@mastra/server 1.82.0 → 1.83.0-alpha.0

package/dist/server/server-adapter/index.cjs

@@ -1,14 +1,15 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 require("../../rolldown-runtime-10nMEhjP.cjs");
-const require_http_exception = require("../../http-exception-Co3MbFUf.cjs");
-const require_route_builder = require("../../route-builder-CvARmqnA.cjs");
-const require_utils = require("../../utils-BhBJHsqX.cjs");
+const require_helpers = require("../../helpers-CylvUIZm.cjs");
 const require_constants = require("../../constants-DMg8hUOR.cjs");
 const require_server_handlers_error = require("../handlers/error.cjs");
-const require_helpers = require("../../helpers-BKtUXhz2.cjs");
-const require_routes = require("../../routes-DU_FlwJP.cjs");
+const require_http_exception = require("../../http-exception-Co3MbFUf.cjs");
+const require_utils = require("../../utils-CL-m2SWZ.cjs");
+const require_route_builder = require("../../route-builder-DHqDrSSy.cjs");
+const require_routes = require("../../routes-BYQ38dFx.cjs");
 let zod_v4 = require("zod/v4");
 let stream = require("stream");
+let _mastra_core_auth_ee = require("@mastra/core/auth/ee");
 let _mastra_core_request_context = require("@mastra/core/request-context");
 let _mastra_core_server = require("@mastra/core/server");
 let _mastra_core_utils = require("@mastra/core/utils");
@@ -291,6 +292,13 @@ function getBuiltInRouteFGAConfig(route) {
 	return null;
 }
 // src/server/server-adapter/mcp-auth.ts
+/**
+* Key under which `applyMcpRequestAuth` attaches the trusted request context to
+* `req.auth`. `@mastra/mcp` reads the same registered symbol and copies the
+* values into the request context its tools receive. A symbol cannot come out
+* of a token or JSON payload, so only server code can supply it.
+*/
+const MCP_TRUSTED_REQUEST_CONTEXT = Symbol.for("mastra.mcp.trustedRequestContext");
 function normalizeScopes(value) {
 	if (Array.isArray(value)) return value.filter((s) => typeof s === "string");
 	if (typeof value === "string") return value.split(/[\s,]+/).filter(Boolean);
@@ -333,21 +341,42 @@ function buildMcpAuthInfoFromRequestContext(requestContext) {
 * transport.
 *
 * Resolution order:
-* 1. An already-set `req.auth` is left untouched.
+* 1. An already-set `req.auth` keeps its identity.
 * 2. A configured `setRequestAuth` hook runs and fully owns the result.
 * 3. Otherwise the principal resolved by Mastra server auth is bridged from the
 *    request context using the default mapping.
+*
+* Whichever way `req.auth` is set, the trusted request context is attached to
+* it so MCP tools see the same principal as Mastra routes.
 */
 async function applyMcpRequestAuth({ req, requestContext, setRequestAuth }) {
 	const request = req;
-	if (request.auth) return;
 	if (!requestContext) return;
-	if (setRequestAuth) {
-		await setRequestAuth(req, requestContext);
-		return;
+	if (!request.auth) {
+		if (setRequestAuth) await setRequestAuth(req, requestContext);
+		else {
+			const authInfo = buildMcpAuthInfoFromRequestContext(requestContext);
+			if (authInfo) request.auth = authInfo;
+		}
+	}
+	if (request.auth && typeof request.auth === "object") attachTrustedRequestContext(request.auth, requestContext);
+}
+/**
+* Hands MCP tools the values Mastra server auth resolved for this request
+* (user, permissions, roles, resource id, tenant, auth mode), so a tool called
+* over MCP is authorized the same way as the matching HTTP route. The token is
+* left out; it is already on `authInfo`.
+*/
+function attachTrustedRequestContext(auth, requestContext) {
+	const trusted = {};
+	for (const key of require_constants.RESERVED_REQUEST_CONTEXT_KEYS) {
+		if (key === "mastra__authToken" || !requestContext.has(key)) continue;
+		trusted[key] = requestContext.get(key);
 	}
-	const authInfo = buildMcpAuthInfoFromRequestContext(requestContext);
-	if (authInfo) request.auth = authInfo;
+	Object.defineProperty(auth, MCP_TRUSTED_REQUEST_CONTEXT, {
+		value: trusted,
+		configurable: true
+	});
 }
 // src/server/server-adapter/mcp-disconnect.ts
 /**
@@ -780,7 +809,7 @@ function normalizeQueryParams(rawQuery) {
 * @template TRequest - The type of the request object
 * @template TResponse - The type of the response object
 */
-var MastraServer = class MastraServer extends _mastra_core_server.MastraServerBase {
+var MastraServer = class extends _mastra_core_server.MastraServerBase {
 	/** Request bodies cannot set agent scopes: handlers strip `scopes`, and `mastra__scopes` is a reserved key. */
 	reservesAgentScopes = true;
 	mastra;
@@ -917,8 +946,7 @@ var MastraServer = class MastraServer extends _mastra_core_server.MastraServerBa
 	* Gets the effective RBAC provider for the current request based on auth mode.
 	*/
 	getEffectiveRBACProvider(requestContext) {
-		if (requestContext.get("mastra__authMode") === "studio") return this.mastra.getStudio?.()?.rbac ?? this.mastra.getServer()?.rbac;
-		return this.mastra.getServer()?.rbac;
+		return getEffectiveRBACProvider(this.mastra, requestContext);
 	}
 	/**
 	* Gets the effective FGA provider for the current request based on auth mode.
@@ -1020,16 +1048,7 @@ var MastraServer = class MastraServer extends _mastra_core_server.MastraServerBa
 	* @returns Error response if permission denied, null if allowed
 	*/
 	checkRoutePermission(route, userPermissions, hasPermissionFn, requestContext) {
-		if (!this.getEffectiveRBACProvider(requestContext)) return null;
-		const requiredPermission = getEffectivePermission(route);
-		if (!requiredPermission) return null;
-		const permissions = Array.isArray(requiredPermission) ? requiredPermission : [requiredPermission];
-		if (!(userPermissions && permissions.some((perm) => hasPermissionFn(userPermissions, perm)))) return {
-			status: 403,
-			error: "Forbidden",
-			message: `Missing required permission: ${permissions.join(" or ")}`
-		};
-		return null;
+		return getRoutePermissionError(this.mastra, route, userPermissions, hasPermissionFn, requestContext);
 	}
 	/**
 	* Build a matcher that answers "is this (path, method) a framework-public
@@ -1370,53 +1389,197 @@ Learn more: https://github.com/mastra-ai/mastra/blob/main/ee/LICENSE`);
 		}, { prefix: this.prefix });
 	}
 	async parsePathParams(route, params) {
-		const pathParamSchema = route.pathParamSchema;
-		if (!pathParamSchema) return params;
-		return pathParamSchema.parseAsync(params);
+		return parseRoutePathParams(route, params);
 	}
 	async parseQueryParams(route, params) {
-		const queryParamSchema = route.queryParamSchema;
-		if (!queryParamSchema) return params;
-		const normalizedParams = parseComplexQueryParams(queryParamSchema, params);
-		return queryParamSchema.parseAsync(normalizedParams);
+		return parseRouteQueryParams(route, params);
 	}
 	async parseBody(route, body) {
-		const bodySchema = route.bodySchema;
-		if (!bodySchema) return body;
-		if (body === void 0) {
-			const omitted = await bodySchema.safeParseAsync(void 0);
-			if (omitted.success) return omitted.data;
-			const schemaType = getSchemaTypeName(unwrapOptionalNullable(bodySchema));
-			if (schemaType === "object" || schemaType === "ZodObject") {
-				const emptyObject = await bodySchema.safeParseAsync({});
-				if (emptyObject.success) return emptyObject.data;
-			}
-			throw omitted.error;
+		return parseRouteBody(route, body);
+	}
+	resolveValidationError(route, error, context) {
+		return resolveRouteValidationError(this.mastra, route, error, context);
+	}
+};
+/**
+* The RBAC provider for the auth mode the request was authenticated with
+* (studio vs server).
+*/
+function getEffectiveRBACProvider(mastra, requestContext) {
+	if (requestContext.get("mastra__authMode") === "studio") return mastra.getStudio?.()?.rbac ?? mastra.getServer()?.rbac;
+	return mastra.getServer()?.rbac;
+}
+/**
+* Check if the user has the required permission for a route.
+*
+* Uses convention-based permission derivation:
+* 1. If route has explicit `requiresPermission`, use that
+* 2. Otherwise, derive permission from path/method (e.g., GET /agents → agents:read)
+* 3. Routes with `requiresAuth: false` skip permission checks
+*
+* When the route specifies an array of permissions, the user needs ANY ONE
+* of them (logical OR). Without an RBAC provider, authenticated users get full access.
+*
+* @returns Error response if permission denied, null if allowed
+*/
+function getRoutePermissionError(mastra, route, userPermissions, hasPermissionFn, requestContext) {
+	if (!getEffectiveRBACProvider(mastra, requestContext)) return null;
+	const requiredPermission = getEffectivePermission(route);
+	if (!requiredPermission) return null;
+	const permissions = Array.isArray(requiredPermission) ? requiredPermission : [requiredPermission];
+	if (!(userPermissions && permissions.some((perm) => hasPermissionFn(userPermissions, perm)))) return {
+		status: 403,
+		error: "Forbidden",
+		message: `Missing required permission: ${permissions.join(" or ")}`
+	};
+	return null;
+}
+async function parseRoutePathParams(route, params) {
+	const pathParamSchema = route.pathParamSchema;
+	if (!pathParamSchema) return params;
+	return pathParamSchema.parseAsync(params);
+}
+async function parseRouteQueryParams(route, params) {
+	const queryParamSchema = route.queryParamSchema;
+	if (!queryParamSchema) return params;
+	const normalizedParams = parseComplexQueryParams(queryParamSchema, params);
+	return queryParamSchema.parseAsync(normalizedParams);
+}
+async function parseRouteBody(route, body) {
+	const bodySchema = route.bodySchema;
+	if (!bodySchema) return body;
+	if (body === void 0) {
+		const omitted = await bodySchema.safeParseAsync(void 0);
+		if (omitted.success) return omitted.data;
+		const schemaType = getSchemaTypeName(unwrapOptionalNullable(bodySchema));
+		if (schemaType === "object" || schemaType === "ZodObject") {
+			const emptyObject = await bodySchema.safeParseAsync({});
+			if (emptyObject.success) return emptyObject.data;
 		}
-		return bodySchema.parseAsync(body);
+		throw omitted.error;
+	}
+	return bodySchema.parseAsync(body);
+}
+const VALIDATION_CONTEXT_LABELS = {
+	query: "query parameters",
+	body: "request body",
+	path: "path parameters"
+};
+function resolveRouteValidationError(mastra, route, error, context) {
+	const hook = route.onValidationError ?? mastra.getServer()?.onValidationError;
+	if (hook) try {
+		const result = hook(error, context);
+		if (result) return result;
+	} catch (hookError) {
+		mastra.getLogger()?.error("Error in custom onValidationError hook", { error: hookError instanceof Error ? {
+			message: hookError.message,
+			stack: hookError.stack
+		} : hookError });
 	}
-	static CONTEXT_LABELS = {
-		query: "query parameters",
-		body: "request body",
-		path: "path parameters"
+	return {
+		status: 400,
+		body: require_server_handlers_error.formatZodError(error, VALIDATION_CONTEXT_LABELS[context])
 	};
-	resolveValidationError(route, error, context) {
-		const hook = route.onValidationError ?? this.mastra.getServer()?.onValidationError;
-		if (hook) try {
-			const result = hook(error, context);
-			if (result) return result;
-		} catch (hookError) {
-			this.mastra.getLogger()?.error("Error in custom onValidationError hook", { error: hookError instanceof Error ? {
-				message: hookError.message,
-				stack: hookError.stack
-			} : hookError });
+}
+/**
+* Runs a server route in-process as the caller, with the checks its HTTP
+* endpoint applies on every adapter: authentication, auth's `authorizeUser`,
+* `authorize` and `rules` (against the route's path under `apiPrefix`), input
+* validation, RBAC permission and FGA. Lets code outside an HTTP request (such
+* as an MCP tool) reuse a route without proxying through the HTTP server.
+*
+* Authentication is not re-run: when server or studio auth is configured, the
+* request context must already carry the user Mastra server auth resolved
+* (`MASTRA_USER_KEY`), otherwise the call is refused with 401.
+*
+* Only JSON routes are supported; other response types throw. The handler gets
+* the parsed params, `mastra`, `requestContext` and `abortSignal`, but not the
+* HTTP-only `request`, `registeredTools`, `taskStore` or `routePrefix`, so
+* routes that read those are not suitable.
+*/
+async function invokeRoute(route, options) {
+	if (route.responseType !== "json") throw new Error(`invokeRoute only runs JSON routes; ${route.method} ${route.path} answers with '${route.responseType}'`);
+	const { mastra, requestContext } = options;
+	const studioAuth = mastra.getStudio?.()?.auth;
+	const serverAuth = mastra.getServer()?.auth;
+	const authConfigured = Boolean(studioAuth || serverAuth);
+	if (authConfigured && route.requiresAuth !== false) {
+		const user = requestContext.get(require_constants.MASTRA_USER_KEY);
+		if (!user) return {
+			status: 401,
+			body: { error: "Authentication required" }
+		};
+		const authConfig = requestContext.get("mastra__authMode") === "studio" && studioAuth ? studioAuth : serverAuth;
+		if (authConfig) {
+			const path = `${require_utils.normalizeRoutePath(mastra.getServer()?.apiPrefix ?? "/api")}${route.path.replace(/:(\w+)/g, (_, name) => encodeURIComponent(options.pathParams?.[name] ?? ""))}`;
+			const token = requestContext.get(require_constants.MASTRA_AUTH_TOKEN_KEY);
+			const authorizationError = await require_helpers.authorizeAuthenticatedUser({
+				path,
+				method: route.method,
+				user,
+				mastra,
+				authConfig,
+				requestContext,
+				rawRequest: new Request(`http://localhost${path}`, {
+					method: route.method,
+					headers: typeof token === "string" && token ? { authorization: `Bearer ${token}` } : void 0
+				}),
+				buildAuthorizeContext: () => null
+			});
+			if (authorizationError) return authorizationError;
+		}
+	}
+	const parse = async (context, run) => {
+		try {
+			return { value: await run() };
+		} catch (error) {
+			if (require_server_handlers_error.isZodError(error)) return { error: resolveRouteValidationError(mastra, route, error, context) };
+			throw error;
 		}
+	};
+	const pathParams = await parse("path", () => parseRoutePathParams(route, options.pathParams ?? {}));
+	if (pathParams.error) return pathParams.error;
+	const query = await parse("query", () => parseRouteQueryParams(route, options.query ?? {}));
+	if (query.error) return query.error;
+	const body = await parse("body", () => parseRouteBody(route, options.body));
+	if (body.error) return body.error;
+	const params = {
+		...pathParams.value,
+		...query.value,
+		...typeof body.value === "object" ? body.value : {}
+	};
+	if (authConfigured) {
+		const permissionError = getRoutePermissionError(mastra, route, requestContext.get(require_constants.MASTRA_USER_PERMISSIONS_KEY), _mastra_core_auth_ee.hasPermission, requestContext);
+		if (permissionError) return {
+			status: permissionError.status,
+			body: {
+				error: permissionError.error,
+				message: permissionError.message
+			}
+		};
+	}
+	const fgaError = await checkRouteFGA(mastra, route, requestContext, params);
+	if (fgaError) return {
+		status: fgaError.status,
+		body: {
+			error: fgaError.error,
+			message: fgaError.message
+		}
+	};
+	try {
 		return {
-			status: 400,
-			body: require_server_handlers_error.formatZodError(error, MastraServer.CONTEXT_LABELS[context])
+			status: 200,
+			body: await route.handler({
+				...params,
+				requestContext,
+				mastra,
+				abortSignal: options.abortSignal ?? new AbortController().signal
+			})
 		};
+	} catch (error) {
+		return getHTTPErrorResponse(error);
 	}
-};
+}
 /**
 * Check FGA authorization for an HTTP route.
 * Returns null if authorized or FGA not configured, or an error object if denied.
@@ -1509,8 +1672,11 @@ exports.generateOpenAPIDocument = require_route_builder.generateOpenAPIDocument;
 exports.getCustomHTTPExceptionResponse = getCustomHTTPExceptionResponse;
 exports.getCustomRouteHTTPExceptionResponse = getCustomRouteHTTPExceptionResponse;
 exports.getEffectivePermission = getEffectivePermission;
+exports.getEffectiveRBACProvider = getEffectiveRBACProvider;
 exports.getFGAProvider = getFGAProvider;
 exports.getHTTPErrorResponse = getHTTPErrorResponse;
+exports.getRoutePermissionError = getRoutePermissionError;
+exports.invokeRoute = invokeRoute;
 exports.isReservedRequestContextKey = require_constants.isReservedRequestContextKey;
 exports.isSafeObjectKey = isSafeObjectKey;
 exports.isStudioClientTypeHeader = require_constants.isStudioClientTypeHeader;
@@ -1518,9 +1684,13 @@ exports.isZodError = require_server_handlers_error.isZodError;
 exports.jsonQueryParam = require_route_builder.jsonQueryParam;
 exports.normalizeQueryParams = normalizeQueryParams;
 exports.normalizeRoutePath = require_utils.normalizeRoutePath;
+exports.parseRouteBody = parseRouteBody;
+exports.parseRoutePathParams = parseRoutePathParams;
+exports.parseRouteQueryParams = parseRouteQueryParams;
 exports.pickParams = require_route_builder.pickParams;
 exports.propagateRequestAbort = propagateRequestAbort;
 exports.redactStreamChunk = redactStreamChunk;
+exports.resolveRouteValidationError = resolveRouteValidationError;
 exports.serializeStreamChunk = serializeStreamChunk;
 exports.wrapSchemaForQueryParams = require_route_builder.wrapSchemaForQueryParams;