@mastra/auth-studio 1.3.5 → 1.3.6
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/_types/@internal_auth/dist/ee/interfaces/permissions.generated.d.ts +5 -1
- package/dist/index.cjs +35 -9
- package/dist/index.cjs.map +1 -1
- package/dist/index.d.ts +4 -1
- package/dist/index.d.ts.map +1 -1
- package/dist/index.js +35 -9
- package/dist/index.js.map +1 -1
- package/package.json +4 -4
package/dist/index.d.ts
CHANGED
|
@@ -16,7 +16,7 @@ export interface StudioUser extends EEUser {
|
|
|
16
16
|
export interface MastraAuthStudioOptions extends MastraAuthProviderOptions<StudioUser> {
|
|
17
17
|
/** Base URL of the Mastra shared API (e.g., https://api.mastra.ai/v1) */
|
|
18
18
|
sharedApiUrl?: string;
|
|
19
|
-
/** Organization ID that owns this deployed instance.
|
|
19
|
+
/** Organization ID that owns this deployed instance. Members are served in this org whatever org their session is on; non-members are rejected. */
|
|
20
20
|
organizationId?: string;
|
|
21
21
|
/**
|
|
22
22
|
* Cookie domain for session cookies (e.g., '.example.com').
|
|
@@ -117,6 +117,9 @@ export declare class MastraAuthStudio extends MastraAuthProvider<StudioUser> imp
|
|
|
117
117
|
* org. Any shared-API failure resolves to `false`.
|
|
118
118
|
*/
|
|
119
119
|
isOrganizationAdmin(organizationId: string, userId: string): Promise<boolean>;
|
|
120
|
+
private fetchOrganizationRole;
|
|
121
|
+
private fetchMembershipRole;
|
|
122
|
+
private asPinnedOrganizationMember;
|
|
120
123
|
/**
|
|
121
124
|
* Record the sealed session cookie last seen for a user so
|
|
122
125
|
* {@link ensureOrganization} / {@link isOrganizationAdmin} can act on their
|
package/dist/index.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EACV,sBAAsB,EACtB,YAAY,EACZ,gBAAgB,EAChB,aAAa,EACb,iBAAiB,EACjB,OAAO,EACP,iBAAiB,EACjB,cAAc,EACf,MAAM,gBAAgB,CAAC;AAExB,OAAO,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAE5E,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAC7D,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,yBAAyB,CAAC;AAEzE,MAAM,WAAW,UAAW,SAAQ,MAAM;IACxC,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,iFAAiF;IACjF,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;CACzB;AAED,MAAM,WAAW,uBAAwB,SAAQ,yBAAyB,CAAC,UAAU,CAAC;IACpF,yEAAyE;IACzE,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,
|
|
1
|
+
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EACV,sBAAsB,EACtB,YAAY,EACZ,gBAAgB,EAChB,aAAa,EACb,iBAAiB,EACjB,OAAO,EACP,iBAAiB,EACjB,cAAc,EACf,MAAM,gBAAgB,CAAC;AAExB,OAAO,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAE5E,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAC7D,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,yBAAyB,CAAC;AAEzE,MAAM,WAAW,UAAW,SAAQ,MAAM;IACxC,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,iFAAiF;IACjF,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;CACzB;AAED,MAAM,WAAW,uBAAwB,SAAQ,yBAAyB,CAAC,UAAU,CAAC;IACpF,yEAAyE;IACzE,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,mJAAmJ;IACnJ,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;;;OAKG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAkBD;;;;;;;;;;GAUG;AACH,qBAAa,gBACX,SAAQ,kBAAkB,CAAC,UAAU,CACrC,YAAW,YAAY,CAAC,UAAU,CAAC,EAAE,gBAAgB,CAAC,OAAO,CAAC,EAAE,aAAa,CAAC,UAAU,CAAC,EAAE,sBAAsB;IAEjH,QAAQ,CAAC,iBAAiB,QAAQ;IAElC,OAAO,CAAC,YAAY,CAAS;IAC7B,OAAO,CAAC,cAAc,CAAqB;IAC3C,OAAO,CAAC,oBAAoB,CAAU;IACtC,OAAO,CAAC,YAAY,CAAqB;IACzC;;;;;;OAMG;IACH,OAAO,CAAC,kBAAkB,CAA6B;IACvD,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAQ;IAE1C;;;;;;OAMG;IACH,OAAO,CAAC,mBAAmB,CAA8D;IACzF,OAAO,CAAC,QAAQ,CAAC,sBAAsB,CAAQ;IAE/C;;;;;;OAMG;IACH,OAAO,CAAC,6BAA6B,CAAkD;IAEvF,YAAY,OAAO,CAAC,EAAE,uBAAuB,EAwC5C;IAMD;;;OAGG;IACG,iBAAiB,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAyB7F;IAED,aAAa,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAEvC;IAMD,WAAW,CAAC,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAwBtD;IAEK,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC,UAAU,CAAC,CAAC,CA0BzF;IAED,uBAAuB,CAAC,aAAa,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI,CAE1D;IAED,eAAe,IAAI,MAAM,EAAE,GAAG,SAAS,CAGtC;IAED,oBAAoB,IAAI,cAAc,CAOrC;IAEK,YAAY,CAAC,YAAY,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAwBlF;IAMK,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,CASxF;IAEK,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAWhE;IAEK,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAWrD;IAEK,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAgD/D;IAED,uBAAuB,CAAC,OAAO,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAGvD;IAED,iBAAiB,CAAC,OAAO,EAAE,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAO1D;IAED,sBAAsB,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAO/C;IAMK,cAAc,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAejE;IAEK,OAAO,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAGzD;IAMD;;;;;;;;;;;;;;OAcG;IACG,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAYpE;YAEa,oBAAoB;IAgDlC;;;;;;;OAOG;IACG,mBAAmB,CAAC,cAAc,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CASlF;YAEa,qBAAqB;YAMrB,mBAAmB;YAYnB,0BAA0B;IAexC;;;;OAIG;IACH,OAAO,CAAC,mBAAmB;IAU3B,wEAAwE;IACxE,OAAO,CAAC,eAAe;IAIvB,OAAO,CAAC,qBAAqB;IAU7B,OAAO,CAAC,iBAAiB;IASzB;;;;OAIG;YACW,OAAO;IAuBrB;;;OAGG;YACW,mBAAmB;IAoEjC;;;OAGG;YACW,iBAAiB;CAqDhC;AAyCD,MAAM,WAAW,uBAAuB;IACtC;;;;;;;;;;;;OAYG;IACH,WAAW,EAAE,WAAW,CAAC;CAC1B;AAED;;;;;GAKG;AACH,qBAAa,gBAAiB,YAAW,aAAa,CAAC,UAAU,CAAC;IAChE,OAAO,CAAC,OAAO,CAA0B;IAEzC,IAAI,WAAW,IAAI,WAAW,CAE7B;IAED,YAAY,OAAO,EAAE,uBAAuB,EAE3C;IAEK,QAAQ,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAElD;IAEK,OAAO,CAAC,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAG9D;IAEK,cAAc,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAMxD;IAEK,aAAa,CAAC,IAAI,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAG1E;IAEK,iBAAiB,CAAC,IAAI,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAGjF;IAEK,gBAAgB,CAAC,IAAI,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAGhF;CACF"}
|
package/dist/index.js
CHANGED
|
@@ -311,7 +311,7 @@ var MastraAuthProvider = class extends MastraBase {
|
|
|
311
311
|
}
|
|
312
312
|
};
|
|
313
313
|
//#endregion
|
|
314
|
-
//#region ../../packages/_internals/auth/dist/ee-
|
|
314
|
+
//#region ../../packages/_internals/auth/dist/ee-B4JkfaNy.js
|
|
315
315
|
/**
|
|
316
316
|
* FGA enforcement utility for checking fine-grained authorization.
|
|
317
317
|
*
|
|
@@ -328,6 +328,7 @@ const RESOURCE_EXPANSIONS = { stored: [
|
|
|
328
328
|
"stored-prompt-blocks",
|
|
329
329
|
"stored-scorers",
|
|
330
330
|
"stored-skills",
|
|
331
|
+
"stored-workflows",
|
|
331
332
|
"stored-workspaces"
|
|
332
333
|
] };
|
|
333
334
|
/**
|
|
@@ -757,16 +758,38 @@ var MastraAuthStudio = class extends MastraAuthProvider {
|
|
|
757
758
|
const sessionCookie = this.userSessionCookies.get(userId);
|
|
758
759
|
if (!sessionCookie) return false;
|
|
759
760
|
try {
|
|
760
|
-
|
|
761
|
-
if (me?.organizationId === organizationId) return isAdminRole(me.role);
|
|
762
|
-
const res = await fetch(`${this.sharedApiUrl}/auth/orgs`, { headers: { Cookie: `${COOKIE_NAME}=${sessionCookie}` } });
|
|
763
|
-
if (!res.ok) return false;
|
|
764
|
-
const membership = (await res.json()).organizations?.find((o) => o.id === organizationId);
|
|
765
|
-
return isAdminRole(membership?.role ?? void 0);
|
|
761
|
+
return isAdminRole(await this.fetchOrganizationRole(sessionCookie, organizationId));
|
|
766
762
|
} catch {
|
|
767
763
|
return false;
|
|
768
764
|
}
|
|
769
765
|
}
|
|
766
|
+
async fetchOrganizationRole(sessionCookie, organizationId) {
|
|
767
|
+
const me = await this.fetchMe(sessionCookie);
|
|
768
|
+
if (me?.organizationId === organizationId) return me.role;
|
|
769
|
+
return this.fetchMembershipRole(sessionCookie, organizationId);
|
|
770
|
+
}
|
|
771
|
+
async fetchMembershipRole(sessionCookie, organizationId) {
|
|
772
|
+
const res = await fetch(`${this.sharedApiUrl}/auth/orgs`, {
|
|
773
|
+
headers: { Cookie: `${COOKIE_NAME}=${sessionCookie}` },
|
|
774
|
+
signal: AbortSignal.timeout(VERIFY_FETCH_TIMEOUT_MS)
|
|
775
|
+
});
|
|
776
|
+
if (!res.ok) return void 0;
|
|
777
|
+
return (await res.json()).organizations?.find((o) => o.id === organizationId)?.role ?? void 0;
|
|
778
|
+
}
|
|
779
|
+
async asPinnedOrganizationMember(user, sessionCookie) {
|
|
780
|
+
const pinnedOrganizationId = this.organizationId;
|
|
781
|
+
if (!pinnedOrganizationId) return user;
|
|
782
|
+
const sessionAlreadyOnPinnedOrganization = user.organizationId === pinnedOrganizationId;
|
|
783
|
+
const memberOfPinnedOrganization = user.memberOrgIds?.includes(pinnedOrganizationId) ?? false;
|
|
784
|
+
if (sessionAlreadyOnPinnedOrganization || !memberOfPinnedOrganization) return user;
|
|
785
|
+
const roleInPinnedOrganization = await this.fetchMembershipRole(sessionCookie, pinnedOrganizationId);
|
|
786
|
+
return {
|
|
787
|
+
...user,
|
|
788
|
+
organizationId: pinnedOrganizationId,
|
|
789
|
+
role: roleInPinnedOrganization,
|
|
790
|
+
permissions: void 0
|
|
791
|
+
};
|
|
792
|
+
}
|
|
770
793
|
/**
|
|
771
794
|
* Record the sealed session cookie last seen for a user so
|
|
772
795
|
* {@link ensureOrganization} / {@link isOrganizationAdmin} can act on their
|
|
@@ -847,7 +870,7 @@ var MastraAuthStudio = class extends MastraAuthProvider {
|
|
|
847
870
|
}
|
|
848
871
|
const data = await res.json();
|
|
849
872
|
this.rememberUserSession(data.user.id, sessionCookie);
|
|
850
|
-
const
|
|
873
|
+
const sessionUser = {
|
|
851
874
|
id: data.user.id,
|
|
852
875
|
email: data.user.email,
|
|
853
876
|
name: [data.user.firstName, data.user.lastName].filter(Boolean).join(" ") || void 0,
|
|
@@ -857,6 +880,7 @@ var MastraAuthStudio = class extends MastraAuthProvider {
|
|
|
857
880
|
permissions: data.permissions,
|
|
858
881
|
memberOrgIds: data.memberOrgIds
|
|
859
882
|
};
|
|
883
|
+
const user = await this.asPinnedOrganizationMember(sessionUser, sessionCookie);
|
|
860
884
|
if (user.organizationId) this.cacheVerification(cacheKey, user);
|
|
861
885
|
return user;
|
|
862
886
|
} catch (error) {
|
|
@@ -879,8 +903,10 @@ var MastraAuthStudio = class extends MastraAuthProvider {
|
|
|
879
903
|
const cached = this.getCachedVerification(cacheKey);
|
|
880
904
|
if (cached) return cached;
|
|
881
905
|
try {
|
|
906
|
+
const headers = { Authorization: `Bearer ${token}` };
|
|
907
|
+
if (this.organizationId) headers["x-organization-id"] = this.organizationId;
|
|
882
908
|
const res = await fetch(`${this.sharedApiUrl}/auth/verify`, {
|
|
883
|
-
headers
|
|
909
|
+
headers,
|
|
884
910
|
signal: AbortSignal.timeout(VERIFY_FETCH_TIMEOUT_MS)
|
|
885
911
|
});
|
|
886
912
|
if (!res.ok) {
|