@mastra/fastify 1.4.11-alpha.0 → 1.4.11-alpha.2

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
package/dist/index.cjs CHANGED
@@ -1,800 +1,686 @@
1
- 'use strict';
2
-
3
- var busboy = require('@fastify/busboy');
4
- var serverAdapter = require('@mastra/server/server-adapter');
5
- var requestContext = require('@mastra/core/request-context');
6
- var auth = require('@mastra/server/auth');
7
-
8
- // src/index.ts
9
- function toWebRequest(request) {
10
- const protocol = request.protocol || "http";
11
- const host = request.headers.host || "localhost";
12
- const url = `${protocol}://${host}${request.url}`;
13
- const headers = new Headers();
14
- for (const [key, value] of Object.entries(request.headers)) {
15
- if (!value) continue;
16
- if (Array.isArray(value)) {
17
- value.forEach((v) => headers.append(key, v));
18
- } else {
19
- headers.set(key, value);
20
- }
21
- }
22
- return new globalThis.Request(url, {
23
- method: request.method,
24
- headers
25
- });
1
+ Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
2
+ let _fastify_busboy = require("@fastify/busboy");
3
+ let _mastra_server_server_adapter = require("@mastra/server/server-adapter");
4
+ let _mastra_core_request_context = require("@mastra/core/request-context");
5
+ let _mastra_server_auth = require("@mastra/server/auth");
6
+ //#region src/auth-middleware.ts
7
+ function toWebRequest$1(request) {
8
+ const url = `${request.protocol || "http"}://${request.headers.host || "localhost"}${request.url}`;
9
+ const headers = new Headers();
10
+ for (const [key, value] of Object.entries(request.headers)) {
11
+ if (!value) continue;
12
+ if (Array.isArray(value)) value.forEach((v) => headers.append(key, v));
13
+ else headers.set(key, value);
14
+ }
15
+ return new globalThis.Request(url, {
16
+ method: request.method,
17
+ headers
18
+ });
26
19
  }
27
- function createAuthMiddleware({
28
- mastra,
29
- requiresAuth = true
30
- }) {
31
- return async (request, reply) => {
32
- if (!requiresAuth) {
33
- return;
34
- }
35
- const authConfig = mastra.getServer()?.auth;
36
- if (!authConfig) {
37
- return;
38
- }
39
- request.requestContext ??= new requestContext.RequestContext();
40
- request.mastra ??= mastra;
41
- const path = String(request.url.split("?")[0] || "/");
42
- const method = String(request.method || "GET");
43
- const customRouteAuthConfig = new Map(request.customRouteAuthConfig ?? []);
44
- customRouteAuthConfig.set(`${method}:${path}`, true);
45
- const authHeader = request.headers.authorization;
46
- let token = authHeader ? authHeader.replace("Bearer ", "") : null;
47
- const query = request.query;
48
- if (!token && query.apiKey) {
49
- token = query.apiKey || null;
50
- }
51
- const result = await auth.coreAuthMiddleware({
52
- path,
53
- method,
54
- getHeader: (name) => request.headers[name.toLowerCase()],
55
- mastra,
56
- authConfig,
57
- customRouteAuthConfig,
58
- requestContext: request.requestContext,
59
- rawRequest: toWebRequest(request),
60
- token,
61
- buildAuthorizeContext: () => toWebRequest(request)
62
- });
63
- if (result.action === "error") {
64
- return reply.status(result.status).send(result.body);
65
- }
66
- };
20
+ function createAuthMiddleware({ mastra, requiresAuth = true }) {
21
+ return async (request, reply) => {
22
+ if (!requiresAuth) return;
23
+ const authConfig = mastra.getServer()?.auth;
24
+ if (!authConfig) return;
25
+ request.requestContext ??= new _mastra_core_request_context.RequestContext();
26
+ request.mastra ??= mastra;
27
+ const path = String(request.url.split("?")[0] || "/");
28
+ const method = String(request.method || "GET");
29
+ const customRouteAuthConfig = new Map(request.customRouteAuthConfig ?? []);
30
+ customRouteAuthConfig.set(`${method}:${path}`, true);
31
+ const authHeader = request.headers.authorization;
32
+ let token = authHeader ? authHeader.replace("Bearer ", "") : null;
33
+ const query = request.query;
34
+ if (!token && query.apiKey) token = query.apiKey || null;
35
+ const result = await (0, _mastra_server_auth.coreAuthMiddleware)({
36
+ path,
37
+ method,
38
+ getHeader: (name) => request.headers[name.toLowerCase()],
39
+ mastra,
40
+ authConfig,
41
+ customRouteAuthConfig,
42
+ requestContext: request.requestContext,
43
+ rawRequest: toWebRequest$1(request),
44
+ token,
45
+ buildAuthorizeContext: () => toWebRequest$1(request)
46
+ });
47
+ if (result.action === "error") return reply.status(result.status).send(result.body);
48
+ };
67
49
  }
68
-
69
- // src/index.ts
70
- var _hasPermissionPromise;
50
+ //#endregion
51
+ //#region src/index.ts
52
+ let _hasPermissionPromise;
71
53
  function loadHasPermission() {
72
- if (!_hasPermissionPromise) {
73
- _hasPermissionPromise = import('@mastra/core/auth/ee').then((m) => m.hasPermission).catch(() => {
74
- console.error(
75
- "[@mastra/fastify] Auth features require @mastra/core >= 1.6.0. Please upgrade: npm install @mastra/core@latest"
76
- );
77
- return void 0;
78
- });
79
- }
80
- return _hasPermissionPromise;
54
+ if (!_hasPermissionPromise) _hasPermissionPromise = import("@mastra/core/auth/ee").then((m) => m.hasPermission).catch(() => {
55
+ console.error("[@mastra/fastify] Auth features require @mastra/core >= 1.6.0. Please upgrade: npm install @mastra/core@latest");
56
+ });
57
+ return _hasPermissionPromise;
81
58
  }
82
- function toWebRequest2(request) {
83
- const protocol = request.protocol || "http";
84
- const host = request.headers.host || "localhost";
85
- const url = `${protocol}://${host}${request.url}`;
86
- const headers = new Headers();
87
- for (const [key, value] of Object.entries(request.headers)) {
88
- if (value) {
89
- if (Array.isArray(value)) {
90
- value.forEach((v) => headers.append(key, v));
91
- } else {
92
- headers.set(key, value);
93
- }
94
- }
95
- }
96
- return new globalThis.Request(url, {
97
- method: request.method,
98
- headers
99
- });
59
+ /**
60
+ * Convert Fastify request to Web API Request for cookie-based auth providers.
61
+ */
62
+ function toWebRequest(request) {
63
+ const url = `${request.protocol || "http"}://${request.headers.host || "localhost"}${request.url}`;
64
+ const headers = new Headers();
65
+ for (const [key, value] of Object.entries(request.headers)) if (value) if (Array.isArray(value)) value.forEach((v) => headers.append(key, v));
66
+ else headers.set(key, value);
67
+ return new globalThis.Request(url, {
68
+ method: request.method,
69
+ headers
70
+ });
100
71
  }
101
72
  function isRequestAborted(rawRequest) {
102
- return rawRequest.aborted || rawRequest.readableAborted || !rawRequest.complete;
73
+ return rawRequest.aborted || rawRequest.readableAborted || !rawRequest.complete;
103
74
  }
104
- var MastraServer = class extends serverAdapter.MastraServer {
105
- createContextMiddleware() {
106
- return async (request, reply) => {
107
- let bodyRequestContext;
108
- let paramsRequestContext;
109
- if (request.method === "POST" || request.method === "PUT") {
110
- const contentType = request.headers["content-type"];
111
- if (contentType?.includes("application/json") && request.body) {
112
- const body = request.body;
113
- if (body.requestContext) {
114
- bodyRequestContext = body.requestContext;
115
- }
116
- }
117
- }
118
- if (request.method === "GET") {
119
- try {
120
- const query = request.query;
121
- const encodedRequestContext = query.requestContext;
122
- if (typeof encodedRequestContext === "string") {
123
- try {
124
- paramsRequestContext = JSON.parse(encodedRequestContext);
125
- } catch {
126
- try {
127
- const json = Buffer.from(encodedRequestContext, "base64").toString("utf-8");
128
- paramsRequestContext = JSON.parse(json);
129
- } catch {
130
- }
131
- }
132
- }
133
- } catch {
134
- }
135
- }
136
- const requestContext = this.mergeRequestContext({ paramsRequestContext, bodyRequestContext });
137
- this.applyRequestMetadataToContext({
138
- requestContext,
139
- getHeader: (name) => {
140
- const value = request.headers[name.toLowerCase()];
141
- return Array.isArray(value) ? value[0] : value;
142
- }
143
- });
144
- request.requestContext = requestContext;
145
- request.mastra = this.mastra;
146
- request.registeredTools = this.tools || {};
147
- if (this.taskStore) {
148
- request.taskStore = this.taskStore;
149
- }
150
- request.customRouteAuthConfig = this.customRouteAuthConfig;
151
- const controller = new AbortController();
152
- request.raw.on("close", () => {
153
- if (isRequestAborted(request.raw)) {
154
- controller.abort();
155
- }
156
- });
157
- reply.raw.on("close", () => {
158
- if (!reply.raw.writableEnded) {
159
- controller.abort();
160
- }
161
- });
162
- request.abortSignal = controller.signal;
163
- };
164
- }
165
- async stream(route, reply, result, request) {
166
- const rawHeaders = reply.getHeaders();
167
- const existingHeaders = {};
168
- for (const [key, value] of Object.entries(rawHeaders)) {
169
- if (value === void 0) continue;
170
- const lowerKey = key.toLowerCase();
171
- if (lowerKey === "content-length" || lowerKey === "transfer-encoding") continue;
172
- existingHeaders[key] = value;
173
- }
174
- reply.hijack();
175
- const streamFormat = route.streamFormat || "stream";
176
- const sseHeaders = streamFormat === "sse" ? {
177
- "Content-Type": "text/event-stream",
178
- "Cache-Control": "no-cache",
179
- Connection: "keep-alive",
180
- "X-Accel-Buffering": "no"
181
- } : {
182
- "Content-Type": "text/plain"
183
- };
184
- reply.raw.writeHead(200, {
185
- ...existingHeaders,
186
- ...sseHeaders,
187
- "Transfer-Encoding": "chunked"
188
- });
189
- if (streamFormat === "sse" && route.sseFlushOnConnect) {
190
- reply.raw.write(": connected\n\n");
191
- }
192
- const readableStream = result instanceof ReadableStream ? result : result.fullStream;
193
- const reader = readableStream.getReader();
194
- let readerCanceled = false;
195
- const cancelReader = (reason) => {
196
- if (readerCanceled) return;
197
- readerCanceled = true;
198
- void reader.cancel(reason);
199
- };
200
- const cancelReaderOnResponseClose = () => cancelReader("request aborted");
201
- const cancelReaderOnRequestClose = () => {
202
- if (request && isRequestAborted(request.raw)) {
203
- cancelReader("request aborted");
204
- }
205
- };
206
- reply.raw.on("close", cancelReaderOnResponseClose);
207
- request?.raw.on("close", cancelReaderOnRequestClose);
208
- try {
209
- while (true) {
210
- const { done, value } = await reader.read();
211
- if (done) break;
212
- if (value) {
213
- if (streamFormat === "sse" && typeof value === "string" && value.startsWith(":")) {
214
- reply.raw.write(value);
215
- continue;
216
- }
217
- const shouldRedact = this.streamOptions?.redact ?? true;
218
- const outputValue = shouldRedact ? serverAdapter.redactStreamChunk(value) : value;
219
- const serialized = serverAdapter.serializeStreamChunk(outputValue);
220
- if (!serialized.ok) {
221
- this.mastra.getLogger()?.error("Failed to serialize stream chunk, skipping", {
222
- path: route.path,
223
- chunkType: outputValue?.type,
224
- error: serialized.error.message
225
- });
226
- continue;
227
- }
228
- if (streamFormat === "sse") {
229
- reply.raw.write(`data: ${serialized.json}
230
-
231
- `);
232
- } else {
233
- reply.raw.write(serialized.json + "");
234
- }
235
- }
236
- }
237
- } catch (error) {
238
- this.mastra.getLogger()?.error("Error in stream processing", {
239
- error: error instanceof Error ? { message: error.message, stack: error.stack } : error
240
- });
241
- } finally {
242
- reply.raw.off("close", cancelReaderOnResponseClose);
243
- request?.raw.off("close", cancelReaderOnRequestClose);
244
- if (!reply.raw.writableEnded && !reply.raw.destroyed) {
245
- reply.raw.end();
246
- }
247
- }
248
- }
249
- async getParams(route, request) {
250
- const urlParams = request.params || {};
251
- const queryParams = serverAdapter.normalizeQueryParams(request.query || {});
252
- let body;
253
- let bodyParseError;
254
- if (route.method === "POST" || route.method === "PUT" || route.method === "PATCH" || route.method === "DELETE") {
255
- const contentType = request.headers["content-type"] || "";
256
- if (contentType.includes("multipart/form-data")) {
257
- try {
258
- const maxFileSize = route.maxBodySize ?? this.bodyLimitOptions?.maxSize;
259
- body = await this.parseMultipartFormData(request, maxFileSize);
260
- } catch (error) {
261
- this.mastra.getLogger()?.error("Failed to parse multipart form data", {
262
- error: error instanceof Error ? { message: error.message, stack: error.stack } : error
263
- });
264
- if (error instanceof Error && error.message.toLowerCase().includes("size")) {
265
- throw error;
266
- }
267
- bodyParseError = {
268
- message: error instanceof Error ? error.message : "Failed to parse multipart form data"
269
- };
270
- }
271
- } else {
272
- body = request.body;
273
- }
274
- }
275
- return { urlParams, queryParams, body, bodyParseError };
276
- }
277
- /**
278
- * Parse multipart/form-data using @fastify/busboy.
279
- * Converts file uploads to Buffers and parses JSON field values.
280
- *
281
- * @param request - The Fastify request object
282
- * @param maxFileSize - Optional maximum file size in bytes
283
- */
284
- parseMultipartFormData(request, maxFileSize) {
285
- return new Promise((resolve, reject) => {
286
- const result = {};
287
- const busboy$1 = new busboy.Busboy({
288
- headers: {
289
- "content-type": request.headers["content-type"]
290
- },
291
- limits: maxFileSize ? { fileSize: maxFileSize } : void 0
292
- });
293
- busboy$1.on(
294
- "file",
295
- (fieldname, file, _filename, _encoding, _mimetype) => {
296
- const chunks = [];
297
- let limitExceeded = false;
298
- file.on("data", (chunk) => {
299
- chunks.push(chunk);
300
- });
301
- file.on("limit", () => {
302
- limitExceeded = true;
303
- file.resume();
304
- reject(new Error(`File size limit exceeded${maxFileSize ? ` (max: ${maxFileSize} bytes)` : ""}`));
305
- });
306
- file.on("end", () => {
307
- if (!limitExceeded) {
308
- result[fieldname] = Buffer.concat(chunks);
309
- }
310
- });
311
- }
312
- );
313
- busboy$1.on("field", (fieldname, value) => {
314
- try {
315
- result[fieldname] = JSON.parse(value);
316
- } catch {
317
- result[fieldname] = value;
318
- }
319
- });
320
- busboy$1.on("finish", () => {
321
- resolve(result);
322
- });
323
- busboy$1.on("error", (error) => {
324
- reject(error);
325
- });
326
- request.raw.pipe(busboy$1);
327
- });
328
- }
329
- async sendResponse(route, reply, result, request, prefix) {
330
- const resolvedPrefix = prefix ?? this.prefix ?? "";
331
- if (result && typeof result === "object" && "__refreshHeaders" in result) {
332
- const refreshHeaders = result.__refreshHeaders;
333
- for (const [key, value] of Object.entries(refreshHeaders)) {
334
- reply.header(key, value);
335
- }
336
- delete result.__refreshHeaders;
337
- }
338
- if (route.responseType === "json") {
339
- await reply.send(result);
340
- } else if (route.responseType === "stream") {
341
- await this.stream(route, reply, result, request);
342
- } else if (route.responseType === "datastream-response") {
343
- const fetchResponse = result;
344
- fetchResponse.headers.forEach((value, key) => reply.header(key, value));
345
- reply.status(fetchResponse.status);
346
- if (fetchResponse.body) {
347
- const reader = fetchResponse.body.getReader();
348
- let readerCanceled = false;
349
- const cancelReader = (reason) => {
350
- if (readerCanceled) return;
351
- readerCanceled = true;
352
- void reader.cancel(reason);
353
- };
354
- const cancelReaderOnResponseClose = () => cancelReader("request aborted");
355
- const cancelReaderOnRequestClose = () => {
356
- if (request && isRequestAborted(request.raw)) {
357
- cancelReader("request aborted");
358
- }
359
- };
360
- const onResError = (err) => {
361
- this.mastra.getLogger()?.error("Error writing datastream response", {
362
- error: err instanceof Error ? { message: err.message, stack: err.stack } : err
363
- });
364
- cancelReader("response write error");
365
- };
366
- reply.raw.once("error", onResError);
367
- reply.raw.on("close", cancelReaderOnResponseClose);
368
- request?.raw.on("close", cancelReaderOnRequestClose);
369
- try {
370
- while (true) {
371
- const { done, value } = await reader.read();
372
- if (done) break;
373
- reply.raw.write(value);
374
- }
375
- } catch (error) {
376
- this.mastra.getLogger()?.error("Error in datastream processing", {
377
- error: error instanceof Error ? { message: error.message, stack: error.stack } : error
378
- });
379
- } finally {
380
- reply.raw.off("error", onResError);
381
- reply.raw.off("close", cancelReaderOnResponseClose);
382
- request?.raw.off("close", cancelReaderOnRequestClose);
383
- if (!reply.raw.writableEnded && !reply.raw.destroyed) {
384
- reply.raw.end();
385
- }
386
- }
387
- } else {
388
- reply.raw.end();
389
- }
390
- } else if (route.responseType === "mcp-http") {
391
- if (!request) {
392
- await reply.status(500).send({ error: "Request object required for MCP transport" });
393
- return;
394
- }
395
- const { server, httpPath, mcpOptions: routeMcpOptions } = result;
396
- try {
397
- reply.hijack();
398
- const rawReq = request.raw;
399
- if (request.body !== void 0) {
400
- rawReq.body = request.body;
401
- }
402
- const options = { ...this.mcpOptions, ...routeMcpOptions };
403
- await server.startHTTP({
404
- url: new URL(request.url, `http://${request.headers.host}`),
405
- httpPath: `${resolvedPrefix}${httpPath}`,
406
- req: rawReq,
407
- res: reply.raw,
408
- options: Object.keys(options).length > 0 ? options : void 0
409
- });
410
- } catch {
411
- if (!reply.raw.headersSent) {
412
- reply.raw.writeHead(500, { "Content-Type": "application/json" });
413
- reply.raw.end(
414
- JSON.stringify({
415
- jsonrpc: "2.0",
416
- error: { code: -32603, message: "Internal server error" },
417
- id: null
418
- })
419
- );
420
- }
421
- }
422
- } else if (route.responseType === "mcp-sse") {
423
- if (!request) {
424
- await reply.status(500).send({ error: "Request object required for MCP transport" });
425
- return;
426
- }
427
- const { server, ssePath, messagePath } = result;
428
- try {
429
- reply.hijack();
430
- const rawReq = request.raw;
431
- if (request.body !== void 0) {
432
- rawReq.body = request.body;
433
- }
434
- await server.startSSE({
435
- url: new URL(request.url, `http://${request.headers.host}`),
436
- ssePath: `${resolvedPrefix}${ssePath}`,
437
- messagePath: `${resolvedPrefix}${messagePath}`,
438
- req: rawReq,
439
- res: reply.raw
440
- });
441
- } catch {
442
- if (!reply.raw.headersSent) {
443
- reply.raw.writeHead(500, { "Content-Type": "application/json" });
444
- reply.raw.end(JSON.stringify({ error: "Error handling MCP SSE request" }));
445
- }
446
- }
447
- } else {
448
- reply.status(500);
449
- }
450
- }
451
- async registerRoute(app, route, { prefix: prefixParam } = {}) {
452
- const prefix = prefixParam ?? this.prefix ?? "";
453
- const fullPath = `${prefix}${route.path}`;
454
- const fastifyPath = fullPath;
455
- const handler = async (request, reply) => {
456
- const authError = await this.checkRouteAuth(route, {
457
- path: String(request.url.split("?")[0] || "/"),
458
- method: String(request.method || "GET"),
459
- getHeader: (name) => request.headers[name.toLowerCase()],
460
- getQuery: (name) => request.query[name],
461
- requestContext: request.requestContext,
462
- request: toWebRequest2(request),
463
- buildAuthorizeContext: () => toWebRequest2(request)
464
- });
465
- if (authError) {
466
- if (authError.headers) {
467
- for (const [key, value] of Object.entries(authError.headers)) {
468
- void reply.header(key, value);
469
- }
470
- }
471
- if (authError.error) {
472
- return reply.status(authError.status).send({ error: authError.error });
473
- }
474
- }
475
- const params = await this.getParams(route, request);
476
- if (params.bodyParseError) {
477
- return reply.status(400).send({
478
- error: "Invalid request body",
479
- issues: [{ field: "body", message: params.bodyParseError.message }]
480
- });
481
- }
482
- if (params.queryParams) {
483
- try {
484
- params.queryParams = await this.parseQueryParams(route, params.queryParams);
485
- } catch (error) {
486
- this.mastra.getLogger()?.error("Error parsing query params", {
487
- error: error instanceof Error ? { message: error.message, stack: error.stack } : error
488
- });
489
- if (serverAdapter.isZodError(error)) {
490
- const { status, body } = this.resolveValidationError(route, error, "query");
491
- return reply.status(status).send(body);
492
- }
493
- return reply.status(400).send({
494
- error: "Invalid query parameters",
495
- issues: [{ field: "unknown", message: error instanceof Error ? error.message : "Unknown error" }]
496
- });
497
- }
498
- }
499
- if (params.body) {
500
- try {
501
- params.body = await this.parseBody(route, params.body);
502
- } catch (error) {
503
- this.mastra.getLogger()?.error("Error parsing body", {
504
- error: error instanceof Error ? { message: error.message, stack: error.stack } : error
505
- });
506
- if (serverAdapter.isZodError(error)) {
507
- const { status, body } = this.resolveValidationError(route, error, "body");
508
- return reply.status(status).send(body);
509
- }
510
- return reply.status(400).send({
511
- error: "Invalid request body",
512
- issues: [{ field: "unknown", message: error instanceof Error ? error.message : "Unknown error" }]
513
- });
514
- }
515
- }
516
- if (params.urlParams) {
517
- try {
518
- params.urlParams = await this.parsePathParams(route, params.urlParams);
519
- } catch (error) {
520
- this.mastra.getLogger()?.error("Error parsing path params", {
521
- error: error instanceof Error ? { message: error.message, stack: error.stack } : error
522
- });
523
- if (serverAdapter.isZodError(error)) {
524
- const { status, body } = this.resolveValidationError(route, error, "path");
525
- return reply.status(status).send(body);
526
- }
527
- return reply.status(400).send({
528
- error: "Invalid path parameters",
529
- issues: [{ field: "unknown", message: error instanceof Error ? error.message : "Unknown error" }]
530
- });
531
- }
532
- }
533
- const handlerParams = {
534
- ...params.urlParams,
535
- ...params.queryParams,
536
- ...typeof params.body === "object" ? params.body : {},
537
- requestContext: request.requestContext,
538
- mastra: this.mastra,
539
- registeredTools: request.registeredTools,
540
- taskStore: request.taskStore,
541
- abortSignal: request.abortSignal,
542
- routePrefix: prefix,
543
- request: toWebRequest2(request)
544
- };
545
- const requestContext = request.requestContext;
546
- const hasAuth = this.mastra.getStudio?.()?.auth || this.mastra.getServer()?.auth;
547
- if (hasAuth) {
548
- const hasPermission = await loadHasPermission();
549
- if (hasPermission) {
550
- const userPermissions = requestContext.get("mastra__userPermissions");
551
- const permissionError = this.checkRoutePermission(route, userPermissions, hasPermission, requestContext);
552
- if (permissionError) {
553
- return reply.status(permissionError.status).send({
554
- error: permissionError.error,
555
- message: permissionError.message
556
- });
557
- }
558
- }
559
- }
560
- const fgaError = await serverAdapter.checkRouteFGA(this.mastra, route, requestContext, {
561
- ...params.urlParams,
562
- ...params.queryParams,
563
- ...typeof params.body === "object" ? params.body : {}
564
- });
565
- if (fgaError) {
566
- return reply.status(fgaError.status).send({ error: fgaError.error, message: fgaError.message });
567
- }
568
- try {
569
- const result = await route.handler(handlerParams);
570
- await this.sendResponse(route, reply, result, request, prefix);
571
- } catch (error) {
572
- const httpStatus = error && typeof error === "object" && "status" in error ? error.status : void 0;
573
- const isClientError = typeof httpStatus === "number" && httpStatus >= 400 && httpStatus < 500;
574
- if (!isClientError) {
575
- this.mastra.getLogger()?.error("Error calling handler", {
576
- error: error instanceof Error ? { message: error.message, stack: error.stack } : error,
577
- path: route.path,
578
- method: route.method
579
- });
580
- }
581
- let status = 500;
582
- if (error && typeof error === "object") {
583
- if ("status" in error) {
584
- status = error.status;
585
- } else if ("details" in error && error.details && typeof error.details === "object" && "status" in error.details) {
586
- status = error.details.status;
587
- }
588
- }
589
- await reply.status(status).send({ error: error instanceof Error ? error.message : "Unknown error" });
590
- }
591
- };
592
- const shouldApplyBodyLimit = this.bodyLimitOptions && ["POST", "PUT", "PATCH"].includes(route.method.toUpperCase());
593
- const maxSize = route.maxBodySize ?? this.bodyLimitOptions?.maxSize;
594
- const config = shouldApplyBodyLimit && maxSize ? { bodyLimit: maxSize } : void 0;
595
- if (route.method.toUpperCase() === "ALL") {
596
- const methods = ["GET", "POST", "PUT", "DELETE", "PATCH"];
597
- for (const method of methods) {
598
- try {
599
- app.route({
600
- method,
601
- url: fastifyPath,
602
- handler,
603
- config
604
- });
605
- } catch (err) {
606
- if (err instanceof Error && err.message.includes("already declared")) {
607
- continue;
608
- }
609
- throw err;
610
- }
611
- }
612
- } else {
613
- app.route({
614
- method: route.method,
615
- url: fastifyPath,
616
- handler,
617
- config
618
- });
619
- }
620
- }
621
- async registerCustomApiRoutes() {
622
- if (!await this.buildCustomRouteHandler()) return;
623
- const routes = this.customApiRoutes ?? this.mastra.getServer()?.apiRoutes ?? [];
624
- for (const route of routes) {
625
- const serverRoute = {
626
- method: route.method,
627
- path: route.path,
628
- responseType: "json",
629
- handler: async () => {
630
- },
631
- requiresAuth: route.requiresAuth,
632
- requiresPermission: route.requiresPermission,
633
- fga: route.fga
634
- };
635
- const fastifyHandler = async (request, reply) => {
636
- const authError = await this.checkRouteAuth(serverRoute, {
637
- path: String(request.url.split("?")[0] || "/"),
638
- method: String(request.method || "GET"),
639
- getHeader: (name) => request.headers[name.toLowerCase()],
640
- getQuery: (name) => request.query[name],
641
- requestContext: request.requestContext,
642
- request: toWebRequest2(request),
643
- buildAuthorizeContext: () => toWebRequest2(request)
644
- });
645
- if (authError) {
646
- if (authError.headers) {
647
- for (const [key, value] of Object.entries(authError.headers)) {
648
- void reply.header(key, value);
649
- }
650
- }
651
- if (authError.error) {
652
- return reply.status(authError.status).send({ error: authError.error });
653
- }
654
- }
655
- const requestContext = request.requestContext;
656
- const hasAuth = this.mastra.getStudio?.()?.auth || this.mastra.getServer()?.auth;
657
- if (hasAuth) {
658
- let hasPermission;
659
- try {
660
- ({ hasPermission } = await import('@mastra/core/auth/ee'));
661
- } catch {
662
- console.error(
663
- "[@mastra/fastify] Auth features require @mastra/core >= 1.6.0. Please upgrade: npm install @mastra/core@latest"
664
- );
665
- }
666
- if (hasPermission) {
667
- const userPermissions = requestContext.get("mastra__userPermissions");
668
- const permissionError = this.checkRoutePermission(
669
- serverRoute,
670
- userPermissions,
671
- hasPermission,
672
- requestContext
673
- );
674
- if (permissionError) {
675
- return reply.status(permissionError.status).send({
676
- error: permissionError.error,
677
- message: permissionError.message
678
- });
679
- }
680
- }
681
- }
682
- const fgaError = await serverAdapter.checkRouteFGA(this.mastra, serverRoute, requestContext, {
683
- ...request.params,
684
- ...request.query,
685
- ...typeof request.body === "object" && request.body !== null ? request.body : {}
686
- });
687
- if (fgaError) {
688
- return reply.status(fgaError.status).send({ error: fgaError.error, message: fgaError.message });
689
- }
690
- const response = await this.handleCustomRouteRequest(
691
- `http://${request.headers.host}${request.url}`,
692
- request.method,
693
- request.headers,
694
- request.body,
695
- request.requestContext,
696
- request.abortSignal
697
- );
698
- if (!response) {
699
- reply.status(404).send({ error: "Not Found" });
700
- return;
701
- }
702
- const existingHeaders = reply.getHeaders();
703
- for (const [key, value] of Object.entries(existingHeaders)) {
704
- if (value === void 0) continue;
705
- const lowerKey = key.toLowerCase();
706
- if (lowerKey === "content-length" || lowerKey === "transfer-encoding") continue;
707
- const isSetCookie = lowerKey === "set-cookie";
708
- if (!isSetCookie && response.headers.has(key)) continue;
709
- if (Array.isArray(value)) {
710
- for (const item of value) response.headers.append(key, String(item));
711
- } else if (isSetCookie) {
712
- response.headers.append(key, String(value));
713
- } else {
714
- response.headers.set(key, String(value));
715
- }
716
- }
717
- reply.hijack();
718
- await this.writeCustomRouteResponse(response, reply.raw, request.abortSignal);
719
- };
720
- if (route.method === "ALL") {
721
- const methods = ["GET", "POST", "PUT", "DELETE", "PATCH"];
722
- for (const method of methods) {
723
- this.app.route({ method, url: route.path, handler: fastifyHandler });
724
- }
725
- } else {
726
- this.app.route({
727
- method: route.method,
728
- url: route.path,
729
- handler: fastifyHandler
730
- });
731
- }
732
- }
733
- }
734
- registerContextMiddleware() {
735
- this.app.removeContentTypeParser("application/json");
736
- this.app.addContentTypeParser("application/json", { parseAs: "string" }, (_request, body, done) => {
737
- try {
738
- if (!body || typeof body === "string" && body.trim() === "") {
739
- done(null, void 0);
740
- return;
741
- }
742
- const parsed = JSON.parse(body);
743
- done(null, parsed);
744
- } catch (err) {
745
- done(err, void 0);
746
- }
747
- });
748
- this.app.addContentTypeParser("multipart/form-data", (_request, _payload, done) => {
749
- done(null, void 0);
750
- });
751
- this.app.addHook("preHandler", this.createContextMiddleware());
752
- }
753
- registerAuthMiddleware() {
754
- }
755
- registerHttpLoggingMiddleware() {
756
- if (!this.httpLoggingConfig?.enabled) {
757
- return;
758
- }
759
- this.app.addHook("onRequest", async (request, reply) => {
760
- const urlPath = request.url.split("?")[0];
761
- if (!this.shouldLogRequest(urlPath)) {
762
- return;
763
- }
764
- const start = Date.now();
765
- const method = request.method;
766
- const path = urlPath;
767
- reply.raw.once("finish", () => {
768
- const duration = Date.now() - start;
769
- const status = reply.statusCode;
770
- const level = this.httpLoggingConfig?.level || "info";
771
- const logData = {
772
- method,
773
- path,
774
- status,
775
- duration: `${duration}ms`
776
- };
777
- if (this.httpLoggingConfig?.includeQueryParams) {
778
- logData.query = request.query;
779
- }
780
- if (this.httpLoggingConfig?.includeHeaders) {
781
- const headers = { ...request.headers };
782
- const redactHeaders = this.httpLoggingConfig.redactHeaders || [];
783
- redactHeaders.forEach((h) => {
784
- const key = h.toLowerCase();
785
- if (headers[key] !== void 0) {
786
- headers[key] = "[REDACTED]";
787
- }
788
- });
789
- logData.headers = headers;
790
- }
791
- this.logger[level](`${method} ${path} ${status} ${duration}ms`, logData);
792
- });
793
- });
794
- }
75
+ var MastraServer = class extends _mastra_server_server_adapter.MastraServer {
76
+ createContextMiddleware() {
77
+ return async (request, reply) => {
78
+ let bodyRequestContext;
79
+ let paramsRequestContext;
80
+ if (request.method === "POST" || request.method === "PUT") {
81
+ if (request.headers["content-type"]?.includes("application/json") && request.body) {
82
+ const body = request.body;
83
+ if (body.requestContext) bodyRequestContext = body.requestContext;
84
+ }
85
+ }
86
+ if (request.method === "GET") try {
87
+ const encodedRequestContext = request.query.requestContext;
88
+ if (typeof encodedRequestContext === "string") try {
89
+ paramsRequestContext = JSON.parse(encodedRequestContext);
90
+ } catch {
91
+ try {
92
+ const json = Buffer.from(encodedRequestContext, "base64").toString("utf-8");
93
+ paramsRequestContext = JSON.parse(json);
94
+ } catch {}
95
+ }
96
+ } catch {}
97
+ const requestContext = this.mergeRequestContext({
98
+ paramsRequestContext,
99
+ bodyRequestContext
100
+ });
101
+ this.applyRequestMetadataToContext({
102
+ requestContext,
103
+ getHeader: (name) => {
104
+ const value = request.headers[name.toLowerCase()];
105
+ return Array.isArray(value) ? value[0] : value;
106
+ }
107
+ });
108
+ request.requestContext = requestContext;
109
+ request.mastra = this.mastra;
110
+ request.registeredTools = this.tools || {};
111
+ if (this.taskStore) request.taskStore = this.taskStore;
112
+ request.customRouteAuthConfig = this.customRouteAuthConfig;
113
+ const controller = new AbortController();
114
+ request.raw.on("close", () => {
115
+ if (isRequestAborted(request.raw)) controller.abort();
116
+ });
117
+ reply.raw.on("close", () => {
118
+ if (!reply.raw.writableEnded) controller.abort();
119
+ });
120
+ request.abortSignal = controller.signal;
121
+ };
122
+ }
123
+ async stream(route, reply, result, request) {
124
+ const rawHeaders = reply.getHeaders();
125
+ const existingHeaders = {};
126
+ for (const [key, value] of Object.entries(rawHeaders)) {
127
+ if (value === void 0) continue;
128
+ const lowerKey = key.toLowerCase();
129
+ if (lowerKey === "content-length" || lowerKey === "transfer-encoding") continue;
130
+ existingHeaders[key] = value;
131
+ }
132
+ reply.hijack();
133
+ const streamFormat = route.streamFormat || "stream";
134
+ const sseHeaders = streamFormat === "sse" ? {
135
+ "Content-Type": "text/event-stream",
136
+ "Cache-Control": "no-cache",
137
+ Connection: "keep-alive",
138
+ "X-Accel-Buffering": "no"
139
+ } : { "Content-Type": "text/plain" };
140
+ reply.raw.writeHead(200, {
141
+ ...existingHeaders,
142
+ ...sseHeaders,
143
+ "Transfer-Encoding": "chunked"
144
+ });
145
+ if (streamFormat === "sse" && route.sseFlushOnConnect) reply.raw.write(": connected\n\n");
146
+ const reader = (result instanceof ReadableStream ? result : result.fullStream).getReader();
147
+ let readerCanceled = false;
148
+ const cancelReader = (reason) => {
149
+ if (readerCanceled) return;
150
+ readerCanceled = true;
151
+ reader.cancel(reason);
152
+ };
153
+ const cancelReaderOnResponseClose = () => cancelReader("request aborted");
154
+ const cancelReaderOnRequestClose = () => {
155
+ if (request && isRequestAborted(request.raw)) cancelReader("request aborted");
156
+ };
157
+ reply.raw.on("close", cancelReaderOnResponseClose);
158
+ request?.raw.on("close", cancelReaderOnRequestClose);
159
+ try {
160
+ while (true) {
161
+ const { done, value } = await reader.read();
162
+ if (done) break;
163
+ if (value) {
164
+ if (streamFormat === "sse" && typeof value === "string" && value.startsWith(":")) {
165
+ reply.raw.write(value);
166
+ continue;
167
+ }
168
+ const outputValue = this.streamOptions?.redact ?? true ? (0, _mastra_server_server_adapter.redactStreamChunk)(value) : value;
169
+ const serialized = (0, _mastra_server_server_adapter.serializeStreamChunk)(outputValue);
170
+ if (!serialized.ok) {
171
+ this.mastra.getLogger()?.error("Failed to serialize stream chunk, skipping", {
172
+ path: route.path,
173
+ chunkType: outputValue?.type,
174
+ error: serialized.error.message
175
+ });
176
+ continue;
177
+ }
178
+ if (streamFormat === "sse") reply.raw.write(`data: ${serialized.json}\n\n`);
179
+ else reply.raw.write(serialized.json + "");
180
+ }
181
+ }
182
+ } catch (error) {
183
+ this.mastra.getLogger()?.error("Error in stream processing", { error: error instanceof Error ? {
184
+ message: error.message,
185
+ stack: error.stack
186
+ } : error });
187
+ } finally {
188
+ reply.raw.off("close", cancelReaderOnResponseClose);
189
+ request?.raw.off("close", cancelReaderOnRequestClose);
190
+ if (!reply.raw.writableEnded && !reply.raw.destroyed) reply.raw.end();
191
+ }
192
+ }
193
+ async getParams(route, request) {
194
+ const urlParams = request.params || {};
195
+ const queryParams = (0, _mastra_server_server_adapter.normalizeQueryParams)(request.query || {});
196
+ let body;
197
+ let bodyParseError;
198
+ if (route.method === "POST" || route.method === "PUT" || route.method === "PATCH" || route.method === "DELETE") if ((request.headers["content-type"] || "").includes("multipart/form-data")) try {
199
+ const maxFileSize = route.maxBodySize ?? this.bodyLimitOptions?.maxSize;
200
+ body = await this.parseMultipartFormData(request, maxFileSize);
201
+ } catch (error) {
202
+ this.mastra.getLogger()?.error("Failed to parse multipart form data", { error: error instanceof Error ? {
203
+ message: error.message,
204
+ stack: error.stack
205
+ } : error });
206
+ if (error instanceof Error && error.message.toLowerCase().includes("size")) throw error;
207
+ bodyParseError = { message: error instanceof Error ? error.message : "Failed to parse multipart form data" };
208
+ }
209
+ else body = request.body;
210
+ return {
211
+ urlParams,
212
+ queryParams,
213
+ body,
214
+ bodyParseError
215
+ };
216
+ }
217
+ /**
218
+ * Parse multipart/form-data using @fastify/busboy.
219
+ * Converts file uploads to Buffers and parses JSON field values.
220
+ *
221
+ * @param request - The Fastify request object
222
+ * @param maxFileSize - Optional maximum file size in bytes
223
+ */
224
+ parseMultipartFormData(request, maxFileSize) {
225
+ return new Promise((resolve, reject) => {
226
+ const result = {};
227
+ const busboy = new _fastify_busboy.Busboy({
228
+ headers: { "content-type": request.headers["content-type"] },
229
+ limits: maxFileSize ? { fileSize: maxFileSize } : void 0
230
+ });
231
+ busboy.on("file", (fieldname, file, _filename, _encoding, _mimetype) => {
232
+ const chunks = [];
233
+ let limitExceeded = false;
234
+ file.on("data", (chunk) => {
235
+ chunks.push(chunk);
236
+ });
237
+ file.on("limit", () => {
238
+ limitExceeded = true;
239
+ file.resume();
240
+ reject(/* @__PURE__ */ new Error(`File size limit exceeded${maxFileSize ? ` (max: ${maxFileSize} bytes)` : ""}`));
241
+ });
242
+ file.on("end", () => {
243
+ if (!limitExceeded) result[fieldname] = Buffer.concat(chunks);
244
+ });
245
+ });
246
+ busboy.on("field", (fieldname, value) => {
247
+ try {
248
+ result[fieldname] = JSON.parse(value);
249
+ } catch {
250
+ result[fieldname] = value;
251
+ }
252
+ });
253
+ busboy.on("finish", () => {
254
+ resolve(result);
255
+ });
256
+ busboy.on("error", (error) => {
257
+ reject(error);
258
+ });
259
+ request.raw.pipe(busboy);
260
+ });
261
+ }
262
+ async sendResponse(route, reply, result, request, prefix) {
263
+ const resolvedPrefix = prefix ?? this.prefix ?? "";
264
+ if (result && typeof result === "object" && "__refreshHeaders" in result) {
265
+ const refreshHeaders = result.__refreshHeaders;
266
+ for (const [key, value] of Object.entries(refreshHeaders)) reply.header(key, value);
267
+ delete result.__refreshHeaders;
268
+ }
269
+ if (route.responseType === "json") await reply.send(result);
270
+ else if (route.responseType === "stream") await this.stream(route, reply, result, request);
271
+ else if (route.responseType === "datastream-response") {
272
+ const fetchResponse = result;
273
+ fetchResponse.headers.forEach((value, key) => reply.header(key, value));
274
+ reply.status(fetchResponse.status);
275
+ if (fetchResponse.body) {
276
+ const reader = fetchResponse.body.getReader();
277
+ let readerCanceled = false;
278
+ const cancelReader = (reason) => {
279
+ if (readerCanceled) return;
280
+ readerCanceled = true;
281
+ reader.cancel(reason);
282
+ };
283
+ const cancelReaderOnResponseClose = () => cancelReader("request aborted");
284
+ const cancelReaderOnRequestClose = () => {
285
+ if (request && isRequestAborted(request.raw)) cancelReader("request aborted");
286
+ };
287
+ const onResError = (err) => {
288
+ this.mastra.getLogger()?.error("Error writing datastream response", { error: err instanceof Error ? {
289
+ message: err.message,
290
+ stack: err.stack
291
+ } : err });
292
+ cancelReader("response write error");
293
+ };
294
+ reply.raw.once("error", onResError);
295
+ reply.raw.on("close", cancelReaderOnResponseClose);
296
+ request?.raw.on("close", cancelReaderOnRequestClose);
297
+ try {
298
+ while (true) {
299
+ const { done, value } = await reader.read();
300
+ if (done) break;
301
+ reply.raw.write(value);
302
+ }
303
+ } catch (error) {
304
+ this.mastra.getLogger()?.error("Error in datastream processing", { error: error instanceof Error ? {
305
+ message: error.message,
306
+ stack: error.stack
307
+ } : error });
308
+ } finally {
309
+ reply.raw.off("error", onResError);
310
+ reply.raw.off("close", cancelReaderOnResponseClose);
311
+ request?.raw.off("close", cancelReaderOnRequestClose);
312
+ if (!reply.raw.writableEnded && !reply.raw.destroyed) reply.raw.end();
313
+ }
314
+ } else reply.raw.end();
315
+ } else if (route.responseType === "mcp-http") {
316
+ if (!request) {
317
+ await reply.status(500).send({ error: "Request object required for MCP transport" });
318
+ return;
319
+ }
320
+ const { server, httpPath, mcpOptions: routeMcpOptions } = result;
321
+ try {
322
+ reply.hijack();
323
+ const rawReq = request.raw;
324
+ if (request.body !== void 0) rawReq.body = request.body;
325
+ const options = {
326
+ ...this.mcpOptions,
327
+ ...routeMcpOptions
328
+ };
329
+ await server.startHTTP({
330
+ url: new URL(request.url, `http://${request.headers.host}`),
331
+ httpPath: `${resolvedPrefix}${httpPath}`,
332
+ req: rawReq,
333
+ res: reply.raw,
334
+ options: Object.keys(options).length > 0 ? options : void 0
335
+ });
336
+ } catch {
337
+ if (!reply.raw.headersSent) {
338
+ reply.raw.writeHead(500, { "Content-Type": "application/json" });
339
+ reply.raw.end(JSON.stringify({
340
+ jsonrpc: "2.0",
341
+ error: {
342
+ code: -32603,
343
+ message: "Internal server error"
344
+ },
345
+ id: null
346
+ }));
347
+ }
348
+ }
349
+ } else if (route.responseType === "mcp-sse") {
350
+ if (!request) {
351
+ await reply.status(500).send({ error: "Request object required for MCP transport" });
352
+ return;
353
+ }
354
+ const { server, ssePath, messagePath } = result;
355
+ try {
356
+ reply.hijack();
357
+ const rawReq = request.raw;
358
+ if (request.body !== void 0) rawReq.body = request.body;
359
+ await server.startSSE({
360
+ url: new URL(request.url, `http://${request.headers.host}`),
361
+ ssePath: `${resolvedPrefix}${ssePath}`,
362
+ messagePath: `${resolvedPrefix}${messagePath}`,
363
+ req: rawReq,
364
+ res: reply.raw
365
+ });
366
+ } catch {
367
+ if (!reply.raw.headersSent) {
368
+ reply.raw.writeHead(500, { "Content-Type": "application/json" });
369
+ reply.raw.end(JSON.stringify({ error: "Error handling MCP SSE request" }));
370
+ }
371
+ }
372
+ } else reply.status(500);
373
+ }
374
+ async registerRoute(app, route, { prefix: prefixParam } = {}) {
375
+ const prefix = prefixParam ?? this.prefix ?? "";
376
+ const fastifyPath = `${prefix}${route.path}`;
377
+ const handler = async (request, reply) => {
378
+ const authError = await this.checkRouteAuth(route, {
379
+ path: String(request.url.split("?")[0] || "/"),
380
+ method: String(request.method || "GET"),
381
+ getHeader: (name) => request.headers[name.toLowerCase()],
382
+ getQuery: (name) => request.query[name],
383
+ requestContext: request.requestContext,
384
+ request: toWebRequest(request),
385
+ buildAuthorizeContext: () => toWebRequest(request)
386
+ });
387
+ if (authError) {
388
+ if (authError.headers) for (const [key, value] of Object.entries(authError.headers)) reply.header(key, value);
389
+ if (authError.error) return reply.status(authError.status).send({ error: authError.error });
390
+ }
391
+ const params = await this.getParams(route, request);
392
+ if (params.bodyParseError) return reply.status(400).send({
393
+ error: "Invalid request body",
394
+ issues: [{
395
+ field: "body",
396
+ message: params.bodyParseError.message
397
+ }]
398
+ });
399
+ if (params.queryParams) try {
400
+ params.queryParams = await this.parseQueryParams(route, params.queryParams);
401
+ } catch (error) {
402
+ this.mastra.getLogger()?.error("Error parsing query params", { error: error instanceof Error ? {
403
+ message: error.message,
404
+ stack: error.stack
405
+ } : error });
406
+ if ((0, _mastra_server_server_adapter.isZodError)(error)) {
407
+ const { status, body } = this.resolveValidationError(route, error, "query");
408
+ return reply.status(status).send(body);
409
+ }
410
+ return reply.status(400).send({
411
+ error: "Invalid query parameters",
412
+ issues: [{
413
+ field: "unknown",
414
+ message: error instanceof Error ? error.message : "Unknown error"
415
+ }]
416
+ });
417
+ }
418
+ if (params.body) try {
419
+ params.body = await this.parseBody(route, params.body);
420
+ } catch (error) {
421
+ this.mastra.getLogger()?.error("Error parsing body", { error: error instanceof Error ? {
422
+ message: error.message,
423
+ stack: error.stack
424
+ } : error });
425
+ if ((0, _mastra_server_server_adapter.isZodError)(error)) {
426
+ const { status, body } = this.resolveValidationError(route, error, "body");
427
+ return reply.status(status).send(body);
428
+ }
429
+ return reply.status(400).send({
430
+ error: "Invalid request body",
431
+ issues: [{
432
+ field: "unknown",
433
+ message: error instanceof Error ? error.message : "Unknown error"
434
+ }]
435
+ });
436
+ }
437
+ if (params.urlParams) try {
438
+ params.urlParams = await this.parsePathParams(route, params.urlParams);
439
+ } catch (error) {
440
+ this.mastra.getLogger()?.error("Error parsing path params", { error: error instanceof Error ? {
441
+ message: error.message,
442
+ stack: error.stack
443
+ } : error });
444
+ if ((0, _mastra_server_server_adapter.isZodError)(error)) {
445
+ const { status, body } = this.resolveValidationError(route, error, "path");
446
+ return reply.status(status).send(body);
447
+ }
448
+ return reply.status(400).send({
449
+ error: "Invalid path parameters",
450
+ issues: [{
451
+ field: "unknown",
452
+ message: error instanceof Error ? error.message : "Unknown error"
453
+ }]
454
+ });
455
+ }
456
+ const handlerParams = {
457
+ ...params.urlParams,
458
+ ...params.queryParams,
459
+ ...typeof params.body === "object" ? params.body : {},
460
+ requestContext: request.requestContext,
461
+ mastra: this.mastra,
462
+ registeredTools: request.registeredTools,
463
+ taskStore: request.taskStore,
464
+ abortSignal: request.abortSignal,
465
+ routePrefix: prefix,
466
+ request: toWebRequest(request)
467
+ };
468
+ const requestContext = request.requestContext;
469
+ if (this.mastra.getStudio?.()?.auth || this.mastra.getServer()?.auth) {
470
+ const hasPermission = await loadHasPermission();
471
+ if (hasPermission) {
472
+ const userPermissions = requestContext.get("mastra__userPermissions");
473
+ const permissionError = this.checkRoutePermission(route, userPermissions, hasPermission, requestContext);
474
+ if (permissionError) return reply.status(permissionError.status).send({
475
+ error: permissionError.error,
476
+ message: permissionError.message
477
+ });
478
+ }
479
+ }
480
+ const fgaError = await (0, _mastra_server_server_adapter.checkRouteFGA)(this.mastra, route, requestContext, {
481
+ ...params.urlParams,
482
+ ...params.queryParams,
483
+ ...typeof params.body === "object" ? params.body : {}
484
+ });
485
+ if (fgaError) return reply.status(fgaError.status).send({
486
+ error: fgaError.error,
487
+ message: fgaError.message
488
+ });
489
+ try {
490
+ const result = await route.handler(handlerParams);
491
+ await this.sendResponse(route, reply, result, request, prefix);
492
+ } catch (error) {
493
+ const httpStatus = error && typeof error === "object" && "status" in error ? error.status : void 0;
494
+ if (!(typeof httpStatus === "number" && httpStatus >= 400 && httpStatus < 500)) this.mastra.getLogger()?.error("Error calling handler", {
495
+ error: error instanceof Error ? {
496
+ message: error.message,
497
+ stack: error.stack
498
+ } : error,
499
+ path: route.path,
500
+ method: route.method
501
+ });
502
+ let status = 500;
503
+ if (error && typeof error === "object") {
504
+ if ("status" in error) status = error.status;
505
+ else if ("details" in error && error.details && typeof error.details === "object" && "status" in error.details) status = error.details.status;
506
+ }
507
+ await reply.status(status).send({ error: error instanceof Error ? error.message : "Unknown error" });
508
+ }
509
+ };
510
+ const shouldApplyBodyLimit = this.bodyLimitOptions && [
511
+ "POST",
512
+ "PUT",
513
+ "PATCH"
514
+ ].includes(route.method.toUpperCase());
515
+ const maxSize = route.maxBodySize ?? this.bodyLimitOptions?.maxSize;
516
+ const config = shouldApplyBodyLimit && maxSize ? { bodyLimit: maxSize } : void 0;
517
+ if (route.method.toUpperCase() === "ALL") for (const method of [
518
+ "GET",
519
+ "POST",
520
+ "PUT",
521
+ "DELETE",
522
+ "PATCH"
523
+ ]) try {
524
+ app.route({
525
+ method,
526
+ url: fastifyPath,
527
+ handler,
528
+ config
529
+ });
530
+ } catch (err) {
531
+ if (err instanceof Error && err.message.includes("already declared")) continue;
532
+ throw err;
533
+ }
534
+ else app.route({
535
+ method: route.method,
536
+ url: fastifyPath,
537
+ handler,
538
+ config
539
+ });
540
+ }
541
+ async registerCustomApiRoutes() {
542
+ if (!await this.buildCustomRouteHandler()) return;
543
+ const routes = this.customApiRoutes ?? this.mastra.getServer()?.apiRoutes ?? [];
544
+ for (const route of routes) {
545
+ const serverRoute = {
546
+ method: route.method,
547
+ path: route.path,
548
+ responseType: "json",
549
+ handler: async () => {},
550
+ requiresAuth: route.requiresAuth,
551
+ requiresPermission: route.requiresPermission,
552
+ fga: route.fga
553
+ };
554
+ const fastifyHandler = async (request, reply) => {
555
+ const authError = await this.checkRouteAuth(serverRoute, {
556
+ path: String(request.url.split("?")[0] || "/"),
557
+ method: String(request.method || "GET"),
558
+ getHeader: (name) => request.headers[name.toLowerCase()],
559
+ getQuery: (name) => request.query[name],
560
+ requestContext: request.requestContext,
561
+ request: toWebRequest(request),
562
+ buildAuthorizeContext: () => toWebRequest(request)
563
+ });
564
+ if (authError) {
565
+ if (authError.headers) for (const [key, value] of Object.entries(authError.headers)) reply.header(key, value);
566
+ if (authError.error) return reply.status(authError.status).send({ error: authError.error });
567
+ }
568
+ const requestContext = request.requestContext;
569
+ if (this.mastra.getStudio?.()?.auth || this.mastra.getServer()?.auth) {
570
+ let hasPermission;
571
+ try {
572
+ ({hasPermission} = await import("@mastra/core/auth/ee"));
573
+ } catch {
574
+ console.error("[@mastra/fastify] Auth features require @mastra/core >= 1.6.0. Please upgrade: npm install @mastra/core@latest");
575
+ }
576
+ if (hasPermission) {
577
+ const userPermissions = requestContext.get("mastra__userPermissions");
578
+ const permissionError = this.checkRoutePermission(serverRoute, userPermissions, hasPermission, requestContext);
579
+ if (permissionError) return reply.status(permissionError.status).send({
580
+ error: permissionError.error,
581
+ message: permissionError.message
582
+ });
583
+ }
584
+ }
585
+ const fgaError = await (0, _mastra_server_server_adapter.checkRouteFGA)(this.mastra, serverRoute, requestContext, {
586
+ ...request.params,
587
+ ...request.query,
588
+ ...typeof request.body === "object" && request.body !== null ? request.body : {}
589
+ });
590
+ if (fgaError) return reply.status(fgaError.status).send({
591
+ error: fgaError.error,
592
+ message: fgaError.message
593
+ });
594
+ const response = await this.handleCustomRouteRequest(`http://${request.headers.host}${request.url}`, request.method, request.headers, request.body, request.requestContext, request.abortSignal);
595
+ if (!response) {
596
+ reply.status(404).send({ error: "Not Found" });
597
+ return;
598
+ }
599
+ const existingHeaders = reply.getHeaders();
600
+ for (const [key, value] of Object.entries(existingHeaders)) {
601
+ if (value === void 0) continue;
602
+ const lowerKey = key.toLowerCase();
603
+ if (lowerKey === "content-length" || lowerKey === "transfer-encoding") continue;
604
+ const isSetCookie = lowerKey === "set-cookie";
605
+ if (!isSetCookie && response.headers.has(key)) continue;
606
+ if (Array.isArray(value)) for (const item of value) response.headers.append(key, String(item));
607
+ else if (isSetCookie) response.headers.append(key, String(value));
608
+ else response.headers.set(key, String(value));
609
+ }
610
+ reply.hijack();
611
+ await this.writeCustomRouteResponse(response, reply.raw, request.abortSignal);
612
+ };
613
+ if (route.method === "ALL") for (const method of [
614
+ "GET",
615
+ "POST",
616
+ "PUT",
617
+ "DELETE",
618
+ "PATCH"
619
+ ]) this.app.route({
620
+ method,
621
+ url: route.path,
622
+ handler: fastifyHandler
623
+ });
624
+ else this.app.route({
625
+ method: route.method,
626
+ url: route.path,
627
+ handler: fastifyHandler
628
+ });
629
+ }
630
+ }
631
+ registerContextMiddleware() {
632
+ this.app.removeContentTypeParser("application/json");
633
+ this.app.addContentTypeParser("application/json", { parseAs: "string" }, (_request, body, done) => {
634
+ try {
635
+ if (!body || typeof body === "string" && body.trim() === "") {
636
+ done(null, void 0);
637
+ return;
638
+ }
639
+ done(null, JSON.parse(body));
640
+ } catch (err) {
641
+ done(err, void 0);
642
+ }
643
+ });
644
+ this.app.addContentTypeParser("multipart/form-data", (_request, _payload, done) => {
645
+ done(null, void 0);
646
+ });
647
+ this.app.addHook("preHandler", this.createContextMiddleware());
648
+ }
649
+ registerAuthMiddleware() {}
650
+ registerHttpLoggingMiddleware() {
651
+ if (!this.httpLoggingConfig?.enabled) return;
652
+ this.app.addHook("onRequest", async (request, reply) => {
653
+ const urlPath = request.url.split("?")[0];
654
+ if (!this.shouldLogRequest(urlPath)) return;
655
+ const start = Date.now();
656
+ const method = request.method;
657
+ const path = urlPath;
658
+ reply.raw.once("finish", () => {
659
+ const duration = Date.now() - start;
660
+ const status = reply.statusCode;
661
+ const level = this.httpLoggingConfig?.level || "info";
662
+ const logData = {
663
+ method,
664
+ path,
665
+ status,
666
+ duration: `${duration}ms`
667
+ };
668
+ if (this.httpLoggingConfig?.includeQueryParams) logData.query = request.query;
669
+ if (this.httpLoggingConfig?.includeHeaders) {
670
+ const headers = { ...request.headers };
671
+ (this.httpLoggingConfig.redactHeaders || []).forEach((h) => {
672
+ const key = h.toLowerCase();
673
+ if (headers[key] !== void 0) headers[key] = "[REDACTED]";
674
+ });
675
+ logData.headers = headers;
676
+ }
677
+ this.logger[level](`${method} ${path} ${status} ${duration}ms`, logData);
678
+ });
679
+ });
680
+ }
795
681
  };
796
-
682
+ //#endregion
797
683
  exports.MastraServer = MastraServer;
798
684
  exports.createAuthMiddleware = createAuthMiddleware;
799
- //# sourceMappingURL=index.cjs.map
685
+
800
686
  //# sourceMappingURL=index.cjs.map