@mastra/auth-studio 1.3.8-alpha.0 → 1.3.9-alpha.0

package/dist/_types/@internal_auth/dist/provider/index.d.ts

@@ -50,6 +50,14 @@ export interface IMastraAuthProvider<TUser = unknown> {
      * Map an authenticated user to a memory resource id
      */
     mapUserToResourceId?(user: TUser): string | undefined | null;
+    /**
+     * Return response headers (typically `Set-Cookie` for a rotated session)
+     * that the provider accumulated while handling this request and clear them
+     * from the provider's per-request state. The server middleware appends them
+     * to the outgoing response so that server-to-server session refreshes
+     * reach the browser.
+     */
+    consumePendingResponseHeaders?(request: MastraAuthRequest): Record<string, string> | undefined;
 }
 export declare abstract class MastraAuthProvider<TUser = unknown> extends MastraBase implements IMastraAuthProvider<TUser> {
     protected?: MastraAuthConfig['protected'];
@@ -97,6 +105,7 @@ export declare class CompositeAuth extends MastraAuthProvider implements ISSOPro
      */
     get isSimpleAuth(): boolean;
     authenticateToken(token: string, request: MastraAuthRequest): Promise<unknown | null>;
+    consumePendingResponseHeaders(request: MastraAuthRequest): Record<string, string> | undefined;
     authorizeUser(user: unknown, request: MastraAuthRequest): Promise<boolean>;
     /**
      * Forward cookie header to SSO provider for PKCE validation.

package/dist/index.cjs

@@ -21,6 +21,10 @@ function getRequestHeader(request, name) {
 	if (headers && typeof headers === "object") return headerFromPlainObject(headers, name);
 	return null;
 }
+function getWebRequest(request) {
+	if (request instanceof Request) return request;
+	return request.raw instanceof Request ? request.raw : void 0;
+}
 //#endregion
 //#region ../../packages/_internal-core/dist/logger/index.js
 /**
@@ -424,6 +428,7 @@ function resolvePermissionsFromMapping(roles, mapping) {
 */
 //#endregion
 //#region src/index.ts
+const DEFAULT_SESSION_MAX_AGE_SECONDS = 336 * 60 * 60;
 const COOKIE_NAME = "wos-session";
 const PROJECT_CONFIG_FILE = ".mastra-project.json";
 /**
@@ -474,6 +479,7 @@ var MastraAuthStudio = class extends MastraAuthProvider {
 	organizationId;
 	useProductionCookies;
 	cookieDomain;
+	sessionMaxAgeSeconds;
 	/**
 	* `userId → sealed session cookie` cache. The `IOrganizationsProvider`
 	* interface only hands us a `userId`, but the shared API's org endpoints are
@@ -500,6 +506,19 @@ var MastraAuthStudio = class extends MastraAuthProvider {
 	* caller's promise is reused by every follower until it settles.
 	*/
 	organizationBootstrapInFlight = /* @__PURE__ */ new Map();
+	/**
+	* Per-request response headers to forward to the browser — specifically a
+	* rotated `wos-session` `Set-Cookie` returned by the shared API when the
+	* platform `sessionAuth` middleware transparently refreshes an expired
+	* access token. Without this, the browser's sealed cookie would never
+	* rotate: platform would succeed server-to-server by refreshing on every
+	* request, but the next refresh would hit `invalid_grant` once WorkOS
+	* invalidated the previous refresh token.
+	*
+	* Keyed by the underlying `Request` (via `getWebRequest`) so we don't retain
+	* requests after the response is written.
+	*/
+	pendingResponseHeaders = /* @__PURE__ */ new WeakMap();
 	constructor(options) {
 		super({
 			name: "mastra-studio",
@@ -510,6 +529,9 @@ var MastraAuthStudio = class extends MastraAuthProvider {
 		this.organizationId = options?.organizationId || process.env.MASTRA_ORGANIZATION_ID || readOrganizationIdFromProjectConfig();
 		if (this.sharedApiUrl.endsWith("/")) this.sharedApiUrl = this.sharedApiUrl.slice(0, -1);
 		this.cookieDomain = options?.cookieDomain || process.env.MASTRA_COOKIE_DOMAIN;
+		const envMaxAge = Number(process.env.MASTRA_SESSION_MAX_AGE);
+		const maxAge = options?.sessionMaxAgeSeconds ?? (envMaxAge > 0 ? envMaxAge : void 0);
+		this.sessionMaxAgeSeconds = maxAge && Number.isFinite(maxAge) && maxAge > 0 ? Math.floor(maxAge) : DEFAULT_SESSION_MAX_AGE_SECONDS;
 		let autoDetectMastraAi = false;
 		if (explicitSharedApiUrl) try {
 			const hostname = new URL(this.sharedApiUrl).hostname.toLowerCase();
@@ -528,7 +550,7 @@ var MastraAuthStudio = class extends MastraAuthProvider {
 	async authenticateToken(token, request) {
 		let user = null;
 		const sessionCookie = parseCookie(getRequestHeader(request, "Cookie"), COOKIE_NAME);
-		if (sessionCookie) user = await this.verifySessionCookie(sessionCookie);
+		if (sessionCookie) user = await this.verifySessionCookie(sessionCookie, request);
 		if (!user && token) user = await this.verifyBearerToken(token);
 		if (!user) return null;
 		if (this.organizationId && !user.memberOrgIds?.includes(this.organizationId)) return null;
@@ -602,7 +624,7 @@ var MastraAuthStudio = class extends MastraAuthProvider {
 		return {
 			id: metadata?.accessToken || crypto.randomUUID(),
 			userId,
-			expiresAt: new Date(now.getTime() + 1440 * 60 * 1e3),
+			expiresAt: new Date(now.getTime() + this.sessionMaxAgeSeconds * 1e3),
 			createdAt: now,
 			metadata
 		};
@@ -614,7 +636,7 @@ var MastraAuthStudio = class extends MastraAuthProvider {
 		return {
 			id: sessionId,
 			userId: user.id,
-			expiresAt: new Date(now.getTime() + 1440 * 60 * 1e3),
+			expiresAt: new Date(now.getTime() + this.sessionMaxAgeSeconds * 1e3),
 			createdAt: now
 		};
 	}
@@ -651,7 +673,7 @@ var MastraAuthStudio = class extends MastraAuthProvider {
 			return {
 				id: newSessionId,
 				userId: user.id,
-				expiresAt: new Date(now.getTime() + 1440 * 60 * 1e3),
+				expiresAt: new Date(now.getTime() + this.sessionMaxAgeSeconds * 1e3),
 				createdAt: now
 			};
 		} catch (error) {
@@ -674,7 +696,7 @@ var MastraAuthStudio = class extends MastraAuthProvider {
 			"HttpOnly",
 			"SameSite=Lax",
 			"Path=/",
-			"Max-Age=86400"
+			`Max-Age=${this.sessionMaxAgeSeconds}`
 		];
 		if (this.useProductionCookies && this.cookieDomain) {
 			parts.push("Secure");
@@ -698,7 +720,7 @@ var MastraAuthStudio = class extends MastraAuthProvider {
 	}
 	async getCurrentUser(request) {
 		const sessionCookie = parseCookie(request.headers.get("Cookie"), COOKIE_NAME);
-		if (sessionCookie) return this.verifySessionCookie(sessionCookie);
+		if (sessionCookie) return this.verifySessionCookie(sessionCookie, request);
 		const authHeader = request.headers.get("Authorization");
 		if (authHeader?.startsWith("Bearer ")) return this.verifyBearerToken(authHeader.slice(7));
 		return null;
@@ -851,6 +873,57 @@ var MastraAuthStudio = class extends MastraAuthProvider {
 		}
 	}
 	/**
+	* Read every `Set-Cookie` header from a response, falling back to the
+	* single-value accessor on runtimes without `Headers.getSetCookie()`.
+	*/
+	readSetCookieHeaders(res) {
+		const headers = res.headers;
+		if (typeof headers.getSetCookie === "function") return headers.getSetCookie();
+		const single = res.headers.get("Set-Cookie");
+		return single ? [single] : [];
+	}
+	/**
+	* If the shared API rotated the sealed `wos-session` cookie on this
+	* response, stash the `Set-Cookie` header against the inbound request so
+	* the server middleware can forward it to the browser, and invalidate the
+	* short-TTL verification cache entry for the old cookie value. Returns the
+	* rotated sealed value, or null when the cookie was not rotated.
+	*/
+	captureRotatedCookie(res, oldSessionCookie, oldCacheKey, request) {
+		const setCookies = this.readSetCookieHeaders(res);
+		if (setCookies.length === 0) return null;
+		const rotatedCookieHeader = setCookies.find((h) => parseCookieFromHeader(h, COOKIE_NAME) !== null);
+		if (!rotatedCookieHeader) return null;
+		const rotatedValue = parseCookieFromHeader(rotatedCookieHeader, COOKIE_NAME);
+		if (!rotatedValue || rotatedValue === oldSessionCookie) return null;
+		const reissued = this.getSessionHeaders({
+			id: rotatedValue,
+			userId: "",
+			expiresAt: /* @__PURE__ */ new Date(),
+			createdAt: /* @__PURE__ */ new Date()
+		});
+		this.verifiedCredentials.delete(oldCacheKey);
+		if (request) {
+			const rawRequest = getWebRequest(request);
+			if (rawRequest) this.pendingResponseHeaders.set(rawRequest, reissued);
+			else this.logger.warn("captureRotatedCookie: renewed session cookie cannot be forwarded (no web Request)");
+		}
+		return rotatedValue;
+	}
+	/**
+	* Server middleware hook: emit any response headers the provider
+	* accumulated for this request (currently a rotated `Set-Cookie`) and
+	* clear them from the provider's per-request state.
+	*/
+	consumePendingResponseHeaders(request) {
+		const rawRequest = getWebRequest(request);
+		if (!rawRequest) return void 0;
+		const headers = this.pendingResponseHeaders.get(rawRequest);
+		if (!headers) return void 0;
+		this.pendingResponseHeaders.delete(rawRequest);
+		return headers;
+	}
+	/**
 	* Fetch the shared API's `/auth/me` and return the raw response body, or
 	* `null` on any non-OK / network error. Split out so `ensureOrganization`
 	* and `isOrganizationAdmin` can reuse it without duplicating the shape.
@@ -871,7 +944,7 @@ var MastraAuthStudio = class extends MastraAuthProvider {
 	* Forward a sealed session cookie to the shared API's /auth/me endpoint
 	* to validate it and get user info.
 	*/
-	async verifySessionCookie(sessionCookie) {
+	async verifySessionCookie(sessionCookie, request) {
 		const cacheKey = await this.verificationKey("cookie", sessionCookie);
 		const cached = this.getCachedVerification(cacheKey);
 		if (cached) {
@@ -883,6 +956,7 @@ var MastraAuthStudio = class extends MastraAuthProvider {
 				headers: { Cookie: `${COOKIE_NAME}=${sessionCookie}` },
 				signal: AbortSignal.timeout(VERIFY_FETCH_TIMEOUT_MS)
 			});
+			const rotated = this.captureRotatedCookie(res, sessionCookie, cacheKey, request);
 			if (!res.ok) {
 				this.logger.warn("verifySessionCookie: shared API returned non-OK status", {
 					status: res.status,
@@ -892,7 +966,7 @@ var MastraAuthStudio = class extends MastraAuthProvider {
 				return null;
 			}
 			const data = await res.json();
-			this.rememberUserSession(data.user.id, sessionCookie);
+			this.rememberUserSession(data.user.id, rotated ?? sessionCookie);
 			const sessionUser = {
 				id: data.user.id,
 				email: data.user.email,
@@ -904,7 +978,7 @@ var MastraAuthStudio = class extends MastraAuthProvider {
 				memberOrgIds: data.memberOrgIds
 			};
 			const user = await this.asPinnedOrganizationMember(sessionUser, sessionCookie);
-			if (user.organizationId) this.cacheVerification(cacheKey, user);
+			if (user.organizationId && !rotated) this.cacheVerification(cacheKey, user);
 			return user;
 		} catch (error) {
 			this.logger.error("verifySessionCookie: fetch to shared API failed", {
@@ -976,7 +1050,7 @@ function isAdminRole(role) {
 }
 /**
 * Parse a cookie value from a Set-Cookie header.
-* Set-Cookie format: "name=value; HttpOnly; SameSite=Lax; Path=/; Max-Age=86400"
+* Set-Cookie format: "name=value; HttpOnly; SameSite=Lax; Path=/; Max-Age=1209600"
 */
 function parseCookieFromHeader(setCookieHeader, name) {
 	const parts = setCookieHeader.split(";");