@mastra/factory 0.0.0-aggregate-trace-20261015182851

package/dist/auth.js

@@ -0,0 +1,623 @@
+import { CUSTOM_DOMAIN_UNSUPPORTED_ERROR, isPlatformAuthSupportedHost } from "./platform-auth-host.js";
+import { actorFromAuthUser } from "./storage/domains/comments/actor.js";
+import { isFactoryTelemetryEnabled } from "./telemetry.js";
+import { timedAboveThreshold } from "./timing.js";
+import { MastraAuthWorkos } from "@mastra/auth-workos";
+import { MASTRA_MESSAGE_AUTHOR_KEY } from "@mastra/core/request-context";
+import { isAuthHttpHandler, isCredentialsProvider, isOrganizationsProvider, isSSOProvider, isSessionProvider, registerApiRoute } from "@mastra/core/server";
+import { HTTPException } from "hono/http-exception";
+//#region src/auth.ts
+const ORGANIZATION_ID_HEADER = "X-Mastra-Organization-Id";
+/**
+* Validate that a `returnTo` value is a safe same-site path, to prevent
+* open-redirect attacks. Only absolute local paths (`/foo`) are allowed;
+* protocol-relative (`//evil.com`) and absolute URLs are rejected.
+*/
+function sanitizeReturnTo(raw) {
+	if (!raw) return "/";
+	if (!raw.startsWith("/")) return "/";
+	if (raw.startsWith("//") || raw.startsWith("/\\")) return "/";
+	return raw;
+}
+/** Extract a bearer token from the Authorization header, if present. */
+function getBearerToken(authorization) {
+	if (!authorization) return "";
+	return /^Bearer\s+(.+)$/i.exec(authorization)?.[1] ?? "";
+}
+/**
+* Whether the SPA is served cross-origin from this API (platform deploy). When
+* `MASTRACODE_ALLOWED_ORIGINS` is set the browser talks to us cross-site, so
+* session cookies must be `SameSite=None; Secure` for the browser to send them.
+* Same-origin local dev leaves this unset and keeps the stricter `SameSite=Lax`.
+*/
+function isCrossSiteAuth() {
+	return Boolean(process.env.MASTRACODE_ALLOWED_ORIGINS?.trim());
+}
+/** Context key under which the gate stashes the authenticated user. */
+const FACTORY_AUTH_USER_KEY = "factoryAuthUser";
+/**
+* Read the authenticated user the gate stashed on the context, or
+* `undefined` when unauthenticated / auth disabled. Used by downstream routes
+* (e.g. GitHub) to scope rows per user.
+*/
+function getFactoryAuthUser(c) {
+	return c.get(FACTORY_AUTH_USER_KEY);
+}
+/**
+* Read the authenticated user off a request context, normalizing whatever the
+* active auth provider put there.
+*
+* The server's auth layer writes the provider's `authenticateToken` result into
+* the request context's `user` slot verbatim, so the value's shape follows the
+* provider: WorkOS writes a flat user, better-auth writes a `{ session, user }`
+* wrapper whose org lives on the session. Reading that slot as a
+* {@link FactoryAuthUser} therefore yields `undefined` for both the id and the
+* org under better-auth, which reads as "this session belongs to somebody else"
+* at every ownership check. Normalize on the way in instead.
+*/
+function getFactoryAuthUserFromContext(requestContext) {
+	if (!requestContext || typeof requestContext.get !== "function") return void 0;
+	return toFactoryAuthUser(requestContext.get("user")) ?? void 0;
+}
+/** Resolve the stable user id from an authenticated user shape. */
+function getFactoryAuthUserId(user) {
+	return user?.workosId ?? user?.id;
+}
+/** Resolve the organization id from a user shape, if present. */
+function getFactoryAuthOrgId(user) {
+	return user?.organizationId;
+}
+/**
+* The org rung a user's rows are keyed by: the organization they belong to, or a
+* per-user rung for personal (no-org) accounts so their rows never land in the
+* shared `local` scope. Every writer and reader of a `(org, user)` row must
+* agree on this, so it lives here rather than being re-derived per call site.
+*/
+function factoryUserOrgId(user) {
+	const userId = getFactoryAuthUserId(user);
+	if (!userId) return void 0;
+	return getFactoryAuthOrgId(user) ?? `user:${userId}`;
+}
+/**
+* Resolve the tenant identity `(orgId, userId)` from the authenticated user on
+* the context. Returns `undefined` when there is no signed-in user (auth
+* disabled or unauthenticated). `orgId` is `undefined` for personal accounts;
+* callers gate org-scoped GitHub features on its presence while agent state
+* falls back to a user-only tenant.
+*/
+function factoryAuthTenant(c) {
+	const user = getFactoryAuthUser(c);
+	const userId = getFactoryAuthUserId(user);
+	if (!userId) return void 0;
+	return {
+		orgId: getFactoryAuthOrgId(user),
+		userId
+	};
+}
+function messageAuthor(user) {
+	const userId = getFactoryAuthUserId(user);
+	if (!userId) return void 0;
+	const actor = actorFromAuthUser(userId, user);
+	return {
+		id: actor.id,
+		...actor.displayName ? { name: actor.displayName } : {},
+		...actor.avatarUrl ? { avatarUrl: actor.avatarUrl } : {}
+	};
+}
+/** True when both WorkOS credential env vars are present (legacy env gate). */
+function envWorkosConfigured() {
+	return Boolean(process.env.WORKOS_API_KEY && process.env.WORKOS_CLIENT_ID);
+}
+/**
+* WorkOS provider implied by the `WORKOS_*` env vars — back-compat for test
+* suites exercised without booting the factory (route suites set `WORKOS_*`
+* directly and call {@link mountFactoryAuth} without an explicit provider).
+* `fetchMemberships: true` lets `authenticateToken` resolve `organizationId`
+* from a single membership when the JWT has no org claim — required so a
+* bootstrapped personal org resolves without re-auth.
+*/
+function envFallbackAuthProvider(redirectUri) {
+	if (!envWorkosConfigured()) return void 0;
+	return new MastraAuthWorkos({
+		redirectUri: redirectUri ?? process.env.WORKOS_REDIRECT_URI,
+		fetchMemberships: true
+	});
+}
+/**
+* Map a provider `authenticateToken` result onto the neutral SPA user shape.
+*
+* Two result families exist today:
+* - flat provider users (WorkOS `WorkOSUser` et al.): `id`/`workosId`/`email`/
+*   `name`/`organizationId` directly on the object;
+* - session-shaped results (better-auth `BetterAuthUser`): `{ session, user }`
+*   with the active org on the session.
+*/
+function toFactoryAuthUser(result) {
+	if (!result || typeof result !== "object") return null;
+	const record = result;
+	if (record.user && typeof record.user === "object" && record.session && typeof record.session === "object") {
+		const user = record.user;
+		const session = record.session;
+		if (typeof user.id !== "string") return null;
+		return {
+			id: user.id,
+			email: typeof user.email === "string" ? user.email : void 0,
+			name: typeof user.name === "string" ? user.name : void 0,
+			avatarUrl: typeof user.avatarUrl === "string" ? user.avatarUrl : void 0,
+			organizationId: typeof session.activeOrganizationId === "string" ? session.activeOrganizationId : void 0
+		};
+	}
+	const flat = record;
+	const id = typeof flat.id === "string" ? flat.id : void 0;
+	const workosId = typeof flat.workosId === "string" ? flat.workosId : void 0;
+	if (!id && !workosId) return null;
+	const membershipOrganizationIds = Array.isArray(flat.memberships) ? flat.memberships.flatMap((membership) => {
+		if (!membership || typeof membership !== "object") return [];
+		const organizationId = membership.organizationId;
+		return typeof organizationId === "string" ? [organizationId] : [];
+	}) : [];
+	const memberOrgIds = Array.isArray(flat.memberOrgIds) ? flat.memberOrgIds.filter((organizationId) => typeof organizationId === "string") : [];
+	const organizationMembershipIds = [.../* @__PURE__ */ new Set([...membershipOrganizationIds, ...memberOrgIds])];
+	return {
+		id,
+		workosId,
+		email: typeof flat.email === "string" ? flat.email : void 0,
+		name: typeof flat.name === "string" ? flat.name : void 0,
+		avatarUrl: typeof flat.avatarUrl === "string" ? flat.avatarUrl : void 0,
+		organizationId: typeof flat.organizationId === "string" ? flat.organizationId : void 0,
+		organizationMembershipIds
+	};
+}
+/**
+* Resolve the authenticated user for a request via the provider. Never throws:
+* ordinary invalid/expired sessions resolve to `null`.
+*/
+async function authenticateRequest(provider, token, raw) {
+	try {
+		return toFactoryAuthUser(await provider.authenticateToken(token, raw));
+	} catch {
+		return null;
+	}
+}
+/**
+* Bootstrap a personal org for no-org accounts so org-scoped features (GitHub
+* connect) work without leaving the app. Mutates the resolved user so the
+* current request sees the org immediately; subsequent requests resolve it via
+* the provider's own session/membership lookup (providers cache internally).
+* Best-effort: providers swallow their own bootstrap failures, and any
+* unexpected throw leaves the user no-org.
+*/
+async function ensureUserOrg(provider, user) {
+	if (getFactoryAuthOrgId(user)) return;
+	if (!isOrganizationsProvider(provider)) return;
+	const userId = getFactoryAuthUserId(user);
+	if (!userId) return;
+	try {
+		const orgId = await provider.ensureOrganization(userId);
+		if (orgId) user.organizationId = orgId;
+	} catch {}
+}
+function selectRequestedOrganization(user, requestedOrganizationId) {
+	if (user.organizationId === requestedOrganizationId) return true;
+	if (!user.organizationMembershipIds?.includes(requestedOrganizationId)) return false;
+	user.organizationId = requestedOrganizationId;
+	return true;
+}
+/**
+* `Set-Cookie` values that clear the provider's session cookie(s), from the
+* provider's (possibly partial) `ISessionProvider.getClearSessionHeaders`.
+*/
+function providerClearCookies(provider) {
+	const getClearSessionHeaders = provider.getClearSessionHeaders;
+	if (typeof getClearSessionHeaders !== "function") return [];
+	const setCookie = (getClearSessionHeaders.call(provider) ?? {})["Set-Cookie"];
+	if (!setCookie) return [];
+	return setCookie.split(/,(?=\s*[^;=,\s]+=)/).map((cookie) => cookie.trim());
+}
+/**
+* Fail-closed authorization for organization-level administrative mutations.
+* The caller must belong to the same active organization and the provider must
+* explicitly confirm an admin/owner role.
+*/
+async function isOrganizationAdmin(provider, c, organizationId) {
+	const user = await ensureFactoryAuthUser(provider, c);
+	if (!user || user.organizationId !== organizationId || !provider || !isOrganizationsProvider(provider)) return false;
+	const userId = getFactoryAuthUserId(user);
+	if (!userId) return false;
+	try {
+		return await provider.isOrganizationAdmin(organizationId, userId);
+	} catch {
+		return false;
+	}
+}
+/**
+* Build the factory's implementation of the `RouteAuth` seam over the
+* resolved provider (`undefined` = auth disabled). Constructed once per boot
+* by `MastraFactory.prepare()` and handed to factory route modules at
+* construction — they never import the factory auth module directly.
+*/
+function createFactoryRouteAuth(provider) {
+	return {
+		enabled: () => provider !== void 0,
+		ensureUser: (c) => ensureFactoryAuthUser(provider, c),
+		tenant: (c) => factoryAuthTenant(c),
+		isOrganizationAdmin: (c, organizationId) => isOrganizationAdmin(provider, c, organizationId)
+	};
+}
+/** True when the given provider is WorkOS. Gates WorkOS-only capabilities. */
+function isWorkOSAuth(provider) {
+	return provider instanceof MastraAuthWorkos;
+}
+/**
+* The raw WorkOS provider, for features that need the WorkOS client directly
+* (audit-log export, Admin Portal links). Callers must gate on
+* {@link isWorkOSAuth} first — throws when the provider is not WorkOS.
+*/
+function getWorkOSProvider(provider) {
+	if (provider instanceof MastraAuthWorkos) return provider;
+	throw new Error("WorkOS provider requested but the active factory auth provider is not WorkOS");
+}
+/**
+* Resolve the authenticated user for a request, stashing it on the context.
+*
+* The gate only authenticates non-`/auth/*` requests via the `Authorization`
+* header, so cookie-based browser navigations to public `/auth/*` routes (the
+* GitHub connect/callback flow) arrive without a gate-stashed user. This reads
+* the session cookie from the raw request the same way `/auth/me` does,
+* caches the result on the context, and returns it so downstream helpers like
+* {@link factoryAuthTenant} work uniformly on both gated and public routes.
+*
+* Returns `undefined` when there is no valid session (or auth is disabled).
+*/
+function forwardPendingResponseHeaders(provider, c) {
+	try {
+		const pending = provider.consumePendingResponseHeaders?.(c.req.raw);
+		for (const [name, value] of Object.entries(pending ?? {})) c.header(name, value, { append: true });
+	} catch {}
+}
+async function ensureFactoryAuthUser(provider, c) {
+	const existing = getFactoryAuthUser(c);
+	if (existing) return existing;
+	if (!provider) return void 0;
+	const token = getBearerToken(c.req.header("Authorization"));
+	const user = await authenticateRequest(provider, token, c.req.raw);
+	forwardPendingResponseHeaders(provider, c);
+	if (!user) return void 0;
+	const requestedOrganizationId = token ? c.req.header(ORGANIZATION_ID_HEADER)?.trim() : void 0;
+	if (requestedOrganizationId) {
+		if (!selectRequestedOrganization(user, requestedOrganizationId)) throw new HTTPException(403, { message: "organization_forbidden" });
+	} else await ensureUserOrg(provider, user);
+	c.set(FACTORY_AUTH_USER_KEY, user);
+	return user;
+}
+/**
+* Decide whether a request is a top-level browser navigation (which should be
+* redirected to `/signin`) versus an API/XHR call (which should get a 401 JSON
+* response the SPA can react to).
+*/
+function isNavigationRequest(path, accept) {
+	if (path.startsWith("/api/")) return false;
+	return (accept ?? "").includes("text/html");
+}
+function isPlatformAuthCustomDomain(provider, publicUrl) {
+	return provider.name === "mastra-studio" && Boolean(publicUrl && !isPlatformAuthSupportedHost(new URL(publicUrl).hostname));
+}
+/**
+* Handle the provider-neutral `/auth/me` route: validate the session with the
+* active provider and report the signed-in user (no tokens) to the SPA.
+* `/auth/me` is public (the gate skips `/auth/*`), so it validates the session
+* itself rather than reading a value the gate would have stashed.
+*/
+async function handleAuthMe(provider, c, publicUrl) {
+	const user = await authenticateRequest(provider, getBearerToken(c.req.header("Authorization")), c.req.raw);
+	const signUpDisabled = isCredentialsProvider(provider) && provider.isSignUpEnabled?.() === false;
+	const customDomainUnsupported = isPlatformAuthCustomDomain(provider, publicUrl);
+	const meta = {
+		provider: provider.name,
+		...signUpDisabled ? { signUpDisabled: true } : {},
+		...customDomainUnsupported ? { customDomainUnsupported: true } : {}
+	};
+	if (!user) return c.json({
+		authenticated: false,
+		user: null,
+		...meta
+	});
+	await ensureUserOrg(provider, user);
+	return c.json({
+		authenticated: true,
+		telemetryEnabled: isFactoryTelemetryEnabled(provider.name),
+		user: {
+			userId: getFactoryAuthUserId(user),
+			email: user.email,
+			name: user.name,
+			avatarUrl: user.avatarUrl,
+			organizationId: user.organizationId
+		},
+		...meta
+	});
+}
+/**
+* Encode a validated returnTo path into the OAuth `state` parameter.
+*
+* Pipe format (`uuid|encodedPath`) is the contract `MastraAuthStudio` parses
+* to forward the path as the platform's `post_login_redirect`; a JSON blob
+* here silently degrades every post-login redirect to `/`.
+*/
+function encodeState(returnTo) {
+	return `${crypto.randomUUID()}|${encodeURIComponent(returnTo)}`;
+}
+/** Decode the OAuth `state` parameter back into a sanitized returnTo path. */
+function decodeState(state) {
+	if (!state) return "/";
+	const pipeIndex = state.indexOf("|");
+	if (pipeIndex !== -1) try {
+		return sanitizeReturnTo(decodeURIComponent(state.slice(pipeIndex + 1)));
+	} catch {
+		return "/";
+	}
+	return "/";
+}
+/**
+* Short-lived cookie stashing the post-login destination across the hosted
+* OAuth round-trip. Providers/platforms differ in whether they echo `state`
+* back to the callback, so the cookie is the reliable channel; `state` (when
+* echoed) takes precedence only if the cookie is missing.
+*/
+const RETURN_TO_COOKIE = "mastra_factory_return_to";
+function returnToCookieHeader(returnTo) {
+	const crossSite = isCrossSiteAuth() ? "; SameSite=None; Secure" : "; SameSite=Lax";
+	return `${RETURN_TO_COOKIE}=${encodeURIComponent(returnTo)}; Path=/; Max-Age=600; HttpOnly${crossSite}`;
+}
+function clearReturnToCookieHeader() {
+	const crossSite = isCrossSiteAuth() ? "; SameSite=None; Secure" : "; SameSite=Lax";
+	return `${RETURN_TO_COOKIE}=; Path=/; Max-Age=0; HttpOnly${crossSite}`;
+}
+function readReturnToCookie(c) {
+	const header = c.req.header("Cookie");
+	if (!header) return void 0;
+	for (const part of header.split(";")) {
+		const [name, ...rest] = part.trim().split("=");
+		if (name === RETURN_TO_COOKIE) try {
+			return decodeURIComponent(rest.join("="));
+		} catch {
+			return;
+		}
+	}
+}
+/**
+* Derive the public `/auth/*` routes from the provider's capabilities:
+*
+* - `IAuthHttpHandler` → `ALL /auth/api/*` proxy to the provider's own HTTP
+*   surface (better-auth sign-in/up/out/session — what the SPA's
+*   email/password form posts to).
+* - `ISSOProvider` → hosted-login `GET /auth/login` / `GET /auth/callback` /
+*   `GET /auth/logout` (returnTo preserved through the OAuth `state` param).
+* - handler-shaped, non-SSO providers → `GET /auth/login` redirects to the
+*   SPA's `/signin` form, `GET /auth/logout` revokes via the provider's
+*   sign-out endpoint and clears the session cookie.
+*/
+function providerAuthRoutes(provider, publicUrl) {
+	const routes = [];
+	if (isAuthHttpHandler(provider)) routes.push({
+		path: "/auth/api/*",
+		method: "ALL",
+		handler: (c) => provider.handleAuthRequest(c.req.raw)
+	});
+	if (isSSOProvider(provider)) routes.push({
+		path: "/auth/login",
+		method: "GET",
+		handler: async (c) => {
+			const returnTo = sanitizeReturnTo(c.req.query("returnTo"));
+			if (isPlatformAuthCustomDomain(provider, publicUrl)) {
+				const query = new URLSearchParams({ error: CUSTOM_DOMAIN_UNSUPPORTED_ERROR });
+				if (returnTo !== "/") query.set("returnTo", returnTo);
+				return c.redirect(`/signin?${query.toString()}`);
+			}
+			const state = encodeState(returnTo);
+			const redirectUri = publicUrl ? new URL("/auth/callback", publicUrl).toString() : "";
+			const loginUrl = await provider.getLoginUrl(redirectUri, state);
+			for (const cookie of await provider.getLoginCookies?.(redirectUri, state) ?? []) c.header("Set-Cookie", cookie, { append: true });
+			if (returnTo !== "/") c.header("Set-Cookie", returnToCookieHeader(returnTo), { append: true });
+			return c.redirect(loginUrl);
+		}
+	}, {
+		path: "/auth/callback",
+		method: "GET",
+		handler: async (c) => {
+			const code = c.req.query("code");
+			const stateReturnTo = decodeState(c.req.query("state"));
+			const cookieReturnTo = sanitizeReturnTo(readReturnToCookie(c));
+			const returnTo = cookieReturnTo !== "/" ? cookieReturnTo : stateReturnTo;
+			c.header("Set-Cookie", clearReturnToCookieHeader(), { append: true });
+			const idpError = c.req.query("error");
+			if (idpError) {
+				const query = new URLSearchParams({ error: idpError.slice(0, 64) });
+				const description = c.req.query("error_description");
+				if (description) query.set("error_description", description.slice(0, 256));
+				if (returnTo !== "/") query.set("returnTo", returnTo);
+				return c.redirect(`/signin?${query.toString()}`);
+			}
+			if (!code) return c.redirect("/auth/login");
+			try {
+				const result = await provider.handleCallback(code, c.req.query("state") ?? "");
+				if (result.cookies?.length) for (const cookie of result.cookies) c.header("Set-Cookie", cookie, { append: true });
+				else if (isSessionProvider(provider) && result.tokens) {
+					const resultUser = result.user;
+					const session = await provider.createSession(resultUser.id, {
+						accessToken: result.tokens.accessToken,
+						refreshToken: result.tokens.refreshToken,
+						expiresAt: result.tokens.expiresAt,
+						organizationId: resultUser.organizationId
+					});
+					for (const [key, value] of Object.entries(provider.getSessionHeaders(session))) c.header(key, value, { append: true });
+				}
+				return c.redirect(returnTo);
+			} catch {
+				return c.redirect("/auth/login");
+			}
+		}
+	}, {
+		path: "/auth/logout",
+		method: "GET",
+		handler: async (c) => {
+			let logoutUrl = null;
+			try {
+				logoutUrl = await provider.getLogoutUrl?.("/", c.req.raw) ?? null;
+			} catch {
+				logoutUrl = null;
+			}
+			for (const cookie of providerClearCookies(provider)) c.header("Set-Cookie", cookie, { append: true });
+			return c.redirect(logoutUrl ?? "/");
+		}
+	});
+	else if (isAuthHttpHandler(provider)) routes.push({
+		path: "/auth/login",
+		method: "GET",
+		handler: (c) => {
+			const returnTo = sanitizeReturnTo(c.req.query("returnTo"));
+			return c.redirect(`/signin?returnTo=${encodeURIComponent(returnTo)}`);
+		}
+	}, {
+		path: "/auth/logout",
+		method: "GET",
+		handler: async (c) => {
+			try {
+				const origin = new URL(c.req.url).origin;
+				const response = await provider.handleAuthRequest(new Request(`${origin}/auth/api/sign-out`, {
+					method: "POST",
+					headers: c.req.raw.headers
+				}));
+				for (const cookie of response.headers.getSetCookie()) c.header("Set-Cookie", cookie, { append: true });
+			} catch {}
+			for (const cookie of providerClearCookies(provider)) c.header("Set-Cookie", cookie, { append: true });
+			return c.redirect("/");
+		}
+	});
+	return routes;
+}
+/**
+* Register the public `/auth/*` routes on a Hono app: the capability-derived
+* provider routes (login/callback/logout/provider APIs) plus the
+* provider-neutral `/auth/me`. Split out from `mountFactoryAuth` so both the local
+* Hono server and the platform Mastra entry can reuse the exact same handlers.
+*/
+function registerAuthRoutes(app, provider, options = {}) {
+	for (const route of providerAuthRoutes(provider, options.publicUrl)) {
+		const methods = route.method === "ALL" ? [
+			"GET",
+			"POST",
+			"PUT",
+			"DELETE",
+			"PATCH"
+		] : [route.method];
+		app.on(methods, route.path, (c) => route.handler(c));
+	}
+	app.get("/auth/me", (c) => handleAuthMe(provider, c, options.publicUrl));
+}
+/**
+* Build the public `/auth/*` routes (provider routes + `/auth/me`) as Mastra
+* `server.apiRoutes`. Used by the platform Mastra entry (`src/mastra/index.ts`),
+* which can't register plain Hono routes on the deployer-generated app the way
+* the local server does via {@link registerAuthRoutes}.
+*
+* Handlers are identical to {@link registerAuthRoutes}. All are `requiresAuth: false`
+* (they must be reachable while unauthenticated), and the gate middleware skips
+* `/auth/*` so it never blocks them. `/auth/*` is not under `/api`, so it is a
+* valid custom-route path.
+*/
+function buildAuthRoutes(provider, options = {}) {
+	return [...providerAuthRoutes(provider, options.publicUrl).map((route) => registerApiRoute(route.path, {
+		method: route.method,
+		requiresAuth: false,
+		handler: (c) => route.handler(c)
+	})), registerApiRoute("/auth/me", {
+		method: "GET",
+		requiresAuth: false,
+		handler: (c) => handleAuthMe(provider, c, options.publicUrl)
+	})];
+}
+/**
+* `/auth/*` routes for auth-disabled mode (`auth: null`). Only `/auth/me`, answering
+* 404 — the UI's "auth disabled" signal. Without it the deployer's HTML catch-all
+* answers `/auth/me` with 200 text/html and the UI retries forever.
+*/
+function buildAuthDisabledRoutes() {
+	return [registerApiRoute("/auth/me", {
+		method: "GET",
+		requiresAuth: false,
+		handler: (c) => c.json({
+			authEnabled: false,
+			authenticated: false
+		}, 404)
+	})];
+}
+/**
+* Channel webhook paths whose adapter verifies the platform's request signature,
+* making the delivery self-authenticating. Add a platform here only once its
+* adapter rejects unsigned or mis-signed requests.
+*/
+const SIGNATURE_VERIFYING_CHANNEL_WEBHOOK = /^\/api\/agent-controllers\/[^/]+\/channels\/slack\/webhook$/;
+const SESSION_FAVICON_PATHS = /* @__PURE__ */ new Set([
+	"/favicon-session-initializing.svg",
+	"/favicon-session-working.svg",
+	"/favicon-session-awaiting.svg",
+	"/favicon-session-error.svg"
+]);
+/**
+* Build the auth gate as a plain Hono middleware handler `(c, next)`. Protects
+* everything that is not a public `/auth/*` route: authenticated requests stash
+* the user on the context and continue; unauthenticated navigations redirect to
+* login and XHR/API calls get a 401 JSON. Shared by the local Hono server
+* (`mountFactoryAuth`) and the platform Mastra entry (`server.middleware`).
+*/
+function createFactoryAuthGate(provider) {
+	return async (c, next) => {
+		const path = c.req.path;
+		if (path.startsWith("/auth/")) return next();
+		if (c.req.method === "POST" && (path === "/web/github/webhook" || path === "/web/gitlab/webhook")) return next();
+		if (c.req.method === "POST" && SIGNATURE_VERIFYING_CHANNEL_WEBHOOK.test(path)) return next();
+		if (c.req.method === "GET" && (path === "/connect/slack" || path.startsWith("/connect/slack/"))) return next();
+		if (c.req.method === "GET" && path === "/login") return c.redirect(`/signin${new URL(c.req.url).search}`);
+		if (path === "/signin" || path.startsWith("/assets/") || path === "/manifest.webmanifest" || path === "/mastra.svg" || path === "/pwa-192.png" || path === "/pwa-512.png" || path === "/apple-touch-icon.png" || c.req.method === "GET" && SESSION_FAVICON_PATHS.has(path)) return next();
+		const token = getBearerToken(c.req.header("Authorization"));
+		const user = await timedAboveThreshold("auth.gate.authenticate", 1e3, () => authenticateRequest(provider, token, c.req.raw));
+		forwardPendingResponseHeaders(provider, c);
+		if (user) {
+			const requestedOrganizationId = token ? c.req.header(ORGANIZATION_ID_HEADER)?.trim() : void 0;
+			if (requestedOrganizationId) {
+				if (!selectRequestedOrganization(user, requestedOrganizationId)) return c.json({ error: "organization_forbidden" }, 403);
+			} else await ensureUserOrg(provider, user);
+			c.set(FACTORY_AUTH_USER_KEY, user);
+			const requestContext = c.get("requestContext");
+			requestContext?.set("user", user);
+			requestContext?.set(MASTRA_MESSAGE_AUTHOR_KEY, messageAuthor(user));
+			return next();
+		}
+		if (isNavigationRequest(path, c.req.header("Accept"))) {
+			const url = new URL(c.req.url);
+			const returnTo = sanitizeReturnTo(url.pathname + url.search);
+			return c.redirect(`/signin?returnTo=${encodeURIComponent(returnTo)}`);
+		}
+		return c.json({ error: "unauthorized" }, 401);
+	};
+}
+/**
+* Mount factory auth gating onto the host app. No-op when auth is disabled
+* (no provider active).
+*
+* Must be called before the Mastra adapter routes, the `/web/*` routes, and
+* the static UI handlers so the gate covers every request. Composes the shared
+* `registerAuthRoutes` + `createFactoryAuthGate` factories so the local Hono server
+* and the platform Mastra entry stay behavior-identical.
+*/
+function mountFactoryAuth(app, options = {}) {
+	const provider = options.provider ?? envFallbackAuthProvider(options.redirectUri);
+	if (!provider) return false;
+	registerAuthRoutes(app, provider, { publicUrl: options.publicUrl });
+	app.use("*", createFactoryAuthGate(provider));
+	return true;
+}
+//#endregion
+export { buildAuthDisabledRoutes, buildAuthRoutes, createFactoryAuthGate, createFactoryRouteAuth, ensureFactoryAuthUser, factoryAuthTenant, factoryUserOrgId, getBearerToken, getFactoryAuthOrgId, getFactoryAuthUser, getFactoryAuthUserFromContext, getFactoryAuthUserId, getWorkOSProvider, isCrossSiteAuth, isOrganizationAdmin, isWorkOSAuth, mountFactoryAuth, registerAuthRoutes, sanitizeReturnTo };
+
+//# sourceMappingURL=auth.js.map