@mastra/auth-studio 1.3.2-alpha.1 → 1.3.3-alpha.0

package/dist/index.js

@@ -1,3 +1,7 @@
+import { createHash } from 'crypto';
+
+// src/index.ts
+
 // ../../packages/_internals/auth/dist/chunk-LZCWL5CT.js
 var RESOURCE_EXPANSIONS = {
   stored: [
@@ -264,6 +268,8 @@ function getRequestHeader2(request, name) {
   return request.raw?.headers.get(name) ?? request.headers?.get(name) ?? request.header(name) ?? null;
 }
 var COOKIE_NAME = "wos-session";
+var VERIFY_FETCH_TIMEOUT_MS = 15e3;
+var VERIFY_CACHE_TTL_MS = 3e4;
 var MastraAuthStudio = class extends MastraAuthProvider {
   isMastraCloudAuth = true;
   sharedApiUrl;
@@ -279,6 +285,15 @@ var MastraAuthStudio = class extends MastraAuthProvider {
    */
   userSessionCookies = /* @__PURE__ */ new Map();
   maxCachedSessions = 1e3;
+  /**
+   * Short-TTL cache of SUCCESSFUL credential verifications, keyed by a
+   * sha256 of the credential (never the raw cookie/token). Every protected
+   * request re-verifies against the shared API otherwise — one network
+   * round trip per request. Failures are never cached, so a rejected
+   * credential is always re-checked. Bounded + insert-order evicted.
+   */
+  verifiedCredentials = /* @__PURE__ */ new Map();
+  maxCachedVerifications = 1e3;
   /**
    * In-flight `ensureOrganization` promises keyed by userId. Concurrent calls
    * for the same brand-new user (multiple tabs, parallel requests) would
@@ -633,6 +648,27 @@ var MastraAuthStudio = class extends MastraAuthProvider {
       if (oldest !== void 0) this.userSessionCookies.delete(oldest);
     }
   }
+  /** Cache key for a verified credential — hash, never the raw secret. */
+  verificationKey(kind, credential) {
+    return createHash("sha256").update(`${kind}:${credential}`).digest("hex");
+  }
+  getCachedVerification(key) {
+    const entry = this.verifiedCredentials.get(key);
+    if (!entry) return null;
+    if (entry.expiresAt <= Date.now()) {
+      this.verifiedCredentials.delete(key);
+      return null;
+    }
+    return entry.user;
+  }
+  cacheVerification(key, user) {
+    this.verifiedCredentials.delete(key);
+    this.verifiedCredentials.set(key, { user, expiresAt: Date.now() + VERIFY_CACHE_TTL_MS });
+    if (this.verifiedCredentials.size > this.maxCachedVerifications) {
+      const oldest = this.verifiedCredentials.keys().next().value;
+      if (oldest !== void 0) this.verifiedCredentials.delete(oldest);
+    }
+  }
   /**
    * Fetch the shared API's `/auth/me` and return the raw response body, or
    * `null` on any non-OK / network error. Split out so `ensureOrganization`
@@ -641,7 +677,8 @@ var MastraAuthStudio = class extends MastraAuthProvider {
   async fetchMe(sessionCookie) {
     try {
       const res = await fetch(`${this.sharedApiUrl}/auth/me`, {
-        headers: { Cookie: `${COOKIE_NAME}=${sessionCookie}` }
+        headers: { Cookie: `${COOKIE_NAME}=${sessionCookie}` },
+        signal: AbortSignal.timeout(VERIFY_FETCH_TIMEOUT_MS)
       });
       if (!res.ok) return null;
       return await res.json();
@@ -654,11 +691,18 @@ var MastraAuthStudio = class extends MastraAuthProvider {
    * to validate it and get user info.
    */
   async verifySessionCookie(sessionCookie) {
+    const cacheKey = this.verificationKey("cookie", sessionCookie);
+    const cached = this.getCachedVerification(cacheKey);
+    if (cached) {
+      this.rememberUserSession(cached.id, sessionCookie);
+      return cached;
+    }
     try {
       const res = await fetch(`${this.sharedApiUrl}/auth/me`, {
         headers: {
           Cookie: `${COOKIE_NAME}=${sessionCookie}`
-        }
+        },
+        signal: AbortSignal.timeout(VERIFY_FETCH_TIMEOUT_MS)
       });
       if (!res.ok) {
         this.logger.warn("verifySessionCookie: shared API returned non-OK status", {
@@ -670,7 +714,7 @@ var MastraAuthStudio = class extends MastraAuthProvider {
       }
       const data = await res.json();
       this.rememberUserSession(data.user.id, sessionCookie);
-      return {
+      const user = {
         id: data.user.id,
         email: data.user.email,
         name: [data.user.firstName, data.user.lastName].filter(Boolean).join(" ") || void 0,
@@ -680,6 +724,8 @@ var MastraAuthStudio = class extends MastraAuthProvider {
         permissions: data.permissions,
         memberOrgIds: data.memberOrgIds
       };
+      if (user.organizationId) this.cacheVerification(cacheKey, user);
+      return user;
     } catch (error) {
       this.logger.error("verifySessionCookie: fetch to shared API failed", {
         url: `${this.sharedApiUrl}/auth/me`,
@@ -693,11 +739,15 @@ var MastraAuthStudio = class extends MastraAuthProvider {
    * to validate it and get user info (used for CLI tokens).
    */
   async verifyBearerToken(token) {
+    const cacheKey = this.verificationKey("bearer", token);
+    const cached = this.getCachedVerification(cacheKey);
+    if (cached) return cached;
     try {
       const res = await fetch(`${this.sharedApiUrl}/auth/verify`, {
         headers: {
           Authorization: `Bearer ${token}`
-        }
+        },
+        signal: AbortSignal.timeout(VERIFY_FETCH_TIMEOUT_MS)
       });
       if (!res.ok) {
         this.logger.warn("verifyBearerToken: shared API returned non-OK status", {
@@ -707,7 +757,7 @@ var MastraAuthStudio = class extends MastraAuthProvider {
         return null;
       }
       const data = await res.json();
-      return {
+      const user = {
         id: data.user.id,
         email: data.user.email,
         name: [data.user.firstName, data.user.lastName].filter(Boolean).join(" ") || void 0,
@@ -715,6 +765,8 @@ var MastraAuthStudio = class extends MastraAuthProvider {
         role: data.role,
         memberOrgIds: data.memberOrgIds
       };
+      if (user.organizationId) this.cacheVerification(cacheKey, user);
+      return user;
     } catch (error) {
       this.logger.error("verifyBearerToken: fetch to shared API failed", {
         url: `${this.sharedApiUrl}/auth/verify`,