@mastra/server 1.34.1-alpha.0 → 1.35.0-alpha.1

package/dist/server/server-adapter/index.cjs

@@ -1,11 +1,11 @@
 'use strict';
 
-var chunkXHDRHNLP_cjs = require('../../chunk-XHDRHNLP.cjs');
-var chunkY5LNMKEY_cjs = require('../../chunk-Y5LNMKEY.cjs');
+var chunkWCYJNG2Y_cjs = require('../../chunk-WCYJNG2Y.cjs');
 var chunkLTYRUL3Q_cjs = require('../../chunk-LTYRUL3Q.cjs');
-var chunk5XW4MKE6_cjs = require('../../chunk-5XW4MKE6.cjs');
-var chunkQO4NGLIB_cjs = require('../../chunk-QO4NGLIB.cjs');
 var chunkB34S64RC_cjs = require('../../chunk-B34S64RC.cjs');
+var chunkAZORAK4H_cjs = require('../../chunk-AZORAK4H.cjs');
+var chunkY5LNMKEY_cjs = require('../../chunk-Y5LNMKEY.cjs');
+var chunk5XW4MKE6_cjs = require('../../chunk-5XW4MKE6.cjs');
 var requestContext = require('@mastra/core/request-context');
 var server = require('@mastra/core/server');
 var hono = require('hono');
@@ -103,6 +103,121 @@ function redactStreamChunk(chunk) {
 }
 
 // src/server/server-adapter/index.ts
+function isProtectedFGARoute(route) {
+  return route.requiresAuth !== false;
+}
+function formatRoute(route) {
+  return `${route.method} ${route.path}`;
+}
+function getFGAProvider(mastra) {
+  return mastra?.getServer?.()?.fga;
+}
+function getFGARouteInfo(route) {
+  return {
+    path: route.path,
+    method: route.method,
+    requiresAuth: route.requiresAuth,
+    requiresPermission: route.requiresPermission,
+    fga: route.fga
+  };
+}
+function getRoutePermissions(route) {
+  return [chunkWCYJNG2Y_cjs.getEffectivePermission(route), route.fga?.permission].filter(
+    (permission) => Boolean(permission)
+  );
+}
+function getToolRoutePermission(path) {
+  return path.includes("/execute") ? "tools:execute" : "tools:read";
+}
+function getBuiltInRouteFGAConfig(route) {
+  if (!isProtectedFGARoute(route) || !route.path || !route.method) {
+    return null;
+  }
+  const permission = chunkWCYJNG2Y_cjs.getEffectivePermission(route);
+  if (!permission) {
+    return null;
+  }
+  const path = route.path;
+  if (path.startsWith("/agents/:agentId/tools/:toolId")) {
+    return {
+      resourceType: "tool",
+      resourceId: ({ agentId, toolId }) => `${String(agentId)}:${String(toolId)}`,
+      permission: getToolRoutePermission(path)
+    };
+  }
+  if (path.startsWith("/agents/:agentId")) {
+    return { resourceType: "agent", resourceIdParam: "agentId", permission };
+  }
+  if (path.startsWith("/workflows/:workflowId")) {
+    return { resourceType: "workflow", resourceIdParam: "workflowId", permission };
+  }
+  if (path.startsWith("/tools/:toolId")) {
+    return { resourceType: "tool", resourceIdParam: "toolId", permission };
+  }
+  if (path.startsWith("/mcp/:serverId/tools/:toolId")) {
+    return {
+      resourceType: "tool",
+      resourceId: ({ serverId, toolId }) => JSON.stringify([String(serverId), String(toolId)]),
+      permission: getToolRoutePermission(path)
+    };
+  }
+  if (path.startsWith("/mcp/:serverId")) {
+    return { resourceType: "mcp", resourceIdParam: "serverId", permission };
+  }
+  if (path.startsWith("/memory/threads/:threadId") || path.startsWith("/memory/network/threads/:threadId")) {
+    return { resourceType: "thread", resourceIdParam: "threadId", permission };
+  }
+  if (path === "/memory/threads" || path === "/memory/network/threads") {
+    return {
+      resourceType: "thread",
+      resourceId: ({ threadId, resourceId }) => {
+        if (typeof threadId === "string") return threadId;
+        return typeof resourceId === "string" ? resourceId : void 0;
+      },
+      permission
+    };
+  }
+  if (path === "/memory/save-messages" || path === "/memory/network/save-messages") {
+    return {
+      resourceType: "thread",
+      resourceId: ({ messages }) => {
+        if (!Array.isArray(messages)) return void 0;
+        const threadId = messages.find(
+          (message) => message && typeof message === "object" && "threadId" in message
+        )?.threadId;
+        return typeof threadId === "string" ? threadId : void 0;
+      },
+      permission
+    };
+  }
+  if (path === "/v1/responses") {
+    return { resourceType: "agent", resourceIdParam: "agent_id", permission };
+  }
+  if (path.startsWith("/v1/responses/:responseId")) {
+    return { resourceType: "response", resourceIdParam: "responseId", permission };
+  }
+  if (path === "/v1/conversations") {
+    return { resourceType: "agent", resourceIdParam: "agent_id", permission };
+  }
+  if (path.startsWith("/v1/conversations/:conversationId")) {
+    return { resourceType: "conversation", resourceIdParam: "conversationId", permission };
+  }
+  return null;
+}
+async function resolveRouteFGAConfig(fgaProvider, route, requestContext, params) {
+  if (route.fga) {
+    return route.fga;
+  }
+  const resolvedConfig = await fgaProvider.resolveRouteFGA?.({
+    route: getFGARouteInfo(route),
+    params,
+    requestContext
+  });
+  if (resolvedConfig) {
+    return resolvedConfig;
+  }
+  return getBuiltInRouteFGAConfig(route);
+}
 function getSchemaTypeName(schema) {
   const schemaDef = schema?._def ?? schema?.def;
   return schemaDef?.typeName ?? schemaDef?.type;
@@ -338,7 +453,7 @@ var MastraServer = class _MastraServer extends server.MastraServerBase {
     if (!rbacProvider) {
       return null;
     }
-    const requiredPermission = chunkXHDRHNLP_cjs.getEffectivePermission(route);
+    const requiredPermission = chunkWCYJNG2Y_cjs.getEffectivePermission(route);
     if (!requiredPermission) {
       return null;
     }
@@ -356,6 +471,7 @@ var MastraServer = class _MastraServer extends server.MastraServerBase {
     this.registerAuthMiddleware();
     this.registerHttpLoggingMiddleware();
     await this.validateEELicense();
+    await this.validateFGAPolicyCoverage();
     await this.registerCustomApiRoutes();
     await this.registerRoutes();
   }
@@ -390,6 +506,38 @@ Ensure @mastra/core is updated to a version that includes EE support.`
       );
     }
   }
+  /**
+   * Validate route-level FGA policy coverage when an FGA provider opts into
+   * startup checks.
+   */
+  async validateFGAPolicyCoverage() {
+    const serverConfig = this.mastra.getServer();
+    const fgaProvider = serverConfig?.fga;
+    if (!fgaProvider) return;
+    const customRoutes = (this.customApiRoutes ?? serverConfig?.apiRoutes ?? []).filter(
+      (route) => !route._mastraInternal
+    );
+    const routes = [...chunkWCYJNG2Y_cjs.SERVER_ROUTES, ...customRoutes];
+    if (fgaProvider.validatePermissions) {
+      const permissions = [...new Set(routes.flatMap((route) => getRoutePermissions(route)))];
+      await fgaProvider.validatePermissions(permissions);
+    }
+    const auditMode = fgaProvider.auditProtectedRoutes ?? (fgaProvider.requireForProtectedRoutes ? "warn" : false);
+    if (!auditMode || fgaProvider.resolveRouteFGA) return;
+    const missingRoutes = routes.filter(
+      (route) => isProtectedFGARoute(route) && !route.fga && !getBuiltInRouteFGAConfig(route)
+    );
+    if (missingRoutes.length === 0) return;
+    const routeList = missingRoutes.map((route) => formatRoute(route));
+    const message = `[mastra/auth-ee] FGA is configured but ${missingRoutes.length} protected route${missingRoutes.length === 1 ? " is" : "s are"} missing FGA metadata: ${routeList.join(", ")}`;
+    if (auditMode === "error") {
+      throw new Error(message);
+    }
+    this.mastra.getLogger()?.warn(message, {
+      routes: routeList,
+      count: missingRoutes.length
+    });
+  }
   /**
    * Override in adapters to register custom API routes defined via registerApiRoute().
    * Called by init() between registerAuthMiddleware() and registerRoutes().
@@ -524,13 +672,13 @@ Ensure @mastra/core is updated to a version that includes EE support.`
    * Builds the OpenAPI spec object with servers field and custom route paths.
    */
   buildOpenAPISpec(config, prefix) {
-    const openApiSpec = chunkQO4NGLIB_cjs.generateOpenAPIDocument(chunkXHDRHNLP_cjs.SERVER_ROUTES, config);
+    const openApiSpec = chunkAZORAK4H_cjs.generateOpenAPIDocument(chunkWCYJNG2Y_cjs.SERVER_ROUTES, config);
     if (prefix) {
       openApiSpec.servers = [{ url: prefix }];
     }
     const allCustomRoutes = this.customApiRoutes ?? this.mastra.getServer()?.apiRoutes;
     if (allCustomRoutes && allCustomRoutes.length > 0) {
-      const customPaths = chunkQO4NGLIB_cjs.convertCustomRoutesToOpenAPIPaths(allCustomRoutes);
+      const customPaths = chunkAZORAK4H_cjs.convertCustomRoutesToOpenAPIPaths(allCustomRoutes);
       if (prefix) {
         for (const pathKey of Object.keys(customPaths)) {
           if (!customPaths[pathKey].servers) {
@@ -559,7 +707,7 @@ Ensure @mastra/core is updated to a version that includes EE support.`
     await this.registerRoute(app, openApiRoute, { prefix });
   }
   async registerRoutes() {
-    for (const route of chunkXHDRHNLP_cjs.SERVER_ROUTES) {
+    for (const route of chunkWCYJNG2Y_cjs.SERVER_ROUTES) {
       await this.registerRoute(this.app, route, { prefix: this.prefix });
     }
     if (this.openapiPath) {
@@ -619,10 +767,19 @@ Ensure @mastra/core is updated to a version that includes EE support.`
   }
 };
 async function checkRouteFGA(mastra, route, requestContext, params) {
-  const fgaConfig = route.fga;
-  if (!fgaConfig) return null;
-  const fgaProvider = mastra?.getServer?.()?.fga;
+  const fgaProvider = getFGAProvider(mastra);
   if (!fgaProvider) return null;
+  const fgaConfig = await resolveRouteFGAConfig(fgaProvider, route, requestContext, params);
+  if (!fgaConfig) {
+    if (fgaProvider.requireForProtectedRoutes && isProtectedFGARoute(route)) {
+      return {
+        status: 403,
+        error: "Forbidden",
+        message: "FGA authorization denied: route FGA metadata is required"
+      };
+    }
+    return null;
+  }
   const user = requestContext?.get("user");
   if (!user) {
     return {
@@ -639,7 +796,7 @@ async function checkRouteFGA(mastra, route, requestContext, params) {
       message: "FGA authorization denied: route FGA metadata is incomplete"
     };
   }
-  const permission = fgaConfig.permission || (route.path ? chunkXHDRHNLP_cjs.getEffectivePermission(route) : null) || `${getFGAResourcePermissionSlug(fgaConfig.resourceType)}:${deriveFGAAction(route.method)}`;
+  const permission = fgaConfig.permission || (route.path ? chunkWCYJNG2Y_cjs.getEffectivePermission(route) : null) || `${getFGAResourcePermissionSlug(fgaConfig.resourceType)}:${deriveFGAAction(route.method)}`;
   const authorized = await fgaProvider.check(user, {
     resource: { type: fgaConfig.resourceType, id: resourceId },
     permission,
@@ -680,23 +837,23 @@ function getFGAResourcePermissionSlug(resourceType) {
 
 Object.defineProperty(exports, "SERVER_ROUTES", {
   enumerable: true,
-  get: function () { return chunkXHDRHNLP_cjs.SERVER_ROUTES; }
+  get: function () { return chunkWCYJNG2Y_cjs.SERVER_ROUTES; }
 });
 Object.defineProperty(exports, "deriveAction", {
   enumerable: true,
-  get: function () { return chunkXHDRHNLP_cjs.deriveAction; }
+  get: function () { return chunkWCYJNG2Y_cjs.deriveAction; }
 });
 Object.defineProperty(exports, "derivePermission", {
   enumerable: true,
-  get: function () { return chunkXHDRHNLP_cjs.derivePermission; }
+  get: function () { return chunkWCYJNG2Y_cjs.derivePermission; }
 });
 Object.defineProperty(exports, "extractResource", {
   enumerable: true,
-  get: function () { return chunkXHDRHNLP_cjs.extractResource; }
+  get: function () { return chunkWCYJNG2Y_cjs.extractResource; }
 });
 Object.defineProperty(exports, "getEffectivePermission", {
   enumerable: true,
-  get: function () { return chunkXHDRHNLP_cjs.getEffectivePermission; }
+  get: function () { return chunkWCYJNG2Y_cjs.getEffectivePermission; }
 });
 Object.defineProperty(exports, "WorkflowRegistry", {
   enumerable: true,
@@ -706,49 +863,49 @@ Object.defineProperty(exports, "normalizeRoutePath", {
   enumerable: true,
   get: function () { return chunkLTYRUL3Q_cjs.normalizeRoutePath; }
 });
-Object.defineProperty(exports, "MASTRA_CLIENT_TYPE_HEADER", {
+Object.defineProperty(exports, "createPublicRoute", {
   enumerable: true,
-  get: function () { return chunk5XW4MKE6_cjs.MASTRA_CLIENT_TYPE_HEADER; }
+  get: function () { return chunkAZORAK4H_cjs.createPublicRoute; }
 });
-Object.defineProperty(exports, "MASTRA_IS_STUDIO_KEY", {
+Object.defineProperty(exports, "createRoute", {
   enumerable: true,
-  get: function () { return chunk5XW4MKE6_cjs.MASTRA_IS_STUDIO_KEY; }
+  get: function () { return chunkAZORAK4H_cjs.createRoute; }
 });
-Object.defineProperty(exports, "MASTRA_STUDIO_CLIENT_TYPE", {
+Object.defineProperty(exports, "generateOpenAPIDocument", {
   enumerable: true,
-  get: function () { return chunk5XW4MKE6_cjs.MASTRA_STUDIO_CLIENT_TYPE; }
+  get: function () { return chunkAZORAK4H_cjs.generateOpenAPIDocument; }
 });
-Object.defineProperty(exports, "isReservedRequestContextKey", {
+Object.defineProperty(exports, "jsonQueryParam", {
   enumerable: true,
-  get: function () { return chunk5XW4MKE6_cjs.isReservedRequestContextKey; }
+  get: function () { return chunkAZORAK4H_cjs.jsonQueryParam; }
 });
-Object.defineProperty(exports, "isStudioClientTypeHeader", {
+Object.defineProperty(exports, "pickParams", {
   enumerable: true,
-  get: function () { return chunk5XW4MKE6_cjs.isStudioClientTypeHeader; }
+  get: function () { return chunkAZORAK4H_cjs.pickParams; }
 });
-Object.defineProperty(exports, "createPublicRoute", {
+Object.defineProperty(exports, "wrapSchemaForQueryParams", {
   enumerable: true,
-  get: function () { return chunkQO4NGLIB_cjs.createPublicRoute; }
+  get: function () { return chunkAZORAK4H_cjs.wrapSchemaForQueryParams; }
 });
-Object.defineProperty(exports, "createRoute", {
+Object.defineProperty(exports, "MASTRA_CLIENT_TYPE_HEADER", {
   enumerable: true,
-  get: function () { return chunkQO4NGLIB_cjs.createRoute; }
+  get: function () { return chunk5XW4MKE6_cjs.MASTRA_CLIENT_TYPE_HEADER; }
 });
-Object.defineProperty(exports, "generateOpenAPIDocument", {
+Object.defineProperty(exports, "MASTRA_IS_STUDIO_KEY", {
   enumerable: true,
-  get: function () { return chunkQO4NGLIB_cjs.generateOpenAPIDocument; }
+  get: function () { return chunk5XW4MKE6_cjs.MASTRA_IS_STUDIO_KEY; }
 });
-Object.defineProperty(exports, "jsonQueryParam", {
+Object.defineProperty(exports, "MASTRA_STUDIO_CLIENT_TYPE", {
   enumerable: true,
-  get: function () { return chunkQO4NGLIB_cjs.jsonQueryParam; }
+  get: function () { return chunk5XW4MKE6_cjs.MASTRA_STUDIO_CLIENT_TYPE; }
 });
-Object.defineProperty(exports, "pickParams", {
+Object.defineProperty(exports, "isReservedRequestContextKey", {
   enumerable: true,
-  get: function () { return chunkQO4NGLIB_cjs.pickParams; }
+  get: function () { return chunk5XW4MKE6_cjs.isReservedRequestContextKey; }
 });
-Object.defineProperty(exports, "wrapSchemaForQueryParams", {
+Object.defineProperty(exports, "isStudioClientTypeHeader", {
   enumerable: true,
-  get: function () { return chunkQO4NGLIB_cjs.wrapSchemaForQueryParams; }
+  get: function () { return chunk5XW4MKE6_cjs.isStudioClientTypeHeader; }
 });
 exports.MastraServer = MastraServer;
 exports.checkRouteFGA = checkRouteFGA;