@mastra/auth-studio 1.3.5 → 1.3.6-alpha.0

package/dist/_types/@internal_auth/dist/ee/interfaces/permissions.generated.d.ts

@@ -158,6 +158,8 @@ export declare const PERMISSION_PATTERNS: {
     readonly 'datasets:write': 'datasets:write';
     /** View embedders */
     readonly 'embedders:read': 'embedders:read';
+    /** Delete experiments */
+    readonly 'experiments:delete': 'experiments:delete';
     /** View experiments */
     readonly 'experiments:read': 'experiments:read';
     /** View infrastructure */
@@ -311,7 +313,7 @@ export type PermissionPattern = keyof typeof PERMISSION_PATTERNS;
 /**
  * All valid resource:action permission combinations (excludes wildcards).
  */
-export declare const PERMISSIONS: readonly ['a2a:read', 'a2a:write', 'agent-builder:execute', 'agent-builder:read', 'agent-builder:write', 'agent-controller:execute', 'agent-controller:read', 'agents:create', 'agents:delete', 'agents:execute', 'agents:read', 'agents:write', 'auth:read', 'background-tasks:read', 'channels:read', 'channels:write', 'datasets:delete', 'datasets:execute', 'datasets:read', 'datasets:write', 'embedders:read', 'experiments:read', 'infrastructure:read', 'logs:read', 'mcp:execute', 'mcp:read', 'mcp:write', 'memory:delete', 'memory:execute', 'memory:read', 'memory:write', 'observability:read', 'observability:write', 'processor-providers:read', 'processors:execute', 'processors:read', 'schedules:delete', 'schedules:execute', 'schedules:read', 'schedules:write', 'scores:read', 'scores:write', 'stored-agents:delete', 'stored-agents:publish', 'stored-agents:read', 'stored-agents:write', 'stored-mcp-clients:delete', 'stored-mcp-clients:publish', 'stored-mcp-clients:read', 'stored-mcp-clients:write', 'stored-prompt-blocks:delete', 'stored-prompt-blocks:publish', 'stored-prompt-blocks:read', 'stored-prompt-blocks:write', 'stored-scorers:delete', 'stored-scorers:publish', 'stored-scorers:read', 'stored-scorers:write', 'stored-skills:delete', 'stored-skills:publish', 'stored-skills:read', 'stored-skills:write', 'stored-workflows:read', 'stored-workflows:write', 'stored-workspaces:delete', 'stored-workspaces:read', 'stored-workspaces:write', 'system:read', 'tool-providers:delete', 'tool-providers:read', 'tool-providers:write', 'tools:execute', 'tools:read', 'vector:delete', 'vector:execute', 'vector:read', 'vector:write', 'vectors:read', 'workflows:delete', 'workflows:execute', 'workflows:read', 'workflows:write', 'workspaces:delete', 'workspaces:read', 'workspaces:write'];
+export declare const PERMISSIONS: readonly ['a2a:read', 'a2a:write', 'agent-builder:execute', 'agent-builder:read', 'agent-builder:write', 'agent-controller:execute', 'agent-controller:read', 'agents:create', 'agents:delete', 'agents:execute', 'agents:read', 'agents:write', 'auth:read', 'background-tasks:read', 'channels:read', 'channels:write', 'datasets:delete', 'datasets:execute', 'datasets:read', 'datasets:write', 'embedders:read', 'experiments:delete', 'experiments:read', 'infrastructure:read', 'logs:read', 'mcp:execute', 'mcp:read', 'mcp:write', 'memory:delete', 'memory:execute', 'memory:read', 'memory:write', 'observability:read', 'observability:write', 'processor-providers:read', 'processors:execute', 'processors:read', 'schedules:delete', 'schedules:execute', 'schedules:read', 'schedules:write', 'scores:read', 'scores:write', 'stored-agents:delete', 'stored-agents:publish', 'stored-agents:read', 'stored-agents:write', 'stored-mcp-clients:delete', 'stored-mcp-clients:publish', 'stored-mcp-clients:read', 'stored-mcp-clients:write', 'stored-prompt-blocks:delete', 'stored-prompt-blocks:publish', 'stored-prompt-blocks:read', 'stored-prompt-blocks:write', 'stored-scorers:delete', 'stored-scorers:publish', 'stored-scorers:read', 'stored-scorers:write', 'stored-skills:delete', 'stored-skills:publish', 'stored-skills:read', 'stored-skills:write', 'stored-workflows:read', 'stored-workflows:write', 'stored-workspaces:delete', 'stored-workspaces:read', 'stored-workspaces:write', 'system:read', 'tool-providers:delete', 'tool-providers:read', 'tool-providers:write', 'tools:execute', 'tools:read', 'vector:delete', 'vector:execute', 'vector:read', 'vector:write', 'vectors:read', 'workflows:delete', 'workflows:execute', 'workflows:read', 'workflows:write', 'workspaces:delete', 'workspaces:read', 'workspaces:write'];
 /**
  * Specific permission type (e.g., 'agents:read', 'workflows:execute').
  */
@@ -365,6 +367,8 @@ export declare const MastraFGAPermissions: {
     readonly DATASETS_WRITE: 'datasets:write';
     /** View embedders */
     readonly EMBEDDERS_READ: 'embedders:read';
+    /** Delete experiments */
+    readonly EXPERIMENTS_DELETE: 'experiments:delete';
     /** View experiments */
     readonly EXPERIMENTS_READ: 'experiments:read';
     /** View infrastructure */

package/dist/index.cjs

@@ -312,7 +312,7 @@ var MastraAuthProvider = class extends MastraBase {
 	}
 };
 //#endregion
-//#region ../../packages/_internals/auth/dist/ee-DXvSoTl7.js
+//#region ../../packages/_internals/auth/dist/ee-BYnTZaqt.js
 /**
 * FGA enforcement utility for checking fine-grained authorization.
 *
@@ -758,16 +758,38 @@ var MastraAuthStudio = class extends MastraAuthProvider {
 		const sessionCookie = this.userSessionCookies.get(userId);
 		if (!sessionCookie) return false;
 		try {
-			const me = await this.fetchMe(sessionCookie);
-			if (me?.organizationId === organizationId) return isAdminRole(me.role);
-			const res = await fetch(`${this.sharedApiUrl}/auth/orgs`, { headers: { Cookie: `${COOKIE_NAME}=${sessionCookie}` } });
-			if (!res.ok) return false;
-			const membership = (await res.json()).organizations?.find((o) => o.id === organizationId);
-			return isAdminRole(membership?.role ?? void 0);
+			return isAdminRole(await this.fetchOrganizationRole(sessionCookie, organizationId));
 		} catch {
 			return false;
 		}
 	}
+	async fetchOrganizationRole(sessionCookie, organizationId) {
+		const me = await this.fetchMe(sessionCookie);
+		if (me?.organizationId === organizationId) return me.role;
+		return this.fetchMembershipRole(sessionCookie, organizationId);
+	}
+	async fetchMembershipRole(sessionCookie, organizationId) {
+		const res = await fetch(`${this.sharedApiUrl}/auth/orgs`, {
+			headers: { Cookie: `${COOKIE_NAME}=${sessionCookie}` },
+			signal: AbortSignal.timeout(VERIFY_FETCH_TIMEOUT_MS)
+		});
+		if (!res.ok) return void 0;
+		return (await res.json()).organizations?.find((o) => o.id === organizationId)?.role ?? void 0;
+	}
+	async asPinnedOrganizationMember(user, sessionCookie) {
+		const pinnedOrganizationId = this.organizationId;
+		if (!pinnedOrganizationId) return user;
+		const sessionAlreadyOnPinnedOrganization = user.organizationId === pinnedOrganizationId;
+		const memberOfPinnedOrganization = user.memberOrgIds?.includes(pinnedOrganizationId) ?? false;
+		if (sessionAlreadyOnPinnedOrganization || !memberOfPinnedOrganization) return user;
+		const roleInPinnedOrganization = await this.fetchMembershipRole(sessionCookie, pinnedOrganizationId);
+		return {
+			...user,
+			organizationId: pinnedOrganizationId,
+			role: roleInPinnedOrganization,
+			permissions: void 0
+		};
+	}
 	/**
 	* Record the sealed session cookie last seen for a user so
 	* {@link ensureOrganization} / {@link isOrganizationAdmin} can act on their
@@ -848,7 +870,7 @@ var MastraAuthStudio = class extends MastraAuthProvider {
 			}
 			const data = await res.json();
 			this.rememberUserSession(data.user.id, sessionCookie);
-			const user = {
+			const sessionUser = {
 				id: data.user.id,
 				email: data.user.email,
 				name: [data.user.firstName, data.user.lastName].filter(Boolean).join(" ") || void 0,
@@ -858,6 +880,7 @@ var MastraAuthStudio = class extends MastraAuthProvider {
 				permissions: data.permissions,
 				memberOrgIds: data.memberOrgIds
 			};
+			const user = await this.asPinnedOrganizationMember(sessionUser, sessionCookie);
 			if (user.organizationId) this.cacheVerification(cacheKey, user);
 			return user;
 		} catch (error) {
@@ -880,8 +903,10 @@ var MastraAuthStudio = class extends MastraAuthProvider {
 		const cached = this.getCachedVerification(cacheKey);
 		if (cached) return cached;
 		try {
+			const headers = { Authorization: `Bearer ${token}` };
+			if (this.organizationId) headers["x-organization-id"] = this.organizationId;
 			const res = await fetch(`${this.sharedApiUrl}/auth/verify`, {
-				headers: { Authorization: `Bearer ${token}` },
+				headers,
 				signal: AbortSignal.timeout(VERIFY_FETCH_TIMEOUT_MS)
 			});
 			if (!res.ok) {