streamby-core 0.42.0 → 0.43.1

package/dist/middleware/routes/export.js

@@ -1,7 +1,9 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.DEFAULT_NODE_SCHEMA = void 0;
 exports.exportRouter = exportRouter;
 const express_1 = require("express");
+const workflowResources_1 = require("../../services/workflowResources");
 const deliverables_1 = require("../../services/deliverables");
 const sanitize_1 = require("../../utils/sanitize");
 const manager_1 = require("../../models/manager");
@@ -11,7 +13,7 @@ const executor_1 = require("../../services/executor");
 const connectionManager_1 = require("../../adapters/database/connectionManager");
 const mongodb_1 = require("mongodb");
 const encryption_1 = require("../../utils/encryption");
-const DEFAULT_NODE_SCHEMA = {
+exports.DEFAULT_NODE_SCHEMA = {
     nodes: [
         {
             id: 'request',
@@ -251,7 +253,7 @@ function exportRouter(config) {
             if (!name) {
                 return res.status(400).json({ message: 'Missing export name' });
             }
-            const resolvedNodeSchema = nodeSchema ?? DEFAULT_NODE_SCHEMA;
+            const resolvedNodeSchema = nodeSchema ?? exports.DEFAULT_NODE_SCHEMA;
             const exportType = useConnections ? 'externalApi' : 'json';
             const project = await Project.findOne({ _id: projectId });
             if (!project || !(0, auth_1.canEditProject)(project, auth.userId)) {
@@ -260,7 +262,8 @@ function exportRouter(config) {
             const mainDb = config.databases?.find(db => db.main) ?? config.databases?.[0];
             const dbType = mainDb?.type ?? 'nosql';
             const result = await (0, export_1.createExport)(config, projectId, description, name, dbType, exportType, isPrivate, allowedOrigin, resolvedNodeSchema, useConnections, useCredentials, storageDbId);
-            res.status(201).json({ data: result, message: result.message });
+            await (0, workflowResources_1.addToWorkflow)(projectId, 'export', { id: result.exportId, name, method: 'GET' });
+            res.status(201).json({ data: result, exports: (0, sanitize_1.exportSummaries)((await Project.findOne({ _id: projectId }))?.exports), message: result.message });
         }
         catch (err) {
             res.status(500).json({ message: 'Failed to create raw export', details: err.message });
@@ -310,7 +313,8 @@ function exportRouter(config) {
             }
             await (0, export_1.deleteExport)(config, projectId, exportId, project.dbType);
             await (0, deliverables_1.deleteDeliverablesOf)(projectId, { exportId });
-            res.status(200).json({ message: 'Export deleted successfully' });
+            await (0, workflowResources_1.removeFromWorkflow)(projectId, 'export', exportId);
+            res.status(200).json({ message: 'Export deleted successfully', exports: (0, sanitize_1.exportSummaries)((await Project.findOne({ _id: projectId }))?.exports) });
         }
         catch (err) {
             res.status(500).json({ message: 'Failed to delete export', details: err.message });

package/dist/middleware/routes/member.js

@@ -157,9 +157,19 @@ function memberRouter(config) {
             if (member.status !== 'pending') {
                 return res.status(400).json({ message: 'Invitation is no longer pending' });
             }
-            const updatedMembers = project.members.map((m) => m.userId?.toString() === targetUserId ? { ...m, status: 'active' } : m);
-            await Project.update({ _id: projectId }, { members: updatedMembers });
-            await (0, notification_1.createNotification)(member.invitedBy, 'member_accepted', `${member.username} aceptó la invitación al proyecto "${project.name}"`, { projectId, userId: targetUserId });
+            if (project.dbType === 'sql') {
+                // A SQL project's members are rows of project_members, not a field of the project.
+                const connection = getSqlConnection();
+                if (!connection) {
+                    return res.status(503).json({ message: 'SQL connection not available' });
+                }
+                await sql_1.sqlAdapter.update(connection, 'project_members', { projectId, userId: targetUserId }, { status: 'active' }, 'streamby');
+            }
+            else {
+                const updatedMembers = project.members.map((m) => m.userId?.toString() === targetUserId ? { ...m, status: 'active' } : m);
+                await Project.update({ _id: projectId }, { members: updatedMembers });
+            }
+            await (0, notification_1.createNotification)(member.invitedBy, 'member_accepted', `${member.username ?? auth.username} aceptó la invitación al proyecto "${project.name}"`, { projectId, userId: targetUserId });
             res.status(200).json({ message: 'Invitation accepted' });
         }
         catch (err) {
@@ -184,8 +194,17 @@ function memberRouter(config) {
             if (member.status !== 'pending') {
                 return res.status(400).json({ message: 'Invitation is no longer pending' });
             }
-            await Project.update({ _id: projectId }, { $pull: { members: { userId: targetUserId } } });
-            await (0, notification_1.createNotification)(member.invitedBy, 'member_rejected', `${member.username} rechazó la invitación al proyecto "${project.name}"`, { projectId, userId: targetUserId });
+            if (project.dbType === 'sql') {
+                const connection = getSqlConnection();
+                if (!connection) {
+                    return res.status(503).json({ message: 'SQL connection not available' });
+                }
+                await sql_1.sqlAdapter.delete(connection, 'project_members', { projectId, userId: targetUserId }, 'streamby');
+            }
+            else {
+                await Project.update({ _id: projectId }, { $pull: { members: { userId: targetUserId } } });
+            }
+            await (0, notification_1.createNotification)(member.invitedBy, 'member_rejected', `${member.username ?? auth.username} rechazó la invitación al proyecto "${project.name}"`, { projectId, userId: targetUserId });
             res.status(200).json({ message: 'Invitation rejected' });
         }
         catch (err) {

package/dist/middleware/routes/pipeline.js

@@ -5,6 +5,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.pipelineRouter = pipelineRouter;
 const express_1 = require("express");
+const workflowResources_1 = require("../../services/workflowResources");
 const auth_1 = require("../../utils/auth");
 const connectionManager_1 = require("../../adapters/database/connectionManager");
 const manager_1 = require("../../models/manager");
@@ -86,7 +87,8 @@ function pipelineRouter(_config) {
             };
             await db.collection('pipelines').insertOne({ ...pipeline });
             await syncProjectRefs(projectId);
-            res.status(201).json({ pipeline });
+            await (0, workflowResources_1.addToWorkflow)(projectId, 'pipeline', pipeline);
+            res.status(201).json({ pipeline, pipelines: (await Project.findOne({ _id: projectId }))?.pipelines ?? [] });
         }
         catch (err) {
             res.status(500).json({ message: err.message });
@@ -161,7 +163,8 @@ function pipelineRouter(_config) {
                 return res.status(500).json({ message: 'Database not available' });
             await db.collection('pipelines').deleteOne({ id: pipelineId, projectId });
             await syncProjectRefs(projectId);
-            res.json({ message: 'Pipeline deleted' });
+            await (0, workflowResources_1.removeFromWorkflow)(projectId, 'pipeline', pipelineId);
+            res.json({ message: 'Pipeline deleted', pipelines: (await Project.findOne({ _id: projectId }))?.pipelines ?? [] });
         }
         catch (err) {
             res.status(500).json({ message: err.message });

package/dist/middleware/routes/project.js

@@ -2,12 +2,14 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.projectRouter = projectRouter;
 const express_1 = require("express");
+const workflowResources_1 = require("../../services/workflowResources");
 const manager_1 = require("../../models/manager");
 const auth_1 = require("../../utils/auth");
 const connectionManager_1 = require("../../adapters/database/connectionManager");
 const sql_1 = require("../../adapters/database/sql");
 const sanitize_1 = require("../../utils/sanitize");
 const projectIntegration_1 = require("../../services/projectIntegration");
+const projectResources_1 = require("./projectResources");
 const auth_2 = require("../../services/auth");
 const apiTokens_1 = require("../../services/apiTokens");
 const nosqlDb_1 = require("../../utils/nosqlDb");
@@ -445,18 +447,11 @@ function projectRouter(config) {
                 return res.status(404).json({ message: 'Project not found' });
             if (!(0, auth_1.canEditProject)(project, auth.userId))
                 return res.status(403).json({ message: 'Unauthorized project access' });
-            const alreadyConnected = [...(project.dbConnections ?? []), ...(project.storageConnections ?? []), ...(project.integrationConnections ?? [])]
-                .some((c) => c.integrationId === integrationId);
-            if (alreadyConnected)
-                return res.status(400).json({ message: 'This integration is already connected to the project' });
-            const result = await (0, projectIntegration_1.classifyIntegrationId)(integrationId, auth, config, projectId);
+            const result = await (0, projectIntegration_1.connectIntegration)(project, integrationId, auth, config);
             if ('error' in result)
                 return res.status(result.status).json({ message: result.error });
-            const updated = result.kind === 'database'
-                ? await Project.update({ _id: projectId }, { $push: { dbConnections: result.connection } })
-                : result.kind === 'storage'
-                    ? await Project.update({ _id: projectId }, { $push: { storageConnections: result.connection } })
-                    : await Project.update({ _id: projectId }, { $push: { integrationConnections: result.connection } });
+            await (0, workflowResources_1.addToWorkflow)(projectId, result.kind === 'database' ? 'db' : result.kind, result.connection);
+            const updated = await Project.findOne({ _id: projectId });
             if (!updated)
                 return res.status(404).json({ message: 'Project not found or not updated' });
             res.status(201).json({ data: result.connection, project: (0, sanitize_1.sanitizeProject)(updated) });
@@ -481,13 +476,20 @@ function projectRouter(config) {
             const integrationConn = (project.integrationConnections ?? []).find((c) => c.integrationId === integrationId);
             if (!dbConn && !storageConn && !integrationConn)
                 return res.status(404).json({ message: 'Integration not connected to this project' });
-            const updated = dbConn
+            const removed = dbConn
                 ? await Project.update({ _id: projectId }, { $pull: { dbConnections: { id: dbConn.id } } })
                 : storageConn
                     ? await Project.update({ _id: projectId }, { $pull: { storageConnections: { id: storageConn.id } } })
                     : await Project.update({ _id: projectId }, { $pull: { integrationConnections: { id: integrationConn.id } } });
-            if (!updated)
+            if (!removed)
                 return res.status(404).json({ message: 'Project not found or not updated' });
+            // A built-in disconnected keeps its id, to come back as it was (services/projectIntegration).
+            const builtin = [dbConn, storageConn].find(c => c?.source === 'builtin');
+            if (builtin)
+                await (0, projectResources_1.rememberDisconnectedBuiltin)(projectId, dbConn ? 'db' : 'storage', builtin);
+            const gone = dbConn ?? storageConn ?? integrationConn;
+            await (0, workflowResources_1.removeFromWorkflow)(projectId, dbConn ? 'db' : storageConn ? 'storage' : 'service', gone.id);
+            const updated = await Project.findOne({ _id: projectId });
             res.status(200).json({ message: 'Integration removed', project: (0, sanitize_1.sanitizeProject)(updated) });
         }
         catch (err) {

package/dist/middleware/routes/projectResources.d.ts

@@ -0,0 +1,8 @@
+import { Router } from 'express';
+import { StreamByConfig } from '../../types';
+export declare function projectResourcesRouter(_config: StreamByConfig): Router;
+/** A built-in disconnected: its id kept, to connect it again as it was (services/projectIntegration). */
+export declare function rememberDisconnectedBuiltin(projectId: string, kind: 'db' | 'storage', conn: {
+    id: string;
+    integrationId?: string;
+}): Promise<void>;

package/dist/middleware/routes/projectResources.js

@@ -0,0 +1,51 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.projectResourcesRouter = projectResourcesRouter;
+exports.rememberDisconnectedBuiltin = rememberDisconnectedBuiltin;
+const express_1 = require("express");
+const manager_1 = require("../../models/manager");
+const auth_1 = require("../../utils/auth");
+const dependents_1 = require("../../services/dependents");
+// A project's resources as a whole: what depends on one, asked before removing it.
+function projectResourcesRouter(_config) {
+    const router = (0, express_1.Router)();
+    const Project = (0, manager_1.getModel)('projects');
+    async function projectFor(req, res, edit = false) {
+        const auth = req.auth;
+        const project = await Project.findOne({ _id: req.params.id });
+        if (!project) {
+            res.status(404).json({ message: 'Project not found' });
+            return null;
+        }
+        if (!(edit ? auth_1.canEditProject : auth_1.isProjectMember)(project, auth.userId)) {
+            res.status(403).json({ message: 'Unauthorized project access' });
+            return null;
+        }
+        return { project, auth };
+    }
+    router.get('/projects/:id/dependents/:kind/:resourceId', async (req, res) => {
+        try {
+            const found = await projectFor(req, res);
+            if (!found)
+                return;
+            const kind = req.params.kind;
+            if (!dependents_1.RESOURCE_KINDS.includes(kind))
+                return res.status(400).json({ message: `kind is one of: ${dependents_1.RESOURCE_KINDS.join(', ')}` });
+            if (!(0, dependents_1.findResource)(found.project, kind, req.params.resourceId))
+                return res.status(404).json({ message: 'Not found in this project' });
+            res.json({ dependents: await (0, dependents_1.dependentsOf)(found.project, kind, req.params.resourceId) });
+        }
+        catch (err) {
+            res.status(500).json({ message: err.message });
+        }
+    });
+    return router;
+}
+/** A built-in disconnected: its id kept, to connect it again as it was (services/projectIntegration). */
+async function rememberDisconnectedBuiltin(projectId, kind, conn) {
+    if (!conn.integrationId)
+        return;
+    const Project = (0, manager_1.getModel)('projects');
+    await Project.update({ _id: projectId }, { $pull: { disconnectedBuiltins: { integrationId: conn.integrationId } } });
+    await Project.update({ _id: projectId }, { $push: { disconnectedBuiltins: { kind, integrationId: conn.integrationId, connectionId: conn.id } } });
+}

package/dist/middleware/routes/rights.js

@@ -3,74 +3,94 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.rightsRouter = rightsRouter;
 const express_1 = require("express");
 const auth_1 = require("../../utils/auth");
-const connectionManager_1 = require("../../adapters/database/connectionManager");
 const manager_1 = require("../../models/manager");
-function getDb() {
-    const ids = (0, connectionManager_1.getConnectedIds)().filter(id => (0, connectionManager_1.getConnection)(id).type === 'nosql');
-    if (!ids.length)
-        return null;
-    return (0, connectionManager_1.getConnection)(ids[0]).client.db();
-}
+const nosqlDb_1 = require("../../utils/nosqlDb");
+const rights_1 = require("../../services/rights");
+const documents_1 = require("../../services/documents");
+const creditsSheets_1 = require("../../services/creditsSheets");
 function rightsRouter(_config) {
     const router = (0, express_1.Router)();
     const Project = (0, manager_1.getModel)('projects');
-    // GET /projects/:projectId/assets/:assetId/rights
+    // The project, if the caller may see it (or, with `edit`, change it); otherwise the answer.
+    async function projectFor(req, res, edit = false) {
+        const auth = req.auth;
+        const project = await Project.findOne({ _id: req.params.projectId });
+        if (!project) {
+            res.status(404).json({ message: 'Project not found' });
+            return null;
+        }
+        if (!(edit ? auth_1.canEditProject : auth_1.isProjectMember)(project, auth.userId)) {
+            res.status(403).json({ message: 'Unauthorized' });
+            return null;
+        }
+        return { project, auth, projectId: String(req.params.projectId) };
+    }
     router.get('/projects/:projectId/assets/:assetId/rights', async (req, res) => {
         try {
-            const auth = req.auth;
-            const { projectId, assetId } = req.params;
-            const project = await Project.findOne({ _id: projectId });
-            if (!project)
-                return res.status(404).json({ message: 'Project not found' });
-            if (!(0, auth_1.isProjectMember)(project, auth.userId))
-                return res.status(403).json({ message: 'Unauthorized' });
-            const db = getDb();
-            if (!db)
+            const found = await projectFor(req, res);
+            if (!found)
+                return;
+            if (!(0, nosqlDb_1.nosqlDb)())
                 return res.status(500).json({ message: 'Database not available' });
-            const rights = await db.collection('asset_rights').findOne({ assetId, projectId });
-            res.json({ rights: rights ?? null });
+            res.json({ rights: await (0, rights_1.getRights)(found.projectId, req.params.assetId) });
         }
         catch (err) {
             res.status(500).json({ message: err.message });
         }
     });
-    // PUT /projects/:projectId/assets/:assetId/rights  (upsert)
+    // Sets the fields given of the asset's license metadata (who may edit the asset may).
     router.put('/projects/:projectId/assets/:assetId/rights', async (req, res) => {
         try {
-            const auth = req.auth;
-            const { projectId, assetId } = req.params;
-            const project = await Project.findOne({ _id: projectId });
-            if (!project)
-                return res.status(404).json({ message: 'Project not found' });
-            if (!(0, auth_1.canEditProject)(project, auth.userId))
-                return res.status(403).json({ message: 'Unauthorized' });
-            const db = getDb();
+            const found = await projectFor(req, res, true);
+            if (!found)
+                return;
+            const db = (0, nosqlDb_1.nosqlDb)();
             if (!db)
                 return res.status(500).json({ message: 'Database not available' });
-            const { rightsHolder, licenseType, licenseUrl, territory, expiresAt, usageRestrictions, notes } = req.body;
-            const now = new Date();
-            const payload = {
-                assetId,
-                projectId,
-                licenseType: licenseType ?? 'unknown',
-                updatedBy: auth.userId,
-                updatedAt: now,
-            };
-            if (rightsHolder !== undefined)
-                payload.rightsHolder = rightsHolder;
-            if (licenseUrl !== undefined)
-                payload.licenseUrl = licenseUrl;
-            if (territory !== undefined)
-                payload.territory = territory;
-            if (expiresAt !== undefined)
-                payload.expiresAt = expiresAt ? new Date(expiresAt) : null;
-            if (usageRestrictions !== undefined)
-                payload.usageRestrictions = usageRestrictions;
-            if (notes !== undefined)
-                payload.notes = notes;
-            await db.collection('asset_rights').updateOne({ assetId, projectId }, { $set: payload }, { upsert: true });
-            const rights = await db.collection('asset_rights').findOne({ assetId, projectId });
-            res.json({ rights });
+            const { assetId } = req.params;
+            if (!(await db.collection('storage_files').findOne({ projectId: found.projectId, fileId: assetId }))) {
+                return res.status(404).json({ message: 'Asset not found' });
+            }
+            const checked = (0, rights_1.checkRights)(req.body);
+            if ('error' in checked)
+                return res.status(400).json({ message: checked.error });
+            res.json({ rights: await (0, rights_1.saveRights)(found.project, assetId, checked.values, found.auth.userId) });
+        }
+        catch (err) {
+            res.status(500).json({ message: err.message });
+        }
+    });
+    // The project's credits sheets, each with its status (as its node shows it).
+    router.get('/projects/:projectId/credits-sheets', async (req, res) => {
+        try {
+            const found = await projectFor(req, res);
+            if (!found)
+                return;
+            const store = (0, documents_1.documentStore)();
+            const sheets = (await store.list(found.projectId)).filter(d => d.kind === 'credits');
+            const read = await Promise.all(sheets.map(async (summary) => {
+                const document = await store.get(found.projectId, summary.id);
+                if (!document)
+                    return null;
+                const { rows, status } = await (0, creditsSheets_1.readSheet)(found.project, document);
+                return { id: document.id, title: document.title, status, rows: rows.length, incomplete: rows.filter(r => r.missing.length).length };
+            }));
+            res.json({ sheets: read.filter(Boolean) });
+        }
+        catch (err) {
+            res.status(500).json({ message: err.message });
+        }
+    });
+    // A credits sheet: its rows, made now from its sources and its assets' metadata, and its status.
+    router.get('/projects/:projectId/credits-sheets/:docId', async (req, res) => {
+        try {
+            const found = await projectFor(req, res);
+            if (!found)
+                return;
+            const document = await (0, documents_1.documentStore)().get(found.projectId, req.params.docId);
+            if (!document || document.kind !== 'credits')
+                return res.status(404).json({ message: 'Credits sheet not found' });
+            res.json(await (0, creditsSheets_1.readSheet)(found.project, document));
         }
         catch (err) {
             res.status(500).json({ message: err.message });

package/dist/middleware/routes/storage.js

@@ -18,6 +18,8 @@ const crypto_1 = __importDefault(require("crypto"));
 const signedUrls_1 = require("../../services/signedUrls");
 const assetVersions_1 = require("../../services/assetVersions");
 const deliverables_1 = require("../../services/deliverables");
+const rights_1 = require("../../services/rights");
+const auth_2 = require("../../services/auth");
 const assetCategories_1 = require("../../utils/assetCategories");
 function getRawFilesCollection() {
     const model = (0, manager_1.getModel)('storage_files', 'nosql');
@@ -116,6 +118,9 @@ function storageRouter(config) {
                 return res.status(404).json({ message: 'Project not found' });
             if (!(0, auth_1.canEditProject)(project, auth.userId))
                 return res.status(403).json({ message: 'Unauthorized access' });
+            const rights = uploadRights(req, res);
+            if (rights === false)
+                return;
             if (!adapter.getPresignedUploadUrl) {
                 return res.status(501).json({ message: 'Storage adapter does not support presigned uploads' });
             }
@@ -137,6 +142,8 @@ function storageRouter(config) {
                 };
                 await collection.insertOne(fileDoc);
                 await (0, assetVersions_1.recordFirstVersion)(fileDoc);
+                if (rights)
+                    await (0, rights_1.saveRights)(project, fileId, rights, auth.userId);
             }
             const expiresIn = (0, signedUrls_1.signedUrlTtl)(auth, config, 'upload');
             const url = await adapter.getPresignedUploadUrl(storageKey, contentType, expiresIn);
@@ -233,6 +240,7 @@ function storageRouter(config) {
                 return res.status(404).json({ message: 'File not found' });
             await deleteAsset(fileDoc, adapter);
             await collection.deleteOne({ fileId, projectId });
+            (0, rights_1.broadcastRights)(project, { action: 'deleted', assetIds: [fileId] });
             res.json({ message: 'File deleted successfully' });
         }
         catch (err) {
@@ -350,6 +358,9 @@ function storageRouter(config) {
                 return res.status(404).json({ message: 'Project not found' });
             if (!(0, auth_1.canEditProject)(project, auth.userId))
                 return res.status(403).json({ message: 'Unauthorized access' });
+            const rights = uploadRights(req, res);
+            if (rights === false)
+                return;
             const connAdapter = await resolveConnAdapter(connId, project, auth);
             if ('error' in connAdapter)
                 return res.status(connAdapter.status).json({ message: connAdapter.error });
@@ -374,6 +385,8 @@ function storageRouter(config) {
                 };
                 await collection.insertOne(fileDoc);
                 await (0, assetVersions_1.recordFirstVersion)(fileDoc);
+                if (rights)
+                    await (0, rights_1.saveRights)(project, fileId, rights, auth.userId);
             }
             const expiresIn = (0, signedUrls_1.signedUrlTtl)(auth, config, 'upload');
             const url = await connAdapter.getPresignedUploadUrl(storageKey, contentType, expiresIn);
@@ -525,6 +538,7 @@ function storageRouter(config) {
                 return res.status(404).json({ message: 'File not found' });
             await deleteAsset(fileDoc, connAdapter);
             await collection.deleteOne(connFilter(projectId, connId, project, { fileId }));
+            (0, rights_1.broadcastRights)(project, { action: 'deleted', assetIds: [fileId] });
             res.json({ message: 'File deleted successfully' });
         }
         catch (err) {
@@ -818,8 +832,26 @@ async function resolveFileUrl(file, adapter, expiresIn) {
 }
 // When a signed URL stops working, for a client to know (only when it's short-lived).
 const expiry = (expiresIn) => expiresIn ? { expiresAt: new Date(Date.now() + expiresIn * 1000).toISOString() } : {};
-// An asset's files (every version), its versions and its deliverables. Its record is the
-// caller's to delete.
+// The license metadata given with an upload (licenseType, sourceUrl, creatorName, creatorUrl,
+// comments as query params), checked: null if none, false if it was refused (and answered).
+// An API token sets it only with rights:write.
+function uploadRights(req, res) {
+    const checked = (0, rights_1.rightsFromQuery)(req.query);
+    if (!checked)
+        return null;
+    const auth = req.auth;
+    if (auth.apiToken && !(0, auth_2.tokenAllows)(auth.apiToken, 'rights:write')) {
+        res.status(403).json({ error: "This API token doesn't have the 'rights:write' permission" });
+        return false;
+    }
+    if ('error' in checked) {
+        res.status(400).json({ message: checked.error });
+        return false;
+    }
+    return checked.values;
+}
+// An asset's files (every version), its versions, its deliverables and its license metadata.
+// Its record is the caller's to delete.
 async function deleteAsset(fileDoc, adapter) {
     const keys = await (0, assetVersions_1.versionStorageKeys)(fileDoc.projectId, fileDoc.fileId, fileDoc.storageKey);
     if (adapter.deleteFile)
@@ -827,4 +859,5 @@ async function deleteAsset(fileDoc, adapter) {
             await adapter.deleteFile(key);
     await (0, assetVersions_1.deleteVersions)(fileDoc.projectId, fileDoc.fileId);
     await (0, deliverables_1.deleteDeliverablesOf)(fileDoc.projectId, { assetId: fileDoc.fileId });
+    await (0, rights_1.deleteRightsOf)(fileDoc.projectId, fileDoc.fileId);
 }

package/dist/middleware/routes/storageConnection.js

@@ -2,16 +2,29 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.storageConnectionRouter = storageConnectionRouter;
 const express_1 = require("express");
+const workflowResources_1 = require("../../services/workflowResources");
 const mongodb_1 = require("mongodb");
 const manager_1 = require("../../models/manager");
 const auth_1 = require("../../utils/auth");
 const builtinAccess_1 = require("../../utils/builtinAccess");
 const sanitize_1 = require("../../utils/sanitize");
 const encryption_1 = require("../../utils/encryption");
+const projectResources_1 = require("./projectResources");
+const projectIntegration_1 = require("../../services/projectIntegration");
 const VALID_STORAGE_TYPES = ['s3', 'gcs', 'r2', 'azure'];
 function storageConnectionRouter(config) {
     const router = (0, express_1.Router)();
     const Project = (0, manager_1.getModel)('projects');
+    // The project's storage connections as they're answered, by the list and after each change.
+    // Availability is recomputed live for builtins — never trust a stored flag, per "validate on
+    // every use" (TCORE-69). BYOC (source: 'integration') is always available.
+    const listOf = (project, auth) => Promise.all((project.storageConnections || []).map(async (conn) => {
+        if (conn.source !== 'builtin')
+            return (0, sanitize_1.sanitizeConnection)(conn);
+        const available = await (0, builtinAccess_1.assertBuiltinAccess)(auth, conn.integrationId ?? conn.id, config, 'storage');
+        return (0, sanitize_1.sanitizeConnection)({ ...conn, isBuiltin: true, available });
+    }));
+    const listNow = async (projectId, auth) => listOf(await Project.findOne({ _id: projectId }), auth);
     // ─── List storage connections ─────────────────────────────────────────────
     router.get('/projects/:id/connections/storage', async (req, res) => {
         try {
@@ -21,16 +34,7 @@ function storageConnectionRouter(config) {
                 return res.status(404).json({ message: 'Project not found' });
             if (!(0, auth_1.isProjectMember)(project, auth.userId))
                 return res.status(403).json({ message: 'Unauthorized project access' });
-            const connections = project.storageConnections || [];
-            // Recompute availability live for builtins — never trust a stored flag, per
-            // "validate on every use" (TCORE-69). BYOC (source: 'integration') is always available.
-            const data = await Promise.all(connections.map(async (conn) => {
-                if (conn.source !== 'builtin')
-                    return (0, sanitize_1.sanitizeConnection)(conn);
-                const available = await (0, builtinAccess_1.assertBuiltinAccess)(auth, conn.integrationId ?? conn.id, config, 'storage');
-                return (0, sanitize_1.sanitizeConnection)({ ...conn, isBuiltin: true, available });
-            }));
-            return res.status(200).json({ data });
+            return res.status(200).json({ data: await listOf(project, auth) });
         }
         catch (err) {
             res.status(500).json({ message: 'Failed to fetch storage connections', details: err.message });
@@ -41,6 +45,22 @@ function storageConnectionRouter(config) {
         try {
             const auth = req.auth;
             const { name, type, credential, integrationId, description } = req.body;
+            if (credential && integrationId) {
+                return res.status(400).json({ message: 'Provide only one of credential or integrationId' });
+            }
+            // An integration (the user's, or a built-in) is a named, typed storage already.
+            if (integrationId) {
+                const project = await Project.findOne({ _id: req.params.id });
+                if (!project)
+                    return res.status(404).json({ message: 'Project not found' });
+                if (!(0, auth_1.canEditProject)(project, auth.userId))
+                    return res.status(403).json({ message: 'Unauthorized project access' });
+                const result = await (0, projectIntegration_1.connectIntegration)(project, integrationId, auth, config, { kind: 'storage', description });
+                if ('error' in result)
+                    return res.status(result.status).json({ message: result.error });
+                await (0, workflowResources_1.addToWorkflow)(req.params.id, 'storage', result.connection);
+                return res.status(201).json({ data: (0, sanitize_1.sanitizeConnection)(result.connection), storageConnections: await listNow(req.params.id, auth) });
+            }
             if (!name || !type) {
                 return res.status(400).json({ message: 'name and type are required' });
             }
@@ -84,7 +104,8 @@ function storageConnectionRouter(config) {
                 ...(description !== undefined && { description }),
             };
             await Project.update({ _id: req.params.id }, { $push: { storageConnections: connection } });
-            return res.status(201).json({ data: (0, sanitize_1.sanitizeConnection)(connection) });
+            await (0, workflowResources_1.addToWorkflow)(req.params.id, 'storage', connection);
+            return res.status(201).json({ data: (0, sanitize_1.sanitizeConnection)(connection), storageConnections: await listNow(req.params.id, auth) });
         }
         catch (err) {
             res.status(500).json({ message: 'Failed to add storage connection', details: err.message });
@@ -103,11 +124,13 @@ function storageConnectionRouter(config) {
             const conn = project.storageConnections?.find((c) => c.id === connId);
             if (!conn)
                 return res.status(404).json({ message: 'Storage connection not found' });
-            if (conn.source === 'builtin') {
-                return res.status(403).json({ message: 'Cannot delete a built-in storage connection' });
-            }
+            // A built-in is disconnected, not deleted: its files stay in it, and it can be connected
+            // again with them (routes/projectResources).
             await Project.update({ _id: req.params.id }, { $pull: { storageConnections: { id: connId } } });
-            return res.status(200).json({ message: 'Storage connection deleted successfully' });
+            if (conn.source === 'builtin')
+                await (0, projectResources_1.rememberDisconnectedBuiltin)(req.params.id, 'storage', conn);
+            await (0, workflowResources_1.removeFromWorkflow)(req.params.id, 'storage', connId);
+            return res.status(200).json({ message: 'Storage connection deleted successfully', storageConnections: await listNow(req.params.id, auth) });
         }
         catch (err) {
             res.status(500).json({ message: 'Failed to delete storage connection', details: err.message });