@mastra/nestjs 0.2.38 → 0.2.39-alpha.0

package/dist/index.js

@@ -1,7 +1,8 @@
 import { createRequire } from "module";
 import { All, BadRequestException, Catch, Controller, ForbiddenException, Get, HttpException, HttpStatus, Inject, Injectable, Logger, Module, NotFoundException, PayloadTooLargeException, Req, Res, Scope, ServiceUnavailableException, SetMetadata, UnauthorizedException, UseFilters, UseGuards, UseInterceptors } from "@nestjs/common";
-import { HTTPException, MASTRA_CLIENT_TYPE_HEADER, MASTRA_IS_STUDIO_KEY, SERVER_ROUTES, getCustomHTTPExceptionResponse, isReservedRequestContextKey, isSafeObjectKey, isStudioClientTypeHeader, isZodError, normalizeQueryParams, redactStreamChunk, serializeStreamChunk } from "@mastra/server/server-adapter";
+import { HTTPException, MASTRA_AUTH_MODE_KEY, MASTRA_CLIENT_TYPE_HEADER, MASTRA_IS_STUDIO_KEY, SERVER_ROUTES, checkRouteFGA, getCustomHTTPExceptionResponse, getCustomRouteHTTPExceptionResponse, getEffectivePermission, getHTTPErrorResponse, isReservedRequestContextKey, isSafeObjectKey, isStudioClientTypeHeader, isZodError, normalizeQueryParams, redactStreamChunk, serializeStreamChunk } from "@mastra/server/server-adapter";
 import { formatZodError, isZodError as isZodError$1 } from "@mastra/server/handlers/error";
+import { hasPermission } from "@mastra/core/auth/ee";
 import { RequestContext } from "@mastra/core/request-context";
 import { MASTRA_USER_KEY, coreAuthMiddleware } from "@mastra/server/auth";
 import { Readable } from "stream";
@@ -203,6 +204,11 @@ let RouteHandlerService = _RouteHandlerService = class RouteHandlerService {
 			if (isZodError(error)) throw this.createValidationError(route, error, "body");
 			throw error;
 		}
+		await this.authorizeRoute(route, params.requestContext, {
+			...validatedPathParams,
+			...validatedQueryParams,
+			...typeof validatedBody === "object" && validatedBody !== null ? validatedBody : {}
+		});
 		const context = {
 			mastra: this.mastra,
 			requestContext: params.requestContext,
@@ -225,6 +231,39 @@ let RouteHandlerService = _RouteHandlerService = class RouteHandlerService {
 			sseFlushOnConnect: route.sseFlushOnConnect
 		};
 	}
+	/**
+	* Enforce the route's RBAC permission and FGA check, matching the other server adapters.
+	* Relies on the auth guard having stored the user, permissions, and auth mode in the request context.
+	*/
+	async authorizeRoute(route, requestContext, params) {
+		await this.enforceRoutePermission(route, requestContext);
+		await this.enforceRouteFGA(route, requestContext, params);
+	}
+	/**
+	* Throws 403 when the user lacks the route's effective RBAC permission.
+	* Skipped when Mastra auth is explicitly disabled (`auth.enabled: false`), since no Mastra user is resolved.
+	*/
+	async enforceRoutePermission(route, requestContext) {
+		if (this.options.auth?.enabled === false) return;
+		const studio = this.mastra.getStudio?.();
+		const server = this.mastra.getServer();
+		if (!studio?.auth && !server?.auth) return;
+		const requiredPermission = (requestContext.get(MASTRA_AUTH_MODE_KEY) === "studio" ? studio?.rbac ?? server?.rbac : server?.rbac) ? getEffectivePermission(route) : null;
+		if (requiredPermission) {
+			const required = Array.isArray(requiredPermission) ? requiredPermission : [requiredPermission];
+			const userPermissions = requestContext.get("mastra__userPermissions");
+			if (!userPermissions || !required.some((permission) => hasPermission(userPermissions, permission))) throw new ForbiddenException(`Missing required permission: ${required.join(" or ")}`);
+		}
+	}
+	/**
+	* Throws when the FGA provider denies the route's resource.
+	* Skipped when Mastra auth is explicitly disabled (`auth.enabled: false`), since no Mastra user is resolved.
+	*/
+	async enforceRouteFGA(route, requestContext, params) {
+		if (this.options.auth?.enabled === false) return;
+		const fgaError = await checkRouteFGA(this.mastra, route, requestContext, params);
+		if (fgaError) throw new HttpException(fgaError.message, fgaError.status);
+	}
 	async parseBody(route, body) {
 		const bodySchema = route.bodySchema;
 		if (!bodySchema) return body;
@@ -318,7 +357,8 @@ let MastraExceptionFilter = _MastraExceptionFilter = class MastraExceptionFilter
 			return;
 		}
 		if (exception instanceof HTTPException) {
-			response.status(exception.status).json({ error: exception.message });
+			const { status, body } = getHTTPErrorResponse(exception);
+			response.status(status).json(body);
 			return;
 		}
 		const normalized = this.normalizeError(exception);
@@ -478,7 +518,7 @@ let CustomRouteService = class CustomRouteService {
 	* Runs a matched custom route and writes its response.
 	* Returns false if no custom route handled the request.
 	*
-	* `authenticate` runs after Hono's router selects the route, so auth is enforced
+	* `authenticate` runs after Hono's router selects the route, so auth, RBAC, and FGA are enforced
 	* for exactly the routes Hono dispatches (including regex-constrained params).
 	*/
 	async handle(req, res, requestContext, authenticate) {
@@ -539,6 +579,8 @@ let CustomRouteService = class CustomRouteService {
 		const serverOnError = mastra.getServer()?.onError;
 		app.onError((err, c) => {
 			if (serverOnError) return serverOnError(err, c);
+			const httpExceptionResponse = getCustomRouteHTTPExceptionResponse(err);
+			if (httpExceptionResponse) return httpExceptionResponse;
 			mastra.getLogger()?.error(`Custom route handler failed: ${c.req.method} ${c.req.path}`, { error: err instanceof Error ? err.stack ?? err.message : String(err) });
 			return c.json({ error: "Internal Server Error" }, 500);
 		});
@@ -549,7 +591,7 @@ let CustomRouteService = class CustomRouteService {
 			const requiresAuth = this.authConfig.get(`${route.method}:${route.path}`) ?? route.requiresAuth !== false;
 			const authMiddleware = async (c, next) => {
 				try {
-					await c.env.authenticate(requiresAuth);
+					await c.env.authenticate(route, requiresAuth, c.req.param());
 				} catch (err) {
 					c.env.authError = err;
 					return c.body(null, 401);
@@ -616,11 +658,29 @@ let AuthService = class AuthService {
 	}
 	/**
 	* Whether Mastra auth should run: module options enable it, or the Mastra
-	* server has auth configured (unless module options explicitly disable it).
+	* server or Studio has auth configured (unless module options explicitly disable it).
 	*/
 	isEnabled() {
 		if (this.options.auth?.enabled === false) return false;
-		return Boolean(this.options.auth?.enabled || this.mastra.getServer()?.auth);
+		return Boolean(this.options.auth?.enabled || this.mastra.getServer()?.auth || this.mastra.getStudio?.()?.auth);
+	}
+	/**
+	* Studio requests (`x-mastra-client-type: studio`) use `studio.auth` exclusively when it is
+	* configured, without falling back to `server.auth`; all other requests use `server.auth`.
+	*/
+	getEffectiveAuthConfig(request) {
+		const clientType = request.headers[MASTRA_CLIENT_TYPE_HEADER];
+		const isStudioRequest = isStudioClientTypeHeader(Array.isArray(clientType) ? clientType[0] : clientType);
+		const studioAuth = this.mastra.getStudio?.()?.auth;
+		if (isStudioRequest && studioAuth) return {
+			authConfig: studioAuth,
+			authMode: "studio"
+		};
+		const serverAuth = this.mastra.getServer()?.auth;
+		return serverAuth ? {
+			authConfig: serverAuth,
+			authMode: "server"
+		} : null;
 	}
 	/**
 	* Check authentication for a request.
@@ -628,9 +688,11 @@ let AuthService = class AuthService {
 	* Throws UnauthorizedException or ForbiddenException if auth fails.
 	*/
 	async authenticate(request, options = {}) {
-		const authConfig = this.mastra.getServer()?.auth;
-		if (!authConfig) return;
+		const effectiveAuth = this.getEffectiveAuthConfig(request);
+		if (!effectiveAuth) return;
+		const { authConfig, authMode } = effectiveAuth;
 		const requestContext = options.requestContext ?? new RequestContext();
+		requestContext.set(MASTRA_AUTH_MODE_KEY, authMode);
 		const path = request.path;
 		const method = request.method;
 		let customRouteAuthConfig = this.customRoutes.customRouteAuthConfig;
@@ -11008,15 +11070,31 @@ let MastraController = class MastraController {
 		const routePath = getMastraRoutePath(path, this.options.prefix);
 		if (!routePath || !this.routeHandler.matchRoute(method, routePath)) {
 			const requestContext = this.requestContext.requestContext;
-			const authenticate = async (requiresAuth) => {
-				if (!this.authService.isEnabled()) return;
-				const user = await this.authService.authenticate(req, {
-					requestContext,
-					response: res,
+			const authenticate = async (customRoute, requiresAuth, pathParams) => {
+				if (this.authService.isEnabled()) {
+					const user = await this.authService.authenticate(req, {
+						requestContext,
+						response: res,
+						requiresAuth,
+						customRoute: true
+					});
+					if (user !== void 0) this.requestContext.setUser(user);
+				}
+				const serverRoute = {
+					method: customRoute.method,
+					path: customRoute.path,
+					responseType: "json",
+					handler: async () => {},
 					requiresAuth,
-					customRoute: true
+					requiresPermission: customRoute.requiresPermission,
+					fga: customRoute.fga
+				};
+				if (requiresAuth) await this.routeHandler.enforceRoutePermission(serverRoute, requestContext);
+				if (customRoute.fga) await this.routeHandler.enforceRouteFGA(serverRoute, requestContext, {
+					...typeof req.body === "object" && req.body !== null ? req.body : {},
+					...req.query,
+					...pathParams
 				});
-				if (user !== void 0) this.requestContext.setUser(user);
 			};
 			if (await this.customRoutes.handle(req, res, requestContext, authenticate)) return;
 		}
@@ -11337,6 +11415,15 @@ let MastraService = _MastraService = class MastraService {
 		}
 		this.serverAdapter = new NestMastraServer(app, this.routeHandler);
 		this.mastra.setMastraServer(this.serverAdapter);
+		this.warnIfServerMiddlewareConfigured();
+	}
+	/** Mastra server middleware uses Hono's `(c, next)` signature, so NestJS cannot run it. */
+	warnIfServerMiddlewareConfigured() {
+		const instanceMiddleware = this.mastra.getServerMiddleware?.() ?? [];
+		const configMiddleware = this.mastra.getServer()?.middleware;
+		const hasConfigMiddleware = Array.isArray(configMiddleware) ? configMiddleware.length > 0 : !!configMiddleware;
+		if (instanceMiddleware.length === 0 && !hasConfigMiddleware) return;
+		this.mastra.getLogger()?.warn("Mastra server middleware (`server.middleware` or `setServerMiddleware()`) is configured, but this server adapter cannot run Hono middleware handlers. The configured middleware will not run — register middleware through your server framework instead.");
 	}
 	/**
 	* Get the Mastra instance.