@mastra/server 1.78.0-alpha.4 → 1.78.0-alpha.6

package/dist/server/handlers/workflows.cjs

@@ -3,11 +3,11 @@ const require_rolldown_runtime = require("../../rolldown-runtime-Bd6kNlEP.cjs");
 const require_http_exception = require("../../http-exception-CKDHupKw.cjs");
 const require_common = require("../../common-DhKNoXGp.cjs");
 const require_workflows = require("../../workflows-C8rDpHyY.cjs");
-const require_agents = require("../../agents-CKSEPpk1.cjs");
+const require_agents = require("../../agents-D9vpLghy.cjs");
 const require_route_builder = require("../../route-builder-2yrD15TL.cjs");
 const require_utils = require("../../utils-CJxnYdr3.cjs");
 const require_server_handlers_error = require("./error.cjs");
-const require_utils$1 = require("../../utils-BF2Kbju4.cjs");
+const require_utils$1 = require("../../utils-DdGLbkOl.cjs");
 let zod_v4 = require("zod/v4");
 let _mastra_core_stream = require("@mastra/core/stream");
 //#region src/server/handlers/workflows.ts
@@ -339,7 +339,7 @@ const GET_WORKFLOW_RUN_BY_ID_ROUTE = require_route_builder.createRoute({
 				fields: fieldList
 			});
 			if (!run) throw new require_http_exception.HTTPException(404, { message: "Workflow run not found" });
-			await require_utils$1.validateRunOwnership(run, effectiveResourceId);
+			await require_utils$1.validateRunOwnership(run, effectiveResourceId, mastra);
 			return run;
 		} catch (error) {
 			return require_server_handlers_error.handleError(error, "Error getting workflow run");
@@ -368,7 +368,7 @@ const DELETE_WORKFLOW_RUN_BY_ID_ROUTE = require_route_builder.createRoute({
 			if (!workflow) throw new require_http_exception.HTTPException(404, { message: "Workflow not found" });
 			const run = await workflow.getWorkflowRunById(runId);
 			if (!run) throw new require_http_exception.HTTPException(404, { message: "Workflow run not found" });
-			await require_utils$1.validateRunOwnership(run, effectiveResourceId);
+			await require_utils$1.validateRunOwnership(run, effectiveResourceId, mastra);
 			await workflow.deleteWorkflowRunById(runId);
 			return { message: "Workflow run deleted" };
 		} catch (error) {
@@ -398,6 +398,7 @@ const CREATE_WORKFLOW_RUN_ROUTE = require_route_builder.createRoute({
 				workflowId
 			});
 			if (!workflow) throw new require_http_exception.HTTPException(404, { message: "Workflow not found" });
+			if (runId) await require_utils$1.validateRunOwnership(await workflow.getWorkflowRunById(runId, { withNestedWorkflows: false }), require_utils$1.getEffectiveResourceId(requestContext, void 0), mastra);
 			return { runId: (await workflow.createRun({
 				runId,
 				resourceId: effectiveResourceId,
@@ -430,6 +431,7 @@ const STREAM_WORKFLOW_ROUTE = require_route_builder.createRoute({
 			});
 			if (!workflow) throw new require_http_exception.HTTPException(404, { message: "Workflow not found" });
 			const existingRun = await workflow.getWorkflowRunById(runId, { withNestedWorkflows: false });
+			await require_utils$1.validateRunOwnership(existingRun, require_utils$1.getEffectiveResourceId(requestContext, void 0), mastra);
 			if (existingRun && TERMINAL_RUN_STATUSES.includes(existingRun.status)) throw new require_http_exception.HTTPException(409, { message: `Workflow run ${runId} already finished with status "${existingRun.status}". Use /observe to read its stream back, or stream a new runId.` });
 			const serverCache = mastra.getServerCache();
 			const result = (await workflow.createRun({
@@ -474,7 +476,7 @@ const RESUME_STREAM_WORKFLOW_ROUTE = require_route_builder.createRoute({
 			if (!workflow) throw new require_http_exception.HTTPException(404, { message: "Workflow not found" });
 			const run = await workflow.getWorkflowRunById(runId);
 			if (!run) throw new require_http_exception.HTTPException(404, { message: "Workflow run not found" });
-			await require_utils$1.validateRunOwnership(run, effectiveResourceId);
+			await require_utils$1.validateRunOwnership(run, effectiveResourceId, mastra);
 			const _run = await workflow.createRun({
 				runId,
 				resourceId: run.resourceId
@@ -516,6 +518,7 @@ const START_ASYNC_WORKFLOW_ROUTE = require_route_builder.createRoute({
 				workflowId
 			});
 			if (!workflow) throw new require_http_exception.HTTPException(404, { message: "Workflow not found" });
+			if (runId) await require_utils$1.validateRunOwnership(await workflow.getWorkflowRunById(runId, { withNestedWorkflows: false }), require_utils$1.getEffectiveResourceId(requestContext, void 0), mastra);
 			return await (await workflow.createRun({
 				runId,
 				resourceId: effectiveResourceId
@@ -552,7 +555,7 @@ const START_WORKFLOW_RUN_ROUTE = require_route_builder.createRoute({
 			if (!workflow) throw new require_http_exception.HTTPException(404, { message: "Workflow not found" });
 			const run = await workflow.getWorkflowRunById(runId);
 			if (!run) throw new require_http_exception.HTTPException(404, { message: "Workflow run not found" });
-			await require_utils$1.validateRunOwnership(run, effectiveResourceId);
+			await require_utils$1.validateRunOwnership(run, effectiveResourceId, mastra);
 			(await workflow.createRun({
 				runId,
 				resourceId: run.resourceId
@@ -595,7 +598,7 @@ const OBSERVE_STREAM_WORKFLOW_ROUTE = require_route_builder.createRoute({
 			if (!workflow) throw new require_http_exception.HTTPException(404, { message: "Workflow not found" });
 			const run = await workflow.getWorkflowRunById(runId);
 			if (!run) throw new require_http_exception.HTTPException(404, { message: "Workflow run not found" });
-			await require_utils$1.validateRunOwnership(run, effectiveResourceId);
+			await require_utils$1.validateRunOwnership(run, effectiveResourceId, mastra);
 			const _run = await workflow.createRun({
 				runId,
 				resourceId: run.resourceId
@@ -636,7 +639,7 @@ const RESUME_ASYNC_WORKFLOW_ROUTE = require_route_builder.createRoute({
 			if (!workflow) throw new require_http_exception.HTTPException(404, { message: "Workflow not found" });
 			const run = await workflow.getWorkflowRunById(runId);
 			if (!run) throw new require_http_exception.HTTPException(404, { message: "Workflow run not found" });
-			await require_utils$1.validateRunOwnership(run, effectiveResourceId);
+			await require_utils$1.validateRunOwnership(run, effectiveResourceId, mastra);
 			return await (await workflow.createRun({
 				runId,
 				resourceId: run.resourceId
@@ -683,7 +686,7 @@ const RESUME_NO_WAIT_WORKFLOW_ROUTE = require_route_builder.createRoute({
 			if (!workflow) throw new require_http_exception.HTTPException(404, { message: "Workflow not found" });
 			const run = await workflow.getWorkflowRunById(runId);
 			if (!run) throw new require_http_exception.HTTPException(404, { message: "Workflow run not found" });
-			await require_utils$1.validateRunOwnership(run, effectiveResourceId);
+			await require_utils$1.validateRunOwnership(run, effectiveResourceId, mastra);
 			return await (await workflow.createRun({
 				runId,
 				resourceId: run.resourceId
@@ -720,7 +723,7 @@ const RESUME_WORKFLOW_ROUTE = require_route_builder.createRoute({
 			if (!workflow) throw new require_http_exception.HTTPException(404, { message: "Workflow not found" });
 			const run = await workflow.getWorkflowRunById(runId);
 			if (!run) throw new require_http_exception.HTTPException(404, { message: "Workflow run not found" });
-			await require_utils$1.validateRunOwnership(run, effectiveResourceId);
+			await require_utils$1.validateRunOwnership(run, effectiveResourceId, mastra);
 			(await workflow.createRun({
 				runId,
 				resourceId: run.resourceId
@@ -764,7 +767,7 @@ const RESTART_ASYNC_WORKFLOW_ROUTE = require_route_builder.createRoute({
 			if (!workflow) throw new require_http_exception.HTTPException(404, { message: "Workflow not found" });
 			const run = await workflow.getWorkflowRunById(runId);
 			if (!run) throw new require_http_exception.HTTPException(404, { message: "Workflow run not found" });
-			await require_utils$1.validateRunOwnership(run, effectiveResourceId);
+			await require_utils$1.validateRunOwnership(run, effectiveResourceId, mastra);
 			return await (await workflow.createRun({
 				runId,
 				resourceId: run.resourceId
@@ -801,7 +804,7 @@ const RESTART_WORKFLOW_ROUTE = require_route_builder.createRoute({
 			if (!workflow) throw new require_http_exception.HTTPException(404, { message: "Workflow not found" });
 			const run = await workflow.getWorkflowRunById(runId);
 			if (!run) throw new require_http_exception.HTTPException(404, { message: "Workflow run not found" });
-			await require_utils$1.validateRunOwnership(run, effectiveResourceId);
+			await require_utils$1.validateRunOwnership(run, effectiveResourceId, mastra);
 			(await workflow.createRun({
 				runId,
 				resourceId: run.resourceId
@@ -831,8 +834,9 @@ const RESTART_ALL_ACTIVE_WORKFLOW_RUNS_ASYNC_ROUTE = require_route_builder.creat
 	description: "Restarts all active workflow runs asynchronously",
 	tags: ["Workflows"],
 	requiresAuth: true,
-	handler: async ({ mastra, workflowId }) => {
+	handler: async ({ mastra, workflowId, requestContext }) => {
 		try {
+			await require_utils$1.validateRunOwnership({ resourceId: null }, require_utils$1.getEffectiveResourceId(requestContext, void 0), mastra);
 			if (!workflowId) throw new require_http_exception.HTTPException(400, { message: "Workflow ID is required" });
 			const { workflow } = await listWorkflowsFromSystem({
 				mastra,
@@ -856,8 +860,9 @@ const RESTART_ALL_ACTIVE_WORKFLOW_RUNS_ROUTE = require_route_builder.createRoute
 	description: "Restarts all active workflow runs",
 	tags: ["Workflows"],
 	requiresAuth: true,
-	handler: async ({ mastra, workflowId }) => {
+	handler: async ({ mastra, workflowId, requestContext }) => {
 		try {
+			await require_utils$1.validateRunOwnership({ resourceId: null }, require_utils$1.getEffectiveResourceId(requestContext, void 0), mastra);
 			if (!workflowId) throw new require_http_exception.HTTPException(400, { message: "Workflow ID is required" });
 			const { workflow } = await listWorkflowsFromSystem({
 				mastra,
@@ -900,7 +905,7 @@ const TIME_TRAVEL_ASYNC_WORKFLOW_ROUTE = require_route_builder.createRoute({
 			if (!workflow) throw new require_http_exception.HTTPException(404, { message: "Workflow not found" });
 			const run = await workflow.getWorkflowRunById(runId);
 			if (!run) throw new require_http_exception.HTTPException(404, { message: "Workflow run not found" });
-			await require_utils$1.validateRunOwnership(run, effectiveResourceId);
+			await require_utils$1.validateRunOwnership(run, effectiveResourceId, mastra);
 			return await (await workflow.createRun({
 				runId,
 				resourceId: run.resourceId
@@ -937,7 +942,7 @@ const TIME_TRAVEL_WORKFLOW_ROUTE = require_route_builder.createRoute({
 			if (!workflow) throw new require_http_exception.HTTPException(404, { message: "Workflow not found" });
 			const run = await workflow.getWorkflowRunById(runId);
 			if (!run) throw new require_http_exception.HTTPException(404, { message: "Workflow run not found" });
-			await require_utils$1.validateRunOwnership(run, effectiveResourceId);
+			await require_utils$1.validateRunOwnership(run, effectiveResourceId, mastra);
 			(await workflow.createRun({
 				runId,
 				resourceId: run.resourceId
@@ -980,7 +985,7 @@ const TIME_TRAVEL_STREAM_WORKFLOW_ROUTE = require_route_builder.createRoute({
 			if (!workflow) throw new require_http_exception.HTTPException(404, { message: "Workflow not found" });
 			const existingRun = await workflow.getWorkflowRunById(runId);
 			if (!existingRun) throw new require_http_exception.HTTPException(404, { message: "Workflow run not found" });
-			await require_utils$1.validateRunOwnership(existingRun, effectiveResourceId);
+			await require_utils$1.validateRunOwnership(existingRun, effectiveResourceId, mastra);
 			const serverCache = mastra.getServerCache();
 			const result = (await workflow.createRun({
 				runId,
@@ -1022,7 +1027,7 @@ const CANCEL_WORKFLOW_RUN_ROUTE = require_route_builder.createRoute({
 			if (!workflow) throw new require_http_exception.HTTPException(404, { message: "Workflow not found" });
 			const run = await workflow.getWorkflowRunById(runId);
 			if (!run) throw new require_http_exception.HTTPException(404, { message: "Workflow run not found" });
-			await require_utils$1.validateRunOwnership(run, effectiveResourceId);
+			await require_utils$1.validateRunOwnership(run, effectiveResourceId, mastra);
 			await (await workflow.createRun({
 				runId,
 				resourceId: run.resourceId
@@ -1056,6 +1061,7 @@ const STREAM_LEGACY_WORKFLOW_ROUTE = require_route_builder.createRoute({
 			});
 			if (!workflow) throw new require_http_exception.HTTPException(404, { message: "Workflow not found" });
 			const serverCache = mastra.getServerCache();
+			if (runId) await require_utils$1.validateRunOwnership(await workflow.getWorkflowRunById(runId, { withNestedWorkflows: false }), require_utils$1.getEffectiveResourceId(requestContext, void 0), mastra);
 			return (await workflow.createRun({
 				runId,
 				resourceId: effectiveResourceId
@@ -1097,7 +1103,7 @@ const OBSERVE_STREAM_LEGACY_WORKFLOW_ROUTE = require_route_builder.createRoute({
 			if (!workflow) throw new require_http_exception.HTTPException(404, { message: "Workflow not found" });
 			const run = await workflow.getWorkflowRunById(runId);
 			if (!run) throw new require_http_exception.HTTPException(404, { message: "Workflow run not found" });
-			await require_utils$1.validateRunOwnership(run, effectiveResourceId);
+			await require_utils$1.validateRunOwnership(run, effectiveResourceId, mastra);
 			const _run = await workflow.createRun({
 				runId,
 				resourceId: run.resourceId
@@ -1161,6 +1167,12 @@ const EXECUTE_WORKFLOW_STEP_ROUTE = require_route_builder.createRoute({
 	requiresAuth: true,
 	handler: (async ({ mastra, workflowId, runId, ...body }) => {
 		try {
+			const candidate = body.requestContext;
+			const serverRequestContext = typeof candidate?.get === "function" ? candidate : void 0;
+			await require_utils$1.validateRunOwnership(await (await mastra.getStorage()?.getStore("workflows"))?.getWorkflowRunById({
+				runId,
+				workflowName: workflowId
+			}), require_utils$1.getEffectiveResourceId(serverRequestContext, void 0), mastra);
 			return await (await getStepStrategy(mastra)).executeStep({
 				workflowId,
 				runId,
@@ -1224,8 +1236,13 @@ const RECEIVE_WORKFLOW_EVENT_ROUTE = require_route_builder.createRoute({
 	tags: ["Workflows", "Worker"],
 	requiresAuth: true,
 	requiresPermission: ["workflows:write", "workflows:execute"],
-	handler: (async ({ mastra, event }) => {
+	handler: (async ({ mastra, event, requestContext }) => {
 		try {
+			const workflowName = event.data?.workflowId;
+			await require_utils$1.validateRunOwnership(await (await mastra.getStorage()?.getStore("workflows"))?.getWorkflowRunById({
+				runId: event.runId,
+				...typeof workflowName === "string" ? { workflowName } : {}
+			}), require_utils$1.getEffectiveResourceId(requestContext, void 0), mastra);
 			const rawCreatedAt = event.createdAt;
 			const createdAt = rawCreatedAt instanceof Date ? rawCreatedAt : new Date(rawCreatedAt);
 			if (Number.isNaN(createdAt.getTime())) throw new require_http_exception.HTTPException(400, { message: "Invalid createdAt" });