@mastra/nestjs 0.2.15 → 0.2.16-alpha.1

package/CHANGELOG.md

@@ -1,5 +1,25 @@
 # @mastra/nestjs
 
+## 0.2.16-alpha.1
+
+### Patch Changes
+
+- Fixed NestJS auth passing a Web Request to authenticateToken and authorize hooks so cookie-based providers (such as Better Auth) no longer fail with 401 on valid credentials. ([#21258](https://github.com/mastra-ai/mastra/pull/21258))
+
+  Resolves https://github.com/mastra-ai/mastra/issues/21253
+
+- Updated dependencies [[`aa3e7be`](https://github.com/mastra-ai/mastra/commit/aa3e7be30f8addb0278ea74429f4df054517a287), [`90822db`](https://github.com/mastra-ai/mastra/commit/90822dba08fb2169c518e4a6d7f127c098eb46b8), [`3700208`](https://github.com/mastra-ai/mastra/commit/37002080c7838267803a7e579a7d58b908d62f36), [`8b7131e`](https://github.com/mastra-ai/mastra/commit/8b7131eb0407f58f5205e68fb27b81f026488f28), [`79c4f82`](https://github.com/mastra-ai/mastra/commit/79c4f8295f568752eeadf8a9b50010a7d9ec06ae)]:
+  - @mastra/core@1.59.0-alpha.1
+  - @mastra/server@1.59.0-alpha.1
+
+## 0.2.16-alpha.0
+
+### Patch Changes
+
+- Updated dependencies [[`088e41e`](https://github.com/mastra-ai/mastra/commit/088e41e434ed05f2c674b254f1034ec46a57a7be), [`b2f0013`](https://github.com/mastra-ai/mastra/commit/b2f0013375588d40c03c13e843b99c0ff8872ca5), [`3b541ae`](https://github.com/mastra-ai/mastra/commit/3b541ae5d410c52b80a7e381d84d021cddb9a449), [`ae79e34`](https://github.com/mastra-ai/mastra/commit/ae79e34c0bd8674fc24c7524217bfc4a051c6136), [`a6c4399`](https://github.com/mastra-ai/mastra/commit/a6c4399763590b3dae21a2c81826e89a3b1deee4)]:
+  - @mastra/core@1.59.0-alpha.0
+  - @mastra/server@1.59.0-alpha.0
+
 ## 0.2.15
 
 ### Patch Changes

package/dist/controllers/mastra.controller.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mastra.controller.d.ts","sourceRoot":"","sources":["../../src/controllers/mastra.controller.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAkCjD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAC5D,OAAO,EAAE,qBAAqB,EAAE,MAAM,qCAAqC,CAAC;AAC5E,OAAO,EAAE,mBAAmB,EAAE,MAAM,mCAAmC,CAAC;AAIxE;;;;;;GAMG;AACH,qBAIa,gBAAgB;IAED,OAAO,CAAC,QAAQ,CAAC,OAAO;IACnB,OAAO,CAAC,QAAQ,CAAC,YAAY;IAC3B,OAAO,CAAC,QAAQ,CAAC,cAAc;gBAFrB,OAAO,EAAE,mBAAmB,EACvB,YAAY,EAAE,mBAAmB,EAC/B,cAAc,EAAE,qBAAqB;IAGvF;;OAEG;IAEG,aAAa,CAAQ,GAAG,EAAE,OAAO,EAA8B,IAAI,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;IAoCtG;;;;;;;;;OASG;IACH,OAAO,CAAC,gBAAgB;IAoBxB;;OAEG;YACW,SAAS;CAsBxB"}
+{"version":3,"file":"mastra.controller.d.ts","sourceRoot":"","sources":["../../src/controllers/mastra.controller.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAQjD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAC5D,OAAO,EAAE,qBAAqB,EAAE,MAAM,qCAAqC,CAAC;AAC5E,OAAO,EAAE,mBAAmB,EAAE,MAAM,mCAAmC,CAAC;AAKxE;;;;;;GAMG;AACH,qBAIa,gBAAgB;IAED,OAAO,CAAC,QAAQ,CAAC,OAAO;IACnB,OAAO,CAAC,QAAQ,CAAC,YAAY;IAC3B,OAAO,CAAC,QAAQ,CAAC,cAAc;gBAFrB,OAAO,EAAE,mBAAmB,EACvB,YAAY,EAAE,mBAAmB,EAC/B,cAAc,EAAE,qBAAqB;IAGvF;;OAEG;IAEG,aAAa,CAAQ,GAAG,EAAE,OAAO,EAA8B,IAAI,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;IAoCtG;;;;;;;;;OASG;IACH,OAAO,CAAC,gBAAgB;IAoBxB;;OAEG;YACW,SAAS;CAsBxB"}

package/dist/index.cjs

@@ -385,6 +385,22 @@ let MastraExceptionFilter = _MastraExceptionFilter = class MastraExceptionFilter
 };
 MastraExceptionFilter = _MastraExceptionFilter = __decorate([(0, _nestjs_common.Catch)()], MastraExceptionFilter);
 //#endregion
+//#region src/utils/to-web-request.ts
+/**
+* Convert an Express request to a Web API Request.
+* Auth providers and route handlers expect this canonical header/cookie shape.
+*/
+function toWebRequest(req) {
+	const url = `${req.protocol || "http"}://${req.get("host") || "localhost"}${req.originalUrl || req.url}`;
+	const headers = new Headers();
+	for (const [key, value] of Object.entries(req.headers)) if (value) if (Array.isArray(value)) value.forEach((v) => headers.append(key, v));
+	else headers.set(key, value);
+	return new globalThis.Request(url, {
+		method: req.method,
+		headers
+	});
+}
+//#endregion
 //#region src/services/auth.service.ts
 var _AuthService;
 let AuthService = _AuthService = class AuthService {
@@ -421,7 +437,7 @@ let AuthService = _AuthService = class AuthService {
 		if (!token) throw new _nestjs_common.UnauthorizedException("Authentication required");
 		try {
 			let user;
-			if (typeof authConfig?.authenticateToken === "function") user = await authConfig.authenticateToken(token, request);
+			if (typeof authConfig?.authenticateToken === "function") user = await authConfig.authenticateToken(token, toWebRequest(request));
 			else throw new Error("No token verification method configured");
 			if (!user) throw new _nestjs_common.UnauthorizedException("Invalid or expired token");
 			request.user = user;
@@ -440,7 +456,7 @@ let AuthService = _AuthService = class AuthService {
 	*/
 	async authorize(request, path, method, user, authConfig) {
 		if (typeof authConfig.authorizeUser === "function") {
-			if (!await authConfig.authorizeUser(user, request)) throw new _nestjs_common.ForbiddenException("Access denied");
+			if (!await authConfig.authorizeUser(user, toWebRequest(request))) throw new _nestjs_common.ForbiddenException("Access denied");
 			return;
 		}
 		if (typeof authConfig.authorize === "function") {
@@ -449,7 +465,7 @@ let AuthService = _AuthService = class AuthService {
 					if (key === "mastra") return this.mastra;
 					if (key === "customRouteAuthConfig") return this.options.customRouteAuthConfig;
 				},
-				req: request
+				req: toWebRequest(request)
 			};
 			if (!await authConfig.authorize(path, method, user, context)) throw new _nestjs_common.ForbiddenException("Access denied");
 			return;
@@ -10761,19 +10777,6 @@ function parseMultipartFormData(request, options = {}) {
 }
 //#endregion
 //#region src/controllers/mastra.controller.ts
-/**
-* Convert Express request to Web API Request for accessing headers, cookies, etc.
-*/
-function toWebRequest(req) {
-	const url = `${req.protocol || "http"}://${req.get("host") || "localhost"}${req.originalUrl || req.url}`;
-	const headers = new Headers();
-	for (const [key, value] of Object.entries(req.headers)) if (value) if (Array.isArray(value)) value.forEach((v) => headers.append(key, v));
-	else headers.set(key, value);
-	return new globalThis.Request(url, {
-		method: req.method,
-		headers
-	});
-}
 let MastraController = class MastraController {
 	options;
 	routeHandler;