@mastra/auth-neon 0.3.0 → 0.3.1

package/dist/index.js

@@ -1,369 +1,411 @@
-import { MastraAuthProvider } from '@mastra/core/server';
-import { createRemoteJWKSet, jwtVerify } from 'jose';
-import { resolvePermissionsFromMapping, matchesPermission } from '@mastra/core/auth/ee';
-
-// src/index.ts
-var DEFAULT_CACHE_TTL_MS = 6e4;
-var DEFAULT_CACHE_MAX_SIZE = 1e3;
+import { getRequestHeader } from "@mastra/core/auth";
+import { MastraAuthProvider } from "@mastra/core/server";
+import { createRemoteJWKSet, jwtVerify } from "jose";
+import { matchesPermission, resolvePermissionsFromMapping } from "@mastra/core/auth/ee";
+//#region src/rbac-provider.ts
+const DEFAULT_CACHE_TTL_MS = 6e4;
+const DEFAULT_CACHE_MAX_SIZE = 1e3;
+/**
+* RBAC provider for Neon Auth that maps organization roles to Mastra permissions.
+*
+* Neon Auth uses Better Auth's Organization plugin which provides `owner`,
+* `admin`, and `member` roles. This provider maps those roles to Mastra
+* permission patterns via a configurable `roleMapping`.
+*
+* @example Static mapping
+* ```typescript
+* import { MastraRBACNeon } from '@mastra/auth-neon';
+*
+* const rbac = new MastraRBACNeon({
+*   roleMapping: {
+*     owner: ['*'],
+*     admin: ['*'],
+*     member: ['agents:read', 'workflows:*'],
+*     _default: [],
+*   },
+* });
+* ```
+*
+* @example With custom role extraction from JWT claims
+* ```typescript
+* const rbac = new MastraRBACNeon({
+*   roleMapping: {
+*     admin: ['*'],
+*     member: ['agents:read'],
+*   },
+*   getUserRoles: (user) => {
+*     const role = user.jwt?.role as string;
+*     return role ? [role] : [];
+*   },
+* });
+* ```
+*/
 var MastraRBACNeon = class {
-  options;
-  baseUrl;
-  rolesCache = /* @__PURE__ */ new Map();
-  cacheTtlMs;
-  cacheMaxSize;
-  get roleMapping() {
-    return this.options.roleMapping;
-  }
-  constructor(options) {
-    this.options = options;
-    const rawUrl = options.baseUrl ?? process.env.NEON_AUTH_BASE_URL ?? "";
-    let end = rawUrl.length;
-    while (end > 0 && rawUrl[end - 1] === "/") {
-      end--;
-    }
-    this.baseUrl = rawUrl.slice(0, end);
-    this.cacheTtlMs = options.cache?.ttlMs ?? DEFAULT_CACHE_TTL_MS;
-    this.cacheMaxSize = options.cache?.maxSize ?? DEFAULT_CACHE_MAX_SIZE;
-  }
-  async getRoles(user) {
-    if (this.options.getUserRoles) {
-      return this.options.getUserRoles(user);
-    }
-    if (user.jwt) {
-      const role = user.jwt.role;
-      if (role) return [role];
-    }
-    const userId = user.user?.id;
-    if (!userId) return [];
-    const cached = this.rolesCache.get(userId);
-    if (cached && cached.expiresAt > Date.now()) {
-      this.rolesCache.delete(userId);
-      this.rolesCache.set(userId, cached);
-      return cached.roles;
-    }
-    const roles = await this.fetchRolesFromNeonAuth(userId);
-    if (this.rolesCache.size >= this.cacheMaxSize) {
-      const firstKey = this.rolesCache.keys().next().value;
-      if (firstKey) this.rolesCache.delete(firstKey);
-    }
-    this.rolesCache.set(userId, { roles, expiresAt: Date.now() + this.cacheTtlMs });
-    return roles;
-  }
-  async hasRole(user, role) {
-    const roles = await this.getRoles(user);
-    return roles.includes(role);
-  }
-  async getPermissions(user) {
-    const roles = await this.getRoles(user);
-    return resolvePermissionsFromMapping(roles, this.options.roleMapping);
-  }
-  async hasPermission(user, permission) {
-    const permissions = await this.getPermissions(user);
-    return permissions.some((p) => matchesPermission(p, permission));
-  }
-  async hasAllPermissions(user, permissions) {
-    const userPermissions = await this.getPermissions(user);
-    return permissions.every((required) => userPermissions.some((p) => matchesPermission(p, required)));
-  }
-  async hasAnyPermission(user, permissions) {
-    const userPermissions = await this.getPermissions(user);
-    return permissions.some((required) => userPermissions.some((p) => matchesPermission(p, required)));
-  }
-  async getAvailableRoles() {
-    return Object.keys(this.options.roleMapping).filter((k) => k !== "_default").map((k) => ({ id: k, name: k.charAt(0).toUpperCase() + k.slice(1) }));
-  }
-  async getRolePermissions(roleId) {
-    return resolvePermissionsFromMapping([roleId], this.options.roleMapping);
-  }
-  /**
-   * Fetch organization membership roles from Neon Auth.
-   *
-   * Uses Better Auth's `organization/list-memberships` admin API.
-   * Falls back to empty roles on error (default permissions will apply).
-   */
-  async fetchRolesFromNeonAuth(userId) {
-    if (!this.baseUrl) return [];
-    try {
-      const response = await fetch(`${this.baseUrl}/auth/api/organization/list-memberships`, {
-        method: "POST",
-        headers: { "Content-Type": "application/json" },
-        body: JSON.stringify({ userId })
-      });
-      if (!response.ok) return [];
-      const data = await response.json();
-      const memberships = Array.isArray(data) ? data : data.data ?? [];
-      const relevant = this.options.organizationId ? memberships.filter((m) => m.organizationId === this.options.organizationId) : memberships;
-      return relevant.map((m) => m.role);
-    } catch {
-      return [];
-    }
-  }
+	options;
+	baseUrl;
+	rolesCache = /* @__PURE__ */ new Map();
+	cacheTtlMs;
+	cacheMaxSize;
+	get roleMapping() {
+		return this.options.roleMapping;
+	}
+	constructor(options) {
+		this.options = options;
+		const rawUrl = options.baseUrl ?? process.env.NEON_AUTH_BASE_URL ?? "";
+		let end = rawUrl.length;
+		while (end > 0 && rawUrl[end - 1] === "/") end--;
+		this.baseUrl = rawUrl.slice(0, end);
+		this.cacheTtlMs = options.cache?.ttlMs ?? DEFAULT_CACHE_TTL_MS;
+		this.cacheMaxSize = options.cache?.maxSize ?? DEFAULT_CACHE_MAX_SIZE;
+	}
+	async getRoles(user) {
+		if (this.options.getUserRoles) return this.options.getUserRoles(user);
+		if (user.jwt) {
+			const role = user.jwt.role;
+			if (role) return [role];
+		}
+		const userId = user.user?.id;
+		if (!userId) return [];
+		const cached = this.rolesCache.get(userId);
+		if (cached && cached.expiresAt > Date.now()) {
+			this.rolesCache.delete(userId);
+			this.rolesCache.set(userId, cached);
+			return cached.roles;
+		}
+		const roles = await this.fetchRolesFromNeonAuth(userId);
+		if (this.rolesCache.size >= this.cacheMaxSize) {
+			const firstKey = this.rolesCache.keys().next().value;
+			if (firstKey) this.rolesCache.delete(firstKey);
+		}
+		this.rolesCache.set(userId, {
+			roles,
+			expiresAt: Date.now() + this.cacheTtlMs
+		});
+		return roles;
+	}
+	async hasRole(user, role) {
+		return (await this.getRoles(user)).includes(role);
+	}
+	async getPermissions(user) {
+		return resolvePermissionsFromMapping(await this.getRoles(user), this.options.roleMapping);
+	}
+	async hasPermission(user, permission) {
+		return (await this.getPermissions(user)).some((p) => matchesPermission(p, permission));
+	}
+	async hasAllPermissions(user, permissions) {
+		const userPermissions = await this.getPermissions(user);
+		return permissions.every((required) => userPermissions.some((p) => matchesPermission(p, required)));
+	}
+	async hasAnyPermission(user, permissions) {
+		const userPermissions = await this.getPermissions(user);
+		return permissions.some((required) => userPermissions.some((p) => matchesPermission(p, required)));
+	}
+	async getAvailableRoles() {
+		return Object.keys(this.options.roleMapping).filter((k) => k !== "_default").map((k) => ({
+			id: k,
+			name: k.charAt(0).toUpperCase() + k.slice(1)
+		}));
+	}
+	async getRolePermissions(roleId) {
+		return resolvePermissionsFromMapping([roleId], this.options.roleMapping);
+	}
+	/**
+	* Fetch organization membership roles from Neon Auth.
+	*
+	* Uses Better Auth's `organization/list-memberships` admin API.
+	* Falls back to empty roles on error (default permissions will apply).
+	*/
+	async fetchRolesFromNeonAuth(userId) {
+		if (!this.baseUrl) return [];
+		try {
+			const response = await fetch(`${this.baseUrl}/auth/api/organization/list-memberships`, {
+				method: "POST",
+				headers: { "Content-Type": "application/json" },
+				body: JSON.stringify({ userId })
+			});
+			if (!response.ok) return [];
+			const data = await response.json();
+			const memberships = Array.isArray(data) ? data : data.data ?? [];
+			return (this.options.organizationId ? memberships.filter((m) => m.organizationId === this.options.organizationId) : memberships).map((m) => m.role);
+		} catch {
+			return [];
+		}
+	}
 };
-
-// src/index.ts
-function getRequestHeader(request, name) {
-  if (request instanceof Request) {
-    return request.headers.get(name);
-  }
-  return request.raw?.headers.get(name) ?? request.headers?.get(name) ?? request.header(name) ?? null;
-}
+//#endregion
+//#region src/index.ts
 function stripTrailingSlashes(url) {
-  let end = url.length;
-  while (end > 0 && url[end - 1] === "/") {
-    end--;
-  }
-  return url.slice(0, end);
+	let end = url.length;
+	while (end > 0 && url[end - 1] === "/") end--;
+	return url.slice(0, end);
 }
 function parseCookies(response) {
-  if (typeof response.headers.getSetCookie === "function") {
-    return response.headers.getSetCookie();
-  }
-  const raw = response.headers.get("set-cookie");
-  if (!raw) return [];
-  return raw.split(/,(?=\s*\w+=)/);
+	if (typeof response.headers.getSetCookie === "function") return response.headers.getSetCookie();
+	const raw = response.headers.get("set-cookie");
+	if (!raw) return [];
+	return raw.split(/,(?=\s*\w+=)/);
 }
 function mapNeonUserToEEUser(user) {
-  return {
-    id: user.id,
-    email: user.email,
-    name: user.name,
-    avatarUrl: user.image ?? void 0,
-    metadata: {
-      emailVerified: user.emailVerified,
-      createdAt: user.createdAt,
-      updatedAt: user.updatedAt
-    }
-  };
+	return {
+		id: user.id,
+		email: user.email,
+		name: user.name,
+		avatarUrl: user.image ?? void 0,
+		metadata: {
+			emailVerified: user.emailVerified,
+			createdAt: user.createdAt,
+			updatedAt: user.updatedAt
+		}
+	};
 }
+/**
+* Mastra authentication provider for Neon Auth.
+*
+* Neon Auth is a managed authentication service built on Better Auth
+* that stores users, sessions, and auth configuration directly in your
+* Neon Postgres database.
+*
+* This adapter supports:
+* - JWT bearer token verification via JWKS (for API clients)
+* - Session cookie verification via Neon Auth REST API (for Studio)
+* - Email/password sign-in and sign-up (for Studio credentials flow)
+* - Session management (validate, refresh, destroy)
+*
+* @example
+* ```typescript
+* import { MastraAuthNeon } from '@mastra/auth-neon';
+*
+* const auth = new MastraAuthNeon({
+*   baseUrl: process.env.NEON_AUTH_BASE_URL,
+* });
+*
+* const mastra = new Mastra({
+*   server: {
+*     auth,
+*   },
+* });
+* ```
+*
+* @example With RBAC
+* ```typescript
+* import { MastraAuthNeon, MastraRBACNeon } from '@mastra/auth-neon';
+*
+* const mastra = new Mastra({
+*   server: {
+*     auth: new MastraAuthNeon({
+*       baseUrl: process.env.NEON_AUTH_BASE_URL,
+*     }),
+*     rbac: new MastraRBACNeon({
+*       roleMapping: {
+*         owner: ['*'],
+*         admin: ['*'],
+*         member: ['agents:read', 'workflows:*'],
+*         _default: [],
+*       },
+*     }),
+*   },
+* });
+* ```
+*
+* @see https://neon.com/docs/auth/overview
+*/
 var MastraAuthNeon = class extends MastraAuthProvider {
-  baseUrl;
-  jwksUrl;
-  sessionCookieName;
-  signUpEnabledConfig;
-  constructor(options) {
-    super({ name: options?.name ?? "neon" });
-    const baseUrl = options?.baseUrl ?? process.env.NEON_AUTH_BASE_URL;
-    if (!baseUrl) {
-      throw new Error(
-        "Neon Auth base URL is required, please provide it in the options or set the NEON_AUTH_BASE_URL environment variable"
-      );
-    }
-    this.baseUrl = stripTrailingSlashes(baseUrl);
-    this.jwksUrl = options?.jwksUrl ?? process.env.NEON_AUTH_JWKS_URL ?? `${this.baseUrl}/auth/jwks`;
-    this.sessionCookieName = options?.sessionCookieName ?? "neonauth.session_token";
-    this.signUpEnabledConfig = options?.signUpEnabled ?? true;
-    this.registerOptions(options);
-  }
-  /** Expose the base URL for RBAC or other consumers. */
-  getBaseUrl() {
-    return this.baseUrl;
-  }
-  isSignUpEnabled() {
-    return this.signUpEnabledConfig;
-  }
-  // ── IUserProvider ──
-  async getCurrentUser(request) {
-    try {
-      const result = await this.fetchSession(request.headers);
-      if (!result?.user) return null;
-      return mapNeonUserToEEUser(result.user);
-    } catch {
-      return null;
-    }
-  }
-  async getUser(_userId) {
-    return null;
-  }
-  getUserProfileUrl(user) {
-    return `/profile/${user.id}`;
-  }
-  // ── MastraAuthProvider ──
-  async authenticateToken(token, request) {
-    if (!token || typeof token !== "string") {
-      return null;
-    }
-    const jwtResult = await this.verifyJwt(token);
-    if (jwtResult) {
-      return {
-        user: {
-          id: jwtResult.sub ?? "",
-          email: jwtResult.email ?? "",
-          name: jwtResult.name ?? "",
-          image: jwtResult.picture ?? null,
-          emailVerified: jwtResult.email_verified ?? false,
-          createdAt: jwtResult.iat ? new Date(jwtResult.iat * 1e3).toISOString() : "",
-          updatedAt: ""
-        },
-        jwt: jwtResult
-      };
-    }
-    try {
-      const headers = new Headers();
-      const cookieHeader = getRequestHeader(request, "Cookie");
-      if (cookieHeader) {
-        headers.set("Cookie", cookieHeader);
-      }
-      const hasSessionCookie = !!cookieHeader?.split(";").some((pair) => pair.trim().split("=")[0]?.trim() === this.sessionCookieName);
-      if (token && !hasSessionCookie) {
-        const existingCookies = cookieHeader ? `${cookieHeader}; ` : "";
-        headers.set("Cookie", `${existingCookies}${this.sessionCookieName}=${token}`);
-      }
-      const result = await this.fetchSession(headers);
-      if (!result?.session || !result?.user) {
-        return null;
-      }
-      return {
-        session: result.session,
-        user: result.user
-      };
-    } catch {
-      return null;
-    }
-  }
-  async authorizeUser(user) {
-    if (!user?.user?.id) return false;
-    if (user.jwt?.exp && user.jwt.exp * 1e3 < Date.now()) {
-      return false;
-    }
-    return true;
-  }
-  // ── ICredentialsProvider ──
-  async signIn(email, password, request) {
-    const response = await fetch(`${this.baseUrl}/auth/sign-in/email`, {
-      method: "POST",
-      headers: {
-        "Content-Type": "application/json",
-        ...request?.headers ? Object.fromEntries(request.headers.entries()) : {}
-      },
-      body: JSON.stringify({ email, password })
-    });
-    if (!response.ok) {
-      const errorData = await response.json().catch(() => ({}));
-      throw new Error(errorData.message || "Invalid email or password");
-    }
-    const result = await response.json();
-    if (!result?.user) {
-      throw new Error("Invalid email or password");
-    }
-    const cookies = parseCookies(response);
-    return {
-      user: mapNeonUserToEEUser(result.user),
-      token: result.token ?? void 0,
-      cookies
-    };
-  }
-  async signUp(email, password, name, request) {
-    const displayName = name ?? email.split("@")[0] ?? "User";
-    const response = await fetch(`${this.baseUrl}/auth/sign-up/email`, {
-      method: "POST",
-      headers: {
-        "Content-Type": "application/json",
-        ...request?.headers ? Object.fromEntries(request.headers.entries()) : {}
-      },
-      body: JSON.stringify({ email, password, name: displayName })
-    });
-    if (!response.ok) {
-      const errorData = await response.json().catch(() => ({}));
-      throw new Error(errorData.message || "Failed to create account");
-    }
-    const result = await response.json();
-    if (!result?.user) {
-      throw new Error("Failed to create account");
-    }
-    const cookies = parseCookies(response);
-    return {
-      user: mapNeonUserToEEUser(result.user),
-      token: result.token ?? void 0,
-      cookies
-    };
-  }
-  // ── ISessionProvider ──
-  async createSession(_userId, metadata) {
-    const now = /* @__PURE__ */ new Date();
-    const expiresAt = new Date(now.getTime() + 7 * 24 * 60 * 60 * 1e3);
-    return {
-      id: crypto.randomUUID(),
-      userId: _userId,
-      createdAt: now,
-      expiresAt,
-      metadata
-    };
-  }
-  async validateSession(sessionId) {
-    try {
-      const headers = new Headers();
-      headers.set("Cookie", `${this.sessionCookieName}=${sessionId}`);
-      const result = await this.fetchSession(headers);
-      if (!result?.session) return null;
-      return {
-        id: result.session.id,
-        userId: result.session.userId,
-        expiresAt: new Date(result.session.expiresAt),
-        createdAt: new Date(result.session.createdAt)
-      };
-    } catch {
-      return null;
-    }
-  }
-  async destroySession(_sessionId) {
-  }
-  async refreshSession(sessionId) {
-    return this.validateSession(sessionId);
-  }
-  getSessionIdFromRequest(request) {
-    const cookieHeader = request.headers.get("Cookie");
-    if (!cookieHeader) return null;
-    for (const pair of cookieHeader.split(";")) {
-      const [key, ...rest] = pair.trim().split("=");
-      if (key?.trim() === this.sessionCookieName) {
-        return rest.join("=") || null;
-      }
-    }
-    return null;
-  }
-  getSessionHeaders(session) {
-    const cookie = session._sessionCookie;
-    if (typeof cookie === "string") {
-      return { "Set-Cookie": cookie };
-    }
-    return {};
-  }
-  getClearSessionHeaders() {
-    const cookies = [
-      `${this.sessionCookieName}=; Path=/; HttpOnly; SameSite=Lax; Max-Age=0`,
-      `${this.sessionCookieName}_sig=; Path=/; HttpOnly; SameSite=Lax; Max-Age=0`
-    ];
-    return {
-      "Set-Cookie": cookies.join(", ")
-    };
-  }
-  // ── Internal helpers ──
-  async verifyJwt(token) {
-    try {
-      const JWKS = createRemoteJWKSet(new URL(this.jwksUrl));
-      const { payload } = await jwtVerify(token, JWKS);
-      return payload;
-    } catch {
-      return null;
-    }
-  }
-  /** Fetch and validate a session from the Neon Auth REST API. */
-  async fetchSession(headers) {
-    const response = await fetch(`${this.baseUrl}/auth/get-session`, {
-      method: "GET",
-      headers
-    });
-    if (!response.ok) {
-      return null;
-    }
-    const data = await response.json();
-    if (!data?.session || !data?.user) {
-      return null;
-    }
-    return data;
-  }
+	baseUrl;
+	jwksUrl;
+	sessionCookieName;
+	signUpEnabledConfig;
+	constructor(options) {
+		super({ name: options?.name ?? "neon" });
+		const baseUrl = options?.baseUrl ?? process.env.NEON_AUTH_BASE_URL;
+		if (!baseUrl) throw new Error("Neon Auth base URL is required, please provide it in the options or set the NEON_AUTH_BASE_URL environment variable");
+		this.baseUrl = stripTrailingSlashes(baseUrl);
+		this.jwksUrl = options?.jwksUrl ?? process.env.NEON_AUTH_JWKS_URL ?? `${this.baseUrl}/auth/jwks`;
+		this.sessionCookieName = options?.sessionCookieName ?? "neonauth.session_token";
+		this.signUpEnabledConfig = options?.signUpEnabled ?? true;
+		this.registerOptions(options);
+	}
+	/** Expose the base URL for RBAC or other consumers. */
+	getBaseUrl() {
+		return this.baseUrl;
+	}
+	isSignUpEnabled() {
+		return this.signUpEnabledConfig;
+	}
+	async getCurrentUser(request) {
+		try {
+			const result = await this.fetchSession(request.headers);
+			if (!result?.user) return null;
+			return mapNeonUserToEEUser(result.user);
+		} catch {
+			return null;
+		}
+	}
+	async getUser(_userId) {
+		return null;
+	}
+	getUserProfileUrl(user) {
+		return `/profile/${user.id}`;
+	}
+	async authenticateToken(token, request) {
+		if (!token || typeof token !== "string") return null;
+		const jwtResult = await this.verifyJwt(token);
+		if (jwtResult) return {
+			user: {
+				id: jwtResult.sub ?? "",
+				email: jwtResult.email ?? "",
+				name: jwtResult.name ?? "",
+				image: jwtResult.picture ?? null,
+				emailVerified: jwtResult.email_verified ?? false,
+				createdAt: jwtResult.iat ? (/* @__PURE__ */ new Date(jwtResult.iat * 1e3)).toISOString() : "",
+				updatedAt: ""
+			},
+			jwt: jwtResult
+		};
+		try {
+			const headers = new Headers();
+			const cookieHeader = getRequestHeader(request, "Cookie");
+			if (cookieHeader) headers.set("Cookie", cookieHeader);
+			const hasSessionCookie = !!cookieHeader?.split(";").some((pair) => pair.trim().split("=")[0]?.trim() === this.sessionCookieName);
+			if (token && !hasSessionCookie) {
+				const existingCookies = cookieHeader ? `${cookieHeader}; ` : "";
+				headers.set("Cookie", `${existingCookies}${this.sessionCookieName}=${token}`);
+			}
+			const result = await this.fetchSession(headers);
+			if (!result?.session || !result?.user) return null;
+			return {
+				session: result.session,
+				user: result.user
+			};
+		} catch {
+			return null;
+		}
+	}
+	async authorizeUser(user) {
+		if (!user?.user?.id) return false;
+		if (user.jwt?.exp && user.jwt.exp * 1e3 < Date.now()) return false;
+		return true;
+	}
+	async signIn(email, password, request) {
+		const response = await fetch(`${this.baseUrl}/auth/sign-in/email`, {
+			method: "POST",
+			headers: {
+				"Content-Type": "application/json",
+				...request?.headers ? Object.fromEntries(request.headers.entries()) : {}
+			},
+			body: JSON.stringify({
+				email,
+				password
+			})
+		});
+		if (!response.ok) {
+			const errorData = await response.json().catch(() => ({}));
+			throw new Error(errorData.message || "Invalid email or password");
+		}
+		const result = await response.json();
+		if (!result?.user) throw new Error("Invalid email or password");
+		const cookies = parseCookies(response);
+		return {
+			user: mapNeonUserToEEUser(result.user),
+			token: result.token ?? void 0,
+			cookies
+		};
+	}
+	async signUp(email, password, name, request) {
+		const displayName = name ?? email.split("@")[0] ?? "User";
+		const response = await fetch(`${this.baseUrl}/auth/sign-up/email`, {
+			method: "POST",
+			headers: {
+				"Content-Type": "application/json",
+				...request?.headers ? Object.fromEntries(request.headers.entries()) : {}
+			},
+			body: JSON.stringify({
+				email,
+				password,
+				name: displayName
+			})
+		});
+		if (!response.ok) {
+			const errorData = await response.json().catch(() => ({}));
+			throw new Error(errorData.message || "Failed to create account");
+		}
+		const result = await response.json();
+		if (!result?.user) throw new Error("Failed to create account");
+		const cookies = parseCookies(response);
+		return {
+			user: mapNeonUserToEEUser(result.user),
+			token: result.token ?? void 0,
+			cookies
+		};
+	}
+	async createSession(_userId, metadata) {
+		const now = /* @__PURE__ */ new Date();
+		const expiresAt = new Date(now.getTime() + 10080 * 60 * 1e3);
+		return {
+			id: crypto.randomUUID(),
+			userId: _userId,
+			createdAt: now,
+			expiresAt,
+			metadata
+		};
+	}
+	async validateSession(sessionId) {
+		try {
+			const headers = new Headers();
+			headers.set("Cookie", `${this.sessionCookieName}=${sessionId}`);
+			const result = await this.fetchSession(headers);
+			if (!result?.session) return null;
+			return {
+				id: result.session.id,
+				userId: result.session.userId,
+				expiresAt: new Date(result.session.expiresAt),
+				createdAt: new Date(result.session.createdAt)
+			};
+		} catch {
+			return null;
+		}
+	}
+	async destroySession(_sessionId) {}
+	async refreshSession(sessionId) {
+		return this.validateSession(sessionId);
+	}
+	getSessionIdFromRequest(request) {
+		const cookieHeader = request.headers.get("Cookie");
+		if (!cookieHeader) return null;
+		for (const pair of cookieHeader.split(";")) {
+			const [key, ...rest] = pair.trim().split("=");
+			if (key?.trim() === this.sessionCookieName) return rest.join("=") || null;
+		}
+		return null;
+	}
+	getSessionHeaders(session) {
+		const cookie = session._sessionCookie;
+		if (typeof cookie === "string") return { "Set-Cookie": cookie };
+		return {};
+	}
+	getClearSessionHeaders() {
+		return { "Set-Cookie": [`${this.sessionCookieName}=; Path=/; HttpOnly; SameSite=Lax; Max-Age=0`, `${this.sessionCookieName}_sig=; Path=/; HttpOnly; SameSite=Lax; Max-Age=0`].join(", ") };
+	}
+	async verifyJwt(token) {
+		try {
+			const { payload } = await jwtVerify(token, createRemoteJWKSet(new URL(this.jwksUrl)));
+			return payload;
+		} catch {
+			return null;
+		}
+	}
+	/** Fetch and validate a session from the Neon Auth REST API. */
+	async fetchSession(headers) {
+		const response = await fetch(`${this.baseUrl}/auth/get-session`, {
+			method: "GET",
+			headers
+		});
+		if (!response.ok) return null;
+		const data = await response.json();
+		if (!data?.session || !data?.user) return null;
+		return data;
+	}
 };
-
+//#endregion
 export { MastraAuthNeon, MastraRBACNeon, mapNeonUserToEEUser };
-//# sourceMappingURL=index.js.map
+
 //# sourceMappingURL=index.js.map