@mastra/express 1.3.17-alpha.1 → 1.3.17-alpha.2

package/dist/index.js

@@ -1,6 +1,6 @@
 import { Busboy } from '@fastify/busboy';
-import { coreAuthMiddleware, isProtectedCustomRoute } from '@mastra/server/auth';
-import { MastraServer as MastraServer$1, redactStreamChunk, normalizeQueryParams } from '@mastra/server/server-adapter';
+import { coreAuthMiddleware, findMatchingCustomRoute, isProtectedCustomRoute } from '@mastra/server/auth';
+import { MastraServer as MastraServer$1, redactStreamChunk, normalizeQueryParams, checkRouteFGA } from '@mastra/server/server-adapter';
 import { RequestContext } from '@mastra/core/request-context';
 
 // src/index.ts
@@ -594,13 +594,14 @@ var MastraServer = class extends MastraServer$1 {
           buildAuthorizeContext: () => toWebRequest2(req)
         });
         if (authError) {
-          if (authError.headers) {
-            for (const [key, value] of Object.entries(authError.headers)) {
+          const authResult = authError;
+          if (authResult.headers) {
+            for (const [key, value] of Object.entries(authResult.headers)) {
               res.setHeader(key, value);
             }
           }
-          if (authError.error) {
-            return res.status(authError.status).json({ error: authError.error });
+          if (authResult.error) {
+            return res.status(authResult.status).json({ error: authResult.error });
           }
         }
         const params = await this.getParams(route, req);
@@ -686,6 +687,14 @@ var MastraServer = class extends MastraServer$1 {
             }
           }
         }
+        const fgaError = await checkRouteFGA(this.mastra, route, res.locals.requestContext, {
+          ...params.urlParams,
+          ...params.queryParams,
+          ...typeof params.body === "object" ? params.body : {}
+        });
+        if (fgaError) {
+          return res.status(fgaError.status).json({ error: fgaError.error, message: fgaError.message });
+        }
         try {
           const result = await route.handler(handlerParams);
           await this.sendResponse(route, res, result, req, prefix);
@@ -713,47 +722,68 @@ var MastraServer = class extends MastraServer$1 {
     this.app.use(async (req, res, next) => {
       const path = String(req.path || "/");
       const method = String(req.method || "GET");
-      if (isProtectedCustomRoute(path, method, this.customRouteAuthConfig)) {
+      const matchedRoute = findMatchingCustomRoute(
+        path,
+        method,
+        this.customApiRoutes ?? this.mastra.getServer()?.apiRoutes
+      );
+      const shouldRunCustomRouteAuth = isProtectedCustomRoute(path, method, this.customRouteAuthConfig);
+      const shouldRunCustomRouteFGA = !!matchedRoute?.route.fga;
+      if (shouldRunCustomRouteAuth || shouldRunCustomRouteFGA) {
         const serverRoute = {
-          method,
-          path,
+          method: matchedRoute?.route.method ?? method,
+          path: matchedRoute?.route.path ?? path,
           responseType: "json",
           handler: async () => {
-          }
+          },
+          requiresAuth: matchedRoute?.route.requiresAuth,
+          requiresPermission: matchedRoute?.route.requiresPermission,
+          fga: matchedRoute?.route.fga
         };
-        const authError = await this.checkRouteAuth(serverRoute, {
-          path,
-          method,
-          getHeader: (name) => req.headers[name.toLowerCase()],
-          getQuery: (name) => req.query[name],
-          requestContext: res.locals.requestContext,
-          request: toWebRequest2(req),
-          buildAuthorizeContext: () => toWebRequest2(req)
-        });
-        if (authError) {
-          if (authError.headers) {
-            for (const [key, value] of Object.entries(authError.headers)) {
-              res.setHeader(key, value);
+        if (shouldRunCustomRouteAuth) {
+          const authError = await this.checkRouteAuth(serverRoute, {
+            path,
+            method,
+            getHeader: (name) => req.headers[name.toLowerCase()],
+            getQuery: (name) => req.query[name],
+            requestContext: res.locals.requestContext,
+            request: toWebRequest2(req),
+            buildAuthorizeContext: () => toWebRequest2(req)
+          });
+          if (authError) {
+            const authResult = authError;
+            if (authResult.headers) {
+              for (const [key, value] of Object.entries(authResult.headers)) {
+                res.setHeader(key, value);
+              }
+            }
+            if (authResult.error) {
+              return res.status(authResult.status).json({ error: authResult.error });
             }
           }
-          if (authError.error) {
-            return res.status(authError.status).json({ error: authError.error });
-          }
-        }
-        const authConfig = this.mastra.getServer()?.auth;
-        if (authConfig) {
-          const hasPermission = await loadHasPermission();
-          if (hasPermission) {
-            const userPermissions = res.locals.requestContext.get("userPermissions");
-            const permissionError = this.checkRoutePermission(serverRoute, userPermissions, hasPermission);
-            if (permissionError) {
-              return res.status(permissionError.status).json({
-                error: permissionError.error,
-                message: permissionError.message
-              });
+          const authConfig = this.mastra.getServer()?.auth;
+          if (authConfig) {
+            const hasPermission = await loadHasPermission();
+            if (hasPermission) {
+              const userPermissions = res.locals.requestContext.get("userPermissions");
+              const permissionError = this.checkRoutePermission(serverRoute, userPermissions, hasPermission);
+              if (permissionError) {
+                return res.status(permissionError.status).json({
+                  error: permissionError.error,
+                  message: permissionError.message
+                });
+              }
             }
           }
         }
+        const fgaError = await checkRouteFGA(this.mastra, serverRoute, res.locals.requestContext, {
+          ...matchedRoute?.params ?? {},
+          ...req.query,
+          ...typeof req.body === "object" && req.body !== null ? req.body : {}
+        });
+        if (fgaError) {
+          return res.status(fgaError.status).json({ error: fgaError.error, message: fgaError.message });
+        }
       }
       const response = await this.handleCustomRouteRequest(
         `${req.protocol}://${req.get("host") || "localhost"}${req.originalUrl}`,