@mastra/nestjs 0.2.38 → 0.2.39-alpha.1

package/dist/controllers/mastra.controller.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mastra.controller.d.ts","sourceRoot":"","sources":["../../src/controllers/mastra.controller.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAQjD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAC5D,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AACvD,OAAO,EAAE,kBAAkB,EAAE,MAAM,kCAAkC,CAAC;AACtE,OAAO,EAAE,qBAAqB,EAAE,MAAM,qCAAqC,CAAC;AAC5E,OAAO,EAAE,mBAAmB,EAAE,MAAM,mCAAmC,CAAC;AAKxE;;;;;;GAMG;AACH,qBAIa,gBAAgB;IAED,OAAO,CAAC,QAAQ,CAAC,OAAO;IACnB,OAAO,CAAC,QAAQ,CAAC,YAAY;IAC3B,OAAO,CAAC,QAAQ,CAAC,cAAc;IAClC,OAAO,CAAC,QAAQ,CAAC,YAAY;IACpC,OAAO,CAAC,QAAQ,CAAC,WAAW;IALnD,YAC2C,OAAO,EAAE,mBAAmB,EACvB,YAAY,EAAE,mBAAmB,EAC/B,cAAc,EAAE,qBAAqB,EACxC,YAAY,EAAE,kBAAkB,EACvC,WAAW,EAAE,WAAW,EAC5D;IAEJ;;OAEG;IAEG,aAAa,CAAQ,GAAG,EAAE,OAAO,EAA8B,GAAG,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,CAmDpG;IAED;;;;;;;;;OASG;IACH,OAAO,CAAC,gBAAgB;IAoBxB;;OAEG;YACW,SAAS;CAsBxB"}
+{"version":3,"file":"mastra.controller.d.ts","sourceRoot":"","sources":["../../src/controllers/mastra.controller.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAQjD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAC5D,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AACvD,OAAO,EAAE,kBAAkB,EAAE,MAAM,kCAAkC,CAAC;AAEtE,OAAO,EAAE,qBAAqB,EAAE,MAAM,qCAAqC,CAAC;AAC5E,OAAO,EAAE,mBAAmB,EAAE,MAAM,mCAAmC,CAAC;AAKxE;;;;;;GAMG;AACH,qBAIa,gBAAgB;IAED,OAAO,CAAC,QAAQ,CAAC,OAAO;IACnB,OAAO,CAAC,QAAQ,CAAC,YAAY;IAC3B,OAAO,CAAC,QAAQ,CAAC,cAAc;IAClC,OAAO,CAAC,QAAQ,CAAC,YAAY;IACpC,OAAO,CAAC,QAAQ,CAAC,WAAW;IALnD,YAC2C,OAAO,EAAE,mBAAmB,EACvB,YAAY,EAAE,mBAAmB,EAC/B,cAAc,EAAE,qBAAqB,EACxC,YAAY,EAAE,kBAAkB,EACvC,WAAW,EAAE,WAAW,EAC5D;IAEJ;;OAEG;IAEG,aAAa,CAAQ,GAAG,EAAE,OAAO,EAA8B,GAAG,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,CA2EpG;IAED;;;;;;;;;OASG;IACH,OAAO,CAAC,gBAAgB;IAoBxB;;OAEG;YACW,SAAS;CAsBxB"}

package/dist/filters/mastra-exception.filter.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mastra-exception.filter.d.ts","sourceRoot":"","sources":["../../src/filters/mastra-exception.filter.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAYrE;;;;;;;;;;;;;GAaG;AACH,qBACa,qBAAsB,YAAW,eAAe;IAC3D,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA0C;IAE3D,KAAK,CAAC,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAyDlE;IAED;;OAEG;IACH,OAAO,CAAC,cAAc;IAgHtB;;OAEG;IACH,OAAO,CAAC,YAAY;CAkCrB"}
+{"version":3,"file":"mastra-exception.filter.d.ts","sourceRoot":"","sources":["../../src/filters/mastra-exception.filter.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAYrE;;;;;;;;;;;;;GAaG;AACH,qBACa,qBAAsB,YAAW,eAAe;IAC3D,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA0C;IAE3D,KAAK,CAAC,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CA0DlE;IAED;;OAEG;IACH,OAAO,CAAC,cAAc;IAgHtB;;OAEG;IACH,OAAO,CAAC,YAAY;CAkCrB"}

package/dist/index.cjs

@@ -25,6 +25,7 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
 let _nestjs_common = require("@nestjs/common");
 let _mastra_server_server_adapter = require("@mastra/server/server-adapter");
 let _mastra_server_handlers_error = require("@mastra/server/handlers/error");
+let _mastra_core_auth_ee = require("@mastra/core/auth/ee");
 let _mastra_core_request_context = require("@mastra/core/request-context");
 let _mastra_server_auth = require("@mastra/server/auth");
 let stream = require("stream");
@@ -225,6 +226,11 @@ let RouteHandlerService = _RouteHandlerService = class RouteHandlerService {
 			if ((0, _mastra_server_server_adapter.isZodError)(error)) throw this.createValidationError(route, error, "body");
 			throw error;
 		}
+		await this.authorizeRoute(route, params.requestContext, {
+			...validatedPathParams,
+			...validatedQueryParams,
+			...typeof validatedBody === "object" && validatedBody !== null ? validatedBody : {}
+		});
 		const context = {
 			mastra: this.mastra,
 			requestContext: params.requestContext,
@@ -247,6 +253,39 @@ let RouteHandlerService = _RouteHandlerService = class RouteHandlerService {
 			sseFlushOnConnect: route.sseFlushOnConnect
 		};
 	}
+	/**
+	* Enforce the route's RBAC permission and FGA check, matching the other server adapters.
+	* Relies on the auth guard having stored the user, permissions, and auth mode in the request context.
+	*/
+	async authorizeRoute(route, requestContext, params) {
+		await this.enforceRoutePermission(route, requestContext);
+		await this.enforceRouteFGA(route, requestContext, params);
+	}
+	/**
+	* Throws 403 when the user lacks the route's effective RBAC permission.
+	* Skipped when Mastra auth is explicitly disabled (`auth.enabled: false`), since no Mastra user is resolved.
+	*/
+	async enforceRoutePermission(route, requestContext) {
+		if (this.options.auth?.enabled === false) return;
+		const studio = this.mastra.getStudio?.();
+		const server = this.mastra.getServer();
+		if (!studio?.auth && !server?.auth) return;
+		const requiredPermission = (requestContext.get(_mastra_server_server_adapter.MASTRA_AUTH_MODE_KEY) === "studio" ? studio?.rbac ?? server?.rbac : server?.rbac) ? (0, _mastra_server_server_adapter.getEffectivePermission)(route) : null;
+		if (requiredPermission) {
+			const required = Array.isArray(requiredPermission) ? requiredPermission : [requiredPermission];
+			const userPermissions = requestContext.get("mastra__userPermissions");
+			if (!userPermissions || !required.some((permission) => (0, _mastra_core_auth_ee.hasPermission)(userPermissions, permission))) throw new _nestjs_common.ForbiddenException(`Missing required permission: ${required.join(" or ")}`);
+		}
+	}
+	/**
+	* Throws when the FGA provider denies the route's resource.
+	* Skipped when Mastra auth is explicitly disabled (`auth.enabled: false`), since no Mastra user is resolved.
+	*/
+	async enforceRouteFGA(route, requestContext, params) {
+		if (this.options.auth?.enabled === false) return;
+		const fgaError = await (0, _mastra_server_server_adapter.checkRouteFGA)(this.mastra, route, requestContext, params);
+		if (fgaError) throw new _nestjs_common.HttpException(fgaError.message, fgaError.status);
+	}
 	async parseBody(route, body) {
 		const bodySchema = route.bodySchema;
 		if (!bodySchema) return body;
@@ -340,7 +379,8 @@ let MastraExceptionFilter = _MastraExceptionFilter = class MastraExceptionFilter
 			return;
 		}
 		if (exception instanceof _mastra_server_server_adapter.HTTPException) {
-			response.status(exception.status).json({ error: exception.message });
+			const { status, body } = (0, _mastra_server_server_adapter.getHTTPErrorResponse)(exception);
+			response.status(status).json(body);
 			return;
 		}
 		const normalized = this.normalizeError(exception);
@@ -500,7 +540,7 @@ let CustomRouteService = class CustomRouteService {
 	* Runs a matched custom route and writes its response.
 	* Returns false if no custom route handled the request.
 	*
-	* `authenticate` runs after Hono's router selects the route, so auth is enforced
+	* `authenticate` runs after Hono's router selects the route, so auth, RBAC, and FGA are enforced
 	* for exactly the routes Hono dispatches (including regex-constrained params).
 	*/
 	async handle(req, res, requestContext, authenticate) {
@@ -561,6 +601,8 @@ let CustomRouteService = class CustomRouteService {
 		const serverOnError = mastra.getServer()?.onError;
 		app.onError((err, c) => {
 			if (serverOnError) return serverOnError(err, c);
+			const httpExceptionResponse = (0, _mastra_server_server_adapter.getCustomRouteHTTPExceptionResponse)(err);
+			if (httpExceptionResponse) return httpExceptionResponse;
 			mastra.getLogger()?.error(`Custom route handler failed: ${c.req.method} ${c.req.path}`, { error: err instanceof Error ? err.stack ?? err.message : String(err) });
 			return c.json({ error: "Internal Server Error" }, 500);
 		});
@@ -571,7 +613,7 @@ let CustomRouteService = class CustomRouteService {
 			const requiresAuth = this.authConfig.get(`${route.method}:${route.path}`) ?? route.requiresAuth !== false;
 			const authMiddleware = async (c, next) => {
 				try {
-					await c.env.authenticate(requiresAuth);
+					await c.env.authenticate(route, requiresAuth, c.req.param());
 				} catch (err) {
 					c.env.authError = err;
 					return c.body(null, 401);
@@ -638,11 +680,29 @@ let AuthService = class AuthService {
 	}
 	/**
 	* Whether Mastra auth should run: module options enable it, or the Mastra
-	* server has auth configured (unless module options explicitly disable it).
+	* server or Studio has auth configured (unless module options explicitly disable it).
 	*/
 	isEnabled() {
 		if (this.options.auth?.enabled === false) return false;
-		return Boolean(this.options.auth?.enabled || this.mastra.getServer()?.auth);
+		return Boolean(this.options.auth?.enabled || this.mastra.getServer()?.auth || this.mastra.getStudio?.()?.auth);
+	}
+	/**
+	* Studio requests (`x-mastra-client-type: studio`) use `studio.auth` exclusively when it is
+	* configured, without falling back to `server.auth`; all other requests use `server.auth`.
+	*/
+	getEffectiveAuthConfig(request) {
+		const clientType = request.headers[_mastra_server_server_adapter.MASTRA_CLIENT_TYPE_HEADER];
+		const isStudioRequest = (0, _mastra_server_server_adapter.isStudioClientTypeHeader)(Array.isArray(clientType) ? clientType[0] : clientType);
+		const studioAuth = this.mastra.getStudio?.()?.auth;
+		if (isStudioRequest && studioAuth) return {
+			authConfig: studioAuth,
+			authMode: "studio"
+		};
+		const serverAuth = this.mastra.getServer()?.auth;
+		return serverAuth ? {
+			authConfig: serverAuth,
+			authMode: "server"
+		} : null;
 	}
 	/**
 	* Check authentication for a request.
@@ -650,9 +710,11 @@ let AuthService = class AuthService {
 	* Throws UnauthorizedException or ForbiddenException if auth fails.
 	*/
 	async authenticate(request, options = {}) {
-		const authConfig = this.mastra.getServer()?.auth;
-		if (!authConfig) return;
+		const effectiveAuth = this.getEffectiveAuthConfig(request);
+		if (!effectiveAuth) return;
+		const { authConfig, authMode } = effectiveAuth;
 		const requestContext = options.requestContext ?? new _mastra_core_request_context.RequestContext();
+		requestContext.set(_mastra_server_server_adapter.MASTRA_AUTH_MODE_KEY, authMode);
 		const path = request.path;
 		const method = request.method;
 		let customRouteAuthConfig = this.customRoutes.customRouteAuthConfig;
@@ -11030,15 +11092,31 @@ let MastraController = class MastraController {
 		const routePath = getMastraRoutePath(path, this.options.prefix);
 		if (!routePath || !this.routeHandler.matchRoute(method, routePath)) {
 			const requestContext = this.requestContext.requestContext;
-			const authenticate = async (requiresAuth) => {
-				if (!this.authService.isEnabled()) return;
-				const user = await this.authService.authenticate(req, {
-					requestContext,
-					response: res,
+			const authenticate = async (customRoute, requiresAuth, pathParams) => {
+				if (this.authService.isEnabled()) {
+					const user = await this.authService.authenticate(req, {
+						requestContext,
+						response: res,
+						requiresAuth,
+						customRoute: true
+					});
+					if (user !== void 0) this.requestContext.setUser(user);
+				}
+				const serverRoute = {
+					method: customRoute.method,
+					path: customRoute.path,
+					responseType: "json",
+					handler: async () => {},
 					requiresAuth,
-					customRoute: true
+					requiresPermission: customRoute.requiresPermission,
+					fga: customRoute.fga
+				};
+				if (requiresAuth) await this.routeHandler.enforceRoutePermission(serverRoute, requestContext);
+				if (customRoute.fga) await this.routeHandler.enforceRouteFGA(serverRoute, requestContext, {
+					...typeof req.body === "object" && req.body !== null ? req.body : {},
+					...req.query,
+					...pathParams
 				});
-				if (user !== void 0) this.requestContext.setUser(user);
 			};
 			if (await this.customRoutes.handle(req, res, requestContext, authenticate)) return;
 		}
@@ -11359,6 +11437,15 @@ let MastraService = _MastraService = class MastraService {
 		}
 		this.serverAdapter = new NestMastraServer(app, this.routeHandler);
 		this.mastra.setMastraServer(this.serverAdapter);
+		this.warnIfServerMiddlewareConfigured();
+	}
+	/** Mastra server middleware uses Hono's `(c, next)` signature, so NestJS cannot run it. */
+	warnIfServerMiddlewareConfigured() {
+		const instanceMiddleware = this.mastra.getServerMiddleware?.() ?? [];
+		const configMiddleware = this.mastra.getServer()?.middleware;
+		const hasConfigMiddleware = Array.isArray(configMiddleware) ? configMiddleware.length > 0 : !!configMiddleware;
+		if (instanceMiddleware.length === 0 && !hasConfigMiddleware) return;
+		this.mastra.getLogger()?.warn("Mastra server middleware (`server.middleware` or `setServerMiddleware()`) is configured, but this server adapter cannot run Hono middleware handlers. The configured middleware will not run — register middleware through your server framework instead.");
 	}
 	/**
 	* Get the Mastra instance.