@mastra/auth 1.1.0 → 1.1.1

package/dist/_types/@internal_auth/dist/provider/index.d.ts

@@ -0,0 +1,125 @@
+import { MastraBase } from '../_types/@internal_core/dist/base/index.d.ts';
+import type { CredentialsResult, ISSOProvider, ISessionProvider, IUserProvider, Session, SSOCallbackResult, SSOLoginConfig, User } from '..';
+import type { AuthorizeUserFn, MastraAuthConfig, MastraAuthRequest } from '../types/index.js';
+export interface MastraAuthProviderOptions<TUser = unknown> {
+    name?: string;
+    authorizeUser?: AuthorizeUserFn<TUser>;
+    mapUserToResourceId?(user: TUser): string | undefined | null;
+    /**
+     * Protected paths for the auth provider
+     */
+    protected?: MastraAuthConfig['protected'];
+    /**
+     * Public paths for the auth provider
+     */
+    public?: MastraAuthConfig['public'];
+}
+export declare abstract class MastraAuthProvider<TUser = unknown> extends MastraBase {
+    protected?: MastraAuthConfig['protected'];
+    public?: MastraAuthConfig['public'];
+    mapUserToResourceId?(user: TUser): string | undefined | null;
+    constructor(options?: MastraAuthProviderOptions<TUser>);
+    /**
+     * Authenticate a token and return the payload
+     * @param token - The token to authenticate
+     * @param request - The request
+     * @returns The payload
+     */
+    abstract authenticateToken(token: string, request: MastraAuthRequest): Promise<TUser | null>;
+    /**
+     * Authorize a user for a path and method
+     * @param user - The user to authorize
+     * @param request - The request
+     * @returns The authorization result
+     */
+    abstract authorizeUser(user: TUser, request: MastraAuthRequest): Promise<boolean> | boolean;
+    protected registerOptions(opts?: MastraAuthProviderOptions<TUser>): void;
+}
+export declare class CompositeAuth extends MastraAuthProvider implements ISSOProvider<User>, ISessionProvider<Session>, IUserProvider<User> {
+    private providers;
+    private authenticatedProviderByObject;
+    private authenticatedProviderByPrimitive;
+    constructor(providers: MastraAuthProvider[]);
+    private findProvider;
+    private rememberAuthenticatedProvider;
+    private takeAuthenticatedProvider;
+    private mapAuthenticatedUserToResourceId;
+    /**
+     * True if any provider is MastraCloudAuth (exempt from license requirement).
+     */
+    get isMastraCloudAuth(): boolean;
+    /**
+     * True if any provider is SimpleAuth (exempt from license requirement).
+     */
+    get isSimpleAuth(): boolean;
+    authenticateToken(token: string, request: MastraAuthRequest): Promise<unknown | null>;
+    authorizeUser(user: unknown, request: MastraAuthRequest): Promise<boolean>;
+    /**
+     * Forward cookie header to SSO provider for PKCE validation.
+     * Called by auth handler before handleCallback().
+     */
+    setCallbackCookieHeader(cookieHeader: string | null): void;
+    getLoginUrl(redirectUri: string, state: string): string | Promise<string>;
+    getLoginCookies(redirectUri: string, state: string): string[] | undefined;
+    handleCallback(code: string, state: string): Promise<SSOCallbackResult<User>>;
+    getLoginButtonConfig(): SSOLoginConfig;
+    getLogoutUrl(redirectUri: string, request?: Request): Promise<string | null>;
+    createSession(userId: string, metadata?: Record<string, unknown>): Promise<Session>;
+    validateSession(sessionId: string): Promise<Session | null>;
+    destroySession(sessionId: string): Promise<void>;
+    refreshSession(sessionId: string): Promise<Session | null>;
+    getSessionIdFromRequest(request: Request): string | null;
+    getSessionHeaders(session: Session): Record<string, string>;
+    getClearSessionHeaders(): Record<string, string>;
+    getCurrentUser(request: Request): Promise<User | null>;
+    getUser(userId: string): Promise<User | null>;
+    getUsers(userIds: string[]): Promise<Array<User | null>>;
+}
+type TokenToUser<TUser> = Record<string, TUser>;
+export interface SimpleAuthOptions<TUser> extends MastraAuthProviderOptions<TUser> {
+    /**
+     * Valid tokens to authenticate against
+     */
+    tokens: TokenToUser<TUser>;
+    /**
+     * Headers to check for authentication
+     * @default ['Authorization', 'X-Playground-Access']
+     */
+    headers?: string | string[];
+}
+export declare class SimpleAuth<TUser> extends MastraAuthProvider<TUser> {
+    /**
+     * Marker to exempt SimpleAuth from EE license requirement.
+     * SimpleAuth is for development/testing and should work without a license.
+     */
+    readonly isSimpleAuth = true;
+    private tokens;
+    private headers;
+    private users;
+    private userById;
+    constructor(options: SimpleAuthOptions<TUser>);
+    authenticateToken(token: string, request: MastraAuthRequest): Promise<TUser | null>;
+    authorizeUser(user: TUser, _request: MastraAuthRequest): Promise<boolean>;
+    /** Get current user from request headers or cookie. */
+    getCurrentUser(request: Request): Promise<TUser | null>;
+    private getUserFromCookie;
+    /** Get user by ID. */
+    getUser(userId: string): Promise<TUser | null>;
+    getUsers(userIds: string[]): Promise<Array<TUser | null>>;
+    /**
+     * Sign in with token (passed as password field).
+     * The email field is ignored - only the token matters.
+     */
+    signIn(_email: string, password: string, _request: Request): Promise<CredentialsResult<TUser>>;
+    signUp(): Promise<CredentialsResult<TUser>>;
+    isSignUpEnabled(): boolean;
+    /**
+     * Get headers to clear the session cookie on logout.
+     * Partial ISessionProvider implementation for logout support.
+     */
+    getClearSessionHeaders(): Record<string, string>;
+    private stripBearerPrefix;
+    private getTokensFromHeaders;
+}
+export {};
+//# sourceMappingURL=index.d.ts.map

package/dist/_types/@internal_auth/dist/session/cookie.d.ts

@@ -0,0 +1,82 @@
+/**
+ * Signed cookie session provider.
+ *
+ * Stores session data in signed cookies. No server-side storage required.
+ */
+import type { Session, ISessionProvider } from '..';
+/**
+ * Options for CookieSessionProvider.
+ */
+export interface CookieSessionProviderOptions {
+    /** Secret for signing cookies (required) */
+    secret: string;
+    /** Session TTL in milliseconds (default: 7 days) */
+    ttl?: number;
+    /** Cookie name (default: 'mastra_session') */
+    cookieName?: string;
+    /** Cookie path (default: '/') */
+    cookiePath?: string;
+    /** Cookie domain */
+    cookieDomain?: string;
+    /** Use secure cookies (default: true in production) */
+    secure?: boolean;
+}
+/**
+ * Signed cookie session provider.
+ *
+ * Stores session data in signed cookies. The session is validated
+ * by verifying the signature on each request.
+ *
+ * @example
+ * ```typescript
+ * const sessionProvider = new CookieSessionProvider({
+ *   secret: process.env.SESSION_SECRET!,
+ *   ttl: 7 * 24 * 60 * 60 * 1000, // 7 days
+ * });
+ * ```
+ */
+export declare class CookieSessionProvider implements ISessionProvider {
+    private secret;
+    private ttl;
+    private cookieName;
+    private cookiePath;
+    private cookieDomain?;
+    private secure;
+    constructor(options: CookieSessionProviderOptions);
+    createSession(userId: string, metadata?: Record<string, unknown>): Promise<Session>;
+    validateSession(_sessionId: string): Promise<Session | null>;
+    destroySession(_sessionId: string): Promise<void>;
+    refreshSession(_sessionId: string): Promise<Session | null>;
+    getSessionIdFromRequest(request: Request): string | null;
+    /**
+     * Get full session from cookie.
+     */
+    getSessionFromCookie(request: Request): Session | null;
+    getSessionHeaders(session: Session): Record<string, string>;
+    getClearSessionHeaders(): Record<string, string>;
+    /**
+     * Sign and encode session data.
+     */
+    private signAndEncode;
+    /**
+     * Decode and verify session cookie.
+     */
+    private decodeAndVerify;
+    /**
+     * Create HMAC-SHA256 signature.
+     */
+    private sign;
+    /**
+     * Base64 encode (consistent across Node.js and browser runtimes).
+     */
+    private base64Encode;
+    /**
+     * Base64 decode (consistent across Node.js and browser runtimes).
+     */
+    private base64Decode;
+    /**
+     * Constant-time string comparison.
+     */
+    private secureCompare;
+}
+//# sourceMappingURL=cookie.d.ts.map

package/dist/_types/@internal_auth/dist/session/index.d.ts

@@ -0,0 +1,30 @@
+/**
+ * Session object representing an authenticated session.
+ */
+export interface Session {
+    /** Unique session identifier */
+    id: string;
+    /** User ID this session belongs to */
+    userId: string;
+    /** When the session expires */
+    expiresAt: Date;
+    /** When the session was created */
+    createdAt: Date;
+    /** Additional session metadata */
+    metadata?: Record<string, unknown>;
+}
+/**
+ * Provider interface for session management.
+ */
+export interface ISessionProvider<TSession extends Session = Session> {
+    createSession(userId: string, metadata?: Record<string, unknown>): Promise<TSession>;
+    validateSession(sessionId: string): Promise<TSession | null>;
+    destroySession(sessionId: string): Promise<void>;
+    refreshSession(sessionId: string): Promise<TSession | null>;
+    getSessionIdFromRequest(request: Request): string | null;
+    getSessionHeaders(session: TSession): Record<string, string>;
+    getClearSessionHeaders(): Record<string, string>;
+}
+export { MemorySessionProvider, type MemorySessionProviderOptions } from './memory.js';
+export { CookieSessionProvider, type CookieSessionProviderOptions } from './cookie.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/_types/@internal_auth/dist/session/memory.d.ts

@@ -0,0 +1,60 @@
+/**
+ * In-memory session provider for development.
+ *
+ * WARNING: Sessions are lost on server restart. Not for production use.
+ */
+import type { Session, ISessionProvider } from '..';
+/**
+ * Options for MemorySessionProvider.
+ */
+export interface MemorySessionProviderOptions {
+    /** Session TTL in milliseconds (default: 7 days) */
+    ttl?: number;
+    /** Cookie name (default: 'mastra_session') */
+    cookieName?: string;
+    /** Cookie path (default: '/') */
+    cookiePath?: string;
+    /** Cleanup interval in milliseconds (default: 60000) */
+    cleanupInterval?: number;
+}
+/**
+ * In-memory session provider.
+ *
+ * Stores sessions in a Map. Useful for development but not suitable
+ * for production as sessions are lost on restart.
+ *
+ * @example
+ * ```typescript
+ * const sessionProvider = new MemorySessionProvider({
+ *   ttl: 24 * 60 * 60 * 1000, // 24 hours
+ * });
+ * ```
+ */
+export declare class MemorySessionProvider implements ISessionProvider {
+    private sessions;
+    private ttl;
+    private cookieName;
+    private cookiePath;
+    private cleanupTimer;
+    constructor(options?: MemorySessionProviderOptions);
+    createSession(userId: string, metadata?: Record<string, unknown>): Promise<Session>;
+    validateSession(sessionId: string): Promise<Session | null>;
+    destroySession(sessionId: string): Promise<void>;
+    refreshSession(sessionId: string): Promise<Session | null>;
+    getSessionIdFromRequest(request: Request): string | null;
+    getSessionHeaders(session: Session): Record<string, string>;
+    getClearSessionHeaders(): Record<string, string>;
+    /**
+     * Clean up expired sessions.
+     */
+    private cleanup;
+    /**
+     * Stop the cleanup timer.
+     */
+    dispose(): void;
+    /**
+     * Get the number of active sessions (for debugging).
+     */
+    getSessionCount(): number;
+}
+//# sourceMappingURL=memory.d.ts.map

package/dist/_types/@internal_auth/dist/types/index.d.ts

@@ -0,0 +1,52 @@
+export interface HonoRequestLike {
+    raw?: Request;
+    headers?: Headers;
+    header(name: string): string | undefined;
+}
+export type MastraAuthRequest = Request | HonoRequestLike;
+export type AuthenticateTokenFn<TUser, TResult = Promise<TUser | null>> = {
+    bivarianceHack(token: string, request: MastraAuthRequest): TResult;
+}['bivarianceHack'];
+export type AuthorizeUserFn<TUser, TResult = Promise<boolean> | boolean> = {
+    bivarianceHack(user: TUser, request: MastraAuthRequest): TResult;
+}['bivarianceHack'];
+export declare function getRequestHeader(request: MastraAuthRequest, name: string): string | null;
+export declare function getWebRequest(request: MastraAuthRequest): Request | undefined;
+export type Methods = 'GET' | 'POST' | 'PUT' | 'DELETE' | 'PATCH' | 'ALL';
+export type MastraAuthConfig<TUser = unknown, TContext = unknown> = {
+    /**
+     * Protected paths for the server.
+     */
+    protected?: (RegExp | string | [string, Methods | Methods[]])[];
+    /**
+     * Public paths for the server.
+     */
+    public?: (RegExp | string | [string, Methods | Methods[]])[];
+    /**
+     * Authenticate a token and return the user.
+     */
+    authenticateToken?: AuthenticateTokenFn<TUser, Promise<TUser>>;
+    /**
+     * Maps the authenticated user to a resource ID for memory/thread scoping.
+     */
+    mapUserToResourceId?(user: TUser): string | undefined | null;
+    /**
+     * Authorization function for the server.
+     */
+    authorize?: (path: string, method: string, user: TUser, context: TContext) => Promise<boolean>;
+    /**
+     * Rules for the server.
+     */
+    rules?: {
+        /** Path for the rule. */
+        path?: RegExp | string | string[];
+        /** Method for the rule. */
+        methods?: Methods | Methods[];
+        /** Condition for the rule. */
+        condition?: (user: TUser) => Promise<boolean> | boolean;
+        /** Allow the rule. */
+        allow?: boolean;
+    }[];
+};
+export type { MastraAuthProviderOptions } from '../provider/index.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/docs/SKILL.md

@@ -3,7 +3,7 @@ name: mastra-auth
 description: Documentation for @mastra/auth. Use when working with @mastra/auth APIs, configuration, or implementation.
 metadata:
   package: "@mastra/auth"
-  version: "1.1.0"
+  version: "1.1.1"
 ---
 
 ## When to use

package/dist/docs/assets/SOURCE_MAP.json

@@ -1,5 +1,5 @@
 {
-  "version": "1.1.0",
+  "version": "1.1.1",
   "package": "@mastra/auth",
   "exports": {},
   "modules": {}

package/dist/docs/references/docs-server-auth.md

@@ -15,7 +15,7 @@ Authentication is optional. If no auth is configured, all routes and Studio are
 
 See [Custom API Routes](https://mastra.ai/docs/server/custom-api-routes) for controlling authentication on custom endpoints. Visit the [Studio Auth docs](https://mastra.ai/docs/studio/auth) for more on securing your Studio deployment.
 
-> **Note:** Authentication for Studio is currently supported by the following providers: Simple Auth, JWT, WorkOS, and Better Auth.
+> **Note:** Authentication for Studio is currently supported by the following providers: Simple Auth, JWT, WorkOS, Better Auth, and Google.
 
 ## Available providers
 
@@ -30,6 +30,7 @@ See [Custom API Routes](https://mastra.ai/docs/server/custom-api-routes) for con
 - [Better Auth](https://mastra.ai/docs/server/auth/better-auth)
 - [Clerk](https://mastra.ai/docs/server/auth/clerk)
 - [Firebase](https://mastra.ai/docs/server/auth/firebase)
+- [Google](https://mastra.ai/docs/server/auth/google)
 - [Okta](https://mastra.ai/docs/server/auth/okta)
 - [Supabase](https://mastra.ai/docs/server/auth/supabase)
 - [WorkOS](https://mastra.ai/docs/server/auth/workos)

package/dist/index.cjs

@@ -2,7 +2,6 @@
 
 var jwt = require('jsonwebtoken');
 var jwksClient = require('jwks-rsa');
-var server = require('@mastra/core/server');
 
 function _interopDefault (e) { return e && e.__esModule ? e : { default: e }; }
 
@@ -33,6 +32,187 @@ async function verifyJwks(accessToken, jwksUri) {
   const signingKey = key.getPublicKey();
   return jwt__default.default.verify(accessToken, signingKey);
 }
+
+// ../_internal-core/dist/chunk-3M4SEWMI.js
+var RegisteredLogger = {
+  LLM: "LLM"};
+var LogLevel = {
+  DEBUG: "debug",
+  INFO: "info",
+  WARN: "warn",
+  ERROR: "error"};
+var MastraLogger = class {
+  name;
+  level;
+  transports;
+  constructor(options = {}) {
+    this.name = options.name || "Mastra";
+    this.level = options.level || LogLevel.ERROR;
+    this.transports = new Map(Object.entries(options.transports || {}));
+  }
+  getTransports() {
+    return this.transports;
+  }
+  trackException(_error, _metadata) {
+  }
+  async listLogs(transportId, params) {
+    if (!transportId || !this.transports.has(transportId)) {
+      return { logs: [], total: 0, page: params?.page ?? 1, perPage: params?.perPage ?? 100, hasMore: false };
+    }
+    return this.transports.get(transportId).listLogs?.(params) ?? {
+      logs: [],
+      total: 0,
+      page: params?.page ?? 1,
+      perPage: params?.perPage ?? 100,
+      hasMore: false
+    };
+  }
+  async listLogsByRunId({
+    transportId,
+    runId,
+    fromDate,
+    toDate,
+    logLevel,
+    filters,
+    page,
+    perPage
+  }) {
+    if (!transportId || !this.transports.has(transportId) || !runId) {
+      return { logs: [], total: 0, page: page ?? 1, perPage: perPage ?? 100, hasMore: false };
+    }
+    return this.transports.get(transportId).listLogsByRunId?.({ runId, fromDate, toDate, logLevel, filters, page, perPage }) ?? {
+      logs: [],
+      total: 0,
+      page: page ?? 1,
+      perPage: perPage ?? 100,
+      hasMore: false
+    };
+  }
+};
+var ConsoleLogger = class _ConsoleLogger extends MastraLogger {
+  component;
+  filter;
+  constructor(options = {}) {
+    super(options);
+    this.component = options.component;
+    this.filter = options.filter;
+  }
+  child(componentOrBindings) {
+    const component = typeof componentOrBindings === "string" ? componentOrBindings : componentOrBindings?.component ?? this.component;
+    return new _ConsoleLogger({
+      name: this.name,
+      level: this.level,
+      component,
+      filter: this.filter
+    });
+  }
+  shouldLog(level, message, args) {
+    if (!this.filter) return true;
+    try {
+      return this.filter({ component: this.component, level, message, args });
+    } catch (e) {
+      console.error(`[Logger] Filter error for component=${this.component} level=${level}:`, e);
+      return true;
+    }
+  }
+  prefix() {
+    return this.component ? `[${this.component}] ` : "";
+  }
+  debug(message, ...args) {
+    if (this.level === LogLevel.DEBUG && this.shouldLog(LogLevel.DEBUG, message, args)) {
+      console.info(`${this.prefix()}${message}`, ...args);
+    }
+  }
+  info(message, ...args) {
+    if ((this.level === LogLevel.INFO || this.level === LogLevel.DEBUG) && this.shouldLog(LogLevel.INFO, message, args)) {
+      console.info(`${this.prefix()}${message}`, ...args);
+    }
+  }
+  warn(message, ...args) {
+    if ((this.level === LogLevel.WARN || this.level === LogLevel.INFO || this.level === LogLevel.DEBUG) && this.shouldLog(LogLevel.WARN, message, args)) {
+      console.warn(`${this.prefix()}${message}`, ...args);
+    }
+  }
+  error(message, ...args) {
+    if ((this.level === LogLevel.ERROR || this.level === LogLevel.WARN || this.level === LogLevel.INFO || this.level === LogLevel.DEBUG) && this.shouldLog(LogLevel.ERROR, message, args)) {
+      console.error(`${this.prefix()}${message}`, ...args);
+    }
+  }
+  async listLogs(_transportId, _params) {
+    return { logs: [], total: 0, page: _params?.page ?? 1, perPage: _params?.perPage ?? 100, hasMore: false };
+  }
+  async listLogsByRunId(_args) {
+    return { logs: [], total: 0, page: _args.page ?? 1, perPage: _args.perPage ?? 100, hasMore: false };
+  }
+};
+
+// ../_internal-core/dist/base/index.js
+var MastraBase = class {
+  component = RegisteredLogger.LLM;
+  logger;
+  name;
+  #rawConfig;
+  constructor({
+    component,
+    name,
+    rawConfig
+  }) {
+    this.component = component || RegisteredLogger.LLM;
+    this.name = name;
+    this.#rawConfig = rawConfig;
+    this.logger = new ConsoleLogger({ name: `${this.component} - ${this.name}` });
+  }
+  /**
+   * Returns the raw storage configuration this primitive was created from,
+   * or undefined if it was created from code.
+   */
+  toRawConfig() {
+    return this.#rawConfig;
+  }
+  /**
+   * Sets the raw storage configuration for this primitive.
+   * @internal
+   */
+  __setRawConfig(rawConfig) {
+    this.#rawConfig = rawConfig;
+  }
+  /**
+   * Set the logger for the agent
+   * @param logger
+   */
+  __setLogger(logger) {
+    this.logger = "child" in logger && typeof logger.child === "function" ? logger.child({ component: this.component }) : logger;
+  }
+};
+
+// ../_internals/auth/dist/chunk-XG6GH2VJ.js
+var MastraAuthProvider = class extends MastraBase {
+  protected;
+  public;
+  constructor(options) {
+    super({ component: "AUTH", name: options?.name });
+    if (options?.authorizeUser) {
+      this.authorizeUser = options.authorizeUser.bind(this);
+    }
+    this.protected = options?.protected;
+    this.public = options?.public;
+    this.mapUserToResourceId = options?.mapUserToResourceId;
+  }
+  registerOptions(opts) {
+    if (opts?.authorizeUser) {
+      this.authorizeUser = opts.authorizeUser.bind(this);
+    }
+    if (opts?.mapUserToResourceId) {
+      this.mapUserToResourceId = opts.mapUserToResourceId;
+    }
+    if (opts?.protected) {
+      this.protected = opts.protected;
+    }
+    if (opts?.public) {
+      this.public = opts.public;
+    }
+  }
+};
 function str(value) {
   return typeof value === "string" ? value : void 0;
 }
@@ -48,7 +228,7 @@ function defaultMapUser(payload) {
     avatarUrl: str(payload.avatarUrl) || str(payload.avatar_url) || str(payload.picture)
   };
 }
-var MastraJwtAuth = class extends server.MastraAuthProvider {
+var MastraJwtAuth = class extends MastraAuthProvider {
   secret;
   mapUser;
   constructor(options) {