@mastra/auth-studio 1.3.6-alpha.0 → 1.3.7-alpha.0

package/dist/_types/@internal_auth/dist/ee/interfaces/permissions.generated.d.ts

@@ -180,6 +180,8 @@ export declare const PERMISSION_PATTERNS: {
     readonly 'memory:read': 'memory:read';
     /** Create and modify memory and threads */
     readonly 'memory:write': 'memory:write';
+    /** Delete traces and spans */
+    readonly 'observability:delete': 'observability:delete';
     /** View traces and spans */
     readonly 'observability:read': 'observability:read';
     /** Create and modify traces and spans */
@@ -313,7 +315,7 @@ export type PermissionPattern = keyof typeof PERMISSION_PATTERNS;
 /**
  * All valid resource:action permission combinations (excludes wildcards).
  */
-export declare const PERMISSIONS: readonly ['a2a:read', 'a2a:write', 'agent-builder:execute', 'agent-builder:read', 'agent-builder:write', 'agent-controller:execute', 'agent-controller:read', 'agents:create', 'agents:delete', 'agents:execute', 'agents:read', 'agents:write', 'auth:read', 'background-tasks:read', 'channels:read', 'channels:write', 'datasets:delete', 'datasets:execute', 'datasets:read', 'datasets:write', 'embedders:read', 'experiments:delete', 'experiments:read', 'infrastructure:read', 'logs:read', 'mcp:execute', 'mcp:read', 'mcp:write', 'memory:delete', 'memory:execute', 'memory:read', 'memory:write', 'observability:read', 'observability:write', 'processor-providers:read', 'processors:execute', 'processors:read', 'schedules:delete', 'schedules:execute', 'schedules:read', 'schedules:write', 'scores:read', 'scores:write', 'stored-agents:delete', 'stored-agents:publish', 'stored-agents:read', 'stored-agents:write', 'stored-mcp-clients:delete', 'stored-mcp-clients:publish', 'stored-mcp-clients:read', 'stored-mcp-clients:write', 'stored-prompt-blocks:delete', 'stored-prompt-blocks:publish', 'stored-prompt-blocks:read', 'stored-prompt-blocks:write', 'stored-scorers:delete', 'stored-scorers:publish', 'stored-scorers:read', 'stored-scorers:write', 'stored-skills:delete', 'stored-skills:publish', 'stored-skills:read', 'stored-skills:write', 'stored-workflows:read', 'stored-workflows:write', 'stored-workspaces:delete', 'stored-workspaces:read', 'stored-workspaces:write', 'system:read', 'tool-providers:delete', 'tool-providers:read', 'tool-providers:write', 'tools:execute', 'tools:read', 'vector:delete', 'vector:execute', 'vector:read', 'vector:write', 'vectors:read', 'workflows:delete', 'workflows:execute', 'workflows:read', 'workflows:write', 'workspaces:delete', 'workspaces:read', 'workspaces:write'];
+export declare const PERMISSIONS: readonly ['a2a:read', 'a2a:write', 'agent-builder:execute', 'agent-builder:read', 'agent-builder:write', 'agent-controller:execute', 'agent-controller:read', 'agents:create', 'agents:delete', 'agents:execute', 'agents:read', 'agents:write', 'auth:read', 'background-tasks:read', 'channels:read', 'channels:write', 'datasets:delete', 'datasets:execute', 'datasets:read', 'datasets:write', 'embedders:read', 'experiments:delete', 'experiments:read', 'infrastructure:read', 'logs:read', 'mcp:execute', 'mcp:read', 'mcp:write', 'memory:delete', 'memory:execute', 'memory:read', 'memory:write', 'observability:delete', 'observability:read', 'observability:write', 'processor-providers:read', 'processors:execute', 'processors:read', 'schedules:delete', 'schedules:execute', 'schedules:read', 'schedules:write', 'scores:read', 'scores:write', 'stored-agents:delete', 'stored-agents:publish', 'stored-agents:read', 'stored-agents:write', 'stored-mcp-clients:delete', 'stored-mcp-clients:publish', 'stored-mcp-clients:read', 'stored-mcp-clients:write', 'stored-prompt-blocks:delete', 'stored-prompt-blocks:publish', 'stored-prompt-blocks:read', 'stored-prompt-blocks:write', 'stored-scorers:delete', 'stored-scorers:publish', 'stored-scorers:read', 'stored-scorers:write', 'stored-skills:delete', 'stored-skills:publish', 'stored-skills:read', 'stored-skills:write', 'stored-workflows:read', 'stored-workflows:write', 'stored-workspaces:delete', 'stored-workspaces:read', 'stored-workspaces:write', 'system:read', 'tool-providers:delete', 'tool-providers:read', 'tool-providers:write', 'tools:execute', 'tools:read', 'vector:delete', 'vector:execute', 'vector:read', 'vector:write', 'vectors:read', 'workflows:delete', 'workflows:execute', 'workflows:read', 'workflows:write', 'workspaces:delete', 'workspaces:read', 'workspaces:write'];
 /**
  * Specific permission type (e.g., 'agents:read', 'workflows:execute').
  */
@@ -389,6 +391,8 @@ export declare const MastraFGAPermissions: {
     readonly MEMORY_READ: 'memory:read';
     /** Create and modify memory and threads */
     readonly MEMORY_WRITE: 'memory:write';
+    /** Delete traces and spans */
+    readonly OBSERVABILITY_DELETE: 'observability:delete';
     /** View traces and spans */
     readonly OBSERVABILITY_READ: 'observability:read';
     /** Create and modify traces and spans */

package/dist/_types/@internal_auth/dist/provider/index.d.ts

@@ -1,4 +1,4 @@
-import { MastraBase } from '../_types/@internal_core/dist/base/index.d.ts';
+import { MastraBase } from '../_types/@internal_core/dist/base/index.js';
 import type { CredentialsResult, IAuthHttpHandler, IAuthInit, ICredentialsProvider, IOrganizationsProvider, ISSOProvider, ISessionProvider, IUserProvider, Session, SSOCallbackResult, SSOLoginConfig, User } from '..';
 import type { AuthorizeUserFn, MastraAuthConfig, MastraAuthRequest } from '../types/index.js';
 export interface MastraAuthProviderOptions<TUser = unknown> {

package/dist/_types/@internal_auth/package.json

@@ -0,0 +1 @@
+{"type":"module"}

package/dist/index.cjs

@@ -1,5 +1,4 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-let crypto$1 = require("crypto");
 //#region ../../packages/_internals/auth/dist/types/index.js
 function headerFromPlainObject(headers, name) {
 	const normalizedName = name.toLowerCase();
@@ -312,7 +311,7 @@ var MastraAuthProvider = class extends MastraBase {
 	}
 };
 //#endregion
-//#region ../../packages/_internals/auth/dist/ee-BYnTZaqt.js
+//#region ../../packages/_internals/auth/dist/ee-btY6vXIW.js
 /**
 * FGA enforcement utility for checking fine-grained authorization.
 *
@@ -329,6 +328,7 @@ const RESOURCE_EXPANSIONS = { stored: [
 	"stored-prompt-blocks",
 	"stored-scorers",
 	"stored-skills",
+	"stored-workflows",
 	"stored-workspaces"
 ] };
 /**
@@ -804,8 +804,9 @@ var MastraAuthStudio = class extends MastraAuthProvider {
 		}
 	}
 	/** Cache key for a verified credential — hash, never the raw secret. */
-	verificationKey(kind, credential) {
-		return (0, crypto$1.createHash)("sha256").update(`${kind}:${credential}`).digest("hex");
+	async verificationKey(kind, credential) {
+		const digest = new Uint8Array(await globalThis.crypto.subtle.digest("SHA-256", new TextEncoder().encode(`${kind}:${credential}`)));
+		return Array.from(digest, (byte) => byte.toString(16).padStart(2, "0")).join("");
 	}
 	getCachedVerification(key) {
 		const entry = this.verifiedCredentials.get(key);
@@ -849,7 +850,7 @@ var MastraAuthStudio = class extends MastraAuthProvider {
 	* to validate it and get user info.
 	*/
 	async verifySessionCookie(sessionCookie) {
-		const cacheKey = this.verificationKey("cookie", sessionCookie);
+		const cacheKey = await this.verificationKey("cookie", sessionCookie);
 		const cached = this.getCachedVerification(cacheKey);
 		if (cached) {
 			this.rememberUserSession(cached.id, sessionCookie);
@@ -899,7 +900,7 @@ var MastraAuthStudio = class extends MastraAuthProvider {
 	* to validate it and get user info (used for CLI tokens).
 	*/
 	async verifyBearerToken(token) {
-		const cacheKey = this.verificationKey("bearer", token);
+		const cacheKey = await this.verificationKey("bearer", token);
 		const cached = this.getCachedVerification(cacheKey);
 		if (cached) return cached;
 		try {