@mastra/mcp 1.9.2-alpha.0 → 1.10.0

package/dist/index.js

@@ -2772,6 +2772,7 @@ var MCPServer = class extends MCPServerBase {
   promptOptions;
   jsonSchemaValidator;
   mapAuthInfoToUser;
+  fga;
   subscriptions = /* @__PURE__ */ new Set();
   currentLoggingLevel;
   /**
@@ -2912,6 +2913,7 @@ var MCPServer = class extends MCPServerBase {
     this.promptOptions = opts.prompts;
     this.jsonSchemaValidator = opts.jsonSchemaValidator;
     this.mapAuthInfoToUser = opts.mapAuthInfoToUser;
+    this.fga = opts.fga;
     const capabilities = {
       tools: {},
       logging: { enabled: true }
@@ -4559,11 +4561,17 @@ Provided arguments: ${JSON.stringify(request.params.arguments, null, 2)}`
     if (!user) {
       throw new FGADeniedError({ id: "unknown" }, { type: "tool", id: resourceId }, MastraFGAPermissions.TOOLS_EXECUTE);
     }
+    const { resource, permission } = this.resolveToolFGAParams({
+      user,
+      resourceId,
+      requestContext,
+      permission: MastraFGAPermissions.TOOLS_EXECUTE
+    });
     await requireFGA({
       fgaProvider,
       user,
-      resource: { type: "tool", id: resourceId },
-      permission: MastraFGAPermissions.TOOLS_EXECUTE,
+      resource,
+      permission,
       requestContext,
       context: {
         resourceId
@@ -4575,6 +4583,28 @@ Provided arguments: ${JSON.stringify(request.params.arguments, null, 2)}`
       }
     });
   }
+  resolveToolFGAParams({
+    user,
+    resourceId,
+    requestContext,
+    permission
+  }) {
+    const mappedPermission = this.fga?.permissionMapping?.[permission] ?? permission;
+    const resourceMapping = this.fga?.resourceMapping?.tool ?? this.fga?.resourceMapping?.tools;
+    if (!resourceMapping) {
+      return {
+        resource: { type: "tool", id: resourceId },
+        permission: mappedPermission
+      };
+    }
+    return {
+      resource: {
+        type: resourceMapping.fgaResourceType,
+        id: resourceMapping.deriveId?.({ user, resourceId, requestContext }) ?? resourceId
+      },
+      permission: mappedPermission
+    };
+  }
   /**
    * Executes a specific tool provided by this MCP server.
    *