@mettlelabs/mettle 0.0.0-beta.2-linux-arm64 → 0.0.0-beta.2
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/bin/mettle.js +53 -0
- package/bin/postinstall.js +28 -0
- package/package.json +19 -13
- package/THIRD_PARTY_NOTICES.md +0 -11974
- package/bin/mettle +0 -4
- package/harness/audit-investigation.mjs +0 -203
- package/harness/chunk-1sygmp11.mjs +0 -18142
- package/harness/chunk-1ykxpmaz.mjs +0 -7887
- package/harness/chunk-2pm2sayw.mjs +0 -248
- package/harness/chunk-3m7jn5ac.mjs +0 -16242
- package/harness/chunk-3wt8a8fq.mjs +0 -1716
- package/harness/chunk-3wvjs93w.mjs +0 -538
- package/harness/chunk-49ytr8d5.mjs +0 -33761
- package/harness/chunk-4bepyxmq.mjs +0 -113
- package/harness/chunk-4vx34w5h.mjs +0 -2357
- package/harness/chunk-50sbrf09.mjs +0 -18972
- package/harness/chunk-56csr8sw.mjs +0 -322
- package/harness/chunk-5wgmv4np.mjs +0 -585
- package/harness/chunk-65eyq32y.mjs +0 -225
- package/harness/chunk-6fnh6qhk.mjs +0 -195
- package/harness/chunk-6kgqw9ny.mjs +0 -32303
- package/harness/chunk-7b242j0n.mjs +0 -14
- package/harness/chunk-9dg1btk1.mjs +0 -2818
- package/harness/chunk-ageqxj9v.mjs +0 -63008
- package/harness/chunk-b0qbt5jd.mjs +0 -14
- package/harness/chunk-b5g1r3fz.mjs +0 -4785
- package/harness/chunk-b71gpkxg.mjs +0 -1514
- package/harness/chunk-bdv1rx4a.mjs +0 -20364
- package/harness/chunk-c1631s2x.mjs +0 -12241
- package/harness/chunk-c7dx5mdd.mjs +0 -10807
- package/harness/chunk-d5xgxsnp.mjs +0 -74
- package/harness/chunk-erg1fbh0.mjs +0 -0
- package/harness/chunk-fh78v9vn.mjs +0 -19366
- package/harness/chunk-fjx29qvp.mjs +0 -50
- package/harness/chunk-gryka6kg.mjs +0 -39
- package/harness/chunk-h1td5kq9.mjs +0 -422
- package/harness/chunk-jb0r19et.mjs +0 -180
- package/harness/chunk-jp69h6sj.mjs +0 -95
- package/harness/chunk-mfn574ss.mjs +0 -179
- package/harness/chunk-nz5sv9as.mjs +0 -1642
- package/harness/chunk-p9d3cgvq.mjs +0 -452
- package/harness/chunk-pq6wvwxr.mjs +0 -12
- package/harness/chunk-qcm9arf8.mjs +0 -7736
- package/harness/chunk-qr8zfqjd.mjs +0 -24
- package/harness/chunk-rd80vvc5.mjs +0 -22047
- package/harness/chunk-rz2tz6jp.mjs +0 -26
- package/harness/chunk-sbkgc3kn.mjs +0 -8
- package/harness/chunk-v66qvpnb.mjs +0 -169
- package/harness/chunk-vjaxzab3.mjs +0 -136
- package/harness/chunk-vr1n5nza.mjs +0 -1045
- package/harness/chunk-vsf2zajv.mjs +0 -3867
- package/harness/chunk-w0qwc5z2.mjs +0 -41
- package/harness/chunk-wq253fj4.mjs +0 -19041
- package/harness/chunk-wyv7ceq4.mjs +0 -0
- package/harness/chunk-xnqknk2r.mjs +0 -198
- package/harness/chunk-z6n9thea.mjs +0 -45146
- package/harness/chunk-zty0d3bw.mjs +0 -0
- package/harness/chunk-zvkxtj82.mjs +0 -42
- package/harness/issue-api-token.mjs +0 -35
- package/harness/launcher.mjs +0 -459
- package/harness/sandbox.mjs +0 -133
- package/harness/server.mjs +0 -87314
|
@@ -1,452 +0,0 @@
|
|
|
1
|
-
// node_modules/.bun/@mastra+core@1.71.0+95d98e20cbc6e6e1/node_modules/@mastra/core/dist/ee-btY6vXIW-DKf_xOxH.js
|
|
2
|
-
import { createHash } from "crypto";
|
|
3
|
-
import os from "os";
|
|
4
|
-
function hashTelemetryValue(value) {
|
|
5
|
-
return createHash("sha256").update(value).digest("hex");
|
|
6
|
-
}
|
|
7
|
-
function getHashedHostname() {
|
|
8
|
-
return hashTelemetryValue(os.hostname() || "unknown-host").slice(0, 16);
|
|
9
|
-
}
|
|
10
|
-
function getEETelemetryFallbackDistinctId() {
|
|
11
|
-
return `mastra-${getHashedHostname()}`;
|
|
12
|
-
}
|
|
13
|
-
var EE_TELEMETRY_BRIDGE = Symbol.for("mastra.eeTelemetryBridge");
|
|
14
|
-
function getTelemetryBridge() {
|
|
15
|
-
return globalThis[EE_TELEMETRY_BRIDGE];
|
|
16
|
-
}
|
|
17
|
-
function captureEEEvent(event, distinctId, properties) {
|
|
18
|
-
getTelemetryBridge()?.captureEEEvent?.(event, distinctId, properties);
|
|
19
|
-
}
|
|
20
|
-
var LicenseClient = class LicenseClient {
|
|
21
|
-
static instance;
|
|
22
|
-
logger;
|
|
23
|
-
licenseKey;
|
|
24
|
-
licenseUrl;
|
|
25
|
-
mode = "open-source";
|
|
26
|
-
status = "pending";
|
|
27
|
-
cachedResult = null;
|
|
28
|
-
cacheExpiry = 0;
|
|
29
|
-
gracePeriodEnd = 0;
|
|
30
|
-
revalidationTimeout = null;
|
|
31
|
-
GRACE_PERIOD_MS = 4320 * 60 * 1000;
|
|
32
|
-
DEFAULT_TTL_MS = 1440 * 60 * 1000;
|
|
33
|
-
constructor(logger) {
|
|
34
|
-
this.logger = logger;
|
|
35
|
-
this.licenseKey = process.env.MASTRA_LICENSE_KEY || process.env.MASTRA_EE_LICENSE;
|
|
36
|
-
this.licenseUrl = process.env.MASTRA_LICENSE_URL || "https://license.mastra.ai";
|
|
37
|
-
if (this.licenseKey)
|
|
38
|
-
this.mode = "enterprise";
|
|
39
|
-
else
|
|
40
|
-
this.mode = "open-source";
|
|
41
|
-
}
|
|
42
|
-
static getInstance(logger) {
|
|
43
|
-
if (!LicenseClient.instance)
|
|
44
|
-
LicenseClient.instance = new LicenseClient(logger);
|
|
45
|
-
else if (logger)
|
|
46
|
-
LicenseClient.instance.logger = logger;
|
|
47
|
-
return LicenseClient.instance;
|
|
48
|
-
}
|
|
49
|
-
static resetInstance() {
|
|
50
|
-
if (LicenseClient.instance?.revalidationTimeout)
|
|
51
|
-
clearTimeout(LicenseClient.instance.revalidationTimeout);
|
|
52
|
-
LicenseClient.instance = undefined;
|
|
53
|
-
}
|
|
54
|
-
REQUEST_TIMEOUT_MS = 1e4;
|
|
55
|
-
async fetchWithRetry(url, options, retries = 3) {
|
|
56
|
-
for (let i = 0;i < retries; i++) {
|
|
57
|
-
const controller = new AbortController;
|
|
58
|
-
const timer = setTimeout(() => controller.abort(), this.REQUEST_TIMEOUT_MS);
|
|
59
|
-
timer.unref?.();
|
|
60
|
-
try {
|
|
61
|
-
const signal = options.signal ? AbortSignal.any([options.signal, controller.signal]) : controller.signal;
|
|
62
|
-
const response = await fetch(url, {
|
|
63
|
-
...options,
|
|
64
|
-
signal
|
|
65
|
-
});
|
|
66
|
-
if (response.status === 429 || response.status >= 500) {
|
|
67
|
-
if (i === retries - 1)
|
|
68
|
-
return response;
|
|
69
|
-
} else
|
|
70
|
-
return response;
|
|
71
|
-
} catch (error) {
|
|
72
|
-
if (i === retries - 1)
|
|
73
|
-
throw error;
|
|
74
|
-
} finally {
|
|
75
|
-
clearTimeout(timer);
|
|
76
|
-
}
|
|
77
|
-
const delay = Math.pow(2, i) * 1000;
|
|
78
|
-
await new Promise((resolve) => setTimeout(resolve, delay));
|
|
79
|
-
}
|
|
80
|
-
throw new Error("Unreachable");
|
|
81
|
-
}
|
|
82
|
-
validationPromise = null;
|
|
83
|
-
async validate() {
|
|
84
|
-
if (this.mode === "open-source")
|
|
85
|
-
return true;
|
|
86
|
-
if (this.cachedResult && Date.now() < this.cacheExpiry)
|
|
87
|
-
return true;
|
|
88
|
-
return this.revalidate();
|
|
89
|
-
}
|
|
90
|
-
revalidate() {
|
|
91
|
-
if (!this.validationPromise)
|
|
92
|
-
this.validationPromise = this.performValidation().finally(() => {
|
|
93
|
-
this.validationPromise = null;
|
|
94
|
-
});
|
|
95
|
-
return this.validationPromise;
|
|
96
|
-
}
|
|
97
|
-
async performValidation() {
|
|
98
|
-
const now = Date.now();
|
|
99
|
-
try {
|
|
100
|
-
if (!this.licenseUrl?.startsWith("https://") && !this.licenseUrl?.includes("localhost"))
|
|
101
|
-
this.logger?.warn("License URL is not HTTPS. Proceeding, but this is insecure.");
|
|
102
|
-
const response = await this.fetchWithRetry(`${this.licenseUrl}/validate`, {
|
|
103
|
-
method: "POST",
|
|
104
|
-
headers: { "content-type": "application/json" },
|
|
105
|
-
body: JSON.stringify({ licenseKey: this.licenseKey })
|
|
106
|
-
});
|
|
107
|
-
if (response.status === 429 || response.status >= 500)
|
|
108
|
-
throw new Error(`License server responded with ${response.status}`);
|
|
109
|
-
const data = await response.json();
|
|
110
|
-
if (data.valid) {
|
|
111
|
-
this.status = "valid";
|
|
112
|
-
this.logger?.info(`License validated: ${data.planTier} tier${data.expiresAt ? `, expires ${data.expiresAt.slice(0, 10)}` : ""}`);
|
|
113
|
-
this.cachedResult = data;
|
|
114
|
-
const ttlSeconds = data.leaseTtlSeconds || this.DEFAULT_TTL_MS / 1000;
|
|
115
|
-
this.cacheExpiry = now + ttlSeconds * 1000;
|
|
116
|
-
this.gracePeriodEnd = now + this.GRACE_PERIOD_MS;
|
|
117
|
-
this.scheduleRevalidation(ttlSeconds);
|
|
118
|
-
return true;
|
|
119
|
-
} else if (data.code === "RATE_LIMITED")
|
|
120
|
-
throw new Error(`License server rate limited: ${data.reason}`);
|
|
121
|
-
else {
|
|
122
|
-
this.status = "invalid";
|
|
123
|
-
this.logger?.error(`License validation failed: ${data.code} - ${data.reason}`);
|
|
124
|
-
this.clearCache();
|
|
125
|
-
return false;
|
|
126
|
-
}
|
|
127
|
-
} catch {
|
|
128
|
-
if (this.cachedResult && now < this.gracePeriodEnd) {
|
|
129
|
-
this.logger?.warn("License server unreachable. Using cached license (within grace period).");
|
|
130
|
-
this.status = "valid";
|
|
131
|
-
this.scheduleRevalidation(this.DEFAULT_TTL_MS / 1000);
|
|
132
|
-
return true;
|
|
133
|
-
} else if (this.cachedResult) {
|
|
134
|
-
this.logger?.error("License server unreachable and grace period expired. Disabling enterprise features.");
|
|
135
|
-
this.status = "invalid";
|
|
136
|
-
this.clearCache();
|
|
137
|
-
return false;
|
|
138
|
-
} else {
|
|
139
|
-
this.logger?.warn("License server unreachable on startup. Failing open (allowing features) and will retry.");
|
|
140
|
-
this.status = "valid";
|
|
141
|
-
this.cachedResult = {
|
|
142
|
-
valid: true,
|
|
143
|
-
entitlements: [],
|
|
144
|
-
planTier: "unknown",
|
|
145
|
-
expiresAt: null,
|
|
146
|
-
leaseTtlSeconds: 300
|
|
147
|
-
};
|
|
148
|
-
this.cacheExpiry = now + 300 * 1000;
|
|
149
|
-
this.gracePeriodEnd = now + this.GRACE_PERIOD_MS;
|
|
150
|
-
this.scheduleRevalidation(300);
|
|
151
|
-
return true;
|
|
152
|
-
}
|
|
153
|
-
}
|
|
154
|
-
}
|
|
155
|
-
scheduleRevalidation(ttlSeconds) {
|
|
156
|
-
if (this.revalidationTimeout)
|
|
157
|
-
clearTimeout(this.revalidationTimeout);
|
|
158
|
-
const revalidateMs = ttlSeconds * 1000 * 0.75;
|
|
159
|
-
this.revalidationTimeout = setTimeout(() => {
|
|
160
|
-
this.logger?.info("Performing background license revalidation...");
|
|
161
|
-
this.revalidate().catch((err) => {
|
|
162
|
-
this.logger?.error(`Background license revalidation failed: ${err instanceof Error ? err.message : String(err)}`);
|
|
163
|
-
});
|
|
164
|
-
}, revalidateMs);
|
|
165
|
-
this.revalidationTimeout.unref();
|
|
166
|
-
}
|
|
167
|
-
clearCache() {
|
|
168
|
-
this.cachedResult = null;
|
|
169
|
-
this.cacheExpiry = 0;
|
|
170
|
-
this.gracePeriodEnd = 0;
|
|
171
|
-
this.status = "invalid";
|
|
172
|
-
if (this.revalidationTimeout) {
|
|
173
|
-
clearTimeout(this.revalidationTimeout);
|
|
174
|
-
this.revalidationTimeout = null;
|
|
175
|
-
}
|
|
176
|
-
}
|
|
177
|
-
hasFeature(featureName) {
|
|
178
|
-
if (this.mode === "open-source")
|
|
179
|
-
return true;
|
|
180
|
-
if (this.status === "pending")
|
|
181
|
-
return true;
|
|
182
|
-
if (this.status === "invalid")
|
|
183
|
-
return false;
|
|
184
|
-
if (!this.cachedResult)
|
|
185
|
-
return false;
|
|
186
|
-
if (this.cachedResult.planTier === "unknown")
|
|
187
|
-
return true;
|
|
188
|
-
return this.cachedResult.entitlements.includes(featureName);
|
|
189
|
-
}
|
|
190
|
-
getEntitlements() {
|
|
191
|
-
if (this.mode === "open-source")
|
|
192
|
-
return null;
|
|
193
|
-
return this.cachedResult?.entitlements || null;
|
|
194
|
-
}
|
|
195
|
-
getSnapshot() {
|
|
196
|
-
return {
|
|
197
|
-
mode: this.mode,
|
|
198
|
-
status: this.status,
|
|
199
|
-
entitlements: this.cachedResult?.entitlements ?? null,
|
|
200
|
-
planTier: this.cachedResult?.planTier ?? null,
|
|
201
|
-
expiresAt: this.cachedResult?.expiresAt ?? null
|
|
202
|
-
};
|
|
203
|
-
}
|
|
204
|
-
};
|
|
205
|
-
function getLicenseKey() {
|
|
206
|
-
return process.env["MASTRA_LICENSE_KEY"] || process.env["MASTRA_EE_LICENSE"];
|
|
207
|
-
}
|
|
208
|
-
var validationStarted = false;
|
|
209
|
-
function getClient() {
|
|
210
|
-
const client = LicenseClient.getInstance();
|
|
211
|
-
if (!validationStarted) {
|
|
212
|
-
validationStarted = true;
|
|
213
|
-
client.validate().catch(() => {});
|
|
214
|
-
}
|
|
215
|
-
return client;
|
|
216
|
-
}
|
|
217
|
-
function validateLicense(licenseKey) {
|
|
218
|
-
const configuredKey = getLicenseKey();
|
|
219
|
-
if (!(licenseKey ?? configuredKey))
|
|
220
|
-
return { valid: false };
|
|
221
|
-
if (licenseKey !== undefined && licenseKey !== configuredKey)
|
|
222
|
-
return { valid: false };
|
|
223
|
-
const snap = getClient().getSnapshot();
|
|
224
|
-
return {
|
|
225
|
-
valid: snap.status !== "invalid",
|
|
226
|
-
features: snap.entitlements ?? undefined,
|
|
227
|
-
tier: snap.planTier ?? undefined,
|
|
228
|
-
expiresAt: snap.expiresAt ? new Date(snap.expiresAt) : undefined
|
|
229
|
-
};
|
|
230
|
-
}
|
|
231
|
-
function getSafeLicenseSummary() {
|
|
232
|
-
const key = getLicenseKey();
|
|
233
|
-
const info = validateLicense(key);
|
|
234
|
-
const licenseHash = key ? hashTelemetryValue(key) : undefined;
|
|
235
|
-
return {
|
|
236
|
-
valid: info.valid,
|
|
237
|
-
isDevEnvironment: isDevEnvironment(),
|
|
238
|
-
licenseHash: licenseHash ? licenseHash.slice(0, 16) : undefined,
|
|
239
|
-
anonymousId: licenseHash ? `${licenseHash.slice(0, 16)}-anonymous` : undefined,
|
|
240
|
-
features: info.features,
|
|
241
|
-
tier: info.tier
|
|
242
|
-
};
|
|
243
|
-
}
|
|
244
|
-
function isDevEnvironment() {
|
|
245
|
-
return process.env["MASTRA_DEV"] === "true" || process.env["MASTRA_DEV"] === "1" || process.env["NODE_ENV"] !== "production" && process.env["NODE_ENV"] !== "prod";
|
|
246
|
-
}
|
|
247
|
-
var MastraFGAPermissions = {
|
|
248
|
-
A2A_READ: "a2a:read",
|
|
249
|
-
A2A_WRITE: "a2a:write",
|
|
250
|
-
AGENT_BUILDER_EXECUTE: "agent-builder:execute",
|
|
251
|
-
AGENT_BUILDER_READ: "agent-builder:read",
|
|
252
|
-
AGENT_BUILDER_WRITE: "agent-builder:write",
|
|
253
|
-
AGENT_CONTROLLER_EXECUTE: "agent-controller:execute",
|
|
254
|
-
AGENT_CONTROLLER_READ: "agent-controller:read",
|
|
255
|
-
AGENTS_CREATE: "agents:create",
|
|
256
|
-
AGENTS_DELETE: "agents:delete",
|
|
257
|
-
AGENTS_EXECUTE: "agents:execute",
|
|
258
|
-
AGENTS_READ: "agents:read",
|
|
259
|
-
AGENTS_WRITE: "agents:write",
|
|
260
|
-
AUTH_READ: "auth:read",
|
|
261
|
-
BACKGROUND_TASKS_READ: "background-tasks:read",
|
|
262
|
-
CHANNELS_READ: "channels:read",
|
|
263
|
-
CHANNELS_WRITE: "channels:write",
|
|
264
|
-
DATASETS_DELETE: "datasets:delete",
|
|
265
|
-
DATASETS_EXECUTE: "datasets:execute",
|
|
266
|
-
DATASETS_READ: "datasets:read",
|
|
267
|
-
DATASETS_WRITE: "datasets:write",
|
|
268
|
-
EMBEDDERS_READ: "embedders:read",
|
|
269
|
-
EXPERIMENTS_DELETE: "experiments:delete",
|
|
270
|
-
EXPERIMENTS_READ: "experiments:read",
|
|
271
|
-
INFRASTRUCTURE_READ: "infrastructure:read",
|
|
272
|
-
LOGS_READ: "logs:read",
|
|
273
|
-
MCP_EXECUTE: "mcp:execute",
|
|
274
|
-
MCP_READ: "mcp:read",
|
|
275
|
-
MCP_WRITE: "mcp:write",
|
|
276
|
-
MEMORY_DELETE: "memory:delete",
|
|
277
|
-
MEMORY_EXECUTE: "memory:execute",
|
|
278
|
-
MEMORY_READ: "memory:read",
|
|
279
|
-
MEMORY_WRITE: "memory:write",
|
|
280
|
-
OBSERVABILITY_DELETE: "observability:delete",
|
|
281
|
-
OBSERVABILITY_READ: "observability:read",
|
|
282
|
-
OBSERVABILITY_WRITE: "observability:write",
|
|
283
|
-
PROCESSOR_PROVIDERS_READ: "processor-providers:read",
|
|
284
|
-
PROCESSORS_EXECUTE: "processors:execute",
|
|
285
|
-
PROCESSORS_READ: "processors:read",
|
|
286
|
-
SCHEDULES_DELETE: "schedules:delete",
|
|
287
|
-
SCHEDULES_EXECUTE: "schedules:execute",
|
|
288
|
-
SCHEDULES_READ: "schedules:read",
|
|
289
|
-
SCHEDULES_WRITE: "schedules:write",
|
|
290
|
-
SCORES_READ: "scores:read",
|
|
291
|
-
SCORES_WRITE: "scores:write",
|
|
292
|
-
STORED_AGENTS_DELETE: "stored-agents:delete",
|
|
293
|
-
STORED_AGENTS_PUBLISH: "stored-agents:publish",
|
|
294
|
-
STORED_AGENTS_READ: "stored-agents:read",
|
|
295
|
-
STORED_AGENTS_WRITE: "stored-agents:write",
|
|
296
|
-
STORED_MCP_CLIENTS_DELETE: "stored-mcp-clients:delete",
|
|
297
|
-
STORED_MCP_CLIENTS_PUBLISH: "stored-mcp-clients:publish",
|
|
298
|
-
STORED_MCP_CLIENTS_READ: "stored-mcp-clients:read",
|
|
299
|
-
STORED_MCP_CLIENTS_WRITE: "stored-mcp-clients:write",
|
|
300
|
-
STORED_PROMPT_BLOCKS_DELETE: "stored-prompt-blocks:delete",
|
|
301
|
-
STORED_PROMPT_BLOCKS_PUBLISH: "stored-prompt-blocks:publish",
|
|
302
|
-
STORED_PROMPT_BLOCKS_READ: "stored-prompt-blocks:read",
|
|
303
|
-
STORED_PROMPT_BLOCKS_WRITE: "stored-prompt-blocks:write",
|
|
304
|
-
STORED_SCORERS_DELETE: "stored-scorers:delete",
|
|
305
|
-
STORED_SCORERS_PUBLISH: "stored-scorers:publish",
|
|
306
|
-
STORED_SCORERS_READ: "stored-scorers:read",
|
|
307
|
-
STORED_SCORERS_WRITE: "stored-scorers:write",
|
|
308
|
-
STORED_SKILLS_DELETE: "stored-skills:delete",
|
|
309
|
-
STORED_SKILLS_PUBLISH: "stored-skills:publish",
|
|
310
|
-
STORED_SKILLS_READ: "stored-skills:read",
|
|
311
|
-
STORED_SKILLS_WRITE: "stored-skills:write",
|
|
312
|
-
STORED_WORKFLOWS_READ: "stored-workflows:read",
|
|
313
|
-
STORED_WORKFLOWS_WRITE: "stored-workflows:write",
|
|
314
|
-
STORED_WORKSPACES_DELETE: "stored-workspaces:delete",
|
|
315
|
-
STORED_WORKSPACES_READ: "stored-workspaces:read",
|
|
316
|
-
STORED_WORKSPACES_WRITE: "stored-workspaces:write",
|
|
317
|
-
SYSTEM_READ: "system:read",
|
|
318
|
-
TOOL_PROVIDERS_DELETE: "tool-providers:delete",
|
|
319
|
-
TOOL_PROVIDERS_READ: "tool-providers:read",
|
|
320
|
-
TOOL_PROVIDERS_WRITE: "tool-providers:write",
|
|
321
|
-
TOOLS_EXECUTE: "tools:execute",
|
|
322
|
-
TOOLS_READ: "tools:read",
|
|
323
|
-
VECTOR_DELETE: "vector:delete",
|
|
324
|
-
VECTOR_EXECUTE: "vector:execute",
|
|
325
|
-
VECTOR_READ: "vector:read",
|
|
326
|
-
VECTOR_WRITE: "vector:write",
|
|
327
|
-
VECTORS_READ: "vectors:read",
|
|
328
|
-
WORKFLOWS_DELETE: "workflows:delete",
|
|
329
|
-
WORKFLOWS_EXECUTE: "workflows:execute",
|
|
330
|
-
WORKFLOWS_READ: "workflows:read",
|
|
331
|
-
WORKFLOWS_WRITE: "workflows:write",
|
|
332
|
-
WORKSPACES_DELETE: "workspaces:delete",
|
|
333
|
-
WORKSPACES_READ: "workspaces:read",
|
|
334
|
-
WORKSPACES_WRITE: "workspaces:write"
|
|
335
|
-
};
|
|
336
|
-
function mergeFGAContext({ context, requestContext, metadata }) {
|
|
337
|
-
const mergedContext = { ...context };
|
|
338
|
-
if (requestContext)
|
|
339
|
-
mergedContext.requestContext = requestContext;
|
|
340
|
-
if (metadata || context?.metadata)
|
|
341
|
-
mergedContext.metadata = {
|
|
342
|
-
...context?.metadata ?? {},
|
|
343
|
-
...metadata ?? {}
|
|
344
|
-
};
|
|
345
|
-
return Object.keys(mergedContext).length > 0 ? mergedContext : undefined;
|
|
346
|
-
}
|
|
347
|
-
function isActorSignal(actor) {
|
|
348
|
-
if (actor === true)
|
|
349
|
-
return true;
|
|
350
|
-
if (typeof actor !== "object" || actor === null)
|
|
351
|
-
return false;
|
|
352
|
-
const candidate = actor;
|
|
353
|
-
return candidate.actorKind === "system" && (candidate.sourceWorkflow === undefined || typeof candidate.sourceWorkflow === "string");
|
|
354
|
-
}
|
|
355
|
-
function getAgentFGAResourceId2(agentId) {
|
|
356
|
-
return agentId;
|
|
357
|
-
}
|
|
358
|
-
function getWorkflowFGAResourceId(workflowId) {
|
|
359
|
-
return workflowId;
|
|
360
|
-
}
|
|
361
|
-
function getStandaloneToolFGAResourceId2(toolName) {
|
|
362
|
-
return toolName;
|
|
363
|
-
}
|
|
364
|
-
function getAgentToolFGAResourceId2(agentId, toolName) {
|
|
365
|
-
return `${agentId}:${toolName}`;
|
|
366
|
-
}
|
|
367
|
-
function getMCPToolFGAResourceId2(serverName, toolName) {
|
|
368
|
-
return JSON.stringify([serverName, toolName]);
|
|
369
|
-
}
|
|
370
|
-
async function requireFGA2(options) {
|
|
371
|
-
const { fgaProvider, user, resource, permission, context, requestContext, metadata, actor } = options;
|
|
372
|
-
if (!fgaProvider)
|
|
373
|
-
return;
|
|
374
|
-
const fgaContext = mergeFGAContext({
|
|
375
|
-
context,
|
|
376
|
-
requestContext,
|
|
377
|
-
metadata
|
|
378
|
-
});
|
|
379
|
-
const license = getSafeLicenseSummary();
|
|
380
|
-
if (isActorSignal(actor)) {
|
|
381
|
-
const tenantOrganizationId = fgaContext?.requestContext?.get("organizationId");
|
|
382
|
-
if (typeof tenantOrganizationId !== "string" || tenantOrganizationId.length === 0)
|
|
383
|
-
throw new FGADeniedError(user, resource, permission, "trusted actor requires organizationId / tenant scope");
|
|
384
|
-
const sourceWorkflow = (actor === true ? undefined : actor.sourceWorkflow) ?? (typeof fgaContext?.metadata?.["sourceWorkflow"] === "string" ? fgaContext.metadata["sourceWorkflow"] : undefined);
|
|
385
|
-
const providerEnforced = typeof fgaProvider.requireActor === "function";
|
|
386
|
-
if (providerEnforced)
|
|
387
|
-
await fgaProvider.requireActor(actor, {
|
|
388
|
-
resource,
|
|
389
|
-
permission,
|
|
390
|
-
...fgaContext ? { context: fgaContext } : {}
|
|
391
|
-
});
|
|
392
|
-
try {
|
|
393
|
-
captureEEEvent("ee_feature_used", license.anonymousId || getEETelemetryFallbackDistinctId(), {
|
|
394
|
-
feature: "fga",
|
|
395
|
-
actor_kind: "system",
|
|
396
|
-
actor_authorized_by: providerEnforced ? "provider" : "bypass",
|
|
397
|
-
resource_type: resource.type,
|
|
398
|
-
resource_id: resource.id,
|
|
399
|
-
permission,
|
|
400
|
-
user_id: null,
|
|
401
|
-
organization_membership_id: null,
|
|
402
|
-
source_workflow: sourceWorkflow,
|
|
403
|
-
license_valid: license.valid,
|
|
404
|
-
license_hash: license.licenseHash,
|
|
405
|
-
is_dev_environment: license.isDevEnvironment
|
|
406
|
-
});
|
|
407
|
-
} catch {}
|
|
408
|
-
return;
|
|
409
|
-
}
|
|
410
|
-
if (!user)
|
|
411
|
-
throw new FGADeniedError(user, resource, permission, "authenticated user is required");
|
|
412
|
-
await fgaProvider.require(user, fgaContext ? {
|
|
413
|
-
resource,
|
|
414
|
-
permission,
|
|
415
|
-
context: fgaContext
|
|
416
|
-
} : {
|
|
417
|
-
resource,
|
|
418
|
-
permission
|
|
419
|
-
});
|
|
420
|
-
try {
|
|
421
|
-
captureEEEvent("ee_feature_used", user?.id || license.anonymousId || getEETelemetryFallbackDistinctId(), {
|
|
422
|
-
feature: "fga",
|
|
423
|
-
actor_kind: "user",
|
|
424
|
-
resource_type: resource.type,
|
|
425
|
-
resource_id: resource.id,
|
|
426
|
-
permission,
|
|
427
|
-
user_id: user?.id ?? null,
|
|
428
|
-
organization_membership_id: user?.organizationMembershipId ?? null,
|
|
429
|
-
license_valid: license.valid,
|
|
430
|
-
license_hash: license.licenseHash,
|
|
431
|
-
is_dev_environment: license.isDevEnvironment
|
|
432
|
-
});
|
|
433
|
-
} catch {}
|
|
434
|
-
}
|
|
435
|
-
var FGADeniedError = class extends Error {
|
|
436
|
-
user;
|
|
437
|
-
resource;
|
|
438
|
-
permission;
|
|
439
|
-
status;
|
|
440
|
-
constructor(user, resource, permission, reason) {
|
|
441
|
-
const userId = user?.id || user?.workosId || "unknown";
|
|
442
|
-
const permissionLabel = Array.isArray(permission) ? `any of [${permission.join(", ")}]` : permission;
|
|
443
|
-
super(reason ? `FGA authorization denied: ${reason}` : `FGA authorization denied: user ${userId} cannot ${permissionLabel} on ${resource.type}:${resource.id}`);
|
|
444
|
-
this.name = "FGADeniedError";
|
|
445
|
-
this.user = user;
|
|
446
|
-
this.resource = resource;
|
|
447
|
-
this.permission = permission;
|
|
448
|
-
this.status = 403;
|
|
449
|
-
}
|
|
450
|
-
};
|
|
451
|
-
|
|
452
|
-
export { MastraFGAPermissions, getAgentFGAResourceId2, getWorkflowFGAResourceId, getStandaloneToolFGAResourceId2, getAgentToolFGAResourceId2, getMCPToolFGAResourceId2, requireFGA2 };
|