@mastra/koa 1.5.0-alpha.1 → 1.5.0-alpha.2

package/dist/index.js

@@ -1,6 +1,6 @@
 import { Busboy } from '@fastify/busboy';
-import { coreAuthMiddleware, isProtectedCustomRoute } from '@mastra/server/auth';
-import { MastraServer as MastraServer$1, redactStreamChunk, normalizeQueryParams } from '@mastra/server/server-adapter';
+import { coreAuthMiddleware, findMatchingCustomRoute, isProtectedCustomRoute } from '@mastra/server/auth';
+import { MastraServer as MastraServer$1, checkRouteFGA, redactStreamChunk, normalizeQueryParams } from '@mastra/server/server-adapter';
 import { RequestContext } from '@mastra/core/request-context';
 
 // src/index.ts
@@ -607,6 +607,16 @@ var MastraServer = class extends MastraServer$1 {
         }
       }
     }
+    const fgaError = await checkRouteFGA(this.mastra, route, ctx.state.requestContext, {
+      ...params.urlParams,
+      ...params.queryParams,
+      ...typeof params.body === "object" ? params.body : {}
+    });
+    if (fgaError) {
+      ctx.status = fgaError.status;
+      ctx.body = { error: fgaError.error, message: fgaError.message };
+      return;
+    }
     try {
       const result = await route.handler(handlerParams);
       await this.sendResponse(route, ctx, result, prefix);
@@ -886,57 +896,72 @@ var MastraServer = class extends MastraServer$1 {
     this.app.use(async function mastraCustomRouteDispatcher(ctx, next) {
       const path = String(ctx.path || "/");
       const method = String(ctx.method || "GET");
-      if (isProtectedCustomRoute(path, method, server.customRouteAuthConfig)) {
+      const matchedRoute = findMatchingCustomRoute(
+        path,
+        method,
+        server.customApiRoutes ?? server.mastra.getServer()?.apiRoutes
+      );
+      const shouldRunCustomRouteAuth = isProtectedCustomRoute(path, method, server.customRouteAuthConfig);
+      const shouldRunCustomRouteFGA = !!matchedRoute?.route.fga;
+      if (shouldRunCustomRouteAuth || shouldRunCustomRouteFGA) {
         const serverRoute = {
-          method,
-          path,
+          method: matchedRoute?.route.method ?? method,
+          path: matchedRoute?.route.path ?? path,
           responseType: "json",
           handler: async () => {
-          }
+          },
+          requiresAuth: matchedRoute?.route.requiresAuth,
+          requiresPermission: matchedRoute?.route.requiresPermission,
+          fga: matchedRoute?.route.fga
         };
-        const authError = await server.checkRouteAuth(serverRoute, {
-          path,
-          method,
-          getHeader: (name) => ctx.headers[name.toLowerCase()],
-          getQuery: (name) => ctx.query[name],
-          requestContext: ctx.state.requestContext,
-          request: toWebRequest2(ctx),
-          buildAuthorizeContext: () => toWebRequest2(ctx)
-        });
-        if (authError) {
-          if (authError.headers) {
-            for (const [key, value] of Object.entries(authError.headers)) {
-              ctx.set(key, value);
+        if (shouldRunCustomRouteAuth) {
+          const authError = await server.checkRouteAuth(serverRoute, {
+            path,
+            method,
+            getHeader: (name) => ctx.headers[name.toLowerCase()],
+            getQuery: (name) => ctx.query[name],
+            requestContext: ctx.state.requestContext,
+            request: toWebRequest2(ctx),
+            buildAuthorizeContext: () => toWebRequest2(ctx)
+          });
+          if (authError) {
+            if (authError.headers) {
+              for (const [key, value] of Object.entries(authError.headers)) {
+                ctx.set(key, value);
+              }
             }
-          }
-          if (authError.error) {
-            ctx.status = authError.status;
-            ctx.body = { error: authError.error };
-            return;
-          }
-        }
-        const authConfig = server.mastra.getServer()?.auth;
-        if (authConfig) {
-          let hasPermission;
-          try {
-            ({ hasPermission } = await import('@mastra/core/auth/ee'));
-          } catch {
-            console.error(
-              "[@mastra/koa] Auth features require @mastra/core >= 1.6.0. Please upgrade: npm install @mastra/core@latest"
-            );
-          }
-          if (hasPermission) {
-            const userPermissions = ctx.state.requestContext.get("userPermissions");
-            const permissionError = server.checkRoutePermission(serverRoute, userPermissions, hasPermission);
-            if (permissionError) {
-              ctx.status = permissionError.status;
-              ctx.body = {
-                error: permissionError.error,
-                message: permissionError.message
-              };
+            if (authError.error) {
+              ctx.status = authError.status;
+              ctx.body = { error: authError.error };
               return;
             }
           }
+          const authConfig = server.mastra.getServer()?.auth;
+          if (authConfig) {
+            const hasPermission = await loadHasPermission();
+            if (hasPermission) {
+              const userPermissions = ctx.state.requestContext.get("userPermissions");
+              const permissionError = server.checkRoutePermission(serverRoute, userPermissions, hasPermission);
+              if (permissionError) {
+                ctx.status = permissionError.status;
+                ctx.body = {
+                  error: permissionError.error,
+                  message: permissionError.message
+                };
+                return;
+              }
+            }
+          }
+        }
+        const fgaError = await checkRouteFGA(server.mastra, serverRoute, ctx.state.requestContext, {
+          ...matchedRoute?.params ?? {},
+          ...ctx.query,
+          ...typeof ctx.request.body === "object" && ctx.request.body !== null ? ctx.request.body : {}
+        });
+        if (fgaError) {
+          ctx.status = fgaError.status;
+          ctx.body = { error: fgaError.error, message: fgaError.message };
+          return;
         }
       }
       const response = await server.handleCustomRouteRequest(