@mastra/auth-cloud 1.2.0 → 1.2.1

package/dist/index.cjs

@@ -1,8 +1,6 @@
 'use strict';
 
 var crypto$1 = require('crypto');
-var server = require('@mastra/core/server');
-var ee = require('@mastra/core/auth/ee');
 
 // src/error.ts
 var AuthError = class _AuthError extends Error {
@@ -466,13 +464,196 @@ var MastraCloudAuth = class {
     return clearSessionCookie();
   }
 };
-function getRequestHeader(request, name) {
+
+// ../../packages/_internal-core/dist/chunk-3M4SEWMI.js
+var RegisteredLogger = {
+  LLM: "LLM"};
+var LogLevel = {
+  DEBUG: "debug",
+  INFO: "info",
+  WARN: "warn",
+  ERROR: "error"};
+var MastraLogger = class {
+  name;
+  level;
+  transports;
+  constructor(options = {}) {
+    this.name = options.name || "Mastra";
+    this.level = options.level || LogLevel.ERROR;
+    this.transports = new Map(Object.entries(options.transports || {}));
+  }
+  getTransports() {
+    return this.transports;
+  }
+  trackException(_error, _metadata) {
+  }
+  async listLogs(transportId, params) {
+    if (!transportId || !this.transports.has(transportId)) {
+      return { logs: [], total: 0, page: params?.page ?? 1, perPage: params?.perPage ?? 100, hasMore: false };
+    }
+    return this.transports.get(transportId).listLogs?.(params) ?? {
+      logs: [],
+      total: 0,
+      page: params?.page ?? 1,
+      perPage: params?.perPage ?? 100,
+      hasMore: false
+    };
+  }
+  async listLogsByRunId({
+    transportId,
+    runId,
+    fromDate,
+    toDate,
+    logLevel,
+    filters,
+    page,
+    perPage
+  }) {
+    if (!transportId || !this.transports.has(transportId) || !runId) {
+      return { logs: [], total: 0, page: page ?? 1, perPage: perPage ?? 100, hasMore: false };
+    }
+    return this.transports.get(transportId).listLogsByRunId?.({ runId, fromDate, toDate, logLevel, filters, page, perPage }) ?? {
+      logs: [],
+      total: 0,
+      page: page ?? 1,
+      perPage: perPage ?? 100,
+      hasMore: false
+    };
+  }
+};
+var ConsoleLogger = class _ConsoleLogger extends MastraLogger {
+  component;
+  filter;
+  constructor(options = {}) {
+    super(options);
+    this.component = options.component;
+    this.filter = options.filter;
+  }
+  child(componentOrBindings) {
+    const component = typeof componentOrBindings === "string" ? componentOrBindings : componentOrBindings?.component ?? this.component;
+    return new _ConsoleLogger({
+      name: this.name,
+      level: this.level,
+      component,
+      filter: this.filter
+    });
+  }
+  shouldLog(level, message, args) {
+    if (!this.filter) return true;
+    try {
+      return this.filter({ component: this.component, level, message, args });
+    } catch (e) {
+      console.error(`[Logger] Filter error for component=${this.component} level=${level}:`, e);
+      return true;
+    }
+  }
+  prefix() {
+    return this.component ? `[${this.component}] ` : "";
+  }
+  debug(message, ...args) {
+    if (this.level === LogLevel.DEBUG && this.shouldLog(LogLevel.DEBUG, message, args)) {
+      console.info(`${this.prefix()}${message}`, ...args);
+    }
+  }
+  info(message, ...args) {
+    if ((this.level === LogLevel.INFO || this.level === LogLevel.DEBUG) && this.shouldLog(LogLevel.INFO, message, args)) {
+      console.info(`${this.prefix()}${message}`, ...args);
+    }
+  }
+  warn(message, ...args) {
+    if ((this.level === LogLevel.WARN || this.level === LogLevel.INFO || this.level === LogLevel.DEBUG) && this.shouldLog(LogLevel.WARN, message, args)) {
+      console.warn(`${this.prefix()}${message}`, ...args);
+    }
+  }
+  error(message, ...args) {
+    if ((this.level === LogLevel.ERROR || this.level === LogLevel.WARN || this.level === LogLevel.INFO || this.level === LogLevel.DEBUG) && this.shouldLog(LogLevel.ERROR, message, args)) {
+      console.error(`${this.prefix()}${message}`, ...args);
+    }
+  }
+  async listLogs(_transportId, _params) {
+    return { logs: [], total: 0, page: _params?.page ?? 1, perPage: _params?.perPage ?? 100, hasMore: false };
+  }
+  async listLogsByRunId(_args) {
+    return { logs: [], total: 0, page: _args.page ?? 1, perPage: _args.perPage ?? 100, hasMore: false };
+  }
+};
+
+// ../../packages/_internal-core/dist/base/index.js
+var MastraBase = class {
+  component = RegisteredLogger.LLM;
+  logger;
+  name;
+  #rawConfig;
+  constructor({
+    component,
+    name,
+    rawConfig
+  }) {
+    this.component = component || RegisteredLogger.LLM;
+    this.name = name;
+    this.#rawConfig = rawConfig;
+    this.logger = new ConsoleLogger({ name: `${this.component} - ${this.name}` });
+  }
+  /**
+   * Returns the raw storage configuration this primitive was created from,
+   * or undefined if it was created from code.
+   */
+  toRawConfig() {
+    return this.#rawConfig;
+  }
+  /**
+   * Sets the raw storage configuration for this primitive.
+   * @internal
+   */
+  __setRawConfig(rawConfig) {
+    this.#rawConfig = rawConfig;
+  }
+  /**
+   * Set the logger for the agent
+   * @param logger
+   */
+  __setLogger(logger) {
+    this.logger = "child" in logger && typeof logger.child === "function" ? logger.child({ component: this.component }) : logger;
+  }
+};
+
+// ../../packages/_internals/auth/dist/chunk-XG6GH2VJ.js
+var MastraAuthProvider = class extends MastraBase {
+  protected;
+  public;
+  constructor(options) {
+    super({ component: "AUTH", name: options?.name });
+    if (options?.authorizeUser) {
+      this.authorizeUser = options.authorizeUser.bind(this);
+    }
+    this.protected = options?.protected;
+    this.public = options?.public;
+    this.mapUserToResourceId = options?.mapUserToResourceId;
+  }
+  registerOptions(opts) {
+    if (opts?.authorizeUser) {
+      this.authorizeUser = opts.authorizeUser.bind(this);
+    }
+    if (opts?.mapUserToResourceId) {
+      this.mapUserToResourceId = opts.mapUserToResourceId;
+    }
+    if (opts?.protected) {
+      this.protected = opts.protected;
+    }
+    if (opts?.public) {
+      this.public = opts.public;
+    }
+  }
+};
+
+// src/auth-provider.ts
+function getRequestHeader2(request, name) {
   if (request instanceof Request) {
     return request.headers.get(name);
   }
   return request.raw?.headers.get(name) ?? request.headers?.get(name) ?? request.header(name) ?? null;
 }
-var MastraCloudAuthProvider = class extends server.MastraAuthProvider {
+var MastraCloudAuthProvider = class extends MastraAuthProvider {
   client;
   /** Marker for EE license exemption - MastraCloudAuth is exempt */
   isMastraCloudAuth = true;
@@ -515,7 +696,7 @@ var MastraCloudAuthProvider = class extends server.MastraAuthProvider {
    */
   async authenticateToken(token, request) {
     try {
-      const cookieHeader = getRequestHeader(request, "cookie");
+      const cookieHeader = getRequestHeader2(request, "cookie");
       const sessionToken = parseSessionCookie(cookieHeader);
       if (sessionToken) {
         const { user, role } = await this.client.verifyToken(sessionToken);
@@ -754,6 +935,85 @@ var MastraCloudAuthProvider = class extends server.MastraAuthProvider {
     return null;
   }
 };
+
+// ../../packages/_internals/auth/dist/chunk-7SVOHBXQ.js
+var RESOURCE_EXPANSIONS = {
+  stored: [
+    "stored-agents",
+    "stored-mcp-clients",
+    "stored-prompt-blocks",
+    "stored-scorers",
+    "stored-skills",
+    "stored-workspaces"
+  ]
+};
+function matchesPermission(userPermission, requiredPermission) {
+  if (userPermission === "*") {
+    return true;
+  }
+  const grantedParts = userPermission.split(":");
+  const requiredParts = requiredPermission.split(":");
+  const expandedFamilies = RESOURCE_EXPANSIONS[grantedParts[0] ?? ""];
+  if (expandedFamilies && expandedFamilies.includes(requiredParts[0] ?? "")) {
+    const aliased = [requiredParts[0], ...grantedParts.slice(1)].join(":");
+    return matchesPermission(aliased, requiredPermission);
+  }
+  if (grantedParts.length < 2 || requiredParts.length < 2) {
+    return userPermission === requiredPermission;
+  }
+  const [grantedResource, grantedAction, grantedId] = grantedParts;
+  const [requiredResource, requiredAction, requiredId] = requiredParts;
+  if (grantedResource === "*") {
+    if (grantedAction === "*") {
+      if (grantedId === void 0) {
+        return true;
+      }
+      return grantedId === requiredId;
+    }
+    if (grantedAction !== requiredAction) {
+      return false;
+    }
+    if (grantedId === void 0) {
+      return true;
+    }
+    return grantedId === requiredId;
+  }
+  if (grantedResource !== requiredResource) {
+    return false;
+  }
+  if (grantedAction === "*") {
+    if (grantedId === void 0) {
+      return true;
+    }
+    return grantedId === requiredId;
+  }
+  if (grantedAction !== requiredAction) {
+    return false;
+  }
+  if (grantedId === void 0) {
+    return true;
+  }
+  return grantedId === requiredId;
+}
+function resolvePermissionsFromMapping(roles, mapping) {
+  const permissions = /* @__PURE__ */ new Set();
+  const defaultPerms = mapping["_default"] ?? [];
+  for (const role of roles) {
+    const rolePerms = mapping[role];
+    if (rolePerms) {
+      for (const perm of rolePerms) {
+        permissions.add(perm);
+      }
+    } else {
+      for (const perm of defaultPerms) {
+        permissions.add(perm);
+      }
+    }
+  }
+  return Array.from(permissions);
+}
+
+// src/rbac/rbac-provider.ts
 var MastraRBACCloud = class {
   options;
   /**
@@ -812,7 +1072,7 @@ var MastraRBACCloud = class {
     if (roles.length === 0) {
       return this.options.roleMapping["_default"] ?? [];
     }
-    return ee.resolvePermissionsFromMapping(roles, this.options.roleMapping);
+    return resolvePermissionsFromMapping(roles, this.options.roleMapping);
   }
   /**
    * Check if a user has a specific permission.
@@ -826,7 +1086,7 @@ var MastraRBACCloud = class {
    */
   async hasPermission(user, permission) {
     const permissions = await this.getPermissions(user);
-    return permissions.some((p) => ee.matchesPermission(p, permission));
+    return permissions.some((p) => matchesPermission(p, permission));
   }
   /**
    * Check if a user has ALL of the specified permissions.
@@ -837,7 +1097,7 @@ var MastraRBACCloud = class {
    */
   async hasAllPermissions(user, permissions) {
     const userPermissions = await this.getPermissions(user);
-    return permissions.every((required) => userPermissions.some((p) => ee.matchesPermission(p, required)));
+    return permissions.every((required) => userPermissions.some((p) => matchesPermission(p, required)));
   }
   /**
    * Check if a user has ANY of the specified permissions.
@@ -848,9 +1108,41 @@ var MastraRBACCloud = class {
    */
   async hasAnyPermission(user, permissions) {
     const userPermissions = await this.getPermissions(user);
-    return permissions.some((required) => userPermissions.some((p) => ee.matchesPermission(p, required)));
+    return permissions.some((required) => userPermissions.some((p) => matchesPermission(p, required)));
   }
 };
+/**
+ * EE Authentication Interfaces
+ *
+ * Enterprise interfaces for RBAC, ACL, and advanced authorization.
+ *
+ * @license Mastra Enterprise License - see ee/LICENSE
+ * @packageDocumentation
+ */
+/**
+ * FGA enforcement utility for checking fine-grained authorization.
+ *
+ * @license Mastra Enterprise License - see ee/LICENSE
+ */
+/**
+ * RBAC provider implementations.
+ *
+ * @license Mastra Enterprise License - see ee/LICENSE
+ */
+/**
+ * Default implementations for EE authentication.
+ *
+ * @license Mastra Enterprise License - see ee/LICENSE
+ */
+/**
+ * @mastra/core/auth/ee
+ *
+ * Enterprise authentication capabilities for Mastra.
+ * This code is licensed under the Mastra Enterprise License - see ee/LICENSE.
+ *
+ * @license Mastra Enterprise License - see ee/LICENSE
+ * @packageDocumentation
+ */
 
 exports.AuthError = AuthError;
 exports.MastraCloudAuth = MastraCloudAuth;