@mastra/core
Version:
314 lines (313 loc) • 11.2 kB
JavaScript
Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
const require_ee_DXvSoTl7 = require("../ee-DXvSoTl7-C7miIhtq.cjs");
const require_provider = require("../provider-BT2YASPQ.cjs");
let crypto$1 = require("crypto");
//#region ../_internals/auth/dist/session-DA5voLUM.js
function escapeRegExp$1(str) {
return str.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
}
/**
* In-memory session provider.
*
* Stores sessions in a Map. Useful for development but not suitable
* for production as sessions are lost on restart.
*
* @example
* ```typescript
* const sessionProvider = new MemorySessionProvider({
* ttl: 24 * 60 * 60 * 1000, // 24 hours
* });
* ```
*/
var MemorySessionProvider = class {
sessions = /* @__PURE__ */ new Map();
ttl;
cookieName;
cookiePath;
cleanupTimer = null;
constructor(options = {}) {
this.ttl = options.ttl ?? 10080 * 60 * 1e3;
this.cookieName = options.cookieName ?? "mastra_session";
this.cookiePath = options.cookiePath ?? "/";
const cleanupInterval = options.cleanupInterval ?? 6e4;
this.cleanupTimer = setInterval(() => this.cleanup(), cleanupInterval);
console.warn("[MemorySessionProvider] Using in-memory sessions. Sessions will be lost on server restart. Use a persistent session provider in production.");
}
async createSession(userId, metadata) {
const session = {
id: crypto.randomUUID(),
userId,
expiresAt: new Date(Date.now() + this.ttl),
createdAt: /* @__PURE__ */ new Date(),
metadata
};
this.sessions.set(session.id, session);
return session;
}
async validateSession(sessionId) {
const session = this.sessions.get(sessionId);
if (!session) return null;
if (session.expiresAt < /* @__PURE__ */ new Date()) {
this.sessions.delete(sessionId);
return null;
}
return session;
}
async destroySession(sessionId) {
this.sessions.delete(sessionId);
}
async refreshSession(sessionId) {
const session = await this.validateSession(sessionId);
if (!session) return null;
session.expiresAt = new Date(Date.now() + this.ttl);
this.sessions.set(sessionId, session);
return session;
}
getSessionIdFromRequest(request) {
const cookieHeader = request.headers.get("cookie");
if (!cookieHeader) return null;
const escapedName = escapeRegExp$1(this.cookieName);
return cookieHeader.match(new RegExp(`${escapedName}=([^;]+)`))?.[1] ?? null;
}
getSessionHeaders(session) {
const maxAge = Math.floor((session.expiresAt.getTime() - Date.now()) / 1e3);
return { "Set-Cookie": `${this.cookieName}=${session.id}; HttpOnly; SameSite=Lax; Path=${this.cookiePath}; Max-Age=${maxAge}` };
}
getClearSessionHeaders() {
return { "Set-Cookie": `${this.cookieName}=; HttpOnly; SameSite=Lax; Path=${this.cookiePath}; Max-Age=0` };
}
/**
* Clean up expired sessions.
*/
cleanup() {
const now = /* @__PURE__ */ new Date();
for (const [id, session] of this.sessions) if (session.expiresAt < now) this.sessions.delete(id);
}
/**
* Stop the cleanup timer.
*/
dispose() {
if (this.cleanupTimer) {
clearInterval(this.cleanupTimer);
this.cleanupTimer = null;
}
}
/**
* Get the number of active sessions (for debugging).
*/
getSessionCount() {
return this.sessions.size;
}
};
/**
* Signed cookie session provider.
*
* Stores session data in signed cookies. No server-side storage required.
*/
function escapeRegExp(str) {
return str.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
}
/**
* Signed cookie session provider.
*
* Stores session data in signed cookies. The session is validated
* by verifying the signature on each request.
*
* @example
* ```typescript
* const sessionProvider = new CookieSessionProvider({
* secret: process.env.SESSION_SECRET!,
* ttl: 7 * 24 * 60 * 60 * 1000, // 7 days
* });
* ```
*/
var CookieSessionProvider = class {
secret;
ttl;
cookieName;
cookiePath;
cookieDomain;
secure;
constructor(options) {
if (!options.secret || options.secret.length < 32) throw new Error("CookieSessionProvider requires a secret of at least 32 characters");
this.secret = options.secret;
this.ttl = options.ttl ?? 10080 * 60 * 1e3;
this.cookieName = options.cookieName ?? "mastra_session";
this.cookiePath = options.cookiePath ?? "/";
this.cookieDomain = options.cookieDomain;
this.secure = options.secure ?? process.env["NODE_ENV"] === "production";
}
async createSession(userId, metadata) {
const now = Date.now();
return {
id: crypto.randomUUID(),
userId,
expiresAt: new Date(now + this.ttl),
createdAt: new Date(now),
metadata
};
}
async validateSession(_sessionId) {
return null;
}
async destroySession(_sessionId) {}
async refreshSession(_sessionId) {
return null;
}
getSessionIdFromRequest(request) {
return this.getSessionFromCookie(request)?.id ?? null;
}
/**
* Get full session from cookie.
*/
getSessionFromCookie(request) {
const cookieHeader = request.headers.get("cookie");
if (!cookieHeader) return null;
const escapedName = escapeRegExp(this.cookieName);
const match = cookieHeader.match(new RegExp(`${escapedName}=([^;]+)`));
if (!match?.[1]) return null;
try {
const decoded = this.decodeAndVerify(match[1]);
if (!decoded) return null;
if (decoded.expiresAt < Date.now()) return null;
return {
id: decoded.id,
userId: decoded.userId,
expiresAt: new Date(decoded.expiresAt),
createdAt: new Date(decoded.createdAt),
metadata: decoded.metadata
};
} catch {
return null;
}
}
getSessionHeaders(session) {
const data = {
id: session.id,
userId: session.userId,
expiresAt: session.expiresAt.getTime(),
createdAt: session.createdAt.getTime(),
metadata: session.metadata
};
const encoded = this.signAndEncode(data);
const maxAge = Math.floor((session.expiresAt.getTime() - Date.now()) / 1e3);
let cookie = `${this.cookieName}=${encoded}; HttpOnly; SameSite=Lax; Path=${this.cookiePath}; Max-Age=${maxAge}`;
if (this.cookieDomain) cookie += `; Domain=${this.cookieDomain}`;
if (this.secure) cookie += "; Secure";
return { "Set-Cookie": cookie };
}
getClearSessionHeaders() {
let cookie = `${this.cookieName}=; HttpOnly; SameSite=Lax; Path=${this.cookiePath}; Max-Age=0`;
if (this.cookieDomain) cookie += `; Domain=${this.cookieDomain}`;
return { "Set-Cookie": cookie };
}
/**
* Sign and encode session data.
*/
signAndEncode(data) {
const json = JSON.stringify(data);
const signature = this.sign(json);
const payload = `${this.base64Encode(json)}.${signature}`;
return encodeURIComponent(payload);
}
/**
* Decode and verify session cookie.
*/
decodeAndVerify(cookie) {
try {
const [data, signature] = decodeURIComponent(cookie).split(".");
if (!data || !signature) return null;
const json = this.base64Decode(data);
const expectedSignature = this.sign(json);
if (!this.secureCompare(signature, expectedSignature)) return null;
return JSON.parse(json);
} catch {
return null;
}
}
/**
* Create HMAC-SHA256 signature.
*/
sign(data) {
return (0, crypto$1.createHmac)("sha256", this.secret).update(data).digest("base64url");
}
/**
* Base64 encode (consistent across Node.js and browser runtimes).
*/
base64Encode(str) {
const bytes = new TextEncoder().encode(str);
if (typeof Buffer !== "undefined") return Buffer.from(bytes).toString("base64");
let binary = "";
for (const byte of bytes) binary += String.fromCharCode(byte);
return btoa(binary);
}
/**
* Base64 decode (consistent across Node.js and browser runtimes).
*/
base64Decode(str) {
if (typeof Buffer !== "undefined") return Buffer.from(str, "base64").toString("utf-8");
const binary = atob(str);
const bytes = new Uint8Array(binary.length);
for (let i = 0; i < binary.length; i++) bytes[i] = binary.charCodeAt(i);
return new TextDecoder().decode(bytes);
}
/**
* Constant-time string comparison.
*/
secureCompare(a, b) {
if (a.length !== b.length) return false;
let result = 0;
for (let i = 0; i < a.length; i++) result |= a.charCodeAt(i) ^ b.charCodeAt(i);
return result === 0;
}
};
//#endregion
exports.ACTIONS = require_ee_DXvSoTl7.ACTIONS;
exports.CompositeAuth = require_provider.CompositeAuth;
exports.CookieSessionProvider = CookieSessionProvider;
exports.DEFAULT_ROLES = require_ee_DXvSoTl7.DEFAULT_ROLES;
exports.FGADeniedError = require_ee_DXvSoTl7.FGADeniedError;
exports.MastraAuthProvider = require_provider.MastraAuthProvider;
exports.MastraFGAPermissions = require_ee_DXvSoTl7.MastraFGAPermissions;
exports.MemorySessionProvider = MemorySessionProvider;
exports.PERMISSIONS = require_ee_DXvSoTl7.PERMISSIONS;
exports.PERMISSION_PATTERNS = require_ee_DXvSoTl7.PERMISSION_PATTERNS;
exports.RESOURCES = require_ee_DXvSoTl7.RESOURCES;
exports.SimpleAuth = require_provider.SimpleAuth;
exports.StaticRBACProvider = require_ee_DXvSoTl7.StaticRBACProvider;
exports.buildCapabilities = require_ee_DXvSoTl7.buildCapabilities;
exports.checkFGA = require_ee_DXvSoTl7.checkFGA;
exports.clearLicenseCache = require_ee_DXvSoTl7.clearLicenseCache;
exports.getAgentFGAResourceId = require_ee_DXvSoTl7.getAgentFGAResourceId;
exports.getAgentToolFGAResourceId = require_ee_DXvSoTl7.getAgentToolFGAResourceId;
exports.getDefaultRole = require_ee_DXvSoTl7.getDefaultRole;
exports.getMCPToolFGAResourceId = require_ee_DXvSoTl7.getMCPToolFGAResourceId;
exports.getRequestHeader = require_provider.getRequestHeader;
exports.getSafeLicenseSummary = require_ee_DXvSoTl7.getSafeLicenseSummary;
exports.getStandaloneToolFGAResourceId = require_ee_DXvSoTl7.getStandaloneToolFGAResourceId;
exports.getWebRequest = require_provider.getWebRequest;
exports.getWorkflowFGAResourceId = require_ee_DXvSoTl7.getWorkflowFGAResourceId;
exports.hasAuthInit = require_provider.hasAuthInit;
exports.hasPermission = require_ee_DXvSoTl7.hasPermission;
exports.isAuthHttpHandler = require_provider.isAuthHttpHandler;
exports.isAuthenticated = require_ee_DXvSoTl7.isAuthenticated;
exports.isCredentialsProvider = require_provider.isCredentialsProvider;
exports.isDevEnvironment = require_ee_DXvSoTl7.isDevEnvironment;
exports.isEEEnabled = require_ee_DXvSoTl7.isEEEnabled;
exports.isEELicenseValid = require_ee_DXvSoTl7.isEELicenseValid;
exports.isFeatureEnabled = require_ee_DXvSoTl7.isFeatureEnabled;
exports.isLicenseValid = require_ee_DXvSoTl7.isLicenseValid;
exports.isOrganizationsProvider = require_provider.isOrganizationsProvider;
exports.isSSOProvider = require_provider.isSSOProvider;
exports.isSessionProvider = require_provider.isSessionProvider;
exports.isUserProvider = require_provider.isUserProvider;
exports.isValidPermissionPattern = require_ee_DXvSoTl7.isValidPermissionPattern;
exports.matchesPermission = require_ee_DXvSoTl7.matchesPermission;
exports.requireFGA = require_ee_DXvSoTl7.requireFGA;
exports.resolvePermissions = require_ee_DXvSoTl7.resolvePermissions;
exports.resolvePermissionsFromMapping = require_ee_DXvSoTl7.resolvePermissionsFromMapping;
exports.startLicenseValidation = require_ee_DXvSoTl7.startLicenseValidation;
exports.validateLicense = require_ee_DXvSoTl7.validateLicense;
exports.validatePermissions = require_ee_DXvSoTl7.validatePermissions;
exports.warnIfDevEENeedsLicense = require_ee_DXvSoTl7.warnIfDevEENeedsLicense;
//# sourceMappingURL=index.cjs.map