@mastra/auth-workos 1.0.0 → 1.1.0-alpha.0

package/CHANGELOG.md

@@ -1,5 +1,43 @@
 # @mastra/auth-workos
 
+## 1.1.0-alpha.0
+
+### Minor Changes
+
+- Added full auth provider to `@mastra/auth-workos` with SSO, RBAC, SCIM directory sync, and admin portal support. ([#13163](https://github.com/mastra-ai/mastra/pull/13163))
+
+  ```ts
+  import { MastraAuthWorkos, MastraRBACWorkos } from '@mastra/auth-workos';
+
+  const mastra = new Mastra({
+    server: {
+      auth: new MastraAuthWorkos({
+        apiKey: process.env.WORKOS_API_KEY,
+        clientId: process.env.WORKOS_CLIENT_ID,
+      }),
+      rbac: new MastraRBACWorkos({
+        apiKey: process.env.WORKOS_API_KEY,
+        clientId: process.env.WORKOS_CLIENT_ID,
+        roleMapping: {
+          admin: ['*'],
+          member: ['agents:read', 'workflows:*'],
+        },
+      }),
+    },
+  });
+  ```
+
+  - **SSO** via WorkOS AuthKit (SAML, OIDC)
+  - **RBAC** with wildcard permission mapping from WorkOS organization roles
+  - **Directory Sync** webhook handler for SCIM-based user provisioning
+  - **Admin Portal** helper for customer self-service SSO configuration
+
+### Patch Changes
+
+- Updated dependencies [[`504fc8b`](https://github.com/mastra-ai/mastra/commit/504fc8b9d0ddab717577ad3bf9c95ea4bd5377bd), [`f9c150b`](https://github.com/mastra-ai/mastra/commit/f9c150b7595ad05ad9cc9a11098e2944361e8c22), [`88de7e8`](https://github.com/mastra-ai/mastra/commit/88de7e8dfe4b7e1951a9e441bb33136e705ce24e), [`edee4b3`](https://github.com/mastra-ai/mastra/commit/edee4b37dff0af515fc7cc0e8d71ee39e6a762f0), [`3790c75`](https://github.com/mastra-ai/mastra/commit/3790c7578cc6a47d854eb12d89e6b1912867fe29), [`e7a235b`](https://github.com/mastra-ai/mastra/commit/e7a235be6472e0c870ed6c791ddb17c492dc188b), [`d51d298`](https://github.com/mastra-ai/mastra/commit/d51d298953967aab1f58ec965b644d109214f085), [`6dbeeb9`](https://github.com/mastra-ai/mastra/commit/6dbeeb94a8b1eebb727300d1a98961f882180794), [`d5f0d8d`](https://github.com/mastra-ai/mastra/commit/d5f0d8d6a03e515ddaa9b5da19b7e44b8357b07b), [`09c3b18`](https://github.com/mastra-ai/mastra/commit/09c3b1802ff14e243a8a8baea327440bc8cc2e32), [`b896379`](https://github.com/mastra-ai/mastra/commit/b8963791c6afa79484645fcec596a201f936b9a2), [`85c84eb`](https://github.com/mastra-ai/mastra/commit/85c84ebb78aebfcba9d209c8e152b16d7a00cb71), [`a89272a`](https://github.com/mastra-ai/mastra/commit/a89272a5d71939b9fcd284e6a6dc1dd091a6bdcf), [`ee9c8df`](https://github.com/mastra-ai/mastra/commit/ee9c8df644f19d055af5f496bf4942705f5a47b7), [`77b4a25`](https://github.com/mastra-ai/mastra/commit/77b4a254e51907f8ff3a3ba95596a18e93ae4b35), [`276246e`](https://github.com/mastra-ai/mastra/commit/276246e0b9066a1ea48bbc70df84dbe528daaf99), [`08ecfdb`](https://github.com/mastra-ai/mastra/commit/08ecfdbdad6fb8285deef86a034bdf4a6047cfca), [`d5f628c`](https://github.com/mastra-ai/mastra/commit/d5f628ca86c6f6f3ff1035d52f635df32dd81cab), [`524c0f3`](https://github.com/mastra-ai/mastra/commit/524c0f3c434c3d9d18f66338dcef383d6161b59c), [`c18a0e9`](https://github.com/mastra-ai/mastra/commit/c18a0e9cef1e4ca004b2963d35e4cfc031971eac), [`4bd21ea`](https://github.com/mastra-ai/mastra/commit/4bd21ea43d44d0a0427414fc047577f9f0aa3bec), [`115a7a4`](https://github.com/mastra-ai/mastra/commit/115a7a47db5e9896fec12ae6507501adb9ec89bf), [`22a48ae`](https://github.com/mastra-ai/mastra/commit/22a48ae2513eb54d8d79dad361fddbca97a155e8), [`3c6ef79`](https://github.com/mastra-ai/mastra/commit/3c6ef798481e00d6d22563be2de98818fd4dd5e0), [`9311c17`](https://github.com/mastra-ai/mastra/commit/9311c17d7a0640d9c4da2e71b814dc67c57c6369), [`7edf78f`](https://github.com/mastra-ai/mastra/commit/7edf78f80422c43e84585f08ba11df0d4d0b73c5), [`1c4221c`](https://github.com/mastra-ai/mastra/commit/1c4221cf6032ec98d0e094d4ee11da3e48490d96), [`d25b9ea`](https://github.com/mastra-ai/mastra/commit/d25b9eabd400167255a97b690ffbc4ee4097ded5), [`fe1ce5c`](https://github.com/mastra-ai/mastra/commit/fe1ce5c9211c03d561606fda95cbfe7df1d9a9b5), [`b03c0e0`](https://github.com/mastra-ai/mastra/commit/b03c0e0389a799523929a458b0509c9e4244d562), [`0a8366b`](https://github.com/mastra-ai/mastra/commit/0a8366b0a692fcdde56c4d526e4cf03c502ae4ac), [`85664e9`](https://github.com/mastra-ai/mastra/commit/85664e9fd857320fbc245e301f764f45f66f32a3), [`bc79650`](https://github.com/mastra-ai/mastra/commit/bc796500c6e0334faa158a96077e3fb332274869), [`9257d01`](https://github.com/mastra-ai/mastra/commit/9257d01d1366d81f84c582fe02b5e200cf9621f4), [`3a3a59e`](https://github.com/mastra-ai/mastra/commit/3a3a59e8ffaa6a985fe3d9a126a3f5ade11a6724), [`3108d4e`](https://github.com/mastra-ai/mastra/commit/3108d4e649c9fddbf03253a6feeb388a5fa9fa5a), [`0c33b2c`](https://github.com/mastra-ai/mastra/commit/0c33b2c9db537f815e1c59e2c898ffce2e395a79), [`191e5bd`](https://github.com/mastra-ai/mastra/commit/191e5bd29b82f5bda35243945790da7bc7b695c2), [`f77cd94`](https://github.com/mastra-ai/mastra/commit/f77cd94c44eabed490384e7d19232a865e13214c), [`e8135c7`](https://github.com/mastra-ai/mastra/commit/e8135c7e300dac5040670eec7eab896ac6092e30), [`daca48f`](https://github.com/mastra-ai/mastra/commit/daca48f0fb17b7ae0b62a2ac40cf0e491b2fd0b7), [`257d14f`](https://github.com/mastra-ai/mastra/commit/257d14faca5931f2e4186fc165b6f0b1f915deee), [`352f25d`](https://github.com/mastra-ai/mastra/commit/352f25da316b24cdd5b410fd8dddf6a8b763da2a), [`93477d0`](https://github.com/mastra-ai/mastra/commit/93477d0769b8a13ea5ed73d508d967fb23eaeed9), [`31c78b3`](https://github.com/mastra-ai/mastra/commit/31c78b3eb28f58a8017f1dcc795c33214d87feac), [`0bc0720`](https://github.com/mastra-ai/mastra/commit/0bc07201095791858087cc56f353fcd65e87ab54), [`36516ac`](https://github.com/mastra-ai/mastra/commit/36516aca1021cbeb42e74751b46a2614101f37c8), [`e947652`](https://github.com/mastra-ai/mastra/commit/e9476527fdecb4449e54570e80dfaf8466901254), [`3c6ef79`](https://github.com/mastra-ai/mastra/commit/3c6ef798481e00d6d22563be2de98818fd4dd5e0), [`9257d01`](https://github.com/mastra-ai/mastra/commit/9257d01d1366d81f84c582fe02b5e200cf9621f4), [`ec248f6`](https://github.com/mastra-ai/mastra/commit/ec248f6b56e8a037c066c49b2178e2507471d988)]:
+  - @mastra/core@1.9.0-alpha.0
+  - @mastra/auth@1.0.0
+
 ## 1.0.0
 
 ### Major Changes

package/LICENSE.md

@@ -1,3 +1,18 @@
+Portions of this software are licensed as follows:
+
+- All content that resides under any directory named "ee/" within this
+  repository, including but not limited to:
+  - `packages/core/src/auth/ee/`
+  - `packages/server/src/server/auth/ee/`
+    is licensed under the license defined in `ee/LICENSE`.
+
+- All third-party components incorporated into the Mastra Software are
+  licensed under the original license provided by the owner of the
+  applicable component.
+
+- Content outside of the above-mentioned directories or restrictions is
+  available under the "Apache License 2.0" as defined below.
+
 # Apache License 2.0
 
 Copyright (c) 2025 Kepler Software, Inc.

package/dist/admin-portal.d.ts

@@ -0,0 +1,77 @@
+/**
+ * WorkOS Admin Portal integration for customer self-service configuration.
+ *
+ * The Admin Portal allows enterprise customers to configure their own:
+ * - SSO connections (SAML, OIDC)
+ * - Directory Sync (SCIM)
+ * - Audit log viewing and export
+ * - Log streaming to SIEM systems
+ *
+ * @module
+ */
+import type { WorkOS } from '@workos-inc/node';
+import type { AdminPortalIntent, WorkOSAdminPortalOptions } from './types.js';
+/**
+ * Generates links to the WorkOS Admin Portal for customer self-service configuration.
+ *
+ * The Admin Portal provides a pre-built UI where enterprise customers can manage
+ * their own identity configuration without developer intervention.
+ *
+ * @example
+ * ```typescript
+ * import { WorkOS } from '@workos-inc/node';
+ * import { WorkOSAdminPortal } from '@mastra/workos';
+ *
+ * const workos = new WorkOS(process.env.WORKOS_API_KEY);
+ * const adminPortal = new WorkOSAdminPortal(workos, {
+ *   returnUrl: 'https://app.example.com/settings',
+ * });
+ *
+ * // Generate a link for SSO configuration
+ * const ssoLink = await adminPortal.getPortalLink('org_01H...', 'sso');
+ *
+ * // Generate a link for Directory Sync configuration
+ * const dsyncLink = await adminPortal.getPortalLink('org_01H...', 'dsync');
+ *
+ * // Redirect the user to the generated link
+ * ```
+ */
+export declare class WorkOSAdminPortal {
+    private workos;
+    private returnUrl;
+    /**
+     * Creates a new WorkOSAdminPortal instance.
+     *
+     * @param workos - The WorkOS client instance
+     * @param options - Configuration options for the Admin Portal
+     */
+    constructor(workos: WorkOS, options?: WorkOSAdminPortalOptions);
+    /**
+     * Generates a link to the WorkOS Admin Portal for a specific organization.
+     *
+     * The generated link is a one-time use URL that expires after a short period.
+     * Users should be redirected to this link immediately after generation.
+     *
+     * @param organizationId - The WorkOS organization ID (e.g., 'org_01H...')
+     * @param intent - The portal section to open. Determines what the user can configure:
+     *   - `'sso'`: Configure SSO connections (SAML, OIDC providers)
+     *   - `'dsync'`: Configure Directory Sync (SCIM provisioning)
+     *   - `'audit_logs'`: View and export audit logs
+     *   - `'log_streams'`: Configure log streaming to external SIEM systems
+     * @returns A promise that resolves to the Admin Portal URL
+     *
+     * @example
+     * ```typescript
+     * // SSO configuration (default)
+     * const link = await adminPortal.getPortalLink('org_01H...');
+     *
+     * // Directory Sync configuration
+     * const link = await adminPortal.getPortalLink('org_01H...', 'dsync');
+     *
+     * // Audit logs viewing
+     * const link = await adminPortal.getPortalLink('org_01H...', 'audit_logs');
+     * ```
+     */
+    getPortalLink(organizationId: string, intent?: AdminPortalIntent): Promise<string>;
+}
+//# sourceMappingURL=admin-portal.d.ts.map

package/dist/admin-portal.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin-portal.d.ts","sourceRoot":"","sources":["../src/admin-portal.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAGH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAE/C,OAAO,KAAK,EAAE,iBAAiB,EAAE,wBAAwB,EAAE,MAAM,YAAY,CAAC;AAY9E;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,qBAAa,iBAAiB;IAC5B,OAAO,CAAC,MAAM,CAAS;IACvB,OAAO,CAAC,SAAS,CAAS;IAE1B;;;;;OAKG;gBACS,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,wBAAwB;IAK9D;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;IACG,aAAa,CAAC,cAAc,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,iBAAiB,GAAG,OAAO,CAAC,MAAM,CAAC;CASzF"}

package/dist/auth-provider.d.ts

@@ -0,0 +1,137 @@
+/**
+ * MastraAuthWorkos - WorkOS authentication provider for Mastra.
+ *
+ * Uses @workos/authkit-session for session management with encrypted
+ * cookie-based sessions that persist across server restarts.
+ */
+import type { IUserProvider, ISSOProvider, ISessionProvider, Session, SSOCallbackResult, SSOLoginConfig } from '@mastra/core/auth';
+import type { EEUser } from '@mastra/core/auth/ee';
+import { MastraAuthProvider } from '@mastra/core/server';
+import { AuthService } from '@workos/authkit-session';
+import type { AuthKitConfig } from '@workos/authkit-session';
+import { WorkOS } from '@workos-inc/node';
+import type { HonoRequest } from 'hono';
+import type { WorkOSUser, MastraAuthWorkosOptions } from './types.js';
+/**
+ * Mastra authentication provider for WorkOS.
+ *
+ * Uses WorkOS AuthKit with encrypted cookie-based sessions.
+ * Sessions are stored in cookies, so they persist across server restarts.
+ *
+ * @example Basic usage with SSO
+ * ```typescript
+ * import { MastraAuthWorkos } from '@mastra/auth-workos';
+ *
+ * const auth = new MastraAuthWorkos({
+ *   apiKey: process.env.WORKOS_API_KEY,
+ *   clientId: process.env.WORKOS_CLIENT_ID,
+ *   redirectUri: 'https://myapp.com/auth/callback',
+ *   cookiePassword: process.env.WORKOS_COOKIE_PASSWORD, // min 32 chars
+ * });
+ * ```
+ */
+export declare class MastraAuthWorkos extends MastraAuthProvider<WorkOSUser> implements IUserProvider<EEUser>, ISSOProvider<EEUser>, ISessionProvider<Session> {
+    protected workos: WorkOS;
+    protected clientId: string;
+    protected redirectUri: string;
+    protected ssoConfig: MastraAuthWorkosOptions['sso'];
+    protected authService: AuthService<Request, Response>;
+    protected config: AuthKitConfig;
+    constructor(options?: MastraAuthWorkosOptions);
+    /**
+     * Authenticate a bearer token or session cookie.
+     *
+     * Uses AuthKit's withAuth() for cookie-based sessions, falls back to
+     * JWT verification for bearer tokens.
+     */
+    authenticateToken(token: string, request: HonoRequest | Request): Promise<WorkOSUser | null>;
+    /**
+     * Authorize a user for access.
+     */
+    authorizeUser(user: WorkOSUser): Promise<boolean>;
+    /**
+     * Get the current user from the request using AuthKit session.
+     */
+    getCurrentUser(request: Request): Promise<EEUser | null>;
+    /**
+     * Get a user by their ID.
+     */
+    getUser(userId: string): Promise<WorkOSUser | null>;
+    /**
+     * Get the URL to the user's profile page.
+     */
+    getUserProfileUrl(user: EEUser): string;
+    /**
+     * Get the URL to redirect users to for SSO login.
+     */
+    getLoginUrl(redirectUri: string, state: string): string;
+    /**
+     * Handle the OAuth callback from WorkOS.
+     *
+     * Uses AuthKit's handleCallback for proper session creation.
+     */
+    handleCallback(code: string, _state: string): Promise<SSOCallbackResult<EEUser>>;
+    /**
+     * Get the URL to redirect users to for logout.
+     * Extracts session ID from the request's JWT to build a valid WorkOS logout URL.
+     *
+     * @param redirectUri - URL to redirect to after logout
+     * @param request - Request containing session cookie (needed to extract sid)
+     * @returns Logout URL or null if no active session
+     */
+    getLogoutUrl(redirectUri: string, request?: Request): Promise<string | null>;
+    /**
+     * Get the configuration for rendering the login button.
+     */
+    getLoginButtonConfig(): SSOLoginConfig;
+    /**
+     * Create a new session for a user.
+     *
+     * Note: With AuthKit, sessions are created via handleCallback.
+     * This method is kept for interface compatibility.
+     */
+    createSession(userId: string, metadata?: Record<string, unknown>): Promise<Session>;
+    /**
+     * Validate a session.
+     *
+     * With AuthKit, sessions are validated via withAuth().
+     */
+    validateSession(_sessionId: string): Promise<Session | null>;
+    /**
+     * Destroy a session.
+     */
+    destroySession(_sessionId: string): Promise<void>;
+    /**
+     * Refresh a session.
+     */
+    refreshSession(_sessionId: string): Promise<Session | null>;
+    /**
+     * Extract session ID from a request.
+     */
+    getSessionIdFromRequest(_request: Request): string | null;
+    /**
+     * Get response headers to set the session cookie.
+     */
+    getSessionHeaders(session: Session): Record<string, string>;
+    /**
+     * Get response headers to clear the session cookie.
+     */
+    getClearSessionHeaders(): Record<string, string>;
+    /**
+     * Get the underlying WorkOS client.
+     */
+    getWorkOS(): WorkOS;
+    /**
+     * Get the AuthKit AuthService.
+     */
+    getAuthService(): AuthService<Request, Response>;
+    /**
+     * Get the configured client ID.
+     */
+    getClientId(): string;
+    /**
+     * Get the configured redirect URI.
+     */
+    getRedirectUri(): string;
+}
+//# sourceMappingURL=auth-provider.d.ts.map

package/dist/auth-provider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-provider.d.ts","sourceRoot":"","sources":["../src/auth-provider.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,KAAK,EACV,aAAa,EACb,YAAY,EACZ,gBAAgB,EAChB,OAAO,EACP,iBAAiB,EACjB,cAAc,EACf,MAAM,mBAAmB,CAAC;AAC3B,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAEnD,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,EAAE,WAAW,EAAqB,MAAM,yBAAyB,CAAC;AACzE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAC7D,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC1C,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,MAAM,CAAC;AAGxC,OAAO,KAAK,EAAE,UAAU,EAAE,uBAAuB,EAAE,MAAM,YAAY,CAAC;AAStE;;;;;;;;;;;;;;;;;GAiBG;AACH,qBAAa,gBACX,SAAQ,kBAAkB,CAAC,UAAU,CACrC,YAAW,aAAa,CAAC,MAAM,CAAC,EAAE,YAAY,CAAC,MAAM,CAAC,EAAE,gBAAgB,CAAC,OAAO,CAAC;IAEjF,SAAS,CAAC,MAAM,EAAE,MAAM,CAAC;IACzB,SAAS,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC3B,SAAS,CAAC,WAAW,EAAE,MAAM,CAAC;IAC9B,SAAS,CAAC,SAAS,EAAE,uBAAuB,CAAC,KAAK,CAAC,CAAC;IACpD,SAAS,CAAC,WAAW,EAAE,WAAW,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IACtD,SAAS,CAAC,MAAM,EAAE,aAAa,CAAC;gBAEpB,OAAO,CAAC,EAAE,uBAAuB;IAqE7C;;;;;OAKG;IACG,iBAAiB,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,GAAG,OAAO,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC;IA2ClG;;OAEG;IACG,aAAa,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC;IAQvD;;OAEG;IACG,cAAc,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAuC9D;;OAEG;IACG,OAAO,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC;IAYzD;;OAEG;IACH,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM;IAQvC;;OAEG;IACH,WAAW,CAAC,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM;IA8BvD;;;;OAIG;IACG,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC;IA4BtF;;;;;;;OAOG;IACG,YAAY,CAAC,WAAW,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAiClF;;OAEG;IACH,oBAAoB,IAAI,cAAc;IAyBtC;;;;;OAKG;IACG,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC;IAczF;;;;OAIG;IACG,eAAe,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC;IAMlE;;OAEG;IACG,cAAc,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAKvD;;OAEG;IACG,cAAc,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC;IAKjE;;OAEG;IACH,uBAAuB,CAAC,QAAQ,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI;IAMzD;;OAEG;IACH,iBAAiB,CAAC,OAAO,EAAE,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC;IAU3D;;OAEG;IACH,sBAAsB,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC;IAShD;;OAEG;IACH,SAAS,IAAI,MAAM;IAInB;;OAEG;IACH,cAAc,IAAI,WAAW,CAAC,OAAO,EAAE,QAAQ,CAAC;IAIhD;;OAEG;IACH,WAAW,IAAI,MAAM;IAIrB;;OAEG;IACH,cAAc,IAAI,MAAM;CAGzB"}

package/dist/directory-sync.d.ts

@@ -0,0 +1,129 @@
+/**
+ * WorkOS Directory Sync integration for automated user provisioning via SCIM.
+ *
+ * This class handles SCIM webhook events from WorkOS, enabling automated
+ * user and group management when integrated with identity providers.
+ */
+import type { WorkOS, Directory, DirectoryUser, DirectoryGroup } from '@workos-inc/node';
+import type { WorkOSDirectorySyncOptions } from './types.js';
+/**
+ * WorkOSDirectorySync handles SCIM webhook events from WorkOS for automated
+ * user provisioning and deprovisioning.
+ *
+ * @example
+ * ```typescript
+ * import { WorkOS } from '@workos-inc/node';
+ * import { WorkOSDirectorySync } from '@mastra/auth-workos';
+ *
+ * const workos = new WorkOS(process.env.WORKOS_API_KEY);
+ *
+ * const directorySync = new WorkOSDirectorySync(workos, {
+ *   webhookSecret: process.env.WORKOS_WEBHOOK_SECRET,
+ *   handlers: {
+ *     onUserCreated: async (user) => {
+ *       await db.users.create({ email: user.emails[0]?.value });
+ *     },
+ *     onUserDeleted: async (user) => {
+ *       await db.users.delete({ id: user.id });
+ *     },
+ *   },
+ * });
+ *
+ * // In your webhook endpoint:
+ * app.post('/webhooks/workos', async (req, res) => {
+ *   const signature = req.headers['workos-signature'] as string;
+ *   await directorySync.handleWebhook(req.body, signature);
+ *   res.status(200).send('OK');
+ * });
+ * ```
+ */
+export declare class WorkOSDirectorySync {
+    private workos;
+    private webhookSecret;
+    private handlers;
+    /**
+     * Creates a new WorkOSDirectorySync instance.
+     *
+     * @param workos - WorkOS client instance
+     * @param options - Configuration options including webhook secret and event handlers
+     * @throws Error if webhook secret is not provided
+     */
+    constructor(workos: WorkOS, options: WorkOSDirectorySyncOptions);
+    /**
+     * Handles incoming webhook events from WorkOS Directory Sync.
+     *
+     * This method verifies the webhook signature for security, parses the event,
+     * and routes it to the appropriate handler based on the event type.
+     *
+     * @param payload - Raw webhook payload (string or object)
+     * @param signature - WorkOS signature header for verification
+     * @throws Error if signature verification fails
+     */
+    handleWebhook(payload: string | object, signature: string): Promise<void>;
+    /**
+     * Routes a directory sync event to the appropriate handler.
+     *
+     * @param event - The verified webhook event
+     */
+    private routeEvent;
+    /**
+     * Maps raw webhook user data to the DirectorySyncUserData type.
+     *
+     * @param data - Raw user data from webhook
+     * @returns Typed user data
+     */
+    private mapUserData;
+    /**
+     * Maps raw webhook group data to the DirectorySyncGroupData type.
+     *
+     * @param data - Raw group data from webhook
+     * @returns Typed group data
+     */
+    private mapGroupData;
+    /**
+     * Lists all directories for an organization.
+     *
+     * @param organizationId - The WorkOS organization ID
+     * @returns Array of directories
+     *
+     * @example
+     * ```typescript
+     * const directories = await directorySync.listDirectories('org_123');
+     * for (const dir of directories) {
+     *   console.log(`Directory: ${dir.name} (${dir.type})`);
+     * }
+     * ```
+     */
+    listDirectories(organizationId: string): Promise<Directory[]>;
+    /**
+     * Lists all users in a directory.
+     *
+     * @param directoryId - The directory ID
+     * @returns Array of directory users
+     *
+     * @example
+     * ```typescript
+     * const users = await directorySync.listDirectoryUsers('directory_123');
+     * for (const user of users) {
+     *   console.log(`User: ${user.firstName} ${user.lastName}`);
+     * }
+     * ```
+     */
+    listDirectoryUsers(directoryId: string): Promise<DirectoryUser[]>;
+    /**
+     * Lists all groups in a directory.
+     *
+     * @param directoryId - The directory ID
+     * @returns Array of directory groups
+     *
+     * @example
+     * ```typescript
+     * const groups = await directorySync.listDirectoryGroups('directory_123');
+     * for (const group of groups) {
+     *   console.log(`Group: ${group.name}`);
+     * }
+     * ```
+     */
+    listDirectoryGroups(directoryId: string): Promise<DirectoryGroup[]>;
+}
+//# sourceMappingURL=directory-sync.d.ts.map

package/dist/directory-sync.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"directory-sync.d.ts","sourceRoot":"","sources":["../src/directory-sync.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAEzF,OAAO,KAAK,EACV,0BAA0B,EAI3B,MAAM,YAAY,CAAC;AAyBpB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,qBAAa,mBAAmB;IAC9B,OAAO,CAAC,MAAM,CAAS;IACvB,OAAO,CAAC,aAAa,CAAS;IAC9B,OAAO,CAAC,QAAQ,CAAwB;IAExC;;;;;;OAMG;gBACS,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,0BAA0B;IAc/D;;;;;;;;;OASG;IACG,aAAa,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAoB/E;;;;OAIG;YACW,UAAU;IAgExB;;;;;OAKG;IACH,OAAO,CAAC,WAAW;IAoBnB;;;;;OAKG;IACH,OAAO,CAAC,YAAY;IAiBpB;;;;;;;;;;;;;OAaG;IACG,eAAe,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC;IAOnE;;;;;;;;;;;;;OAaG;IACG,kBAAkB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC;IAOvE;;;;;;;;;;;;;OAaG;IACG,mBAAmB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC;CAM1E"}