEditProject)(project, auth.userId))
                 return res.status(403).json({ message: 'Unauthorized' });
+            const checked = (0, productionFields_1.checkProductionFields)(req.body, ['name', 'description', 'order'], project, { creating: true });
+            if ('error' in checked)
+                return res.status(400).json({ message: checked.error });
+            const { values } = checked;
             const db = getDb();
             if (!db)
                 return res.status(500).json({ message: 'Database not available' });
@@ -60,9 +65,9 @@ function productionRouter(_config) {
             const sequence = {
                 id: crypto_1.default.randomUUID(),
                 projectId,
-                name,
-                description: description ?? null,
-                order: order ?? 0,
+                name: values.name,
+                description: values.description ?? null,
+                order: values.order ?? 0,
                 createdBy: auth.userId,
                 createdAt: now,
                 updatedAt: now,
@@ -86,14 +91,10 @@ function productionRouter(_config) {
             const db = getDb();
             if (!db)
                 return res.status(500).json({ message: 'Database not available' });
-            const { name, description, order } = req.body;
-            const $set = { updatedAt: new Date() };
-            if (name !== undefined)
-                $set.name = name;
-            if (description !== undefined)
-                $set.description = description;
-            if (order !== undefined)
-                $set.order = order;
+            const checked = (0, productionFields_1.checkProductionFields)(req.body, ['name', 'description', 'order'], project);
+            if ('error' in checked)
+                return res.status(400).json({ message: checked.error });
+            const $set = { ...checked.values, updatedAt: new Date() };
             const result = await db.collection('production_sequences').findOneAndUpdate({ id: seqId, projectId }, { $set }, { returnDocument: 'after' });
             if (!result)
                 return res.status(404).json({ message: 'Sequence not found' });
@@ -115,8 +116,15 @@ function productionRouter(_config) {
             const db = getDb();
             if (!db)
                 return res.status(500).json({ message: 'Database not available' });
-            await db.collection('production_sequences').deleteOne({ id: seqId, projectId });
+            // With its shots, and their tasks and deliverables: nothing is left behind.
+            const shotIds = (await db.collection('production_shots').find({ sequenceId: seqId, projectId }).toArray()).map(s => s.id);
+            const { deletedCount } = await db.collection('production_sequences').deleteOne({ id: seqId, projectId });
+            if (!deletedCount)
+                return res.status(404).json({ message: 'Sequence not found' });
             await db.collection('production_shots').deleteMany({ sequenceId: seqId, projectId });
+            if (shotIds.length)
+                await db.collection('production_tasks').deleteMany({ projectId, shotId: { $in: shotIds } });
+            await (0, deliverables_1.deleteDeliverablesOf)(projectId, { shotIds });
             res.json({ message: 'Sequence deleted' });
         }
         catch (err) {
@@ -150,30 +158,34 @@ function productionRouter(_config) {
         try {
             const auth = req.auth;
             const { projectId, seqId } = req.params;
-            const { name, description, status, assignedTo, assetId, exportId, dueDate, order } = req.body;
-            if (!name)
-                return res.status(400).json({ message: 'name is required' });
             const project = await Project.findOne({ _id: projectId });
             if (!project)
                 return res.status(404).json({ message: 'Project not found' });
             if (!(0, auth_1.canEditProject)(project, auth.userId))
                 return res.status(403).json({ message: 'Unauthorized' });
+            const checked = (0, productionFields_1.checkProductionFields)(req.body, SHOT_FIELDS, project, { creating: true });
+            if ('error' in checked)
+                return res.status(400).json({ message: checked.error });
+            const { values } = checked;
             const db = getDb();
             if (!db)
                 return res.status(500).json({ message: 'Database not available' });
+            if (!(await db.collection('production_sequences').findOne({ id: seqId, projectId }))) {
+                return res.status(404).json({ message: 'Sequence not found' });
+            }
             const now = new Date();
             const shot = {
                 id: crypto_1.default.randomUUID(),
                 sequenceId: seqId,
                 projectId,
-                name,
-                description: description ?? null,
-                order: order ?? 0,
-                status: status ?? 'todo',
-                assignedTo: assignedTo ?? [],
-                assetId: assetId ?? null,
-                exportId: exportId ?? null,
-                dueDate: dueDate ? new Date(dueDate) : null,
+                name: values.name,
+                description: values.description ?? null,
+                order: values.order ?? 0,
+                status: values.status ?? 'todo',
+                assignedTo: values.assignedTo ?? [],
+                assetId: values.assetId ?? null,
+                exportId: values.exportId ?? null,
+                dueDate: values.dueDate ?? null,
                 createdBy: auth.userId,
                 createdAt: now,
                 updatedAt: now,
@@ -197,24 +209,10 @@ function productionRouter(_config) {
             const db = getDb();
             if (!db)
                 return res.status(500).json({ message: 'Database not available' });
-            const { name, description, status, assignedTo, assetId, exportId, dueDate, order } = req.body;
-            const $set = { updatedAt: new Date() };
-            if (name !== undefined)
-                $set.name = name;
-            if (description !== undefined)
-                $set.description = description;
-            if (status !== undefined)
-                $set.status = status;
-            if (assignedTo !== undefined)
-                $set.assignedTo = assignedTo;
-            if (assetId !== undefined)
-                $set.assetId = assetId;
-            if (exportId !== undefined)
-                $set.exportId = exportId;
-            if (dueDate !== undefined)
-                $set.dueDate = dueDate ? new Date(dueDate) : null;
-            if (order !== undefined)
-                $set.order = order;
+            const checked = (0, productionFields_1.checkProductionFields)(req.body, SHOT_FIELDS, project);
+            if ('error' in checked)
+                return res.status(400).json({ message: checked.error });
+            const $set = { ...checked.values, updatedAt: new Date() };
             const result = await db.collection('production_shots').findOneAndUpdate({ id: shotId, projectId }, { $set }, { returnDocument: 'after' });
             if (!result)
                 return res.status(404).json({ message: 'Shot not found' });
@@ -238,6 +236,7 @@ function productionRouter(_config) {
                 return res.status(500).json({ message: 'Database not available' });
             await db.collection('production_shots').deleteOne({ id: shotId, projectId });
             await db.collection('production_tasks').deleteMany({ shotId, projectId });
+            await (0, deliverables_1.deleteDeliverablesOf)(projectId, { shotIds: [shotId] });
             res.json({ message: 'Shot deleted' });
         }
         catch (err) {
@@ -271,28 +270,32 @@ function productionRouter(_config) {
         try {
             const auth = req.auth;
             const { projectId, shotId } = req.params;
-            const { name, status, priority, assignedTo, dueDate, notes } = req.body;
-            if (!name)
-                return res.status(400).json({ message: 'name is required' });
             const project = await Project.findOne({ _id: projectId });
             if (!project)
                 return res.status(404).json({ message: 'Project not found' });
             if (!(0, auth_1.canEditProject)(project, auth.userId))
                 return res.status(403).json({ message: 'Unauthorized' });
+            const checked = (0, productionFields_1.checkProductionFields)(req.body, TASK_FIELDS, project, { creating: true });
+            if ('error' in checked)
+                return res.status(400).json({ message: checked.error });
+            const { values } = checked;
             const db = getDb();
             if (!db)
                 return res.status(500).json({ message: 'Database not available' });
+            if (!(await db.collection('production_shots').findOne({ id: shotId, projectId }))) {
+                return res.status(404).json({ message: 'Shot not found' });
+            }
             const now = new Date();
             const task = {
                 id: crypto_1.default.randomUUID(),
                 shotId,
                 projectId,
-                name,
-                status: status ?? 'todo',
-                priority: priority ?? 'medium',
-                assignedTo: assignedTo ?? null,
-                dueDate: dueDate ? new Date(dueDate) : null,
-                notes: notes ?? null,
+                name: values.name,
+                status: values.status ?? 'todo',
+                priority: values.priority ?? 'medium',
+                assignedTo: values.assignedTo ?? null,
+                dueDate: values.dueDate ?? null,
+                notes: values.notes ?? null,
                 createdBy: auth.userId,
                 createdAt: now,
                 updatedAt: now,
@@ -316,20 +319,10 @@ function productionRouter(_config) {
             const db = getDb();
             if (!db)
                 return res.status(500).json({ message: 'Database not available' });
-            const { name, status, priority, assignedTo, dueDate, notes } = req.body;
-            const $set = { updatedAt: new Date() };
-            if (name !== undefined)
-                $set.name = name;
-            if (status !== undefined)
-                $set.status = status;
-            if (priority !== undefined)
-                $set.priority = priority;
-            if (assignedTo !== undefined)
-                $set.assignedTo = assignedTo;
-            if (dueDate !== undefined)
-                $set.dueDate = dueDate ? new Date(dueDate) : null;
-            if (notes !== undefined)
-                $set.notes = notes;
+            const checked = (0, productionFields_1.checkProductionFields)(req.body, TASK_FIELDS, project);
+            if ('error' in checked)
+                return res.status(400).json({ message: checked.error });
+            const $set = { ...checked.values, updatedAt: new Date() };
             const result = await db.collection('production_tasks').findOneAndUpdate({ id: taskId, shotId, projectId }, { $set }, { returnDocument: 'after' });
             if (!result)
                 return res.status(404).json({ message: 'Task not found' });

package/dist/middleware/routes/project.js

@@ -10,6 +10,8 @@ const sanitize_1 = require("../../utils/sanitize");
 const projectIntegration_1 = require("../../services/projectIntegration");
 const auth_2 = require("../../services/auth");
 const apiTokens_1 = require("../../services/apiTokens");
+const nosqlDb_1 = require("../../utils/nosqlDb");
+const production_1 = require("../../services/production");
 function projectRouter(config) {
     const router = (0, express_1.Router)();
     const Project = (0, manager_1.getModel)('projects');
@@ -194,17 +196,12 @@ function projectRouter(config) {
             if (!(0, auth_1.isProjectMember)(project, auth.userId)) {
                 return res.status(403).json({ message: 'Unauthorized project access' });
             }
-            const exports = (project.exports || []).map((e) => ({
-                id: e.id,
-                name: e.name,
-                description: e.description,
-                method: e.method,
-                private: e.private,
-                useConnections: e.useConnections,
-                useCredentials: e.useCredentials,
-            }));
+            const exports = (0, sanitize_1.exportSummaries)(project.exports);
             const sanitized = (0, sanitize_1.sanitizeProject)({ ...project, id: project._id || project.id, _id: undefined, connections: project.connections || [], exports });
-            res.json({ project: sanitized, message: 'Project fetched successfully' });
+            // Whether it has production data, for its Production section to show even without a
+            // production node in its workflow.
+            const hasProductionData = !!(await (0, nosqlDb_1.nosqlDb)()?.collection('production_sequences').findOne({ projectId }));
+            res.json({ project: { ...sanitized, hasProductionData }, message: 'Project fetched successfully' });
         }
         catch (err) {
             res.status(500).json({ message: 'Failed to fetch project', details: err.message });
@@ -257,8 +254,9 @@ function projectRouter(config) {
                 return res.status(403).json({ message: 'Only a project admin can delete it' });
             }
             await Project.useDbType(project.dbType).delete({ _id: projectId });
-            // Its tokens have nothing left to reach.
+            // Its tokens have nothing left to reach, and its production data nothing to belong to.
             await (0, apiTokens_1.deleteProjectApiTokens)(String(projectId));
+            await (0, production_1.deleteProductionData)(String(projectId));
             const allProjects = await Project.find({});
             const projects = allProjects
                 .filter(project => {
@@ -375,6 +373,21 @@ function projectRouter(config) {
             res.status(500).json({ message: 'Failed to update project image', details: err.message });
         }
     });
+    // ─── A project's allowed origins, on their own ────────────────────────────
+    router.get('/projects/:id/origins', async (req, res) => {
+        try {
+            const auth = req.auth;
+            const project = await Project.findOne({ _id: req.params.id });
+            if (!project)
+                return res.status(404).json({ message: 'Project not found' });
+            if (!(0, auth_1.isProjectMember)(project, auth.userId))
+                return res.status(403).json({ message: 'Unauthorized project access' });
+            return res.status(200).json({ data: project.allowedOrigin || [] });
+        }
+        catch (err) {
+            res.status(500).json({ message: 'Failed to fetch project origins', details: err.message });
+        }
+    });
     router.patch('/projects/:id/origins', async (req, res) => {
         try {
             const auth = req.auth;
@@ -397,6 +410,21 @@ function projectRouter(config) {
             res.status(500).json({ message: 'Failed to update project origins', details: err.message });
         }
     });
+    // ─── A project's integrations, on their own ───────────────────────────────
+    router.get('/projects/:id/integrations', async (req, res) => {
+        try {
+            const auth = req.auth;
+            const project = await Project.findOne({ _id: req.params.id });
+            if (!project)
+                return res.status(404).json({ message: 'Project not found' });
+            if (!(0, auth_1.isProjectMember)(project, auth.userId))
+                return res.status(403).json({ message: 'Unauthorized project access' });
+            return res.status(200).json({ data: (0, sanitize_1.sanitizeIntegrationConnections)(project.integrationConnections) });
+        }
+        catch (err) {
+            res.status(500).json({ message: 'Failed to fetch project integrations', details: err.message });
+        }
+    });
     // ─── Add an integration to an existing project ───────────────────────────
     router.post('/projects/:id/integrations', async (req, res) => {
         try {

package/dist/middleware/routes/storage.js

@@ -15,6 +15,9 @@ const builtinAccess_1 = require("../../utils/builtinAccess");
 const connectionResolver_1 = require("../../services/connectionResolver");
 const mongodb_1 = require("mongodb");
 const crypto_1 = __importDefault(require("crypto"));
+const signedUrls_1 = require("../../services/signedUrls");
+const assetVersions_1 = require("../../services/assetVersions");
+const deliverables_1 = require("../../services/deliverables");
 const VALID_CATEGORIES = ['images', 'audios', 'videos', '3d-models'];
 const VALID_3D_EXTENSIONS = new Set(['.glb', '.gltf', '.obj', '.fbx', '.stl', '.ply']);
 function validateContentType(contentType, filename, category) {
@@ -135,7 +138,7 @@ function storageRouter(config) {
             const storageKey = `${projectId}/${category}/${fileId}${ext}`;
             const collection = getRawFilesCollection();
             if (collection) {
-                await collection.insertOne({
+                const fileDoc = {
                     _id: new mongodb_1.ObjectId(),
                     fileId,
                     projectId,
@@ -145,10 +148,13 @@ function storageRouter(config) {
                     contentType,
                     uploadedBy: auth.userId,
                     createdAt: new Date(),
-                });
+                };
+                await collection.insertOne(fileDoc);
+                await (0, assetVersions_1.recordFirstVersion)(fileDoc);
             }
-            const url = await adapter.getPresignedUploadUrl(storageKey, contentType);
-            res.json({ url, fileId, storageKey, displayName: fileName });
+            const expiresIn = (0, signedUrls_1.signedUrlTtl)(auth, config, 'upload');
+            const url = await adapter.getPresignedUploadUrl(storageKey, contentType, expiresIn);
+            res.json({ url, fileId, storageKey, displayName: fileName, ...expiry(expiresIn) });
         }
         catch (err) {
             res.status(500).json({ message: 'Failed to generate upload URL', details: err.message });
@@ -165,7 +171,7 @@ function storageRouter(config) {
             const project = await Project.findOne({ _id: projectId });
             if (!project)
                 return res.status(404).json({ message: 'Project not found' });
-            if (!(0, auth_1.isProjectMember)(project, auth.userId))
+            if (!(0, auth_1.canEditProject)(project, auth.userId))
                 return res.status(403).json({ message: 'Unauthorized access' });
             const collection = getRawFilesCollection();
             if (!collection)
@@ -179,9 +185,21 @@ function storageRouter(config) {
             if (!adapter.getPresignedUploadUrl) {
                 return res.status(501).json({ message: 'Storage adapter does not support presigned uploads' });
             }
-            const url = await adapter.getPresignedUploadUrl(fileDoc.storageKey, contentType);
+            // The new version goes to the asset's own key, so its URL doesn't change; the current
+            // one is archived first, and without a way to archive it nothing is replaced.
+            if (!adapter.copyFile)
+                return res.status(501).json({ message: 'Storage adapter cannot keep versions' });
+            let version;
+            try {
+                version = await (0, assetVersions_1.archiveCurrentVersion)(fileDoc, { fileName, contentType, userId: auth.userId }, adapter.copyFile.bind(adapter));
+            }
+            catch (err) {
+                return res.status(502).json({ message: 'Failed to archive the current version; nothing was replaced', details: err.message });
+            }
+            const expiresIn = (0, signedUrls_1.signedUrlTtl)(auth, config, 'upload');
+            const url = await adapter.getPresignedUploadUrl(fileDoc.storageKey, contentType, expiresIn);
             await collection.updateOne({ fileId, projectId }, { $set: { contentType, updatedAt: new Date() } });
-            res.json({ url, storageKey: fileDoc.storageKey, fileId });
+            res.json({ url, storageKey: fileDoc.storageKey, fileId, versionId: version.versionId, version: version.version, ...expiry(expiresIn) });
         }
         catch (err) {
             res.status(500).json({ message: 'Failed to generate replace URL', details: err.message });
@@ -227,8 +245,7 @@ function storageRouter(config) {
             const fileDoc = await collection.findOne({ fileId, projectId });
             if (!fileDoc)
                 return res.status(404).json({ message: 'File not found' });
-            if (adapter.deleteFile)
-                await adapter.deleteFile(fileDoc.storageKey);
+            await deleteAsset(fileDoc, adapter);
             await collection.deleteOne({ fileId, projectId });
             res.json({ message: 'File deleted successfully' });
         }
@@ -249,7 +266,7 @@ function storageRouter(config) {
             if (!collection)
                 return res.status(500).json({ message: 'Database not available' });
             const files = await collection.find({ projectId }).sort({ createdAt: -1 }).limit(12).toArray();
-            const data = await Promise.all(files.map(f => resolveFileUrl(f, adapter)));
+            const data = await Promise.all(files.map(f => resolveFileUrl(f, adapter, (0, signedUrls_1.signedUrlTtl)(auth, config, 'download'))));
             res.json({ data });
         }
         catch (err) {
@@ -272,13 +289,61 @@ function storageRouter(config) {
             if (!collection)
                 return res.status(500).json({ message: 'Database not available' });
             const files = await collection.find({ projectId, category }).sort({ createdAt: -1 }).toArray();
-            const data = await Promise.all(files.map(f => resolveFileUrl(f, adapter)));
+            const data = await Promise.all(files.map(f => resolveFileUrl(f, adapter, (0, signedUrls_1.signedUrlTtl)(auth, config, 'download'))));
             res.json({ data });
         }
         catch (err) {
             res.status(500).json({ message: 'Failed to list files', details: err.message });
         }
     });
+    // A short-lived URL to download an asset, or one of its versions, wherever it's stored
+    // (the built-in storage or one of the project's storage connections). It's for that file
+    // only, and downloads it with its name.
+    router.get('/projects/:projectId/assets/:fileId/download-url', async (req, res) => {
+        try {
+            const auth = req.auth;
+            const { projectId, fileId } = req.params;
+            const { versionId } = req.query;
+            const project = await Project.findOne({ _id: projectId });
+            if (!project)
+                return res.status(404).json({ message: 'Project not found' });
+            if (!(0, auth_1.isProjectMember)(project, auth.userId))
+                return res.status(403).json({ message: 'Unauthorized access' });
+            const collection = getRawFilesCollection();
+            if (!collection)
+                return res.status(500).json({ message: 'Database not available' });
+            const fileDoc = await collection.findOne({ fileId, projectId });
+            if (!fileDoc)
+                return res.status(404).json({ message: 'File not found' });
+            let storageKey = fileDoc.storageKey;
+            let fileName = fileDoc.displayName;
+            let contentType = fileDoc.contentType;
+            let version;
+            if (versionId) {
+                const found = await (0, assetVersions_1.findVersion)(projectId, fileId, versionId);
+                if (!found)
+                    return res.status(404).json({ message: 'Version not found' });
+                storageKey = found.storageKey;
+                fileName = found.fileName ?? fileName;
+                contentType = found.contentType ?? contentType;
+                version = found.version;
+            }
+            // Its storage connection's adapter; files stored before connections had their own row
+            // (no connection, or the built-in provider's id) are in the default storage.
+            const connId = fileDoc.storageConnectionId;
+            const fileAdapter = connId && findStorageConn(project, connId) ? await resolveConnAdapter(connId, project, auth) : adapter;
+            if ('error' in fileAdapter)
+                return res.status(fileAdapter.status).json({ message: fileAdapter.error });
+            if (!fileAdapter.getPresignedGetUrl)
+                return res.status(501).json({ message: 'Storage adapter does not support download URLs' });
+            const expiresIn = (0, signedUrls_1.signedUrlTtl)(auth, config, 'download') ?? 3600;
+            const url = await fileAdapter.getPresignedGetUrl(storageKey, expiresIn, fileName);
+            res.json({ url, fileId, fileName, contentType: contentType ?? null, ...(version ? { versionId, version } : {}), ...expiry(expiresIn) });
+        }
+        catch (err) {
+            res.status(500).json({ message: 'Failed to generate download URL', details: err.message });
+        }
+    });
     // ─── Per-connection file routes ───────────────────────────────────────────
     router.get('/projects/:projectId/connections/storage/:connId/upload-url', async (req, res) => {
         try {
@@ -309,7 +374,7 @@ function storageRouter(config) {
             const storageKey = `${projectId}/${category}/${fileId}${ext}`;
             const collection = getRawFilesCollection();
             if (collection) {
-                await collection.insertOne({
+                const fileDoc = {
                     _id: new mongodb_1.ObjectId(),
                     fileId,
                     projectId,
@@ -320,10 +385,13 @@ function storageRouter(config) {
                     contentType,
                     uploadedBy: auth.userId,
                     createdAt: new Date(),
-                });
+                };
+                await collection.insertOne(fileDoc);
+                await (0, assetVersions_1.recordFirstVersion)(fileDoc);
             }
-            const url = await connAdapter.getPresignedUploadUrl(storageKey, contentType);
-            res.json({ url, fileId, storageKey, displayName: fileName });
+            const expiresIn = (0, signedUrls_1.signedUrlTtl)(auth, config, 'upload');
+            const url = await connAdapter.getPresignedUploadUrl(storageKey, contentType, expiresIn);
+            res.json({ url, fileId, storageKey, displayName: fileName, ...expiry(expiresIn) });
         }
         catch (err) {
             res.status(500).json({ message: 'Failed to generate upload URL', details: err.message });
@@ -345,7 +413,7 @@ function storageRouter(config) {
             if (!collection)
                 return res.status(500).json({ message: 'Database not available' });
             const files = await collection.find(connFilter(projectId, connId, project)).sort({ createdAt: -1 }).limit(12).toArray();
-            const data = await Promise.all(files.map(f => resolveFileUrl(f, connAdapter)));
+            const data = await Promise.all(files.map(f => resolveFileUrl(f, connAdapter, (0, signedUrls_1.signedUrlTtl)(auth, config, 'download'))));
             res.json({ data });
         }
         catch (err) {
@@ -371,7 +439,7 @@ function storageRouter(config) {
             if (!collection)
                 return res.status(500).json({ message: 'Database not available' });
             const files = await collection.find(connFilter(projectId, connId, project, { category })).sort({ createdAt: -1 }).toArray();
-            const data = await Promise.all(files.map(f => resolveFileUrl(f, connAdapter)));
+            const data = await Promise.all(files.map(f => resolveFileUrl(f, connAdapter, (0, signedUrls_1.signedUrlTtl)(auth, config, 'download'))));
             res.json({ data });
         }
         catch (err) {
@@ -389,7 +457,7 @@ function storageRouter(config) {
             const project = await Project.findOne({ _id: projectId });
             if (!project)
                 return res.status(404).json({ message: 'Project not found' });
-            if (!(0, auth_1.isProjectMember)(project, auth.userId))
+            if (!(0, auth_1.canEditProject)(project, auth.userId))
                 return res.status(403).json({ message: 'Unauthorized access' });
             const collection = getRawFilesCollection();
             if (!collection)
@@ -406,9 +474,21 @@ function storageRouter(config) {
             if (!connAdapter.getPresignedUploadUrl) {
                 return res.status(501).json({ message: 'Storage adapter does not support presigned uploads' });
             }
-            const url = await connAdapter.getPresignedUploadUrl(fileDoc.storageKey, contentType);
+            // The new version goes to the asset's own key, so its URL doesn't change; the current
+            // one is archived first, and without a way to archive it nothing is replaced.
+            if (!connAdapter.copyFile)
+                return res.status(501).json({ message: 'Storage adapter cannot keep versions' });
+            let version;
+            try {
+                version = await (0, assetVersions_1.archiveCurrentVersion)(fileDoc, { fileName, contentType, userId: auth.userId }, connAdapter.copyFile.bind(connAdapter));
+            }
+            catch (err) {
+                return res.status(502).json({ message: 'Failed to archive the current version; nothing was replaced', details: err.message });
+            }
+            const expiresIn = (0, signedUrls_1.signedUrlTtl)(auth, config, 'upload');
+            const url = await connAdapter.getPresignedUploadUrl(fileDoc.storageKey, contentType, expiresIn);
             await collection.updateOne(connFilter(projectId, connId, project, { fileId }), { $set: { contentType, updatedAt: new Date() } });
-            res.json({ url, storageKey: fileDoc.storageKey, fileId });
+            res.json({ url, storageKey: fileDoc.storageKey, fileId, versionId: version.versionId, version: version.version, ...expiry(expiresIn) });
         }
         catch (err) {
             res.status(500).json({ message: 'Failed to generate replace URL', details: err.message });
@@ -457,8 +537,7 @@ function storageRouter(config) {
             const fileDoc = await collection.findOne(connFilter(projectId, connId, project, { fileId }));
             if (!fileDoc)
                 return res.status(404).json({ message: 'File not found' });
-            if (connAdapter.deleteFile)
-                await connAdapter.deleteFile(fileDoc.storageKey);
+            await deleteAsset(fileDoc, connAdapter);
             await collection.deleteOne(connFilter(projectId, connId, project, { fileId }));
             res.json({ message: 'File deleted successfully' });
         }
@@ -731,11 +810,11 @@ function storageRouter(config) {
     });
     return router;
 }
-async function resolveFileUrl(file, adapter) {
+async function resolveFileUrl(file, adapter, expiresIn) {
     let url = null;
     if (adapter.getPresignedGetUrl) {
         try {
-            url = await adapter.getPresignedGetUrl(file.storageKey);
+            url = await adapter.getPresignedGetUrl(file.storageKey, expiresIn);
         }
         catch { /* leave null */ }
     }
@@ -751,3 +830,15 @@ async function resolveFileUrl(file, adapter) {
         url,
     };
 }
+// When a signed URL stops working, for a client to know (only when it's short-lived).
+const expiry = (expiresIn) => expiresIn ? { expiresAt: new Date(Date.now() + expiresIn * 1000).toISOString() } : {};
+// An asset's files (every version), its versions and its deliverables. Its record is the
+// caller's to delete.
+async function deleteAsset(fileDoc, adapter) {
+    const keys = await (0, assetVersions_1.versionStorageKeys)(fileDoc.projectId, fileDoc.fileId, fileDoc.storageKey);
+    if (adapter.deleteFile)
+        for (const key of keys)
+            await adapter.deleteFile(key);
+    await (0, assetVersions_1.deleteVersions)(fileDoc.projectId, fileDoc.fileId);
+    await (0, deliverables_1.deleteDeliverablesOf)(fileDoc.projectId, { assetId: fileDoc.fileId });
+}

package/dist/models/Model.js

@@ -45,11 +45,11 @@ class Model {
                     // Handle members filter for SQL projects
                     const userId = processedFilter.members.$elemMatch.userId;
                     const schema = this.schema || 'streamby'; // Default to 'streamby' if schema not provided
-                    const query = `
-            SELECT p.*, pm."userId" as memberUserId, pm.role as memberRole, pm.status as memberStatus, pm.archived as memberArchived
-            FROM "${schema}"."projects" p
-            JOIN "${schema}"."project_members" pm ON p.id = pm."projectId"
-            WHERE pm."userId" = $1
+                    const query = `
+            SELECT p.*, pm."userId" as memberUserId, pm.role as memberRole, pm.status as memberStatus, pm.archived as memberArchived
+            FROM "${schema}"."projects" p
+            JOIN "${schema}"."project_members" pm ON p.id = pm."projectId"
+            WHERE pm."userId" = $1
           `;
                     const result = await connection.query(query, [userId]);
                     sqlResults = result.rows.map(row => ({
@@ -219,10 +219,10 @@ class Model {
         else {
             const matchKey = value.id !== undefined ? 'id' : Object.keys(value)[0];
             const matchVal = String(value[matchKey]);
-            await connection.query(`UPDATE ${tbl} SET "${field}" = (
-          SELECT COALESCE(jsonb_agg(elem), '[]'::jsonb)
-          FROM jsonb_array_elements("${field}") elem
-          WHERE elem->>'${matchKey}' != $1
+            await connection.query(`UPDATE ${tbl} SET "${field}" = (
+          SELECT COALESCE(jsonb_agg(elem), '[]'::jsonb)
+          FROM jsonb_array_elements("${field}") elem
+          WHERE elem->>'${matchKey}' != $1
         ) WHERE id = $2`, [matchVal, id]);
         }
     }

package/dist/services/apiConnection.d.ts

@@ -0,0 +1,18 @@
+import { StreamByConfig, ApiConnection, ApiConnectionMethod } from '../types';
+export declare function addApiConnection(config: StreamByConfig, projectId: string, data: {
+    name: string;
+    apiUrl: string;
+    method: ApiConnectionMethod;
+    prefix?: string;
+    description?: string;
+    credentialId?: string;
+}): Promise<ApiConnection>;
+export declare function updateApiConnection(config: StreamByConfig, projectId: string, connectionId: string, data: {
+    name?: string;
+    apiUrl?: string;
+    method?: ApiConnectionMethod;
+    prefix?: string;
+    description?: string;
+    credentialId?: string;
+}): Promise<ApiConnection>;
+export declare function deleteApiConnection(config: StreamByConfig, projectId: string, connectionId: string): Promise<void>;