@mastra/auth-studio 1.3.10 → 1.3.11-alpha.1

package/dist/_types/@internal_auth/dist/_types/@internal_core/dist/base/index.d.ts

@@ -1,6 +1,5 @@
-import { i as IMastraLogger, u as RegisteredLogger } from "../index-Biaf3BmX.js";
-//#region src/base/MastraBase.d.ts
-declare class MastraBase {
+import { i as IMastraLogger, u as RegisteredLogger } from "../index-TNVgGNjs.js";
+export declare class MastraBase {
   #private;
   component: RegisteredLogger;
   protected logger: IMastraLogger;
@@ -26,6 +25,4 @@ declare class MastraBase {
    */
   __setLogger(logger: IMastraLogger): void;
 }
-//#endregion
-export { MastraBase };
 //# sourceMappingURL=index.d.ts.map

package/dist/_types/@internal_auth/dist/_types/@internal_core/dist/{index-Biaf3BmX.d.ts → index-TNVgGNjs.d.ts}

@@ -1,5 +1,4 @@
 import { Transform } from "stream";
-//#region src/logger/adapter.d.ts
 /**
  * OpenTelemetry-compatible trace correlation fields, injected at the top
  * level of a logger's native record.
@@ -91,8 +90,6 @@ declare function exportTrackedException(ctx: LoggerAdapterContext | undefined, e
  * so the derived record preserves all context from the native call.
  */
 declare function buildLogRecordData(args: unknown[]): Record<string, unknown> | undefined;
-//#endregion
-//#region src/logger/index.d.ts
 declare const RegisteredLogger: {
   readonly AGENT: 'AGENT';
   readonly OBSERVABILITY: 'OBSERVABILITY';
@@ -314,6 +311,5 @@ declare class ConsoleLogger extends MastraLogger {
     hasMore: boolean;
   }>;
 }
-//#endregion
 export { buildLogRecordData as _, LogFilter as a, LoggerTransport as c, createCustomTransport as d, AdaptableLogger as f, TraceFields as g, LoggerAdapterOptions as h, IMastraLogger as i, MastraLogger as l, LoggerAdapterContext as m, ConsoleLogger as n, LogFilterContext as o, AdapterLogSink as p, ConsoleLoggerOptions as r, LogLevel as s, BaseLogMessage as t, RegisteredLogger as u, exportTrackedException as v, isAdaptableLogger as y };
-//# sourceMappingURL=index-Biaf3BmX.d.ts.map
+//# sourceMappingURL=index-TNVgGNjs.d.ts.map

package/dist/_types/@internal_auth/dist/session/index.d.ts

@@ -24,6 +24,15 @@ export interface ISessionProvider<TSession extends Session = Session> {
     getSessionIdFromRequest(request: Request): string | null;
     getSessionHeaders(session: TSession): Record<string, string>;
     getClearSessionHeaders(): Record<string, string>;
+    /**
+     * Optional: `Set-Cookie` values expiring legacy copies of the session cookie
+     * (for example one an earlier release scoped to a shared parent `Domain`).
+     * A browser only deletes a cookie whose exact `(name, Domain, Path)` match,
+     * so servers append these to every response that sets or clears the session
+     * cookie; otherwise a stale shared-domain copy keeps being sent to every
+     * sibling host until it expires.
+     */
+    getLegacySessionClearCookies?(): string[];
 }
 export { MemorySessionProvider, type MemorySessionProviderOptions } from './memory.js';
 export { CookieSessionProvider, type CookieSessionProviderOptions } from './cookie.js';

package/dist/index.cjs

@@ -1,7 +1,7 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 let fs = require("fs");
 let path = require("path");
-//#region ../../packages/_internals/auth/dist/types/index.js
+// ../../packages/_internals/auth/dist/types/index.js
 function headerFromPlainObject(headers, name) {
 	const normalizedName = name.toLowerCase();
 	const matchingKey = Object.keys(headers).find((key) => key.toLowerCase() === normalizedName);
@@ -25,8 +25,7 @@ function getWebRequest(request) {
 	if (request instanceof Request) return request;
 	return request.raw instanceof Request ? request.raw : void 0;
 }
-//#endregion
-//#region ../../packages/_internal-core/dist/logger/index.js
+// ../../packages/_internal-core/dist/logger/index.js
 /**
 * Export a tracked exception through the adapter sink, mirroring the
 * DualLogger dual-write shape (`errorId`/`domain`/`category`/`details`/`cause`
@@ -259,8 +258,7 @@ var ConsoleLogger = class ConsoleLogger extends MastraLogger {
 		};
 	}
 };
-//#endregion
-//#region ../../packages/_internal-core/dist/base/index.js
+// ../../packages/_internal-core/dist/base/index.js
 var MastraBase = class {
 	component = RegisteredLogger.LLM;
 	logger;
@@ -294,8 +292,7 @@ var MastraBase = class {
 		this.logger = "child" in logger && typeof logger.child === "function" ? logger.child({ component: this.component }) : logger;
 	}
 };
-//#endregion
-//#region ../../packages/_internals/auth/dist/provider/index.js
+// ../../packages/_internals/auth/dist/provider/index.js
 var MastraAuthProvider = class extends MastraBase {
 	protected;
 	public;
@@ -307,7 +304,7 @@ var MastraAuthProvider = class extends MastraBase {
 		if (options?.authorizeUser) this.authorizeUser = options.authorizeUser.bind(this);
 		this.protected = options?.protected;
 		this.public = options?.public;
-		this.mapUserToResourceId = options?.mapUserToResourceId;
+		if (options?.mapUserToResourceId) this.mapUserToResourceId = options.mapUserToResourceId;
 	}
 	registerOptions(opts) {
 		if (opts?.authorizeUser) this.authorizeUser = opts.authorizeUser.bind(this);
@@ -316,8 +313,7 @@ var MastraAuthProvider = class extends MastraBase {
 		if (opts?.public) this.public = opts.public;
 	}
 };
-//#endregion
-//#region ../../packages/_internals/auth/dist/ee-XRuijAiF.js
+// ../../packages/_internals/auth/dist/ee-CnZdF0Vm.js
 /**
 * FGA enforcement utility for checking fine-grained authorization.
 *
@@ -426,10 +422,29 @@ function resolvePermissionsFromMapping(roles, mapping) {
 * @license Mastra Enterprise License - see ee/LICENSE
 * @packageDocumentation
 */
-//#endregion
-//#region src/index.ts
+// src/index.ts
 const DEFAULT_SESSION_MAX_AGE_SECONDS = 1209600;
+/**
+* Name of the sealed session cookie on the shared API. Used for server-to-server
+* calls to the shared API, and as the unprefixed (legacy / insecure-dev /
+* explicit-domain) browser cookie name.
+*/
 const COOKIE_NAME = "wos-session";
+/** Host-only browser session cookie used on secure deployments. */
+const HOST_SESSION_COOKIE_NAME = "__Host-wos-session";
+/** Unprefixed session cookie name earlier releases issued (often with a shared parent `Domain`). */
+const LEGACY_SESSION_COOKIE_NAME = COOKIE_NAME;
+/** A `Domain` attribute value we are willing to emit in a clearing cookie. */
+function normalizeCookieDomain(value) {
+	const domain = value?.trim().toLowerCase();
+	if (!domain) return void 0;
+	if (!/^\.?[a-z0-9-]+(\.[a-z0-9-]+)*$/.test(domain)) return void 0;
+	return domain;
+}
+function isLocalhostDomain(domain) {
+	const bare = domain.replace(/^\./, "");
+	return bare === "localhost" || bare.endsWith(".localhost") || /^[\d.]+$/.test(bare);
+}
 const PROJECT_CONFIG_FILE = ".mastra-project.json";
 /**
 * Read `organizationId` from a project's `.mastra-project.json` in the current
@@ -479,6 +494,10 @@ var MastraAuthStudio = class extends MastraAuthProvider {
 	organizationId;
 	useProductionCookies;
 	cookieDomain;
+	/** Browser cookie name this provider issues. */
+	sessionCookieName;
+	/** `Set-Cookie` values expiring legacy copies of the session cookie. */
+	legacyClearCookies;
 	sessionMaxAgeSeconds;
 	/**
 	* `userId → sealed session cookie` cache. The `IOrganizationsProvider`
@@ -528,7 +547,8 @@ var MastraAuthStudio = class extends MastraAuthProvider {
 		this.sharedApiUrl = explicitSharedApiUrl || "https://platform.mastra.ai/v1";
 		this.organizationId = options?.organizationId || process.env.MASTRA_ORGANIZATION_ID || readOrganizationIdFromProjectConfig();
 		if (this.sharedApiUrl.endsWith("/")) this.sharedApiUrl = this.sharedApiUrl.slice(0, -1);
-		this.cookieDomain = options?.cookieDomain || process.env.MASTRA_COOKIE_DOMAIN;
+		this.cookieDomain = normalizeCookieDomain(options?.cookieDomain);
+		const envCookieDomain = normalizeCookieDomain(process.env.MASTRA_COOKIE_DOMAIN);
 		const envMaxAge = Number(process.env.MASTRA_SESSION_MAX_AGE);
 		const maxAge = options?.sessionMaxAgeSeconds ?? (envMaxAge > 0 ? envMaxAge : void 0);
 		this.sessionMaxAgeSeconds = maxAge && Number.isFinite(maxAge) && maxAge > 0 ? Math.floor(maxAge) : DEFAULT_SESSION_MAX_AGE_SECONDS;
@@ -539,8 +559,31 @@ var MastraAuthStudio = class extends MastraAuthProvider {
 		} catch {
 			autoDetectMastraAi = false;
 		}
-		this.useProductionCookies = !!this.cookieDomain || autoDetectMastraAi;
-		if (!this.cookieDomain && autoDetectMastraAi) this.cookieDomain = ".mastra.ai";
+		this.useProductionCookies = options?.secureCookies ?? (!!(this.cookieDomain && !isLocalhostDomain(this.cookieDomain)) || !!(envCookieDomain && !isLocalhostDomain(envCookieDomain)) || autoDetectMastraAi);
+		this.sessionCookieName = this.useProductionCookies && !this.cookieDomain ? HOST_SESSION_COOKIE_NAME : LEGACY_SESSION_COOKIE_NAME;
+		const legacyDomains = /* @__PURE__ */ new Set();
+		const addLegacyDomain = (value) => {
+			const domain = normalizeCookieDomain(value);
+			if (domain && domain !== this.cookieDomain) legacyDomains.add(domain);
+		};
+		addLegacyDomain(envCookieDomain);
+		if (autoDetectMastraAi) addLegacyDomain(".mastra.ai");
+		for (const value of (process.env.MASTRA_LEGACY_COOKIE_DOMAINS ?? "").split(",")) addLegacyDomain(value);
+		for (const value of options?.legacyCookieDomains ?? []) addLegacyDomain(value);
+		const clearAttributes = [
+			"HttpOnly",
+			"SameSite=Lax",
+			"Path=/",
+			"Max-Age=0"
+		];
+		if (this.useProductionCookies) clearAttributes.push("Secure");
+		this.legacyClearCookies = [];
+		if (this.sessionCookieName !== "wos-session" || this.cookieDomain) this.legacyClearCookies.push([`${LEGACY_SESSION_COOKIE_NAME}=`, ...clearAttributes].join("; "));
+		for (const domain of legacyDomains) this.legacyClearCookies.push([
+			`${LEGACY_SESSION_COOKIE_NAME}=`,
+			...clearAttributes,
+			`Domain=${domain}`
+		].join("; "));
 		if (options) this.registerOptions(options);
 	}
 	/**
@@ -549,8 +592,12 @@ var MastraAuthStudio = class extends MastraAuthProvider {
 	*/
 	async authenticateToken(token, request) {
 		let user = null;
-		const sessionCookie = parseCookie(getRequestHeader(request, "Cookie"), COOKIE_NAME);
-		if (sessionCookie) user = await this.verifySessionCookie(sessionCookie, request);
+		const cookieHeader = getRequestHeader(request, "Cookie");
+		const sessionCookie = this.readSessionCookie(cookieHeader);
+		if (sessionCookie) {
+			user = await this.verifySessionCookie(sessionCookie.value, request);
+			if (user && sessionCookie.legacy) this.queueSessionCookieMigration(request, sessionCookie.value);
+		}
 		if (!user && token) user = await this.verifyBearerToken(token);
 		if (!user) return null;
 		if (this.organizationId && !user.memberOrgIds?.includes(this.organizationId)) return null;
@@ -604,8 +651,7 @@ var MastraAuthStudio = class extends MastraAuthProvider {
 		};
 	}
 	async getLogoutUrl(_redirectUri, request) {
-		const cookieHeader = request?.headers.get("Cookie");
-		const sessionCookie = parseCookie(cookieHeader, COOKIE_NAME);
+		const sessionCookie = this.readSessionCookie(request?.headers.get("Cookie"))?.value;
 		if (!sessionCookie) return null;
 		try {
 			const res = await fetch(`${this.sharedApiUrl}/auth/logout`, {
@@ -688,39 +734,76 @@ var MastraAuthStudio = class extends MastraAuthProvider {
 		}
 	}
 	getSessionIdFromRequest(request) {
-		return parseCookie(request.headers.get("Cookie"), COOKIE_NAME);
+		return this.readSessionCookie(request.headers.get("Cookie"))?.value ?? null;
+	}
+	/**
+	* The browser session cookie on a request: this provider's cookie
+	* (`__Host-wos-session` on secure deployments) first, then — only to migrate
+	* sessions issued by earlier releases — the unprefixed `wos-session`.
+	*/
+	readSessionCookie(cookieHeader) {
+		const current = parseCookie(cookieHeader, this.sessionCookieName);
+		if (current) return {
+			value: current,
+			legacy: false
+		};
+		if (this.sessionCookieName === "wos-session") return null;
+		const legacy = parseCookie(cookieHeader, LEGACY_SESSION_COOKIE_NAME);
+		return legacy ? {
+			value: legacy,
+			legacy: true
+		} : null;
+	}
+	/**
+	* A request authenticated with a legacy `wos-session` cookie: re-issue the
+	* session under this provider's cookie so the browser stops depending on the
+	* legacy (possibly shared-domain) copy. The legacy copy itself is expired on
+	* the next sign-in, refresh or sign-out (see `getLegacySessionClearCookies`).
+	*/
+	queueSessionCookieMigration(request, sessionId) {
+		const rawRequest = getWebRequest(request);
+		if (!rawRequest || this.pendingResponseHeaders.has(rawRequest)) return;
+		this.pendingResponseHeaders.set(rawRequest, this.getSessionHeaders({
+			id: sessionId,
+			userId: "",
+			expiresAt: /* @__PURE__ */ new Date(),
+			createdAt: /* @__PURE__ */ new Date()
+		}));
 	}
 	getSessionHeaders(session) {
-		const parts = [
-			`${COOKIE_NAME}=${session.id}`,
-			"HttpOnly",
-			"SameSite=Lax",
-			"Path=/",
-			`Max-Age=${this.sessionMaxAgeSeconds}`
-		];
-		if (this.useProductionCookies && this.cookieDomain) {
-			parts.push("Secure");
-			parts.push(`Domain=${this.cookieDomain}`);
-		}
-		return { "Set-Cookie": parts.join("; ") };
+		return { "Set-Cookie": this.buildSessionCookie(`${this.sessionCookieName}=${session.id}`, [`Max-Age=${this.sessionMaxAgeSeconds}`]) };
 	}
 	getClearSessionHeaders() {
+		return { "Set-Cookie": this.buildSessionCookie(`${this.sessionCookieName}=`, ["Max-Age=0"]) };
+	}
+	/**
+	* `Set-Cookie` values expiring legacy copies of the session cookie: the
+	* unprefixed `wos-session` on this host and on every domain an earlier
+	* release (or the platform) scoped it to. Servers send these with every
+	* response that sets or clears the session cookie.
+	*/
+	getLegacySessionClearCookies() {
+		return [...this.legacyClearCookies];
+	}
+	buildSessionCookie(nameValue, extra) {
 		const parts = [
-			`${COOKIE_NAME}=`,
+			nameValue,
 			"HttpOnly",
 			"SameSite=Lax",
 			"Path=/",
-			"Max-Age=0"
+			...extra
 		];
-		if (this.useProductionCookies && this.cookieDomain) {
-			parts.push("Secure");
-			parts.push(`Domain=${this.cookieDomain}`);
-		}
-		return { "Set-Cookie": parts.join("; ") };
+		if (this.useProductionCookies) parts.push("Secure");
+		if (this.cookieDomain && this.sessionCookieName !== "__Host-wos-session") parts.push(`Domain=${this.cookieDomain}`);
+		return parts.join("; ");
 	}
 	async getCurrentUser(request) {
-		const sessionCookie = parseCookie(request.headers.get("Cookie"), COOKIE_NAME);
-		if (sessionCookie) return this.verifySessionCookie(sessionCookie, request);
+		const sessionCookie = this.readSessionCookie(request.headers.get("Cookie"));
+		if (sessionCookie) {
+			const user = await this.verifySessionCookie(sessionCookie.value, request);
+			if (user && sessionCookie.legacy) this.queueSessionCookieMigration(request, sessionCookie.value);
+			return user;
+		}
 		const authHeader = request.headers.get("Authorization");
 		if (authHeader?.startsWith("Bearer ")) return this.verifyBearerToken(authHeader.slice(7));
 		return null;
@@ -1038,7 +1121,13 @@ var MastraAuthStudio = class extends MastraAuthProvider {
 };
 function parseCookie(cookieHeader, name) {
 	if (!cookieHeader) return null;
-	return cookieHeader.match(new RegExp(`${name}=([^;]+)`))?.[1] ?? null;
+	for (const pair of cookieHeader.split(";")) {
+		const eq = pair.indexOf("=");
+		if (eq === -1 || pair.slice(0, eq).trim() !== name) continue;
+		const value = pair.slice(eq + 1).trim();
+		if (value) return value;
+	}
+	return null;
 }
 /**
 * WorkOS AuthKit conventionally uses `admin` / `owner` for admin-equivalent
@@ -1096,7 +1185,8 @@ var MastraRBACStudio = class {
 		return permissions.some((required) => userPermissions.some((p) => matchesPermission(p, required)));
 	}
 };
-//#endregion
+exports.HOST_SESSION_COOKIE_NAME = HOST_SESSION_COOKIE_NAME;
+exports.LEGACY_SESSION_COOKIE_NAME = LEGACY_SESSION_COOKIE_NAME;
 exports.MastraAuthStudio = MastraAuthStudio;
 exports.MastraRBACStudio = MastraRBACStudio;