@mastra/server 1.25.0-alpha.3 → 1.25.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +30 -0
- package/dist/docs/SKILL.md +1 -1
- package/dist/docs/assets/SOURCE_MAP.json +1 -1
- package/package.json +8 -8
package/CHANGELOG.md
CHANGED
|
@@ -1,5 +1,35 @@
|
|
|
1
1
|
# @mastra/server
|
|
2
2
|
|
|
3
|
+
## 1.25.0
|
|
4
|
+
|
|
5
|
+
### Minor Changes
|
|
6
|
+
|
|
7
|
+
- feat(server): Add `mapUserToResourceId` callback to auth config for automatic resource ID scoping ([#13954](https://github.com/mastra-ai/mastra/pull/13954))
|
|
8
|
+
|
|
9
|
+
Auth configs now accept a `mapUserToResourceId` callback that maps the authenticated user to a resource ID after successful authentication. This enables per-user memory and thread isolation without requiring custom middleware or adapter subclassing.
|
|
10
|
+
|
|
11
|
+
```typescript
|
|
12
|
+
const mastra = new Mastra({
|
|
13
|
+
server: {
|
|
14
|
+
auth: {
|
|
15
|
+
authenticateToken: async token => verifyToken(token),
|
|
16
|
+
mapUserToResourceId: user => user.id,
|
|
17
|
+
},
|
|
18
|
+
},
|
|
19
|
+
});
|
|
20
|
+
```
|
|
21
|
+
|
|
22
|
+
The callback is called in `coreAuthMiddleware` after the user is authenticated and set on the request context. The returned value is set as `MASTRA_RESOURCE_ID_KEY`, which takes precedence over client-provided values for security. Works across all server adapters (Hono, Express, Next.js, etc.).
|
|
23
|
+
|
|
24
|
+
### Patch Changes
|
|
25
|
+
|
|
26
|
+
- fix(server): Strip reserved context keys from client-provided requestContext ([#13954](https://github.com/mastra-ai/mastra/pull/13954))
|
|
27
|
+
|
|
28
|
+
Clients could inject `mastra__resourceId` or `mastra__threadId` via the request body or query params to impersonate other users' memory/thread access. Reserved keys are now filtered out during request context creation in `mergeRequestContext`, so only server-side code (auth callbacks, middleware) can set them.
|
|
29
|
+
|
|
30
|
+
- Updated dependencies [[`87df955`](https://github.com/mastra-ai/mastra/commit/87df955c028660c075873fd5d74af28233ce32eb), [`8fad147`](https://github.com/mastra-ai/mastra/commit/8fad14759804179c8e080ce4d9dec6ef1a808b31), [`582644c`](https://github.com/mastra-ai/mastra/commit/582644c4a87f83b4f245a84d72b9e8590585012e), [`cbdf3e1`](https://github.com/mastra-ai/mastra/commit/cbdf3e12b3d0c30a6e5347be658e2009648c130a), [`8fe46d3`](https://github.com/mastra-ai/mastra/commit/8fe46d354027f3f0f0846e64219772348de106dd), [`18c67db`](https://github.com/mastra-ai/mastra/commit/18c67dbb9c9ebc26f26f65f7d3ff836e5691ef46), [`4ba3bb1`](https://github.com/mastra-ai/mastra/commit/4ba3bb1e465ad2ddaba3bbf2bc47e0faec32985e), [`5d84914`](https://github.com/mastra-ai/mastra/commit/5d84914e0e520c642a40329b210b413fcd139898), [`8dcc77e`](https://github.com/mastra-ai/mastra/commit/8dcc77e78a5340f5848f74b9e9f1b3da3513c1f5), [`aa67fc5`](https://github.com/mastra-ai/mastra/commit/aa67fc59ee8a5eeff1f23eb05970b8d7a536c8ff), [`fd2f314`](https://github.com/mastra-ai/mastra/commit/fd2f31473d3449b6b97e837ef8641264377f41a7), [`fa8140b`](https://github.com/mastra-ai/mastra/commit/fa8140bcd4251d2e3ac85fdc5547dfc4f372b5be), [`190f452`](https://github.com/mastra-ai/mastra/commit/190f45258b0640e2adfc8219fa3258cdc5b8f071), [`e80fead`](https://github.com/mastra-ai/mastra/commit/e80fead1412cc0d1b2f7d6a1ce5017d9e0098ff7), [`0287b64`](https://github.com/mastra-ai/mastra/commit/0287b644a5c3272755cf3112e71338106664103b), [`7e7bf60`](https://github.com/mastra-ai/mastra/commit/7e7bf606886bf374a6f9d4ca9b09dd83d0533372), [`184907d`](https://github.com/mastra-ai/mastra/commit/184907d775d8609c03c26e78ccaf37315f3aa287), [`075e91a`](https://github.com/mastra-ai/mastra/commit/075e91a4549baf46ad7a42a6a8ac8dfa78cc09e6), [`0c4cd13`](https://github.com/mastra-ai/mastra/commit/0c4cd131931c04ac5405373c932a242dbe88edd6), [`b16a753`](https://github.com/mastra-ai/mastra/commit/b16a753d5748440248d7df82e29bb987a9c8386c)]:
|
|
31
|
+
- @mastra/core@1.25.0
|
|
32
|
+
|
|
3
33
|
## 1.25.0-alpha.3
|
|
4
34
|
|
|
5
35
|
### Patch Changes
|
package/dist/docs/SKILL.md
CHANGED
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@mastra/server",
|
|
3
|
-
"version": "1.25.0
|
|
3
|
+
"version": "1.25.0",
|
|
4
4
|
"description": "",
|
|
5
5
|
"type": "module",
|
|
6
6
|
"files": [
|
|
@@ -112,14 +112,14 @@
|
|
|
112
112
|
"typescript": "^5.9.3",
|
|
113
113
|
"vitest": "4.0.18",
|
|
114
114
|
"zod": "^4.3.6",
|
|
115
|
-
"@internal/storage-test-utils": "0.0.78",
|
|
116
|
-
"@internal/test-utils": "0.0.18",
|
|
117
|
-
"@internal/lint": "0.0.82",
|
|
118
|
-
"@mastra/agent-builder": "1.0.26-alpha.1",
|
|
119
|
-
"@internal/types-builder": "0.0.57",
|
|
120
|
-
"@mastra/core": "1.25.0-alpha.3",
|
|
121
115
|
"@internal/core": "0.0.0",
|
|
122
|
-
"@
|
|
116
|
+
"@internal/lint": "0.0.83",
|
|
117
|
+
"@internal/storage-test-utils": "0.0.79",
|
|
118
|
+
"@internal/types-builder": "0.0.58",
|
|
119
|
+
"@internal/test-utils": "0.0.19",
|
|
120
|
+
"@mastra/agent-builder": "1.0.26",
|
|
121
|
+
"@mastra/schema-compat": "1.2.8",
|
|
122
|
+
"@mastra/core": "1.25.0"
|
|
123
123
|
},
|
|
124
124
|
"homepage": "https://mastra.ai",
|
|
125
125
|
"repository": {
|