@mastra/auth-better-auth 1.1.2-alpha.2 → 1.1.3-alpha.0

package/CHANGELOG.md

@@ -1,5 +1,48 @@
 # @mastra/auth-better-auth
 
+## 1.1.3-alpha.0
+
+### Patch Changes
+
+- dependencies updates: ([#20162](https://github.com/mastra-ai/mastra/pull/20162))
+  - Updated dependency [`better-auth@^1.6.23` ↗︎](https://www.npmjs.com/package/better-auth/v/1.6.23) (from `^1.6.13`, in `dependencies`)
+
+## 1.1.2
+
+### Patch Changes
+
+- Added a deferred instance mode and organization management to MastraAuthBetterAuth so it can be passed directly to a server host without a wrapper adapter. The provider can now be constructed with just a secret and will build its Better Auth instance (including running migrations) against the host database during init. It also bootstraps a personal organization for new users (ensureOrganization), checks organization admin roles (isOrganizationAdmin), and exposes the Better Auth HTTP handler (handleAuthRequest) so hosts can mount it under /auth/api/*. ([#19765](https://github.com/mastra-ai/mastra/pull/19765))
+
+  **Before**
+
+  ```ts
+  import { betterAuth } from 'better-auth';
+  import { MastraAuthBetterAuth } from '@mastra/auth-better-auth';
+
+  const auth = new MastraAuthBetterAuth({ auth: betterAuth({/* ... */}) });
+  ```
+
+  **After** (bring-your-own instance still works)
+
+  ```ts
+  import { MastraAuthBetterAuth } from '@mastra/auth-better-auth';
+
+  const auth = new MastraAuthBetterAuth({ secret: process.env.BETTER_AUTH_SECRET! });
+  // host calls auth.init({ database, publicUrl, allowedOrigins }) during startup
+  ```
+
+- Updated the minimum better-auth version to 1.6.13 to pull in the fix for a stored cross-site scripting vulnerability in better-auth's OIDC provider and MCP plugins (GHSA-86j7-9j95-vpqj). ([#19584](https://github.com/mastra-ai/mastra/pull/19584))
+
+- Fixed Better Auth bearer token authentication and implemented user lookup in `@mastra/auth-better-auth` (fixes [#19110](https://github.com/mastra-ai/mastra/issues/19110)). ([#19629](https://github.com/mastra-ai/mastra/pull/19629))
+
+  **Bearer tokens now work after credentials sign-in**
+
+  `signIn`/`signUp` return Better Auth's raw session token, but Better Auth only accepts _signed_ session cookies. Sending that token as `Authorization: Bearer <token>` previously always failed authentication. The provider now signs unsigned tokens with the Better Auth secret before verifying the session — matching the semantics of Better Auth's bearer plugin. The session cookie name is also resolved from the Better Auth instance, so secure-cookie setups (`__Secure-` prefix) work too.
+
+  **`getUser()` and `getUsers()` are now implemented**
+
+  Previously `getUser()` was a stub that always returned `null`, breaking Studio user lookup and author enrichment. It now resolves users by ID through Better Auth's internal database adapter, and `getUsers()` supports batch lookups.
+
 ## 1.1.2-alpha.2
 
 ### Patch Changes

package/dist/_types/@internal_auth/dist/_types/@internal_core/dist/base/index.d.ts

@@ -1,31 +1,31 @@
-import { RegisteredLogger, IMastraLogger } from '../logger/index.js';
-import 'node:stream';
-
+import { i as IMastraLogger, u as RegisteredLogger } from "../index-S1lgaKO7.js";
+//#region src/base/MastraBase.d.ts
 declare class MastraBase {
-    #private;
-    component: RegisteredLogger;
-    protected logger: IMastraLogger;
+  #private;
+  component: RegisteredLogger;
+  protected logger: IMastraLogger;
+  name?: string;
+  constructor({ component, name, rawConfig }: {
+    component?: RegisteredLogger;
     name?: string;
-    constructor({ component, name, rawConfig, }: {
-        component?: RegisteredLogger;
-        name?: string;
-        rawConfig?: Record<string, unknown>;
-    });
-    /**
-     * Returns the raw storage configuration this primitive was created from,
-     * or undefined if it was created from code.
-     */
-    toRawConfig(): Record<string, unknown> | undefined;
-    /**
-     * Sets the raw storage configuration for this primitive.
-     * @internal
-     */
-    __setRawConfig(rawConfig: Record<string, unknown>): void;
-    /**
-     * Set the logger for the agent
-     * @param logger
-     */
-    __setLogger(logger: IMastraLogger): void;
+    rawConfig?: Record<string, unknown>;
+  });
+  /**
+   * Returns the raw storage configuration this primitive was created from,
+   * or undefined if it was created from code.
+   */
+  toRawConfig(): Record<string, unknown> | undefined;
+  /**
+   * Sets the raw storage configuration for this primitive.
+   * @internal
+   */
+  __setRawConfig(rawConfig: Record<string, unknown>): void;
+  /**
+   * Set the logger for the agent
+   * @param logger
+   */
+  __setLogger(logger: IMastraLogger): void;
 }
-
+//#endregion
 export { MastraBase };
+//# sourceMappingURL=index.d.ts.map

package/dist/_types/@internal_auth/dist/_types/@internal_core/dist/index-S1lgaKO7.d.ts

@@ -0,0 +1,218 @@
+import { Transform } from "stream";
+//#region src/logger/index.d.ts
+declare const RegisteredLogger: {
+  readonly AGENT: "AGENT";
+  readonly OBSERVABILITY: "OBSERVABILITY";
+  readonly AUTH: "AUTH";
+  readonly BROWSER: "BROWSER";
+  readonly NETWORK: "NETWORK";
+  readonly WORKFLOW: "WORKFLOW";
+  readonly LLM: "LLM";
+  readonly TTS: "TTS";
+  readonly VOICE: "VOICE";
+  readonly VECTOR: "VECTOR";
+  readonly BUNDLER: "BUNDLER";
+  readonly DEPLOYER: "DEPLOYER";
+  readonly MEMORY: "MEMORY";
+  readonly STORAGE: "STORAGE";
+  readonly EMBEDDINGS: "EMBEDDINGS";
+  readonly MCP_SERVER: "MCP_SERVER";
+  readonly SERVER_CACHE: "SERVER_CACHE";
+  readonly SERVER: "SERVER";
+  readonly WORKSPACE: "WORKSPACE";
+  readonly CHANNEL: "CHANNEL";
+};
+type RegisteredLogger = (typeof RegisteredLogger)[keyof typeof RegisteredLogger];
+declare const LogLevel: {
+  readonly DEBUG: "debug";
+  readonly INFO: "info";
+  readonly WARN: "warn";
+  readonly ERROR: "error";
+  readonly NONE: "silent";
+};
+type LogLevel = (typeof LogLevel)[keyof typeof LogLevel];
+interface BaseLogMessage {
+  runId?: string;
+  msg: string;
+  level: LogLevel;
+  time: Date;
+  pid: number;
+  hostname: string;
+  name: string;
+}
+declare abstract class LoggerTransport extends Transform {
+  constructor(opts?: any);
+  listLogsByRunId(_args: {
+    runId: string;
+    fromDate?: Date;
+    toDate?: Date;
+    logLevel?: LogLevel;
+    filters?: Record<string, any>;
+    page?: number;
+    perPage?: number;
+  }): Promise<{
+    logs: BaseLogMessage[];
+    total: number;
+    page: number;
+    perPage: number;
+    hasMore: boolean;
+  }>;
+  listLogs(_args?: {
+    fromDate?: Date;
+    toDate?: Date;
+    logLevel?: LogLevel;
+    filters?: Record<string, any>;
+    returnPaginationResults?: boolean;
+    page?: number;
+    perPage?: number;
+  }): Promise<{
+    logs: BaseLogMessage[];
+    total: number;
+    page: number;
+    perPage: number;
+    hasMore: boolean;
+  }>;
+}
+declare const createCustomTransport: (stream: Transform, listLogs?: LoggerTransport["listLogs"], listLogsByRunId?: LoggerTransport["listLogsByRunId"]) => LoggerTransport;
+interface IMastraLogger {
+  debug(message: string, ...args: any[]): void;
+  info(message: string, ...args: any[]): void;
+  warn(message: string, ...args: any[]): void;
+  error(message: string, ...args: any[]): void;
+  trackException(error: Error, metadata?: Record<string, unknown>): void;
+  getTransports(): Map<string, LoggerTransport>;
+  listLogs(_transportId: string, _params?: {
+    fromDate?: Date;
+    toDate?: Date;
+    logLevel?: LogLevel;
+    filters?: Record<string, any>;
+    page?: number;
+    perPage?: number;
+  }): Promise<{
+    logs: BaseLogMessage[];
+    total: number;
+    page: number;
+    perPage: number;
+    hasMore: boolean;
+  }>;
+  listLogsByRunId(_args: {
+    transportId: string;
+    runId: string;
+    fromDate?: Date;
+    toDate?: Date;
+    logLevel?: LogLevel;
+    filters?: Record<string, any>;
+    page?: number;
+    perPage?: number;
+  }): Promise<{
+    logs: BaseLogMessage[];
+    total: number;
+    page: number;
+    perPage: number;
+    hasMore: boolean;
+  }>;
+}
+declare abstract class MastraLogger implements IMastraLogger {
+  protected name: string;
+  protected level: LogLevel;
+  protected transports: Map<string, LoggerTransport>;
+  constructor(options?: {
+    name?: string;
+    level?: LogLevel;
+    transports?: Record<string, LoggerTransport>;
+  });
+  abstract debug(message: string, ...args: any[]): void;
+  abstract info(message: string, ...args: any[]): void;
+  abstract warn(message: string, ...args: any[]): void;
+  abstract error(message: string, ...args: any[]): void;
+  getTransports(): Map<string, LoggerTransport>;
+  trackException(_error: Error, _metadata?: Record<string, unknown>): void;
+  listLogs(transportId: string, params?: {
+    fromDate?: Date;
+    toDate?: Date;
+    logLevel?: LogLevel;
+    filters?: Record<string, any>;
+    page?: number;
+    perPage?: number;
+  }): Promise<{
+    logs: BaseLogMessage[];
+    total: number;
+    page: number;
+    perPage: number;
+    hasMore: boolean;
+  }>;
+  listLogsByRunId({ transportId, runId, fromDate, toDate, logLevel, filters, page, perPage }: {
+    transportId: string;
+    runId: string;
+    fromDate?: Date;
+    toDate?: Date;
+    logLevel?: LogLevel;
+    filters?: Record<string, any>;
+    page?: number;
+    perPage?: number;
+  }): Promise<{
+    logs: BaseLogMessage[];
+    total: number;
+    page: number;
+    perPage: number;
+    hasMore: boolean;
+  }>;
+}
+type LogFilterContext = {
+  component?: RegisteredLogger;
+  level: LogLevel;
+  message: string;
+  args: unknown[];
+};
+type LogFilter = (ctx: LogFilterContext) => boolean;
+interface ConsoleLoggerOptions {
+  name?: string;
+  level?: LogLevel;
+  component?: RegisteredLogger;
+  filter?: LogFilter;
+}
+declare class ConsoleLogger extends MastraLogger {
+  protected component?: RegisteredLogger;
+  protected filter?: LogFilter;
+  constructor(options?: ConsoleLoggerOptions);
+  child(componentOrBindings: RegisteredLogger | Record<string, unknown>): ConsoleLogger;
+  private shouldLog;
+  private prefix;
+  debug(message: string, ...args: any[]): void;
+  info(message: string, ...args: any[]): void;
+  warn(message: string, ...args: any[]): void;
+  error(message: string, ...args: any[]): void;
+  listLogs(_transportId: string, _params?: {
+    fromDate?: Date;
+    toDate?: Date;
+    logLevel?: LogLevel;
+    filters?: Record<string, any>;
+    page?: number;
+    perPage?: number;
+  }): Promise<{
+    logs: never[];
+    total: number;
+    page: number;
+    perPage: number;
+    hasMore: boolean;
+  }>;
+  listLogsByRunId(_args: {
+    transportId: string;
+    runId: string;
+    fromDate?: Date;
+    toDate?: Date;
+    logLevel?: LogLevel;
+    filters?: Record<string, any>;
+    page?: number;
+    perPage?: number;
+  }): Promise<{
+    logs: never[];
+    total: number;
+    page: number;
+    perPage: number;
+    hasMore: boolean;
+  }>;
+}
+//#endregion
+export { LogFilter as a, LoggerTransport as c, createCustomTransport as d, IMastraLogger as i, MastraLogger as l, ConsoleLogger as n, LogFilterContext as o, ConsoleLoggerOptions as r, LogLevel as s, BaseLogMessage as t, RegisteredLogger as u };
+//# sourceMappingURL=index-S1lgaKO7.d.ts.map

package/dist/_types/@internal_auth/dist/ee/interfaces/permissions.generated.d.ts

@@ -10,7 +10,7 @@
  * All known API resources.
  * Derived from SERVER_ROUTES paths in @mastra/server.
  */
-export declare const RESOURCES: readonly ["a2a", "agent-builder", "agent-controller", "agents", "auth", "background-tasks", "channels", "datasets", "embedders", "experiments", "infrastructure", "logs", "mcp", "memory", "observability", "processor-providers", "processors", "schedules", "scores", "stored-agents", "stored-mcp-clients", "stored-prompt-blocks", "stored-scorers", "stored-skills", "stored-workspaces", "system", "tool-providers", "tools", "vector", "vectors", "workflows", "workspaces"];
+export declare const RESOURCES: readonly ["a2a", "agent-builder", "agent-controller", "agents", "auth", "background-tasks", "channels", "datasets", "embedders", "experiments", "infrastructure", "logs", "mcp", "memory", "observability", "processor-providers", "processors", "schedules", "scores", "stored-agents", "stored-mcp-clients", "stored-prompt-blocks", "stored-scorers", "stored-skills", "stored-workflows", "stored-workspaces", "system", "tool-providers", "tools", "vector", "vectors", "workflows", "workspaces"];
 /**
  * Resource type union.
  */
@@ -98,6 +98,8 @@ export declare const PERMISSION_PATTERNS: {
     readonly 'stored-scorers:*': "stored-scorers:*";
     /** Full access to stored skills */
     readonly 'stored-skills:*': "stored-skills:*";
+    /** Full access to stored workflows */
+    readonly 'stored-workflows:*': "stored-workflows:*";
     /** Full access to stored workspaces */
     readonly 'stored-workspaces:*': "stored-workspaces:*";
     /** Full access to system info */
@@ -238,6 +240,10 @@ export declare const PERMISSION_PATTERNS: {
     readonly 'stored-skills:read': "stored-skills:read";
     /** Create and modify stored skills */
     readonly 'stored-skills:write': "stored-skills:write";
+    /** View stored workflows */
+    readonly 'stored-workflows:read': "stored-workflows:read";
+    /** Create and modify stored workflows */
+    readonly 'stored-workflows:write': "stored-workflows:write";
     /** Delete stored workspaces */
     readonly 'stored-workspaces:delete': "stored-workspaces:delete";
     /** View stored workspaces */
@@ -305,7 +311,7 @@ export type PermissionPattern = keyof typeof PERMISSION_PATTERNS;
 /**
  * All valid resource:action permission combinations (excludes wildcards).
  */
-export declare const PERMISSIONS: readonly ["a2a:read", "a2a:write", "agent-builder:execute", "agent-builder:read", "agent-builder:write", "agent-controller:execute", "agent-controller:read", "agents:create", "agents:delete", "agents:execute", "agents:read", "agents:write", "auth:read", "background-tasks:read", "channels:read", "channels:write", "datasets:delete", "datasets:execute", "datasets:read", "datasets:write", "embedders:read", "experiments:read", "infrastructure:read", "logs:read", "mcp:execute", "mcp:read", "mcp:write", "memory:delete", "memory:execute", "memory:read", "memory:write", "observability:read", "observability:write", "processor-providers:read", "processors:execute", "processors:read", "schedules:delete", "schedules:execute", "schedules:read", "schedules:write", "scores:read", "scores:write", "stored-agents:delete", "stored-agents:publish", "stored-agents:read", "stored-agents:write", "stored-mcp-clients:delete", "stored-mcp-clients:publish", "stored-mcp-clients:read", "stored-mcp-clients:write", "stored-prompt-blocks:delete", "stored-prompt-blocks:publish", "stored-prompt-blocks:read", "stored-prompt-blocks:write", "stored-scorers:delete", "stored-scorers:publish", "stored-scorers:read", "stored-scorers:write", "stored-skills:delete", "stored-skills:publish", "stored-skills:read", "stored-skills:write", "stored-workspaces:delete", "stored-workspaces:read", "stored-workspaces:write", "system:read", "tool-providers:delete", "tool-providers:read", "tool-providers:write", "tools:execute", "tools:read", "vector:delete", "vector:execute", "vector:read", "vector:write", "vectors:read", "workflows:delete", "workflows:execute", "workflows:read", "workflows:write", "workspaces:delete", "workspaces:read", "workspaces:write"];
+export declare const PERMISSIONS: readonly ["a2a:read", "a2a:write", "agent-builder:execute", "agent-builder:read", "agent-builder:write", "agent-controller:execute", "agent-controller:read", "agents:create", "agents:delete", "agents:execute", "agents:read", "agents:write", "auth:read", "background-tasks:read", "channels:read", "channels:write", "datasets:delete", "datasets:execute", "datasets:read", "datasets:write", "embedders:read", "experiments:read", "infrastructure:read", "logs:read", "mcp:execute", "mcp:read", "mcp:write", "memory:delete", "memory:execute", "memory:read", "memory:write", "observability:read", "observability:write", "processor-providers:read", "processors:execute", "processors:read", "schedules:delete", "schedules:execute", "schedules:read", "schedules:write", "scores:read", "scores:write", "stored-agents:delete", "stored-agents:publish", "stored-agents:read", "stored-agents:write", "stored-mcp-clients:delete", "stored-mcp-clients:publish", "stored-mcp-clients:read", "stored-mcp-clients:write", "stored-prompt-blocks:delete", "stored-prompt-blocks:publish", "stored-prompt-blocks:read", "stored-prompt-blocks:write", "stored-scorers:delete", "stored-scorers:publish", "stored-scorers:read", "stored-scorers:write", "stored-skills:delete", "stored-skills:publish", "stored-skills:read", "stored-skills:write", "stored-workflows:read", "stored-workflows:write", "stored-workspaces:delete", "stored-workspaces:read", "stored-workspaces:write", "system:read", "tool-providers:delete", "tool-providers:read", "tool-providers:write", "tools:execute", "tools:read", "vector:delete", "vector:execute", "vector:read", "vector:write", "vectors:read", "workflows:delete", "workflows:execute", "workflows:read", "workflows:write", "workspaces:delete", "workspaces:read", "workspaces:write"];
 /**
  * Specific permission type (e.g., 'agents:read', 'workflows:execute').
  */
@@ -441,6 +447,10 @@ export declare const MastraFGAPermissions: {
     readonly STORED_SKILLS_READ: "stored-skills:read";
     /** Create and modify stored skills */
     readonly STORED_SKILLS_WRITE: "stored-skills:write";
+    /** View stored workflows */
+    readonly STORED_WORKFLOWS_READ: "stored-workflows:read";
+    /** Create and modify stored workflows */
+    readonly STORED_WORKFLOWS_WRITE: "stored-workflows:write";
     /** Delete stored workspaces */
     readonly STORED_WORKSPACES_DELETE: "stored-workspaces:delete";
     /** View stored workspaces */