@mastra/auth-studio 1.3.3 → 1.3.4-alpha.0

package/dist/index.js

@@ -1,112 +1,24 @@
 import { createHash } from "crypto";
-//#region ../../packages/_internals/auth/dist/ee-C8o0LZ3r.js
-/**
-* FGA enforcement utility for checking fine-grained authorization.
-*
-* @license Mastra Enterprise License - see ee/LICENSE
-*/
-/**
-* Compound resource keys that expand to a set of per-family resources.
-* A granted `stored:<action>` is treated as matching any `stored-<family>:<action>`
-* (and `stored:*` matches any `stored-<family>:*`).
-*/
-const RESOURCE_EXPANSIONS = { stored: [
-	"stored-agents",
-	"stored-mcp-clients",
-	"stored-prompt-blocks",
-	"stored-scorers",
-	"stored-skills",
-	"stored-workspaces"
-] };
-/**
-* Check if a permission matches (including wildcard support).
-*
-* Permission format: `{resource}:{action}[:{resource-id}]`
-*
-* Examples:
-* - `*` matches everything
-* - `agents:*` matches `agents:read`, `agents:read:my-agent`
-* - `*:read` matches `agents:read`, `workflows:read` (action across all resources)
-* - `agents:read` matches `agents:read`, `agents:read:my-agent`
-* - `agents:read:my-agent` matches only `agents:read:my-agent`
-* - `agents:*:my-agent` matches `agents:read:my-agent`, `agents:write:my-agent`
-*
-* @param userPermission - Permission the user has
-* @param requiredPermission - Permission being checked
-* @returns True if permission matches
-*/
-function matchesPermission(userPermission, requiredPermission) {
-	if (userPermission === "*") return true;
-	const grantedParts = userPermission.split(":");
-	const requiredParts = requiredPermission.split(":");
-	const expandedFamilies = RESOURCE_EXPANSIONS[grantedParts[0] ?? ""];
-	if (expandedFamilies && expandedFamilies.includes(requiredParts[0] ?? "")) return matchesPermission([requiredParts[0], ...grantedParts.slice(1)].join(":"), requiredPermission);
-	if (grantedParts.length < 2 || requiredParts.length < 2) return userPermission === requiredPermission;
-	const [grantedResource, grantedAction, grantedId] = grantedParts;
-	const [requiredResource, requiredAction, requiredId] = requiredParts;
-	if (grantedResource === "*") {
-		if (grantedAction === "*") {
-			if (grantedId === void 0) return true;
-			return grantedId === requiredId;
-		}
-		if (grantedAction !== requiredAction) return false;
-		if (grantedId === void 0) return true;
-		return grantedId === requiredId;
-	}
-	if (grantedResource !== requiredResource) return false;
-	if (grantedAction === "*") {
-		if (grantedId === void 0) return true;
-		return grantedId === requiredId;
-	}
-	if (grantedAction !== requiredAction) return false;
-	if (grantedId === void 0) return true;
-	return grantedId === requiredId;
+//#region ../../packages/_internals/auth/dist/types/index.js
+function headerFromPlainObject(headers, name) {
+	const normalizedName = name.toLowerCase();
+	const matchingKey = Object.keys(headers).find((key) => key.toLowerCase() === normalizedName);
+	const value = matchingKey === void 0 ? void 0 : headers[matchingKey];
+	return Array.isArray(value) ? value[0] ?? null : value ?? null;
 }
 /**
-* Resolve permissions from user roles using a role mapping.
-*
-* This function translates provider-defined roles (from WorkOS, Okta, etc.)
-* to Mastra permissions using a configurable mapping.
-*
-* @example
-* ```typescript
-* const roleMapping = {
-*   "Engineering": ["agents:*", "workflows:*"],
-*   "Product": ["agents:read"],
-*   "_default": [],
-* };
-*
-* // User has "Engineering" and "QA" roles
-* const permissions = resolvePermissionsFromMapping(
-*   ["Engineering", "QA"],
-*   roleMapping
-* );
-* // Result: ["agents:*", "workflows:*"] (QA is unmapped, gets _default)
-* ```
-*
-* @param roles - User's roles from the identity provider
-* @param mapping - Role to permission mapping
-* @returns Array of resolved permissions
+* Read a request header across fetch, Hono, and Express-style request shapes.
+* Must not throw when `headers` is a plain object (Express `IncomingHttpHeaders`).
 */
-function resolvePermissionsFromMapping(roles, mapping) {
-	const permissions = /* @__PURE__ */ new Set();
-	const defaultPerms = mapping["_default"] ?? [];
-	for (const role of roles) {
-		const rolePerms = mapping[role];
-		if (rolePerms) for (const perm of rolePerms) permissions.add(perm);
-		else for (const perm of defaultPerms) permissions.add(perm);
-	}
-	return Array.from(permissions);
+function getRequestHeader(request, name) {
+	if (request instanceof Request) return request.headers.get(name);
+	if (request.raw instanceof Request) return request.raw.headers.get(name);
+	const headers = request.headers;
+	if (headers instanceof Headers) return headers.get(name);
+	if (typeof request.header === "function") return request.header(name) ?? null;
+	if (headers && typeof headers === "object") return headerFromPlainObject(headers, name);
+	return null;
 }
-/**
-* @mastra/core/auth/ee
-*
-* Enterprise authentication capabilities for Mastra.
-* This code is licensed under the Mastra Enterprise License - see ee/LICENSE.
-*
-* @license Mastra Enterprise License - see ee/LICENSE
-* @packageDocumentation
-*/
 //#endregion
 //#region ../../packages/_internal-core/dist/logger/index.js
 const RegisteredLogger = {
@@ -315,11 +227,116 @@ var MastraAuthProvider = class extends MastraBase {
 	}
 };
 //#endregion
-//#region src/index.ts
-function getRequestHeader(request, name) {
-	if (request instanceof Request) return request.headers.get(name);
-	return request.raw?.headers.get(name) ?? request.headers?.get(name) ?? request.header(name) ?? null;
+//#region ../../packages/_internals/auth/dist/ee-DXvSoTl7.js
+/**
+* FGA enforcement utility for checking fine-grained authorization.
+*
+* @license Mastra Enterprise License - see ee/LICENSE
+*/
+/**
+* Compound resource keys that expand to a set of per-family resources.
+* A granted `stored:<action>` is treated as matching any `stored-<family>:<action>`
+* (and `stored:*` matches any `stored-<family>:*`).
+*/
+const RESOURCE_EXPANSIONS = { stored: [
+	"stored-agents",
+	"stored-mcp-clients",
+	"stored-prompt-blocks",
+	"stored-scorers",
+	"stored-skills",
+	"stored-workspaces"
+] };
+/**
+* Check if a permission matches (including wildcard support).
+*
+* Permission format: `{resource}:{action}[:{resource-id}]`
+*
+* Examples:
+* - `*` matches everything
+* - `agents:*` matches `agents:read`, `agents:read:my-agent`
+* - `*:read` matches `agents:read`, `workflows:read` (action across all resources)
+* - `agents:read` matches `agents:read`, `agents:read:my-agent`
+* - `agents:read:my-agent` matches only `agents:read:my-agent`
+* - `agents:*:my-agent` matches `agents:read:my-agent`, `agents:write:my-agent`
+*
+* @param userPermission - Permission the user has
+* @param requiredPermission - Permission being checked
+* @returns True if permission matches
+*/
+function matchesPermission(userPermission, requiredPermission) {
+	if (userPermission === "*") return true;
+	const grantedParts = userPermission.split(":");
+	const requiredParts = requiredPermission.split(":");
+	const expandedFamilies = RESOURCE_EXPANSIONS[grantedParts[0] ?? ""];
+	if (expandedFamilies && expandedFamilies.includes(requiredParts[0] ?? "")) return matchesPermission([requiredParts[0], ...grantedParts.slice(1)].join(":"), requiredPermission);
+	if (grantedParts.length < 2 || requiredParts.length < 2) return userPermission === requiredPermission;
+	const [grantedResource, grantedAction, grantedId] = grantedParts;
+	const [requiredResource, requiredAction, requiredId] = requiredParts;
+	if (grantedResource === "*") {
+		if (grantedAction === "*") {
+			if (grantedId === void 0) return true;
+			return grantedId === requiredId;
+		}
+		if (grantedAction !== requiredAction) return false;
+		if (grantedId === void 0) return true;
+		return grantedId === requiredId;
+	}
+	if (grantedResource !== requiredResource) return false;
+	if (grantedAction === "*") {
+		if (grantedId === void 0) return true;
+		return grantedId === requiredId;
+	}
+	if (grantedAction !== requiredAction) return false;
+	if (grantedId === void 0) return true;
+	return grantedId === requiredId;
+}
+/**
+* Resolve permissions from user roles using a role mapping.
+*
+* This function translates provider-defined roles (from WorkOS, Okta, etc.)
+* to Mastra permissions using a configurable mapping.
+*
+* @example
+* ```typescript
+* const roleMapping = {
+*   "Engineering": ["agents:*", "workflows:*"],
+*   "Product": ["agents:read"],
+*   "_default": [],
+* };
+*
+* // User has "Engineering" and "QA" roles
+* const permissions = resolvePermissionsFromMapping(
+*   ["Engineering", "QA"],
+*   roleMapping
+* );
+* // Result: ["agents:*", "workflows:*"] (QA is unmapped, gets _default)
+* ```
+*
+* @param roles - User's roles from the identity provider
+* @param mapping - Role to permission mapping
+* @returns Array of resolved permissions
+*/
+function resolvePermissionsFromMapping(roles, mapping) {
+	const permissions = /* @__PURE__ */ new Set();
+	const defaultPerms = mapping["_default"] ?? [];
+	for (const role of roles) {
+		const rolePerms = mapping[role];
+		if (rolePerms) for (const perm of rolePerms) permissions.add(perm);
+		else for (const perm of defaultPerms) permissions.add(perm);
+	}
+	return Array.from(permissions);
 }
+/**
+* @mastra/core/auth/ee
+*
+* Enterprise authentication capabilities for Mastra.
+* This code is licensed under the Mastra Enterprise License - see ee/LICENSE.
+*
+* @license Mastra Enterprise License - see ee/LICENSE
+* @packageDocumentation
+*/
+//#endregion
+//#region src/index.ts
 const COOKIE_NAME = "wos-session";
 /**
 * Upper bound for shared-API verification fetches. Matches the platform API