@mastra/auth-studio 1.3.5 → 1.3.6-alpha.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/_types/@internal_auth/dist/ee/interfaces/permissions.generated.d.ts +5 -1
- package/dist/index.cjs +34 -9
- package/dist/index.cjs.map +1 -1
- package/dist/index.d.ts +4 -1
- package/dist/index.d.ts.map +1 -1
- package/dist/index.js +34 -9
- package/dist/index.js.map +1 -1
- package/package.json +4 -4
package/dist/index.d.ts
CHANGED
|
@@ -16,7 +16,7 @@ export interface StudioUser extends EEUser {
|
|
|
16
16
|
export interface MastraAuthStudioOptions extends MastraAuthProviderOptions<StudioUser> {
|
|
17
17
|
/** Base URL of the Mastra shared API (e.g., https://api.mastra.ai/v1) */
|
|
18
18
|
sharedApiUrl?: string;
|
|
19
|
-
/** Organization ID that owns this deployed instance.
|
|
19
|
+
/** Organization ID that owns this deployed instance. Members are served in this org whatever org their session is on; non-members are rejected. */
|
|
20
20
|
organizationId?: string;
|
|
21
21
|
/**
|
|
22
22
|
* Cookie domain for session cookies (e.g., '.example.com').
|
|
@@ -117,6 +117,9 @@ export declare class MastraAuthStudio extends MastraAuthProvider<StudioUser> imp
|
|
|
117
117
|
* org. Any shared-API failure resolves to `false`.
|
|
118
118
|
*/
|
|
119
119
|
isOrganizationAdmin(organizationId: string, userId: string): Promise<boolean>;
|
|
120
|
+
private fetchOrganizationRole;
|
|
121
|
+
private fetchMembershipRole;
|
|
122
|
+
private asPinnedOrganizationMember;
|
|
120
123
|
/**
|
|
121
124
|
* Record the sealed session cookie last seen for a user so
|
|
122
125
|
* {@link ensureOrganization} / {@link isOrganizationAdmin} can act on their
|
package/dist/index.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EACV,sBAAsB,EACtB,YAAY,EACZ,gBAAgB,EAChB,aAAa,EACb,iBAAiB,EACjB,OAAO,EACP,iBAAiB,EACjB,cAAc,EACf,MAAM,gBAAgB,CAAC;AAExB,OAAO,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAE5E,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAC7D,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,yBAAyB,CAAC;AAEzE,MAAM,WAAW,UAAW,SAAQ,MAAM;IACxC,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,iFAAiF;IACjF,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;CACzB;AAED,MAAM,WAAW,uBAAwB,SAAQ,yBAAyB,CAAC,UAAU,CAAC;IACpF,yEAAyE;IACzE,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,
|
|
1
|
+
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EACV,sBAAsB,EACtB,YAAY,EACZ,gBAAgB,EAChB,aAAa,EACb,iBAAiB,EACjB,OAAO,EACP,iBAAiB,EACjB,cAAc,EACf,MAAM,gBAAgB,CAAC;AAExB,OAAO,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAE5E,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAC7D,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,yBAAyB,CAAC;AAEzE,MAAM,WAAW,UAAW,SAAQ,MAAM;IACxC,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,iFAAiF;IACjF,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;CACzB;AAED,MAAM,WAAW,uBAAwB,SAAQ,yBAAyB,CAAC,UAAU,CAAC;IACpF,yEAAyE;IACzE,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,mJAAmJ;IACnJ,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;;;OAKG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAkBD;;;;;;;;;;GAUG;AACH,qBAAa,gBACX,SAAQ,kBAAkB,CAAC,UAAU,CACrC,YAAW,YAAY,CAAC,UAAU,CAAC,EAAE,gBAAgB,CAAC,OAAO,CAAC,EAAE,aAAa,CAAC,UAAU,CAAC,EAAE,sBAAsB;IAEjH,QAAQ,CAAC,iBAAiB,QAAQ;IAElC,OAAO,CAAC,YAAY,CAAS;IAC7B,OAAO,CAAC,cAAc,CAAqB;IAC3C,OAAO,CAAC,oBAAoB,CAAU;IACtC,OAAO,CAAC,YAAY,CAAqB;IACzC;;;;;;OAMG;IACH,OAAO,CAAC,kBAAkB,CAA6B;IACvD,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAQ;IAE1C;;;;;;OAMG;IACH,OAAO,CAAC,mBAAmB,CAA8D;IACzF,OAAO,CAAC,QAAQ,CAAC,sBAAsB,CAAQ;IAE/C;;;;;;OAMG;IACH,OAAO,CAAC,6BAA6B,CAAkD;IAEvF,YAAY,OAAO,CAAC,EAAE,uBAAuB,EAwC5C;IAMD;;;OAGG;IACG,iBAAiB,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAyB7F;IAED,aAAa,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAEvC;IAMD,WAAW,CAAC,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAwBtD;IAEK,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC,UAAU,CAAC,CAAC,CA0BzF;IAED,uBAAuB,CAAC,aAAa,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI,CAE1D;IAED,eAAe,IAAI,MAAM,EAAE,GAAG,SAAS,CAGtC;IAED,oBAAoB,IAAI,cAAc,CAOrC;IAEK,YAAY,CAAC,YAAY,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAwBlF;IAMK,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,CASxF;IAEK,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAWhE;IAEK,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAWrD;IAEK,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAgD/D;IAED,uBAAuB,CAAC,OAAO,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAGvD;IAED,iBAAiB,CAAC,OAAO,EAAE,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAO1D;IAED,sBAAsB,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAO/C;IAMK,cAAc,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAejE;IAEK,OAAO,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAGzD;IAMD;;;;;;;;;;;;;;OAcG;IACG,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAYpE;YAEa,oBAAoB;IAgDlC;;;;;;;OAOG;IACG,mBAAmB,CAAC,cAAc,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CASlF;YAEa,qBAAqB;YAMrB,mBAAmB;YAYnB,0BAA0B;IAexC;;;;OAIG;IACH,OAAO,CAAC,mBAAmB;IAU3B,wEAAwE;IACxE,OAAO,CAAC,eAAe;IAIvB,OAAO,CAAC,qBAAqB;IAU7B,OAAO,CAAC,iBAAiB;IASzB;;;;OAIG;YACW,OAAO;IAuBrB;;;OAGG;YACW,mBAAmB;IAoEjC;;;OAGG;YACW,iBAAiB;CAqDhC;AAyCD,MAAM,WAAW,uBAAuB;IACtC;;;;;;;;;;;;OAYG;IACH,WAAW,EAAE,WAAW,CAAC;CAC1B;AAED;;;;;GAKG;AACH,qBAAa,gBAAiB,YAAW,aAAa,CAAC,UAAU,CAAC;IAChE,OAAO,CAAC,OAAO,CAA0B;IAEzC,IAAI,WAAW,IAAI,WAAW,CAE7B;IAED,YAAY,OAAO,EAAE,uBAAuB,EAE3C;IAEK,QAAQ,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAElD;IAEK,OAAO,CAAC,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAG9D;IAEK,cAAc,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAMxD;IAEK,aAAa,CAAC,IAAI,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAG1E;IAEK,iBAAiB,CAAC,IAAI,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAGjF;IAEK,gBAAgB,CAAC,IAAI,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAGhF;CACF"}
|
package/dist/index.js
CHANGED
|
@@ -311,7 +311,7 @@ var MastraAuthProvider = class extends MastraBase {
|
|
|
311
311
|
}
|
|
312
312
|
};
|
|
313
313
|
//#endregion
|
|
314
|
-
//#region ../../packages/_internals/auth/dist/ee-
|
|
314
|
+
//#region ../../packages/_internals/auth/dist/ee-BYnTZaqt.js
|
|
315
315
|
/**
|
|
316
316
|
* FGA enforcement utility for checking fine-grained authorization.
|
|
317
317
|
*
|
|
@@ -757,16 +757,38 @@ var MastraAuthStudio = class extends MastraAuthProvider {
|
|
|
757
757
|
const sessionCookie = this.userSessionCookies.get(userId);
|
|
758
758
|
if (!sessionCookie) return false;
|
|
759
759
|
try {
|
|
760
|
-
|
|
761
|
-
if (me?.organizationId === organizationId) return isAdminRole(me.role);
|
|
762
|
-
const res = await fetch(`${this.sharedApiUrl}/auth/orgs`, { headers: { Cookie: `${COOKIE_NAME}=${sessionCookie}` } });
|
|
763
|
-
if (!res.ok) return false;
|
|
764
|
-
const membership = (await res.json()).organizations?.find((o) => o.id === organizationId);
|
|
765
|
-
return isAdminRole(membership?.role ?? void 0);
|
|
760
|
+
return isAdminRole(await this.fetchOrganizationRole(sessionCookie, organizationId));
|
|
766
761
|
} catch {
|
|
767
762
|
return false;
|
|
768
763
|
}
|
|
769
764
|
}
|
|
765
|
+
async fetchOrganizationRole(sessionCookie, organizationId) {
|
|
766
|
+
const me = await this.fetchMe(sessionCookie);
|
|
767
|
+
if (me?.organizationId === organizationId) return me.role;
|
|
768
|
+
return this.fetchMembershipRole(sessionCookie, organizationId);
|
|
769
|
+
}
|
|
770
|
+
async fetchMembershipRole(sessionCookie, organizationId) {
|
|
771
|
+
const res = await fetch(`${this.sharedApiUrl}/auth/orgs`, {
|
|
772
|
+
headers: { Cookie: `${COOKIE_NAME}=${sessionCookie}` },
|
|
773
|
+
signal: AbortSignal.timeout(VERIFY_FETCH_TIMEOUT_MS)
|
|
774
|
+
});
|
|
775
|
+
if (!res.ok) return void 0;
|
|
776
|
+
return (await res.json()).organizations?.find((o) => o.id === organizationId)?.role ?? void 0;
|
|
777
|
+
}
|
|
778
|
+
async asPinnedOrganizationMember(user, sessionCookie) {
|
|
779
|
+
const pinnedOrganizationId = this.organizationId;
|
|
780
|
+
if (!pinnedOrganizationId) return user;
|
|
781
|
+
const sessionAlreadyOnPinnedOrganization = user.organizationId === pinnedOrganizationId;
|
|
782
|
+
const memberOfPinnedOrganization = user.memberOrgIds?.includes(pinnedOrganizationId) ?? false;
|
|
783
|
+
if (sessionAlreadyOnPinnedOrganization || !memberOfPinnedOrganization) return user;
|
|
784
|
+
const roleInPinnedOrganization = await this.fetchMembershipRole(sessionCookie, pinnedOrganizationId);
|
|
785
|
+
return {
|
|
786
|
+
...user,
|
|
787
|
+
organizationId: pinnedOrganizationId,
|
|
788
|
+
role: roleInPinnedOrganization,
|
|
789
|
+
permissions: void 0
|
|
790
|
+
};
|
|
791
|
+
}
|
|
770
792
|
/**
|
|
771
793
|
* Record the sealed session cookie last seen for a user so
|
|
772
794
|
* {@link ensureOrganization} / {@link isOrganizationAdmin} can act on their
|
|
@@ -847,7 +869,7 @@ var MastraAuthStudio = class extends MastraAuthProvider {
|
|
|
847
869
|
}
|
|
848
870
|
const data = await res.json();
|
|
849
871
|
this.rememberUserSession(data.user.id, sessionCookie);
|
|
850
|
-
const
|
|
872
|
+
const sessionUser = {
|
|
851
873
|
id: data.user.id,
|
|
852
874
|
email: data.user.email,
|
|
853
875
|
name: [data.user.firstName, data.user.lastName].filter(Boolean).join(" ") || void 0,
|
|
@@ -857,6 +879,7 @@ var MastraAuthStudio = class extends MastraAuthProvider {
|
|
|
857
879
|
permissions: data.permissions,
|
|
858
880
|
memberOrgIds: data.memberOrgIds
|
|
859
881
|
};
|
|
882
|
+
const user = await this.asPinnedOrganizationMember(sessionUser, sessionCookie);
|
|
860
883
|
if (user.organizationId) this.cacheVerification(cacheKey, user);
|
|
861
884
|
return user;
|
|
862
885
|
} catch (error) {
|
|
@@ -879,8 +902,10 @@ var MastraAuthStudio = class extends MastraAuthProvider {
|
|
|
879
902
|
const cached = this.getCachedVerification(cacheKey);
|
|
880
903
|
if (cached) return cached;
|
|
881
904
|
try {
|
|
905
|
+
const headers = { Authorization: `Bearer ${token}` };
|
|
906
|
+
if (this.organizationId) headers["x-organization-id"] = this.organizationId;
|
|
882
907
|
const res = await fetch(`${this.sharedApiUrl}/auth/verify`, {
|
|
883
|
-
headers
|
|
908
|
+
headers,
|
|
884
909
|
signal: AbortSignal.timeout(VERIFY_FETCH_TIMEOUT_MS)
|
|
885
910
|
});
|
|
886
911
|
if (!res.ok) {
|