@mastra/auth-workos 1.3.0 → 1.4.0

package/dist/index.js

@@ -785,6 +785,9 @@ var MastraRBACWorkos = class {
   }
 };
 var FILTER_ACCESSIBLE_CHECK_CONCURRENCY = 5;
+function isWorkOSResourceNotFoundError(error) {
+  return error?.status === 404 || error?.code === "entity_not_found";
+}
 var WorkOSFGAResourceNotFoundError = class extends Error {
   status = 404;
   resourceType;
@@ -814,6 +817,10 @@ var MastraFGAWorkos = class {
   organizationId;
   resourceMapping;
   permissionMapping;
+  requireForProtectedRoutes;
+  auditProtectedRoutes;
+  resolveRouteFGA;
+  validatePermissions;
   constructor(options) {
     const apiKey = options.apiKey ?? process.env.WORKOS_API_KEY;
     const clientId = options.clientId ?? process.env.WORKOS_CLIENT_ID;
@@ -826,6 +833,10 @@ var MastraFGAWorkos = class {
     this.organizationId = options.organizationId;
     this.resourceMapping = options.resourceMapping ?? {};
     this.permissionMapping = options.permissionMapping ?? {};
+    this.requireForProtectedRoutes = options.requireForProtectedRoutes;
+    this.auditProtectedRoutes = options.auditProtectedRoutes;
+    this.resolveRouteFGA = options.resolveRouteFGA;
+    this.validatePermissions = options.validatePermissions;
   }
   // ──────────────────────────────────────────────────────────────
   // IFGAProvider — Read-only checks
@@ -843,8 +854,8 @@ var MastraFGAWorkos = class {
       const result = await this.workos.authorization.check(checkOptions);
       return result.authorized;
     } catch (error) {
-      if (error?.status === 404 || error?.code === "entity_not_found") {
-        throw new WorkOSFGAResourceNotFoundError(params.resource.type, params.resource.id);
+      if (isWorkOSResourceNotFoundError(error)) {
+        return false;
       }
       throw error;
     }
@@ -864,8 +875,8 @@ var MastraFGAWorkos = class {
       }
     } catch (error) {
       if (error instanceof FGADeniedError) throw error;
-      if (error?.status === 404 || error?.code === "entity_not_found") {
-        throw new WorkOSFGAResourceNotFoundError(params.resource.type, params.resource.id);
+      if (isWorkOSResourceNotFoundError(error)) {
+        throw new FGADeniedError(user, params.resource, params.permission);
       }
       throw error;
     }