@mastra/server 1.36.0-alpha.1 → 1.36.0-alpha.2

package/dist/server/server-adapter/index.js

@@ -1,18 +1,143 @@
-import { getEffectivePermission, SERVER_ROUTES } from '../../chunk-XZT7USLH.js';
-export { SERVER_ROUTES, deriveAction, derivePermission, extractResource, getEffectivePermission } from '../../chunk-XZT7USLH.js';
-import { coreAuthMiddleware } from '../../chunk-M7DF3D2M.js';
-import { normalizeRoutePath } from '../../chunk-YHRGDSTK.js';
-export { WorkflowRegistry, normalizeRoutePath } from '../../chunk-YHRGDSTK.js';
-import { generateOpenAPIDocument, convertCustomRoutesToOpenAPIPaths } from '../../chunk-E53AJNZB.js';
-export { createPublicRoute, createRoute, generateOpenAPIDocument, jsonQueryParam, pickParams, wrapSchemaForQueryParams } from '../../chunk-E53AJNZB.js';
-import { formatZodError } from '../../chunk-P23KBWKB.js';
-import { isReservedRequestContextKey, isStudioClientTypeHeader, MASTRA_CLIENT_TYPE_HEADER, MASTRA_IS_STUDIO_KEY } from '../../chunk-YARY4I5U.js';
-export { MASTRA_CLIENT_TYPE_HEADER, MASTRA_IS_STUDIO_KEY, MASTRA_STUDIO_CLIENT_TYPE, isReservedRequestContextKey, isStudioClientTypeHeader } from '../../chunk-YARY4I5U.js';
+import { getEffectivePermission, SERVER_ROUTES } from '../../chunk-EX3XD2F5.js';
+export { SERVER_ROUTES, deriveAction, derivePermission, extractResource, getEffectivePermission } from '../../chunk-EX3XD2F5.js';
+import { coreAuthMiddleware } from '../../chunk-OJNVSXOF.js';
+import { normalizeRoutePath } from '../../chunk-4XSWMZTL.js';
+export { WorkflowRegistry, normalizeRoutePath } from '../../chunk-4XSWMZTL.js';
+import { formatZodError } from '../../chunk-GA4BG5JK.js';
+import { generateOpenAPIDocument, convertCustomRoutesToOpenAPIPaths } from '../../chunk-F2FAL5CZ.js';
+export { createPublicRoute, createRoute, generateOpenAPIDocument, jsonQueryParam, pickParams, wrapSchemaForQueryParams } from '../../chunk-F2FAL5CZ.js';
+import { isReservedRequestContextKey, isStudioClientTypeHeader, MASTRA_CLIENT_TYPE_HEADER, MASTRA_IS_STUDIO_KEY, MASTRA_RESOURCE_ID_KEY } from '../../chunk-23S37FLK.js';
+export { MASTRA_CLIENT_TYPE_HEADER, MASTRA_IS_STUDIO_KEY, MASTRA_STUDIO_CLIENT_TYPE, isReservedRequestContextKey, isStudioClientTypeHeader } from '../../chunk-23S37FLK.js';
 import { RequestContext } from '@mastra/core/request-context';
 import { MastraServerBase } from '@mastra/core/server';
 import { Hono } from 'hono';
 import { z } from 'zod/v4';
 
+// src/server/server-adapter/routes/fga-manifest.ts
+function isProtectedFGARoute(route) {
+  return route.requiresAuth !== false;
+}
+function getToolRoutePermission(path) {
+  return path.includes("/execute") ? "tools:execute" : "tools:read";
+}
+function getAgentToolResourceId(agentId, toolId) {
+  return `${agentId}:${toolId}`;
+}
+function getMCPToolResourceId(serverId, toolId) {
+  return JSON.stringify([serverId, toolId]);
+}
+var STORED_ROUTE_FGA = {
+  agents: { resourceType: "stored-agents", idParams: ["storedAgentId", "agentId"] },
+  "mcp-clients": { resourceType: "stored-mcp-clients", idParams: ["storedMCPClientId", "mcpClientId"] },
+  "prompt-blocks": { resourceType: "stored-prompt-blocks", idParams: ["storedPromptBlockId", "promptBlockId"] },
+  scorers: { resourceType: "stored-scorers", idParams: ["storedScorerId", "scorerId"] },
+  skills: { resourceType: "stored-skills", idParams: ["storedSkillId"] },
+  workspaces: { resourceType: "stored-workspaces", idParams: ["storedWorkspaceId"] }
+};
+function getStoredResourceRouteFGAConfig(path, permission) {
+  const match = path.match(/^\/stored\/([^/]+)/);
+  if (!match?.[1]) {
+    return null;
+  }
+  const config = STORED_ROUTE_FGA[match[1]];
+  if (!config) {
+    return null;
+  }
+  return {
+    resourceType: config.resourceType,
+    resourceId: (params, { requestContext }) => {
+      for (const idParam of config.idParams) {
+        const id = params[idParam];
+        if (typeof id === "string" && id) {
+          return id;
+        }
+      }
+      const scopedResourceId = requestContext?.get(MASTRA_RESOURCE_ID_KEY);
+      return typeof scopedResourceId === "string" && scopedResourceId ? scopedResourceId : config.resourceType;
+    },
+    permission
+  };
+}
+function getBuiltInRouteFGAConfig(route) {
+  if (!isProtectedFGARoute(route) || !route.path || !route.method) {
+    return null;
+  }
+  const permission = getEffectivePermission(route);
+  if (!permission) {
+    return null;
+  }
+  const path = route.path;
+  const storedRouteConfig = getStoredResourceRouteFGAConfig(path, permission);
+  if (storedRouteConfig) {
+    return storedRouteConfig;
+  }
+  if (path.startsWith("/agents/:agentId/tools/:toolId")) {
+    return {
+      resourceType: "tool",
+      resourceId: ({ agentId, toolId }) => getAgentToolResourceId(String(agentId), String(toolId)),
+      permission: getToolRoutePermission(path)
+    };
+  }
+  if (path.startsWith("/agents/:agentId")) {
+    return { resourceType: "agent", resourceIdParam: "agentId", permission };
+  }
+  if (path.startsWith("/workflows/:workflowId")) {
+    return { resourceType: "workflow", resourceIdParam: "workflowId", permission };
+  }
+  if (path.startsWith("/tools/:toolId")) {
+    return { resourceType: "tool", resourceIdParam: "toolId", permission };
+  }
+  if (path.startsWith("/mcp/:serverId/tools/:toolId")) {
+    return {
+      resourceType: "tool",
+      resourceId: ({ serverId, toolId }) => getMCPToolResourceId(String(serverId), String(toolId)),
+      permission: getToolRoutePermission(path)
+    };
+  }
+  if (path.startsWith("/mcp/:serverId")) {
+    return { resourceType: "mcp", resourceIdParam: "serverId", permission };
+  }
+  if (path.startsWith("/memory/threads/:threadId") || path.startsWith("/memory/network/threads/:threadId")) {
+    return { resourceType: "thread", resourceIdParam: "threadId", permission };
+  }
+  if (path === "/memory/threads" || path === "/memory/network/threads") {
+    return {
+      resourceType: "thread",
+      resourceId: ({ threadId, resourceId }) => {
+        if (typeof threadId === "string") return threadId;
+        return typeof resourceId === "string" ? resourceId : void 0;
+      },
+      permission
+    };
+  }
+  if (path === "/memory/save-messages" || path === "/memory/network/save-messages") {
+    return {
+      resourceType: "thread",
+      resourceId: ({ messages }) => {
+        if (!Array.isArray(messages)) return void 0;
+        const threadId = messages.find(
+          (message) => message && typeof message === "object" && "threadId" in message
+        )?.threadId;
+        return typeof threadId === "string" ? threadId : void 0;
+      },
+      permission
+    };
+  }
+  if (path === "/v1/responses") {
+    return { resourceType: "agent", resourceIdParam: "agent_id", permission };
+  }
+  if (path.startsWith("/v1/responses/:responseId")) {
+    return { resourceType: "response", resourceIdParam: "responseId", permission };
+  }
+  if (path === "/v1/conversations") {
+    return { resourceType: "agent", resourceIdParam: "agent_id", permission };
+  }
+  if (path.startsWith("/v1/conversations/:conversationId")) {
+    return { resourceType: "conversation", resourceIdParam: "conversationId", permission };
+  }
+  return null;
+}
+
 // src/server/server-adapter/redact.ts
 function redactV2Payload(payload) {
   const redactedPayload = { ...payload };
@@ -105,7 +230,7 @@ function redactStreamChunk(chunk) {
 }
 
 // src/server/server-adapter/index.ts
-function isProtectedFGARoute(route) {
+function isProtectedFGARoute2(route) {
   return route.requiresAuth !== false;
 }
 function formatRoute(route) {
@@ -124,87 +249,7 @@ function getFGARouteInfo(route) {
   };
 }
 function getRoutePermissions(route) {
-  return [getEffectivePermission(route), route.fga?.permission].filter(
-    (permission) => Boolean(permission)
-  );
-}
-function getToolRoutePermission(path) {
-  return path.includes("/execute") ? "tools:execute" : "tools:read";
-}
-function getBuiltInRouteFGAConfig(route) {
-  if (!isProtectedFGARoute(route) || !route.path || !route.method) {
-    return null;
-  }
-  const permission = getEffectivePermission(route);
-  if (!permission) {
-    return null;
-  }
-  const path = route.path;
-  if (path.startsWith("/agents/:agentId/tools/:toolId")) {
-    return {
-      resourceType: "tool",
-      resourceId: ({ agentId, toolId }) => `${String(agentId)}:${String(toolId)}`,
-      permission: getToolRoutePermission(path)
-    };
-  }
-  if (path.startsWith("/agents/:agentId")) {
-    return { resourceType: "agent", resourceIdParam: "agentId", permission };
-  }
-  if (path.startsWith("/workflows/:workflowId")) {
-    return { resourceType: "workflow", resourceIdParam: "workflowId", permission };
-  }
-  if (path.startsWith("/tools/:toolId")) {
-    return { resourceType: "tool", resourceIdParam: "toolId", permission };
-  }
-  if (path.startsWith("/mcp/:serverId/tools/:toolId")) {
-    return {
-      resourceType: "tool",
-      resourceId: ({ serverId, toolId }) => JSON.stringify([String(serverId), String(toolId)]),
-      permission: getToolRoutePermission(path)
-    };
-  }
-  if (path.startsWith("/mcp/:serverId")) {
-    return { resourceType: "mcp", resourceIdParam: "serverId", permission };
-  }
-  if (path.startsWith("/memory/threads/:threadId") || path.startsWith("/memory/network/threads/:threadId")) {
-    return { resourceType: "thread", resourceIdParam: "threadId", permission };
-  }
-  if (path === "/memory/threads" || path === "/memory/network/threads") {
-    return {
-      resourceType: "thread",
-      resourceId: ({ threadId, resourceId }) => {
-        if (typeof threadId === "string") return threadId;
-        return typeof resourceId === "string" ? resourceId : void 0;
-      },
-      permission
-    };
-  }
-  if (path === "/memory/save-messages" || path === "/memory/network/save-messages") {
-    return {
-      resourceType: "thread",
-      resourceId: ({ messages }) => {
-        if (!Array.isArray(messages)) return void 0;
-        const threadId = messages.find(
-          (message) => message && typeof message === "object" && "threadId" in message
-        )?.threadId;
-        return typeof threadId === "string" ? threadId : void 0;
-      },
-      permission
-    };
-  }
-  if (path === "/v1/responses") {
-    return { resourceType: "agent", resourceIdParam: "agent_id", permission };
-  }
-  if (path.startsWith("/v1/responses/:responseId")) {
-    return { resourceType: "response", resourceIdParam: "responseId", permission };
-  }
-  if (path === "/v1/conversations") {
-    return { resourceType: "agent", resourceIdParam: "agent_id", permission };
-  }
-  if (path.startsWith("/v1/conversations/:conversationId")) {
-    return { resourceType: "conversation", resourceIdParam: "conversationId", permission };
-  }
-  return null;
+  return [getEffectivePermission(route), route.fga?.permission].flatMap((value) => Array.isArray(value) ? value : [value]).filter((permission) => Boolean(permission));
 }
 async function resolveRouteFGAConfig(fgaProvider, route, requestContext, params) {
   if (route.fga) {
@@ -427,7 +472,8 @@ var MastraServer = class _MastraServer extends MastraServerBase {
       requestContext: context.requestContext,
       rawRequest: context.request,
       token,
-      buildAuthorizeContext: context.buildAuthorizeContext ?? (() => null)
+      buildAuthorizeContext: context.buildAuthorizeContext ?? (() => null),
+      requiresAuth: route.requiresAuth
     });
     if (result.action === "next") {
       if (result.headers) {
@@ -446,6 +492,9 @@ var MastraServer = class _MastraServer extends MastraServerBase {
    * 2. Otherwise, derive permission from path/method (e.g., GET /agents → agents:read)
    * 3. Routes with `requiresAuth: false` skip permission checks
    *
+   * When the route specifies an array of permissions, the user needs ANY ONE
+   * of them (logical OR).
+   *
    * @param route - The route being accessed
    * @param userPermissions - The user's permissions from the request context
    * @returns Error response if permission denied, null if allowed
@@ -459,11 +508,13 @@ var MastraServer = class _MastraServer extends MastraServerBase {
     if (!requiredPermission) {
       return null;
     }
-    if (!userPermissions || !hasPermissionFn(userPermissions, requiredPermission)) {
+    const permissions = Array.isArray(requiredPermission) ? requiredPermission : [requiredPermission];
+    const hasAny = userPermissions && permissions.some((perm) => hasPermissionFn(userPermissions, perm));
+    if (!hasAny) {
       return {
         status: 403,
         error: "Forbidden",
-        message: `Missing required permission: ${requiredPermission}`
+        message: `Missing required permission: ${permissions.join(" or ")}`
       };
     }
     return null;
@@ -473,6 +524,7 @@ var MastraServer = class _MastraServer extends MastraServerBase {
     this.registerAuthMiddleware();
     this.registerHttpLoggingMiddleware();
     await this.validateEELicense();
+    await this.validateAgentBuilderLicense();
     await this.validateFGAPolicyCoverage();
     await this.registerCustomApiRoutes();
     await this.registerRoutes();
@@ -508,6 +560,29 @@ Ensure @mastra/core is updated to a version that includes EE support.`
       );
     }
   }
+  /**
+   * Validate that an Agent Builder configuration has a valid EE license.
+   * Throws if the editor is configured with builder support but no valid EE license is available.
+   */
+  async validateAgentBuilderLicense() {
+    const editor = this.mastra.getEditor();
+    if (!editor?.hasEnabledBuilderConfig?.()) return;
+    try {
+      const { isEEEnabled } = await import('@mastra/core/auth/ee');
+      if (!isEEEnabled()) {
+        throw new Error(
+          "[mastra/auth-ee] Agent Builder is configured but no valid EE license was found.\nAgent Builder requires a Mastra Enterprise License for production use.\nSet the MASTRA_EE_LICENSE environment variable with your license key.\nLearn more: https://github.com/mastra-ai/mastra/blob/main/ee/LICENSE"
+        );
+      }
+    } catch (err) {
+      if (err instanceof Error && err.message.startsWith("[mastra/auth-ee]")) {
+        throw err;
+      }
+      throw new Error(
+        "[mastra/auth-ee] Agent Builder is configured but the EE module (@mastra/core/auth/ee) could not be loaded.\nEnsure @mastra/core is updated to a version that includes EE support."
+      );
+    }
+  }
   /**
    * Validate route-level FGA policy coverage when an FGA provider opts into
    * startup checks.
@@ -527,7 +602,7 @@ Ensure @mastra/core is updated to a version that includes EE support.`
     const auditMode = fgaProvider.auditProtectedRoutes ?? (fgaProvider.requireForProtectedRoutes ? "warn" : false);
     if (!auditMode || fgaProvider.resolveRouteFGA) return;
     const missingRoutes = routes.filter(
-      (route) => isProtectedFGARoute(route) && !route.fga && !getBuiltInRouteFGAConfig(route)
+      (route) => isProtectedFGARoute2(route) && !route.fga && !getBuiltInRouteFGAConfig(route)
     );
     if (missingRoutes.length === 0) return;
     const routeList = missingRoutes.map((route) => formatRoute(route));
@@ -773,7 +848,7 @@ async function checkRouteFGA(mastra, route, requestContext, params) {
   if (!fgaProvider) return null;
   const fgaConfig = await resolveRouteFGAConfig(fgaProvider, route, requestContext, params);
   if (!fgaConfig) {
-    if (fgaProvider.requireForProtectedRoutes && isProtectedFGARoute(route)) {
+    if (fgaProvider.requireForProtectedRoutes && isProtectedFGARoute2(route)) {
       return {
         status: 403,
         error: "Forbidden",
@@ -798,7 +873,8 @@ async function checkRouteFGA(mastra, route, requestContext, params) {
       message: "FGA authorization denied: route FGA metadata is incomplete"
     };
   }
-  const permission = fgaConfig.permission || (route.path ? getEffectivePermission(route) : null) || `${getFGAResourcePermissionSlug(fgaConfig.resourceType)}:${deriveFGAAction(route.method)}`;
+  const effectivePermission = route.path ? getEffectivePermission(route) : null;
+  const permission = fgaConfig.permission || effectivePermission || `${getFGAResourcePermissionSlug(fgaConfig.resourceType)}:${deriveFGAAction(route.method)}`;
   const authorized = await fgaProvider.check(user, {
     resource: { type: fgaConfig.resourceType, id: resourceId },
     permission,