@mastra/auth-studio 1.3.1 → 1.3.2-alpha.1

package/dist/index.js

@@ -1,4 +1,4 @@
-// ../../packages/_internals/auth/dist/chunk-7SVOHBXQ.js
+// ../../packages/_internals/auth/dist/chunk-LZCWL5CT.js
 var RESOURCE_EXPANSIONS = {
   stored: [
     "stored-agents",
@@ -227,7 +227,7 @@ var MastraBase = class {
   }
 };
 
-// ../../packages/_internals/auth/dist/chunk-XG6GH2VJ.js
+// ../../packages/_internals/auth/dist/chunk-NJOKT6V5.js
 var MastraAuthProvider = class extends MastraBase {
   protected;
   public;
@@ -270,20 +270,40 @@ var MastraAuthStudio = class extends MastraAuthProvider {
   organizationId;
   useProductionCookies;
   cookieDomain;
+  /**
+   * `userId → sealed session cookie` cache. The `IOrganizationsProvider`
+   * interface only hands us a `userId`, but the shared API's org endpoints are
+   * cookie-authenticated — so we remember the cookie last seen for a user
+   * inside `verifySessionCookie` and reuse it here. Kept small: bounded to
+   * the last 1000 users, LRU-evicted on insert.
+   */
+  userSessionCookies = /* @__PURE__ */ new Map();
+  maxCachedSessions = 1e3;
+  /**
+   * In-flight `ensureOrganization` promises keyed by userId. Concurrent calls
+   * for the same brand-new user (multiple tabs, parallel requests) would
+   * otherwise all see "no org" from `GET /auth/me` and each fire
+   * `POST /auth/orgs`, creating duplicate personal organizations. The first
+   * caller's promise is reused by every follower until it settles.
+   */
+  organizationBootstrapInFlight = /* @__PURE__ */ new Map();
   constructor(options) {
     super({ name: "mastra-studio", ...options });
-    this.sharedApiUrl = options?.sharedApiUrl || process.env.MASTRA_SHARED_API_URL || "http://localhost:3010/v1";
+    const explicitSharedApiUrl = options?.sharedApiUrl || process.env.MASTRA_SHARED_API_URL;
+    this.sharedApiUrl = explicitSharedApiUrl || "https://platform.mastra.ai/v1";
     this.organizationId = options?.organizationId || process.env.MASTRA_ORGANIZATION_ID;
     if (this.sharedApiUrl.endsWith("/")) {
       this.sharedApiUrl = this.sharedApiUrl.slice(0, -1);
     }
     this.cookieDomain = options?.cookieDomain || process.env.MASTRA_COOKIE_DOMAIN;
     let autoDetectMastraAi = false;
-    try {
-      const hostname = new URL(this.sharedApiUrl).hostname.toLowerCase();
-      autoDetectMastraAi = hostname === "mastra.ai" || hostname.endsWith(".mastra.ai");
-    } catch {
-      autoDetectMastraAi = false;
+    if (explicitSharedApiUrl) {
+      try {
+        const hostname = new URL(this.sharedApiUrl).hostname.toLowerCase();
+        autoDetectMastraAi = hostname === "mastra.ai" || hostname.endsWith(".mastra.ai");
+      } catch {
+        autoDetectMastraAi = false;
+      }
     }
     this.useProductionCookies = !!this.cookieDomain || autoDetectMastraAi;
     if (!this.cookieDomain && autoDetectMastraAi) {
@@ -508,8 +528,127 @@ var MastraAuthStudio = class extends MastraAuthProvider {
     return null;
   }
   // ---------------------------------------------------------------------------
+  // IOrganizationsProvider
+  // ---------------------------------------------------------------------------
+  /**
+   * Ensure the user belongs to an organization, bootstrapping a personal org
+   * on first use when they have none.
+   *
+   * Because the shared API's org endpoints are cookie-authenticated but this
+   * method only receives a userId, we look up the user's sealed session cookie
+   * from the {@link userSessionCookies} cache populated by
+   * {@link verifySessionCookie}. If we have never seen a cookie for this user
+   * (e.g. bearer-token flow, or the cache was evicted), we skip bootstrap and
+   * return `undefined` — the caller keeps the user in their current no-org
+   * state and the next authenticated request retries.
+   *
+   * Best-effort: any shared-API failure returns `undefined` rather than
+   * throwing, mirroring `MastraAuthWorkos.ensureOrganization`.
+   */
+  async ensureOrganization(userId) {
+    const inFlight = this.organizationBootstrapInFlight.get(userId);
+    if (inFlight) return inFlight;
+    const bootstrap = this.doEnsureOrganization(userId).finally(() => {
+      this.organizationBootstrapInFlight.delete(userId);
+    });
+    this.organizationBootstrapInFlight.set(userId, bootstrap);
+    return bootstrap;
+  }
+  async doEnsureOrganization(userId) {
+    const sessionCookie = this.userSessionCookies.get(userId);
+    if (!sessionCookie) {
+      this.logger.debug("ensureOrganization: no cached session cookie for user; skipping bootstrap", { userId });
+      return void 0;
+    }
+    try {
+      const me = await this.fetchMe(sessionCookie);
+      if (me?.organizationId) return me.organizationId;
+      if (me?.memberOrgIds && me.memberOrgIds.length > 0) return me.memberOrgIds[0];
+      const orgName = me?.user?.email ? `${me.user.email}'s org` : `Personal (${userId})`;
+      const res = await fetch(`${this.sharedApiUrl}/auth/orgs`, {
+        method: "POST",
+        headers: {
+          "Content-Type": "application/json",
+          Cookie: `${COOKIE_NAME}=${sessionCookie}`
+        },
+        body: JSON.stringify({ name: orgName })
+      });
+      if (!res.ok) {
+        this.logger.warn("ensureOrganization: shared API POST /auth/orgs returned non-OK", {
+          status: res.status,
+          userId
+        });
+        return void 0;
+      }
+      const data = await res.json();
+      return data.organization?.id;
+    } catch (error) {
+      this.logger.error("ensureOrganization: fetch to shared API failed", {
+        userId,
+        error: error instanceof Error ? { message: error.message, stack: error.stack } : String(error)
+      });
+      return void 0;
+    }
+  }
+  /**
+   * Whether the user holds an admin-equivalent role in the organization.
+   *
+   * Fast path: if the org matches the user's currently-active session org, we
+   * read the role directly from `/auth/me`. Cross-org path: we call
+   * `/auth/orgs` (which returns per-membership roles) and look up the target
+   * org. Any shared-API failure resolves to `false`.
+   */
+  async isOrganizationAdmin(organizationId, userId) {
+    const sessionCookie = this.userSessionCookies.get(userId);
+    if (!sessionCookie) return false;
+    try {
+      const me = await this.fetchMe(sessionCookie);
+      if (me?.organizationId === organizationId) {
+        return isAdminRole(me.role);
+      }
+      const res = await fetch(`${this.sharedApiUrl}/auth/orgs`, {
+        headers: { Cookie: `${COOKIE_NAME}=${sessionCookie}` }
+      });
+      if (!res.ok) return false;
+      const data = await res.json();
+      const membership = data.organizations?.find((o) => o.id === organizationId);
+      return isAdminRole(membership?.role ?? void 0);
+    } catch {
+      return false;
+    }
+  }
+  // ---------------------------------------------------------------------------
   // Internal helpers
   // ---------------------------------------------------------------------------
+  /**
+   * Record the sealed session cookie last seen for a user so
+   * {@link ensureOrganization} / {@link isOrganizationAdmin} can act on their
+   * behalf. LRU-evicted at {@link maxCachedSessions} entries.
+   */
+  rememberUserSession(userId, sessionCookie) {
+    this.userSessionCookies.delete(userId);
+    this.userSessionCookies.set(userId, sessionCookie);
+    if (this.userSessionCookies.size > this.maxCachedSessions) {
+      const oldest = this.userSessionCookies.keys().next().value;
+      if (oldest !== void 0) this.userSessionCookies.delete(oldest);
+    }
+  }
+  /**
+   * Fetch the shared API's `/auth/me` and return the raw response body, or
+   * `null` on any non-OK / network error. Split out so `ensureOrganization`
+   * and `isOrganizationAdmin` can reuse it without duplicating the shape.
+   */
+  async fetchMe(sessionCookie) {
+    try {
+      const res = await fetch(`${this.sharedApiUrl}/auth/me`, {
+        headers: { Cookie: `${COOKIE_NAME}=${sessionCookie}` }
+      });
+      if (!res.ok) return null;
+      return await res.json();
+    } catch {
+      return null;
+    }
+  }
   /**
    * Forward a sealed session cookie to the shared API's /auth/me endpoint
    * to validate it and get user info.
@@ -530,6 +669,7 @@ var MastraAuthStudio = class extends MastraAuthProvider {
         return null;
       }
       const data = await res.json();
+      this.rememberUserSession(data.user.id, sessionCookie);
       return {
         id: data.user.id,
         email: data.user.email,
@@ -589,6 +729,9 @@ function parseCookie(cookieHeader, name) {
   const match = cookieHeader.match(new RegExp(`${name}=([^;]+)`));
   return match?.[1] ?? null;
 }
+function isAdminRole(role) {
+  return role === "admin" || role === "owner";
+}
 function parseCookieFromHeader(setCookieHeader, name) {
   const parts = setCookieHeader.split(";");
   if (parts.length === 0) return null;