@mastra/auth-studio 1.3.10 → 1.3.11-alpha.0

package/dist/_types/@internal_auth/dist/_types/@internal_core/dist/base/index.d.ts

@@ -1,6 +1,6 @@
 import { i as IMastraLogger, u as RegisteredLogger } from "../index-Biaf3BmX.js";
 //#region src/base/MastraBase.d.ts
-declare class MastraBase {
+export declare class MastraBase {
   #private;
   component: RegisteredLogger;
   protected logger: IMastraLogger;
@@ -27,5 +27,4 @@ declare class MastraBase {
   __setLogger(logger: IMastraLogger): void;
 }
 //#endregion
-export { MastraBase };
 //# sourceMappingURL=index.d.ts.map

package/dist/_types/@internal_auth/dist/session/index.d.ts

@@ -24,6 +24,15 @@ export interface ISessionProvider<TSession extends Session = Session> {
     getSessionIdFromRequest(request: Request): string | null;
     getSessionHeaders(session: TSession): Record<string, string>;
     getClearSessionHeaders(): Record<string, string>;
+    /**
+     * Optional: `Set-Cookie` values expiring legacy copies of the session cookie
+     * (for example one an earlier release scoped to a shared parent `Domain`).
+     * A browser only deletes a cookie whose exact `(name, Domain, Path)` match,
+     * so servers append these to every response that sets or clears the session
+     * cookie; otherwise a stale shared-domain copy keeps being sent to every
+     * sibling host until it expires.
+     */
+    getLegacySessionClearCookies?(): string[];
 }
 export { MemorySessionProvider, type MemorySessionProviderOptions } from './memory.js';
 export { CookieSessionProvider, type CookieSessionProviderOptions } from './cookie.js';

package/dist/index.cjs

@@ -429,7 +429,27 @@ function resolvePermissionsFromMapping(roles, mapping) {
 //#endregion
 //#region src/index.ts
 const DEFAULT_SESSION_MAX_AGE_SECONDS = 1209600;
+/**
+* Name of the sealed session cookie on the shared API. Used for server-to-server
+* calls to the shared API, and as the unprefixed (legacy / insecure-dev /
+* explicit-domain) browser cookie name.
+*/
 const COOKIE_NAME = "wos-session";
+/** Host-only browser session cookie used on secure deployments. */
+const HOST_SESSION_COOKIE_NAME = "__Host-wos-session";
+/** Unprefixed session cookie name earlier releases issued (often with a shared parent `Domain`). */
+const LEGACY_SESSION_COOKIE_NAME = COOKIE_NAME;
+/** A `Domain` attribute value we are willing to emit in a clearing cookie. */
+function normalizeCookieDomain(value) {
+	const domain = value?.trim().toLowerCase();
+	if (!domain) return void 0;
+	if (!/^\.?[a-z0-9-]+(\.[a-z0-9-]+)*$/.test(domain)) return void 0;
+	return domain;
+}
+function isLocalhostDomain(domain) {
+	const bare = domain.replace(/^\./, "");
+	return bare === "localhost" || bare.endsWith(".localhost") || /^[\d.]+$/.test(bare);
+}
 const PROJECT_CONFIG_FILE = ".mastra-project.json";
 /**
 * Read `organizationId` from a project's `.mastra-project.json` in the current
@@ -479,6 +499,10 @@ var MastraAuthStudio = class extends MastraAuthProvider {
 	organizationId;
 	useProductionCookies;
 	cookieDomain;
+	/** Browser cookie name this provider issues. */
+	sessionCookieName;
+	/** `Set-Cookie` values expiring legacy copies of the session cookie. */
+	legacyClearCookies;
 	sessionMaxAgeSeconds;
 	/**
 	* `userId → sealed session cookie` cache. The `IOrganizationsProvider`
@@ -528,7 +552,8 @@ var MastraAuthStudio = class extends MastraAuthProvider {
 		this.sharedApiUrl = explicitSharedApiUrl || "https://platform.mastra.ai/v1";
 		this.organizationId = options?.organizationId || process.env.MASTRA_ORGANIZATION_ID || readOrganizationIdFromProjectConfig();
 		if (this.sharedApiUrl.endsWith("/")) this.sharedApiUrl = this.sharedApiUrl.slice(0, -1);
-		this.cookieDomain = options?.cookieDomain || process.env.MASTRA_COOKIE_DOMAIN;
+		this.cookieDomain = normalizeCookieDomain(options?.cookieDomain);
+		const envCookieDomain = normalizeCookieDomain(process.env.MASTRA_COOKIE_DOMAIN);
 		const envMaxAge = Number(process.env.MASTRA_SESSION_MAX_AGE);
 		const maxAge = options?.sessionMaxAgeSeconds ?? (envMaxAge > 0 ? envMaxAge : void 0);
 		this.sessionMaxAgeSeconds = maxAge && Number.isFinite(maxAge) && maxAge > 0 ? Math.floor(maxAge) : DEFAULT_SESSION_MAX_AGE_SECONDS;
@@ -539,8 +564,31 @@ var MastraAuthStudio = class extends MastraAuthProvider {
 		} catch {
 			autoDetectMastraAi = false;
 		}
-		this.useProductionCookies = !!this.cookieDomain || autoDetectMastraAi;
-		if (!this.cookieDomain && autoDetectMastraAi) this.cookieDomain = ".mastra.ai";
+		this.useProductionCookies = options?.secureCookies ?? (!!(this.cookieDomain && !isLocalhostDomain(this.cookieDomain)) || !!(envCookieDomain && !isLocalhostDomain(envCookieDomain)) || autoDetectMastraAi);
+		this.sessionCookieName = this.useProductionCookies && !this.cookieDomain ? HOST_SESSION_COOKIE_NAME : LEGACY_SESSION_COOKIE_NAME;
+		const legacyDomains = /* @__PURE__ */ new Set();
+		const addLegacyDomain = (value) => {
+			const domain = normalizeCookieDomain(value);
+			if (domain && domain !== this.cookieDomain) legacyDomains.add(domain);
+		};
+		addLegacyDomain(envCookieDomain);
+		if (autoDetectMastraAi) addLegacyDomain(".mastra.ai");
+		for (const value of (process.env.MASTRA_LEGACY_COOKIE_DOMAINS ?? "").split(",")) addLegacyDomain(value);
+		for (const value of options?.legacyCookieDomains ?? []) addLegacyDomain(value);
+		const clearAttributes = [
+			"HttpOnly",
+			"SameSite=Lax",
+			"Path=/",
+			"Max-Age=0"
+		];
+		if (this.useProductionCookies) clearAttributes.push("Secure");
+		this.legacyClearCookies = [];
+		if (this.sessionCookieName !== "wos-session" || this.cookieDomain) this.legacyClearCookies.push([`${LEGACY_SESSION_COOKIE_NAME}=`, ...clearAttributes].join("; "));
+		for (const domain of legacyDomains) this.legacyClearCookies.push([
+			`${LEGACY_SESSION_COOKIE_NAME}=`,
+			...clearAttributes,
+			`Domain=${domain}`
+		].join("; "));
 		if (options) this.registerOptions(options);
 	}
 	/**
@@ -549,8 +597,12 @@ var MastraAuthStudio = class extends MastraAuthProvider {
 	*/
 	async authenticateToken(token, request) {
 		let user = null;
-		const sessionCookie = parseCookie(getRequestHeader(request, "Cookie"), COOKIE_NAME);
-		if (sessionCookie) user = await this.verifySessionCookie(sessionCookie, request);
+		const cookieHeader = getRequestHeader(request, "Cookie");
+		const sessionCookie = this.readSessionCookie(cookieHeader);
+		if (sessionCookie) {
+			user = await this.verifySessionCookie(sessionCookie.value, request);
+			if (user && sessionCookie.legacy) this.queueSessionCookieMigration(request, sessionCookie.value);
+		}
 		if (!user && token) user = await this.verifyBearerToken(token);
 		if (!user) return null;
 		if (this.organizationId && !user.memberOrgIds?.includes(this.organizationId)) return null;
@@ -604,8 +656,7 @@ var MastraAuthStudio = class extends MastraAuthProvider {
 		};
 	}
 	async getLogoutUrl(_redirectUri, request) {
-		const cookieHeader = request?.headers.get("Cookie");
-		const sessionCookie = parseCookie(cookieHeader, COOKIE_NAME);
+		const sessionCookie = this.readSessionCookie(request?.headers.get("Cookie"))?.value;
 		if (!sessionCookie) return null;
 		try {
 			const res = await fetch(`${this.sharedApiUrl}/auth/logout`, {
@@ -688,39 +739,76 @@ var MastraAuthStudio = class extends MastraAuthProvider {
 		}
 	}
 	getSessionIdFromRequest(request) {
-		return parseCookie(request.headers.get("Cookie"), COOKIE_NAME);
+		return this.readSessionCookie(request.headers.get("Cookie"))?.value ?? null;
+	}
+	/**
+	* The browser session cookie on a request: this provider's cookie
+	* (`__Host-wos-session` on secure deployments) first, then — only to migrate
+	* sessions issued by earlier releases — the unprefixed `wos-session`.
+	*/
+	readSessionCookie(cookieHeader) {
+		const current = parseCookie(cookieHeader, this.sessionCookieName);
+		if (current) return {
+			value: current,
+			legacy: false
+		};
+		if (this.sessionCookieName === "wos-session") return null;
+		const legacy = parseCookie(cookieHeader, LEGACY_SESSION_COOKIE_NAME);
+		return legacy ? {
+			value: legacy,
+			legacy: true
+		} : null;
+	}
+	/**
+	* A request authenticated with a legacy `wos-session` cookie: re-issue the
+	* session under this provider's cookie so the browser stops depending on the
+	* legacy (possibly shared-domain) copy. The legacy copy itself is expired on
+	* the next sign-in, refresh or sign-out (see `getLegacySessionClearCookies`).
+	*/
+	queueSessionCookieMigration(request, sessionId) {
+		const rawRequest = getWebRequest(request);
+		if (!rawRequest || this.pendingResponseHeaders.has(rawRequest)) return;
+		this.pendingResponseHeaders.set(rawRequest, this.getSessionHeaders({
+			id: sessionId,
+			userId: "",
+			expiresAt: /* @__PURE__ */ new Date(),
+			createdAt: /* @__PURE__ */ new Date()
+		}));
 	}
 	getSessionHeaders(session) {
-		const parts = [
-			`${COOKIE_NAME}=${session.id}`,
-			"HttpOnly",
-			"SameSite=Lax",
-			"Path=/",
-			`Max-Age=${this.sessionMaxAgeSeconds}`
-		];
-		if (this.useProductionCookies && this.cookieDomain) {
-			parts.push("Secure");
-			parts.push(`Domain=${this.cookieDomain}`);
-		}
-		return { "Set-Cookie": parts.join("; ") };
+		return { "Set-Cookie": this.buildSessionCookie(`${this.sessionCookieName}=${session.id}`, [`Max-Age=${this.sessionMaxAgeSeconds}`]) };
 	}
 	getClearSessionHeaders() {
+		return { "Set-Cookie": this.buildSessionCookie(`${this.sessionCookieName}=`, ["Max-Age=0"]) };
+	}
+	/**
+	* `Set-Cookie` values expiring legacy copies of the session cookie: the
+	* unprefixed `wos-session` on this host and on every domain an earlier
+	* release (or the platform) scoped it to. Servers send these with every
+	* response that sets or clears the session cookie.
+	*/
+	getLegacySessionClearCookies() {
+		return [...this.legacyClearCookies];
+	}
+	buildSessionCookie(nameValue, extra) {
 		const parts = [
-			`${COOKIE_NAME}=`,
+			nameValue,
 			"HttpOnly",
 			"SameSite=Lax",
 			"Path=/",
-			"Max-Age=0"
+			...extra
 		];
-		if (this.useProductionCookies && this.cookieDomain) {
-			parts.push("Secure");
-			parts.push(`Domain=${this.cookieDomain}`);
-		}
-		return { "Set-Cookie": parts.join("; ") };
+		if (this.useProductionCookies) parts.push("Secure");
+		if (this.cookieDomain && this.sessionCookieName !== "__Host-wos-session") parts.push(`Domain=${this.cookieDomain}`);
+		return parts.join("; ");
 	}
 	async getCurrentUser(request) {
-		const sessionCookie = parseCookie(request.headers.get("Cookie"), COOKIE_NAME);
-		if (sessionCookie) return this.verifySessionCookie(sessionCookie, request);
+		const sessionCookie = this.readSessionCookie(request.headers.get("Cookie"));
+		if (sessionCookie) {
+			const user = await this.verifySessionCookie(sessionCookie.value, request);
+			if (user && sessionCookie.legacy) this.queueSessionCookieMigration(request, sessionCookie.value);
+			return user;
+		}
 		const authHeader = request.headers.get("Authorization");
 		if (authHeader?.startsWith("Bearer ")) return this.verifyBearerToken(authHeader.slice(7));
 		return null;
@@ -1038,7 +1126,13 @@ var MastraAuthStudio = class extends MastraAuthProvider {
 };
 function parseCookie(cookieHeader, name) {
 	if (!cookieHeader) return null;
-	return cookieHeader.match(new RegExp(`${name}=([^;]+)`))?.[1] ?? null;
+	for (const pair of cookieHeader.split(";")) {
+		const eq = pair.indexOf("=");
+		if (eq === -1 || pair.slice(0, eq).trim() !== name) continue;
+		const value = pair.slice(eq + 1).trim();
+		if (value) return value;
+	}
+	return null;
 }
 /**
 * WorkOS AuthKit conventionally uses `admin` / `owner` for admin-equivalent
@@ -1097,6 +1191,8 @@ var MastraRBACStudio = class {
 	}
 };
 //#endregion
+exports.HOST_SESSION_COOKIE_NAME = HOST_SESSION_COOKIE_NAME;
+exports.LEGACY_SESSION_COOKIE_NAME = LEGACY_SESSION_COOKIE_NAME;
 exports.MastraAuthStudio = MastraAuthStudio;
 exports.MastraRBACStudio = MastraRBACStudio;