@mastra/auth-studio 1.3.3 → 1.3.4

package/CHANGELOG.md

@@ -1,5 +1,21 @@
 # @mastra/auth-studio
 
+## 1.3.4
+
+### Patch Changes
+
+- Fixed reading request headers from Express-style plain header objects so cookie-based auth providers no longer throw and fail with a misleading 401. ([#21261](https://github.com/mastra-ai/mastra/pull/21261))
+
+  Related to https://github.com/mastra-ai/mastra/issues/21253
+
+## 1.3.4-alpha.0
+
+### Patch Changes
+
+- Fixed reading request headers from Express-style plain header objects so cookie-based auth providers no longer throw and fail with a misleading 401. ([#21261](https://github.com/mastra-ai/mastra/pull/21261))
+
+  Related to https://github.com/mastra-ai/mastra/issues/21253
+
 ## 1.3.3
 
 ### Patch Changes

package/dist/_types/@internal_auth/dist/ee/interfaces/fga.d.ts

@@ -35,6 +35,17 @@ export type ActorSignal = true | {
     permissions?: MastraFGAPermissionInput[];
     /** Additional provider-specific scope for the actor (e.g. tenant, environment). */
     scope?: Record<string, string>;
+    /**
+     * Opt in to propagating this actor into the agent/tool calls the framework
+     * makes for declarative workflow steps (`.then(agent)` / `.then(tool)`)
+     * within this run's own execution tree.
+     *
+     * Never implicit, and ignored by authorization itself. Custom step
+     * `execute` closures are not covered — they already receive `actor` on the
+     * step context and must pass it explicitly. The `true` shorthand cannot
+     * opt in; use this object form.
+     */
+    propagate?: boolean;
 };
 /**
  * Optional context for an authorization check.

package/dist/_types/@internal_auth/dist/ee/interfaces/permissions.generated.d.ts

@@ -10,7 +10,7 @@
  * All known API resources.
  * Derived from SERVER_ROUTES paths in @mastra/server.
  */
-export declare const RESOURCES: readonly ["a2a", "agent-builder", "agent-controller", "agents", "auth", "background-tasks", "channels", "datasets", "embedders", "experiments", "infrastructure", "logs", "mcp", "memory", "observability", "processor-providers", "processors", "schedules", "scores", "stored-agents", "stored-mcp-clients", "stored-prompt-blocks", "stored-scorers", "stored-skills", "stored-workspaces", "system", "tool-providers", "tools", "vector", "vectors", "workflows", "workspaces"];
+export declare const RESOURCES: readonly ["a2a", "agent-builder", "agent-controller", "agents", "auth", "background-tasks", "channels", "datasets", "embedders", "experiments", "infrastructure", "logs", "mcp", "memory", "observability", "processor-providers", "processors", "schedules", "scores", "stored-agents", "stored-mcp-clients", "stored-prompt-blocks", "stored-scorers", "stored-skills", "stored-workflows", "stored-workspaces", "system", "tool-providers", "tools", "vector", "vectors", "workflows", "workspaces"];
 /**
  * Resource type union.
  */
@@ -98,6 +98,8 @@ export declare const PERMISSION_PATTERNS: {
     readonly 'stored-scorers:*': "stored-scorers:*";
     /** Full access to stored skills */
     readonly 'stored-skills:*': "stored-skills:*";
+    /** Full access to stored workflows */
+    readonly 'stored-workflows:*': "stored-workflows:*";
     /** Full access to stored workspaces */
     readonly 'stored-workspaces:*': "stored-workspaces:*";
     /** Full access to system info */
@@ -238,6 +240,10 @@ export declare const PERMISSION_PATTERNS: {
     readonly 'stored-skills:read': "stored-skills:read";
     /** Create and modify stored skills */
     readonly 'stored-skills:write': "stored-skills:write";
+    /** View stored workflows */
+    readonly 'stored-workflows:read': "stored-workflows:read";
+    /** Create and modify stored workflows */
+    readonly 'stored-workflows:write': "stored-workflows:write";
     /** Delete stored workspaces */
     readonly 'stored-workspaces:delete': "stored-workspaces:delete";
     /** View stored workspaces */
@@ -305,7 +311,7 @@ export type PermissionPattern = keyof typeof PERMISSION_PATTERNS;
 /**
  * All valid resource:action permission combinations (excludes wildcards).
  */
-export declare const PERMISSIONS: readonly ["a2a:read", "a2a:write", "agent-builder:execute", "agent-builder:read", "agent-builder:write", "agent-controller:execute", "agent-controller:read", "agents:create", "agents:delete", "agents:execute", "agents:read", "agents:write", "auth:read", "background-tasks:read", "channels:read", "channels:write", "datasets:delete", "datasets:execute", "datasets:read", "datasets:write", "embedders:read", "experiments:read", "infrastructure:read", "logs:read", "mcp:execute", "mcp:read", "mcp:write", "memory:delete", "memory:execute", "memory:read", "memory:write", "observability:read", "observability:write", "processor-providers:read", "processors:execute", "processors:read", "schedules:delete", "schedules:execute", "schedules:read", "schedules:write", "scores:read", "scores:write", "stored-agents:delete", "stored-agents:publish", "stored-agents:read", "stored-agents:write", "stored-mcp-clients:delete", "stored-mcp-clients:publish", "stored-mcp-clients:read", "stored-mcp-clients:write", "stored-prompt-blocks:delete", "stored-prompt-blocks:publish", "stored-prompt-blocks:read", "stored-prompt-blocks:write", "stored-scorers:delete", "stored-scorers:publish", "stored-scorers:read", "stored-scorers:write", "stored-skills:delete", "stored-skills:publish", "stored-skills:read", "stored-skills:write", "stored-workspaces:delete", "stored-workspaces:read", "stored-workspaces:write", "system:read", "tool-providers:delete", "tool-providers:read", "tool-providers:write", "tools:execute", "tools:read", "vector:delete", "vector:execute", "vector:read", "vector:write", "vectors:read", "workflows:delete", "workflows:execute", "workflows:read", "workflows:write", "workspaces:delete", "workspaces:read", "workspaces:write"];
+export declare const PERMISSIONS: readonly ["a2a:read", "a2a:write", "agent-builder:execute", "agent-builder:read", "agent-builder:write", "agent-controller:execute", "agent-controller:read", "agents:create", "agents:delete", "agents:execute", "agents:read", "agents:write", "auth:read", "background-tasks:read", "channels:read", "channels:write", "datasets:delete", "datasets:execute", "datasets:read", "datasets:write", "embedders:read", "experiments:read", "infrastructure:read", "logs:read", "mcp:execute", "mcp:read", "mcp:write", "memory:delete", "memory:execute", "memory:read", "memory:write", "observability:read", "observability:write", "processor-providers:read", "processors:execute", "processors:read", "schedules:delete", "schedules:execute", "schedules:read", "schedules:write", "scores:read", "scores:write", "stored-agents:delete", "stored-agents:publish", "stored-agents:read", "stored-agents:write", "stored-mcp-clients:delete", "stored-mcp-clients:publish", "stored-mcp-clients:read", "stored-mcp-clients:write", "stored-prompt-blocks:delete", "stored-prompt-blocks:publish", "stored-prompt-blocks:read", "stored-prompt-blocks:write", "stored-scorers:delete", "stored-scorers:publish", "stored-scorers:read", "stored-scorers:write", "stored-skills:delete", "stored-skills:publish", "stored-skills:read", "stored-skills:write", "stored-workflows:read", "stored-workflows:write", "stored-workspaces:delete", "stored-workspaces:read", "stored-workspaces:write", "system:read", "tool-providers:delete", "tool-providers:read", "tool-providers:write", "tools:execute", "tools:read", "vector:delete", "vector:execute", "vector:read", "vector:write", "vectors:read", "workflows:delete", "workflows:execute", "workflows:read", "workflows:write", "workspaces:delete", "workspaces:read", "workspaces:write"];
 /**
  * Specific permission type (e.g., 'agents:read', 'workflows:execute').
  */
@@ -441,6 +447,10 @@ export declare const MastraFGAPermissions: {
     readonly STORED_SKILLS_READ: "stored-skills:read";
     /** Create and modify stored skills */
     readonly STORED_SKILLS_WRITE: "stored-skills:write";
+    /** View stored workflows */
+    readonly STORED_WORKFLOWS_READ: "stored-workflows:read";
+    /** Create and modify stored workflows */
+    readonly STORED_WORKFLOWS_WRITE: "stored-workflows:write";
     /** Delete stored workspaces */
     readonly STORED_WORKSPACES_DELETE: "stored-workspaces:delete";
     /** View stored workspaces */

package/dist/_types/@internal_auth/dist/types/index.d.ts

@@ -1,7 +1,7 @@
 export interface HonoRequestLike {
     raw?: Request;
-    headers?: Headers;
-    header(name: string): string | undefined;
+    headers?: Headers | Record<string, string | string[] | undefined>;
+    header?(name: string): string | undefined;
 }
 export type MastraAuthRequest = Request | HonoRequestLike;
 export type AuthenticateTokenFn<TUser, TResult = Promise<TUser | null>> = {
@@ -10,6 +10,10 @@ export type AuthenticateTokenFn<TUser, TResult = Promise<TUser | null>> = {
 export type AuthorizeUserFn<TUser, TResult = Promise<boolean> | boolean> = {
     bivarianceHack(user: TUser, request: MastraAuthRequest): TResult;
 }['bivarianceHack'];
+/**
+ * Read a request header across fetch, Hono, and Express-style request shapes.
+ * Must not throw when `headers` is a plain object (Express `IncomingHttpHeaders`).
+ */
 export declare function getRequestHeader(request: MastraAuthRequest, name: string): string | null;
 export declare function getWebRequest(request: MastraAuthRequest): Request | undefined;
 export type Methods = 'GET' | 'POST' | 'PUT' | 'DELETE' | 'PATCH' | 'ALL';

package/dist/index.cjs

@@ -1,113 +1,25 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 let crypto$1 = require("crypto");
-//#region ../../packages/_internals/auth/dist/ee-C8o0LZ3r.js
-/**
-* FGA enforcement utility for checking fine-grained authorization.
-*
-* @license Mastra Enterprise License - see ee/LICENSE
-*/
-/**
-* Compound resource keys that expand to a set of per-family resources.
-* A granted `stored:<action>` is treated as matching any `stored-<family>:<action>`
-* (and `stored:*` matches any `stored-<family>:*`).
-*/
-const RESOURCE_EXPANSIONS = { stored: [
-	"stored-agents",
-	"stored-mcp-clients",
-	"stored-prompt-blocks",
-	"stored-scorers",
-	"stored-skills",
-	"stored-workspaces"
-] };
-/**
-* Check if a permission matches (including wildcard support).
-*
-* Permission format: `{resource}:{action}[:{resource-id}]`
-*
-* Examples:
-* - `*` matches everything
-* - `agents:*` matches `agents:read`, `agents:read:my-agent`
-* - `*:read` matches `agents:read`, `workflows:read` (action across all resources)
-* - `agents:read` matches `agents:read`, `agents:read:my-agent`
-* - `agents:read:my-agent` matches only `agents:read:my-agent`
-* - `agents:*:my-agent` matches `agents:read:my-agent`, `agents:write:my-agent`
-*
-* @param userPermission - Permission the user has
-* @param requiredPermission - Permission being checked
-* @returns True if permission matches
-*/
-function matchesPermission(userPermission, requiredPermission) {
-	if (userPermission === "*") return true;
-	const grantedParts = userPermission.split(":");
-	const requiredParts = requiredPermission.split(":");
-	const expandedFamilies = RESOURCE_EXPANSIONS[grantedParts[0] ?? ""];
-	if (expandedFamilies && expandedFamilies.includes(requiredParts[0] ?? "")) return matchesPermission([requiredParts[0], ...grantedParts.slice(1)].join(":"), requiredPermission);
-	if (grantedParts.length < 2 || requiredParts.length < 2) return userPermission === requiredPermission;
-	const [grantedResource, grantedAction, grantedId] = grantedParts;
-	const [requiredResource, requiredAction, requiredId] = requiredParts;
-	if (grantedResource === "*") {
-		if (grantedAction === "*") {
-			if (grantedId === void 0) return true;
-			return grantedId === requiredId;
-		}
-		if (grantedAction !== requiredAction) return false;
-		if (grantedId === void 0) return true;
-		return grantedId === requiredId;
-	}
-	if (grantedResource !== requiredResource) return false;
-	if (grantedAction === "*") {
-		if (grantedId === void 0) return true;
-		return grantedId === requiredId;
-	}
-	if (grantedAction !== requiredAction) return false;
-	if (grantedId === void 0) return true;
-	return grantedId === requiredId;
+//#region ../../packages/_internals/auth/dist/types/index.js
+function headerFromPlainObject(headers, name) {
+	const normalizedName = name.toLowerCase();
+	const matchingKey = Object.keys(headers).find((key) => key.toLowerCase() === normalizedName);
+	const value = matchingKey === void 0 ? void 0 : headers[matchingKey];
+	return Array.isArray(value) ? value[0] ?? null : value ?? null;
 }
 /**
-* Resolve permissions from user roles using a role mapping.
-*
-* This function translates provider-defined roles (from WorkOS, Okta, etc.)
-* to Mastra permissions using a configurable mapping.
-*
-* @example
-* ```typescript
-* const roleMapping = {
-*   "Engineering": ["agents:*", "workflows:*"],
-*   "Product": ["agents:read"],
-*   "_default": [],
-* };
-*
-* // User has "Engineering" and "QA" roles
-* const permissions = resolvePermissionsFromMapping(
-*   ["Engineering", "QA"],
-*   roleMapping
-* );
-* // Result: ["agents:*", "workflows:*"] (QA is unmapped, gets _default)
-* ```
-*
-* @param roles - User's roles from the identity provider
-* @param mapping - Role to permission mapping
-* @returns Array of resolved permissions
+* Read a request header across fetch, Hono, and Express-style request shapes.
+* Must not throw when `headers` is a plain object (Express `IncomingHttpHeaders`).
 */
-function resolvePermissionsFromMapping(roles, mapping) {
-	const permissions = /* @__PURE__ */ new Set();
-	const defaultPerms = mapping["_default"] ?? [];
-	for (const role of roles) {
-		const rolePerms = mapping[role];
-		if (rolePerms) for (const perm of rolePerms) permissions.add(perm);
-		else for (const perm of defaultPerms) permissions.add(perm);
-	}
-	return Array.from(permissions);
+function getRequestHeader(request, name) {
+	if (request instanceof Request) return request.headers.get(name);
+	if (request.raw instanceof Request) return request.raw.headers.get(name);
+	const headers = request.headers;
+	if (headers instanceof Headers) return headers.get(name);
+	if (typeof request.header === "function") return request.header(name) ?? null;
+	if (headers && typeof headers === "object") return headerFromPlainObject(headers, name);
+	return null;
 }
-/**
-* @mastra/core/auth/ee
-*
-* Enterprise authentication capabilities for Mastra.
-* This code is licensed under the Mastra Enterprise License - see ee/LICENSE.
-*
-* @license Mastra Enterprise License - see ee/LICENSE
-* @packageDocumentation
-*/
 //#endregion
 //#region ../../packages/_internal-core/dist/logger/index.js
 const RegisteredLogger = {
@@ -316,11 +228,116 @@ var MastraAuthProvider = class extends MastraBase {
 	}
 };
 //#endregion
-//#region src/index.ts
-function getRequestHeader(request, name) {
-	if (request instanceof Request) return request.headers.get(name);
-	return request.raw?.headers.get(name) ?? request.headers?.get(name) ?? request.header(name) ?? null;
+//#region ../../packages/_internals/auth/dist/ee-DXvSoTl7.js
+/**
+* FGA enforcement utility for checking fine-grained authorization.
+*
+* @license Mastra Enterprise License - see ee/LICENSE
+*/
+/**
+* Compound resource keys that expand to a set of per-family resources.
+* A granted `stored:<action>` is treated as matching any `stored-<family>:<action>`
+* (and `stored:*` matches any `stored-<family>:*`).
+*/
+const RESOURCE_EXPANSIONS = { stored: [
+	"stored-agents",
+	"stored-mcp-clients",
+	"stored-prompt-blocks",
+	"stored-scorers",
+	"stored-skills",
+	"stored-workspaces"
+] };
+/**
+* Check if a permission matches (including wildcard support).
+*
+* Permission format: `{resource}:{action}[:{resource-id}]`
+*
+* Examples:
+* - `*` matches everything
+* - `agents:*` matches `agents:read`, `agents:read:my-agent`
+* - `*:read` matches `agents:read`, `workflows:read` (action across all resources)
+* - `agents:read` matches `agents:read`, `agents:read:my-agent`
+* - `agents:read:my-agent` matches only `agents:read:my-agent`
+* - `agents:*:my-agent` matches `agents:read:my-agent`, `agents:write:my-agent`
+*
+* @param userPermission - Permission the user has
+* @param requiredPermission - Permission being checked
+* @returns True if permission matches
+*/
+function matchesPermission(userPermission, requiredPermission) {
+	if (userPermission === "*") return true;
+	const grantedParts = userPermission.split(":");
+	const requiredParts = requiredPermission.split(":");
+	const expandedFamilies = RESOURCE_EXPANSIONS[grantedParts[0] ?? ""];
+	if (expandedFamilies && expandedFamilies.includes(requiredParts[0] ?? "")) return matchesPermission([requiredParts[0], ...grantedParts.slice(1)].join(":"), requiredPermission);
+	if (grantedParts.length < 2 || requiredParts.length < 2) return userPermission === requiredPermission;
+	const [grantedResource, grantedAction, grantedId] = grantedParts;
+	const [requiredResource, requiredAction, requiredId] = requiredParts;
+	if (grantedResource === "*") {
+		if (grantedAction === "*") {
+			if (grantedId === void 0) return true;
+			return grantedId === requiredId;
+		}
+		if (grantedAction !== requiredAction) return false;
+		if (grantedId === void 0) return true;
+		return grantedId === requiredId;
+	}
+	if (grantedResource !== requiredResource) return false;
+	if (grantedAction === "*") {
+		if (grantedId === void 0) return true;
+		return grantedId === requiredId;
+	}
+	if (grantedAction !== requiredAction) return false;
+	if (grantedId === void 0) return true;
+	return grantedId === requiredId;
+}
+/**
+* Resolve permissions from user roles using a role mapping.
+*
+* This function translates provider-defined roles (from WorkOS, Okta, etc.)
+* to Mastra permissions using a configurable mapping.
+*
+* @example
+* ```typescript
+* const roleMapping = {
+*   "Engineering": ["agents:*", "workflows:*"],
+*   "Product": ["agents:read"],
+*   "_default": [],
+* };
+*
+* // User has "Engineering" and "QA" roles
+* const permissions = resolvePermissionsFromMapping(
+*   ["Engineering", "QA"],
+*   roleMapping
+* );
+* // Result: ["agents:*", "workflows:*"] (QA is unmapped, gets _default)
+* ```
+*
+* @param roles - User's roles from the identity provider
+* @param mapping - Role to permission mapping
+* @returns Array of resolved permissions
+*/
+function resolvePermissionsFromMapping(roles, mapping) {
+	const permissions = /* @__PURE__ */ new Set();
+	const defaultPerms = mapping["_default"] ?? [];
+	for (const role of roles) {
+		const rolePerms = mapping[role];
+		if (rolePerms) for (const perm of rolePerms) permissions.add(perm);
+		else for (const perm of defaultPerms) permissions.add(perm);
+	}
+	return Array.from(permissions);
 }
+/**
+* @mastra/core/auth/ee
+*
+* Enterprise authentication capabilities for Mastra.
+* This code is licensed under the Mastra Enterprise License - see ee/LICENSE.
+*
+* @license Mastra Enterprise License - see ee/LICENSE
+* @packageDocumentation
+*/
+//#endregion
+//#region src/index.ts
 const COOKIE_NAME = "wos-session";
 /**
 * Upper bound for shared-API verification fetches. Matches the platform API