@mastra/server 1.78.0-alpha.5 → 1.78.0-alpha.7

package/dist/server/handlers/workflows.js

@@ -2,11 +2,11 @@ import { r as __exportAll } from "../../rolldown-runtime-maW3aOIk.js";
 import { t as HTTPException } from "../../http-exception-CyfxZB6W.js";
 import { o as optionalRunIdSchema, u as runIdSchema } from "../../common-Y30XtCyr.js";
 import { _ as workflowRunCountsResponseSchema, a as observeWorkflowQuerySchema, b as workflowRunResultSchema, d as streamWorkflowBodySchema, f as timeTravelBodySchema, g as workflowInfoSchema, h as workflowIdPathParams, i as listWorkflowsResponseSchema, l as startAsyncWorkflowBodySchema, m as workflowExecutionResultSchema, n as createWorkflowRunResponseSchema, o as restartBodySchema, p as workflowControlResponseSchema, r as listWorkflowRunsQuerySchema, s as resumeBodySchema, t as createWorkflowRunBodySchema, v as workflowRunPathParams, x as workflowRunsResponseSchema, y as workflowRunResultQuerySchema } from "../../workflows-Dcx4Ib0t.js";
-import { J as streamResponseSchema } from "../../agents-CW_JJZOf.js";
+import { Y as streamResponseSchema } from "../../agents-DNWDET4U.js";
 import { n as createRoute } from "../../route-builder-lBil8Cvo.js";
 import { a as getWorkflowInfo, t as WorkflowRegistry } from "../../utils-BpQY-tBr.js";
 import { handleError } from "./error.js";
-import { a as getPublicWorkflowById, h as MastraFGAPermissions, p as validateRunOwnership, r as getEffectiveResourceId } from "../../utils-GVYTDbr2.js";
+import { a as getPublicWorkflowById, h as MastraFGAPermissions, p as validateRunOwnership, r as getEffectiveResourceId } from "../../utils-mIFmRM_j.js";
 import { z } from "zod/v4";
 import { createReplayStream } from "@mastra/core/stream";
 //#region src/server/handlers/workflows.ts
@@ -338,7 +338,7 @@ const GET_WORKFLOW_RUN_BY_ID_ROUTE = createRoute({
 				fields: fieldList
 			});
 			if (!run) throw new HTTPException(404, { message: "Workflow run not found" });
-			await validateRunOwnership(run, effectiveResourceId);
+			await validateRunOwnership(run, effectiveResourceId, mastra);
 			return run;
 		} catch (error) {
 			return handleError(error, "Error getting workflow run");
@@ -367,7 +367,7 @@ const DELETE_WORKFLOW_RUN_BY_ID_ROUTE = createRoute({
 			if (!workflow) throw new HTTPException(404, { message: "Workflow not found" });
 			const run = await workflow.getWorkflowRunById(runId);
 			if (!run) throw new HTTPException(404, { message: "Workflow run not found" });
-			await validateRunOwnership(run, effectiveResourceId);
+			await validateRunOwnership(run, effectiveResourceId, mastra);
 			await workflow.deleteWorkflowRunById(runId);
 			return { message: "Workflow run deleted" };
 		} catch (error) {
@@ -397,6 +397,7 @@ const CREATE_WORKFLOW_RUN_ROUTE = createRoute({
 				workflowId
 			});
 			if (!workflow) throw new HTTPException(404, { message: "Workflow not found" });
+			if (runId) await validateRunOwnership(await workflow.getWorkflowRunById(runId, { withNestedWorkflows: false }), getEffectiveResourceId(requestContext, void 0), mastra);
 			return { runId: (await workflow.createRun({
 				runId,
 				resourceId: effectiveResourceId,
@@ -429,6 +430,7 @@ const STREAM_WORKFLOW_ROUTE = createRoute({
 			});
 			if (!workflow) throw new HTTPException(404, { message: "Workflow not found" });
 			const existingRun = await workflow.getWorkflowRunById(runId, { withNestedWorkflows: false });
+			await validateRunOwnership(existingRun, getEffectiveResourceId(requestContext, void 0), mastra);
 			if (existingRun && TERMINAL_RUN_STATUSES.includes(existingRun.status)) throw new HTTPException(409, { message: `Workflow run ${runId} already finished with status "${existingRun.status}". Use /observe to read its stream back, or stream a new runId.` });
 			const serverCache = mastra.getServerCache();
 			const result = (await workflow.createRun({
@@ -473,7 +475,7 @@ const RESUME_STREAM_WORKFLOW_ROUTE = createRoute({
 			if (!workflow) throw new HTTPException(404, { message: "Workflow not found" });
 			const run = await workflow.getWorkflowRunById(runId);
 			if (!run) throw new HTTPException(404, { message: "Workflow run not found" });
-			await validateRunOwnership(run, effectiveResourceId);
+			await validateRunOwnership(run, effectiveResourceId, mastra);
 			const _run = await workflow.createRun({
 				runId,
 				resourceId: run.resourceId
@@ -515,6 +517,7 @@ const START_ASYNC_WORKFLOW_ROUTE = createRoute({
 				workflowId
 			});
 			if (!workflow) throw new HTTPException(404, { message: "Workflow not found" });
+			if (runId) await validateRunOwnership(await workflow.getWorkflowRunById(runId, { withNestedWorkflows: false }), getEffectiveResourceId(requestContext, void 0), mastra);
 			return await (await workflow.createRun({
 				runId,
 				resourceId: effectiveResourceId
@@ -551,7 +554,7 @@ const START_WORKFLOW_RUN_ROUTE = createRoute({
 			if (!workflow) throw new HTTPException(404, { message: "Workflow not found" });
 			const run = await workflow.getWorkflowRunById(runId);
 			if (!run) throw new HTTPException(404, { message: "Workflow run not found" });
-			await validateRunOwnership(run, effectiveResourceId);
+			await validateRunOwnership(run, effectiveResourceId, mastra);
 			(await workflow.createRun({
 				runId,
 				resourceId: run.resourceId
@@ -594,7 +597,7 @@ const OBSERVE_STREAM_WORKFLOW_ROUTE = createRoute({
 			if (!workflow) throw new HTTPException(404, { message: "Workflow not found" });
 			const run = await workflow.getWorkflowRunById(runId);
 			if (!run) throw new HTTPException(404, { message: "Workflow run not found" });
-			await validateRunOwnership(run, effectiveResourceId);
+			await validateRunOwnership(run, effectiveResourceId, mastra);
 			const _run = await workflow.createRun({
 				runId,
 				resourceId: run.resourceId
@@ -635,7 +638,7 @@ const RESUME_ASYNC_WORKFLOW_ROUTE = createRoute({
 			if (!workflow) throw new HTTPException(404, { message: "Workflow not found" });
 			const run = await workflow.getWorkflowRunById(runId);
 			if (!run) throw new HTTPException(404, { message: "Workflow run not found" });
-			await validateRunOwnership(run, effectiveResourceId);
+			await validateRunOwnership(run, effectiveResourceId, mastra);
 			return await (await workflow.createRun({
 				runId,
 				resourceId: run.resourceId
@@ -682,7 +685,7 @@ const RESUME_NO_WAIT_WORKFLOW_ROUTE = createRoute({
 			if (!workflow) throw new HTTPException(404, { message: "Workflow not found" });
 			const run = await workflow.getWorkflowRunById(runId);
 			if (!run) throw new HTTPException(404, { message: "Workflow run not found" });
-			await validateRunOwnership(run, effectiveResourceId);
+			await validateRunOwnership(run, effectiveResourceId, mastra);
 			return await (await workflow.createRun({
 				runId,
 				resourceId: run.resourceId
@@ -719,7 +722,7 @@ const RESUME_WORKFLOW_ROUTE = createRoute({
 			if (!workflow) throw new HTTPException(404, { message: "Workflow not found" });
 			const run = await workflow.getWorkflowRunById(runId);
 			if (!run) throw new HTTPException(404, { message: "Workflow run not found" });
-			await validateRunOwnership(run, effectiveResourceId);
+			await validateRunOwnership(run, effectiveResourceId, mastra);
 			(await workflow.createRun({
 				runId,
 				resourceId: run.resourceId
@@ -763,7 +766,7 @@ const RESTART_ASYNC_WORKFLOW_ROUTE = createRoute({
 			if (!workflow) throw new HTTPException(404, { message: "Workflow not found" });
 			const run = await workflow.getWorkflowRunById(runId);
 			if (!run) throw new HTTPException(404, { message: "Workflow run not found" });
-			await validateRunOwnership(run, effectiveResourceId);
+			await validateRunOwnership(run, effectiveResourceId, mastra);
 			return await (await workflow.createRun({
 				runId,
 				resourceId: run.resourceId
@@ -800,7 +803,7 @@ const RESTART_WORKFLOW_ROUTE = createRoute({
 			if (!workflow) throw new HTTPException(404, { message: "Workflow not found" });
 			const run = await workflow.getWorkflowRunById(runId);
 			if (!run) throw new HTTPException(404, { message: "Workflow run not found" });
-			await validateRunOwnership(run, effectiveResourceId);
+			await validateRunOwnership(run, effectiveResourceId, mastra);
 			(await workflow.createRun({
 				runId,
 				resourceId: run.resourceId
@@ -830,8 +833,9 @@ const RESTART_ALL_ACTIVE_WORKFLOW_RUNS_ASYNC_ROUTE = createRoute({
 	description: "Restarts all active workflow runs asynchronously",
 	tags: ["Workflows"],
 	requiresAuth: true,
-	handler: async ({ mastra, workflowId }) => {
+	handler: async ({ mastra, workflowId, requestContext }) => {
 		try {
+			await validateRunOwnership({ resourceId: null }, getEffectiveResourceId(requestContext, void 0), mastra);
 			if (!workflowId) throw new HTTPException(400, { message: "Workflow ID is required" });
 			const { workflow } = await listWorkflowsFromSystem({
 				mastra,
@@ -855,8 +859,9 @@ const RESTART_ALL_ACTIVE_WORKFLOW_RUNS_ROUTE = createRoute({
 	description: "Restarts all active workflow runs",
 	tags: ["Workflows"],
 	requiresAuth: true,
-	handler: async ({ mastra, workflowId }) => {
+	handler: async ({ mastra, workflowId, requestContext }) => {
 		try {
+			await validateRunOwnership({ resourceId: null }, getEffectiveResourceId(requestContext, void 0), mastra);
 			if (!workflowId) throw new HTTPException(400, { message: "Workflow ID is required" });
 			const { workflow } = await listWorkflowsFromSystem({
 				mastra,
@@ -899,7 +904,7 @@ const TIME_TRAVEL_ASYNC_WORKFLOW_ROUTE = createRoute({
 			if (!workflow) throw new HTTPException(404, { message: "Workflow not found" });
 			const run = await workflow.getWorkflowRunById(runId);
 			if (!run) throw new HTTPException(404, { message: "Workflow run not found" });
-			await validateRunOwnership(run, effectiveResourceId);
+			await validateRunOwnership(run, effectiveResourceId, mastra);
 			return await (await workflow.createRun({
 				runId,
 				resourceId: run.resourceId
@@ -936,7 +941,7 @@ const TIME_TRAVEL_WORKFLOW_ROUTE = createRoute({
 			if (!workflow) throw new HTTPException(404, { message: "Workflow not found" });
 			const run = await workflow.getWorkflowRunById(runId);
 			if (!run) throw new HTTPException(404, { message: "Workflow run not found" });
-			await validateRunOwnership(run, effectiveResourceId);
+			await validateRunOwnership(run, effectiveResourceId, mastra);
 			(await workflow.createRun({
 				runId,
 				resourceId: run.resourceId
@@ -979,7 +984,7 @@ const TIME_TRAVEL_STREAM_WORKFLOW_ROUTE = createRoute({
 			if (!workflow) throw new HTTPException(404, { message: "Workflow not found" });
 			const existingRun = await workflow.getWorkflowRunById(runId);
 			if (!existingRun) throw new HTTPException(404, { message: "Workflow run not found" });
-			await validateRunOwnership(existingRun, effectiveResourceId);
+			await validateRunOwnership(existingRun, effectiveResourceId, mastra);
 			const serverCache = mastra.getServerCache();
 			const result = (await workflow.createRun({
 				runId,
@@ -1021,7 +1026,7 @@ const CANCEL_WORKFLOW_RUN_ROUTE = createRoute({
 			if (!workflow) throw new HTTPException(404, { message: "Workflow not found" });
 			const run = await workflow.getWorkflowRunById(runId);
 			if (!run) throw new HTTPException(404, { message: "Workflow run not found" });
-			await validateRunOwnership(run, effectiveResourceId);
+			await validateRunOwnership(run, effectiveResourceId, mastra);
 			await (await workflow.createRun({
 				runId,
 				resourceId: run.resourceId
@@ -1055,6 +1060,7 @@ const STREAM_LEGACY_WORKFLOW_ROUTE = createRoute({
 			});
 			if (!workflow) throw new HTTPException(404, { message: "Workflow not found" });
 			const serverCache = mastra.getServerCache();
+			if (runId) await validateRunOwnership(await workflow.getWorkflowRunById(runId, { withNestedWorkflows: false }), getEffectiveResourceId(requestContext, void 0), mastra);
 			return (await workflow.createRun({
 				runId,
 				resourceId: effectiveResourceId
@@ -1096,7 +1102,7 @@ const OBSERVE_STREAM_LEGACY_WORKFLOW_ROUTE = createRoute({
 			if (!workflow) throw new HTTPException(404, { message: "Workflow not found" });
 			const run = await workflow.getWorkflowRunById(runId);
 			if (!run) throw new HTTPException(404, { message: "Workflow run not found" });
-			await validateRunOwnership(run, effectiveResourceId);
+			await validateRunOwnership(run, effectiveResourceId, mastra);
 			const _run = await workflow.createRun({
 				runId,
 				resourceId: run.resourceId
@@ -1159,6 +1165,12 @@ const EXECUTE_WORKFLOW_STEP_ROUTE = createRoute({
 	requiresAuth: true,
 	handler: (async ({ mastra, workflowId, runId, ...body }) => {
 		try {
+			const candidate = body.requestContext;
+			const serverRequestContext = typeof candidate?.get === "function" ? candidate : void 0;
+			await validateRunOwnership(await (await mastra.getStorage()?.getStore("workflows"))?.getWorkflowRunById({
+				runId,
+				workflowName: workflowId
+			}), getEffectiveResourceId(serverRequestContext, void 0), mastra);
 			return await (await getStepStrategy(mastra)).executeStep({
 				workflowId,
 				runId,
@@ -1220,8 +1232,13 @@ const RECEIVE_WORKFLOW_EVENT_ROUTE = createRoute({
 	tags: ["Workflows", "Worker"],
 	requiresAuth: true,
 	requiresPermission: ["workflows:write", "workflows:execute"],
-	handler: (async ({ mastra, event }) => {
+	handler: (async ({ mastra, event, requestContext }) => {
 		try {
+			const workflowName = event.data?.workflowId;
+			await validateRunOwnership(await (await mastra.getStorage()?.getStore("workflows"))?.getWorkflowRunById({
+				runId: event.runId,
+				...typeof workflowName === "string" ? { workflowName } : {}
+			}), getEffectiveResourceId(requestContext, void 0), mastra);
 			const rawCreatedAt = event.createdAt;
 			const createdAt = rawCreatedAt instanceof Date ? rawCreatedAt : new Date(rawCreatedAt);
 			if (Number.isNaN(createdAt.getTime())) throw new HTTPException(400, { message: "Invalid createdAt" });