@mastra/core
Version:
Mastra is a framework for building AI-powered applications and agents with a modern TypeScript stack.
140 lines • 4.48 kB
TypeScript
/**
* ACL provider interface for EE authentication.
* Enables resource-level access control in Studio.
*/
/**
* Identifier for a resource.
*/
export interface ResourceIdentifier {
/** Resource type (e.g., 'agent', 'workflow', 'thread') */
type: string;
/** Resource ID */
id: string;
}
/**
* An access control grant.
*/
export interface ACLGrant {
/** Subject of the grant (user or role) */
subject: {
type: 'user' | 'role';
id: string;
};
/** Resource the grant applies to */
resource: ResourceIdentifier;
/** Actions granted */
actions: string[];
/** When the grant was created */
grantedAt: Date;
/** Who created the grant */
grantedBy?: string;
}
/**
* Provider interface for access control lists (read-only).
*
* Implement this interface to enable:
* - Resource-level permission checks
* - Filtered resource lists based on access
* - ACL display in resource settings
*
* @example
* ```typescript
* class DatabaseACLProvider implements IACLProvider {
* async canAccess(user, resource, action) {
* const grants = await this.db.query(
* `SELECT * FROM acl_grants
* WHERE (subject_type = 'user' AND subject_id = $1)
* OR (subject_type = 'role' AND subject_id = ANY($2))
* AND resource_type = $3 AND resource_id = $4
* AND $5 = ANY(actions)`,
* [user.id, user.roles, resource.type, resource.id, action]
* );
* return grants.length > 0;
* }
*
* async filterAccessible(user, resources, resourceType, action) {
* const accessible = await this.listAccessible(user, resourceType, action);
* return resources.filter(r => accessible.includes(r.id));
* }
* }
* ```
*/
export interface IACLProvider<TUser = unknown> {
/**
* Check if user can perform action on resource.
*
* @param user - User making the request
* @param resource - Resource to check access for
* @param action - Action to check (e.g., 'read', 'write', 'execute', 'delete')
* @returns True if access is granted
*/
canAccess(user: TUser, resource: ResourceIdentifier, action: string): Promise<boolean>;
/**
* Get list of resource IDs user can access.
*
* @param user - User to check access for
* @param resourceType - Type of resources to list
* @param action - Action to filter by
* @returns Array of accessible resource IDs
*/
listAccessible(user: TUser, resourceType: string, action: string): Promise<string[]>;
/**
* Filter array of resources to only those user can access.
*
* @param user - User to check access for
* @param resources - Resources to filter
* @param resourceType - Type of the resources
* @param action - Action to filter by
* @returns Filtered array of accessible resources
*/
filterAccessible<T extends {
id: string;
}>(user: TUser, resources: T[], resourceType: string, action: string): Promise<T[]>;
}
/**
* Extended interface for managing ACLs (write operations).
*
* Implement this in addition to IACLProvider to enable ACL management.
*/
export interface IACLManager<TUser = unknown> extends IACLProvider<TUser> {
/**
* Grant access to a resource.
*
* @param subject - User or role to grant access to
* @param resource - Resource to grant access to
* @param actions - Actions to grant
*/
grant(subject: {
type: 'user' | 'role';
id: string;
}, resource: ResourceIdentifier, actions: string[]): Promise<void>;
/**
* Revoke access to a resource.
*
* @param subject - User or role to revoke access from
* @param resource - Resource to revoke access to
* @param actions - Actions to revoke (omit to revoke all)
*/
revoke(subject: {
type: 'user' | 'role';
id: string;
}, resource: ResourceIdentifier, actions?: string[]): Promise<void>;
/**
* List all grants for a resource.
*
* @param resource - Resource to list grants for
* @returns Array of grants
*/
listGrants(resource: ResourceIdentifier): Promise<ACLGrant[]>;
/**
* List all grants for a subject.
*
* @param subject - User or role to list grants for
* @returns Array of grants
*/
listGrantsForSubject(subject: {
type: 'user' | 'role';
id: string;
}): Promise<ACLGrant[]>;
}
//# sourceMappingURL=acl.d.ts.map