@mastra/core
Version:
266 lines (265 loc) • 9.98 kB
JavaScript
import { A as isFeatureEnabled, C as buildCapabilities, D as isDevEnvironment, E as isAuthenticated, M as startLicenseValidation, N as validateLicense, O as isEEEnabled, P as warnIfDevEENeedsLicense, S as validatePermissions, T as getSafeLicenseSummary, _ as isValidPermissionPattern, a as PERMISSIONS, b as resolvePermissions, c as StaticRBACProvider, d as getAgentToolFGAResourceId, f as getDefaultRole, g as hasPermission, h as getWorkflowFGAResourceId, i as MastraFGAPermissions, j as isLicenseValid, k as isEELicenseValid, l as checkFGA, m as getStandaloneToolFGAResourceId, n as DEFAULT_ROLES, o as PERMISSION_PATTERNS, p as getMCPToolFGAResourceId, r as FGADeniedError, s as RESOURCES, t as ACTIONS, u as getAgentFGAResourceId, v as matchesPermission, w as clearLicenseCache, x as resolvePermissionsFromMapping, y as requireFGA } from "../ee-DXvSoTl7-BqTsKmQd.js";
import { a as isAuthHttpHandler, c as isSSOProvider, d as getRequestHeader, f as getWebRequest, i as hasAuthInit, l as isSessionProvider, n as MastraAuthProvider, o as isCredentialsProvider, r as SimpleAuth, s as isOrganizationsProvider, t as CompositeAuth, u as isUserProvider } from "../provider-SdHMYtrR.js";
import { createHmac } from "crypto";
//#region ../_internals/auth/dist/session-DA5voLUM.js
function escapeRegExp$1(str) {
return str.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
}
/**
* In-memory session provider.
*
* Stores sessions in a Map. Useful for development but not suitable
* for production as sessions are lost on restart.
*
* @example
* ```typescript
* const sessionProvider = new MemorySessionProvider({
* ttl: 24 * 60 * 60 * 1000, // 24 hours
* });
* ```
*/
var MemorySessionProvider = class {
sessions = /* @__PURE__ */ new Map();
ttl;
cookieName;
cookiePath;
cleanupTimer = null;
constructor(options = {}) {
this.ttl = options.ttl ?? 10080 * 60 * 1e3;
this.cookieName = options.cookieName ?? "mastra_session";
this.cookiePath = options.cookiePath ?? "/";
const cleanupInterval = options.cleanupInterval ?? 6e4;
this.cleanupTimer = setInterval(() => this.cleanup(), cleanupInterval);
console.warn("[MemorySessionProvider] Using in-memory sessions. Sessions will be lost on server restart. Use a persistent session provider in production.");
}
async createSession(userId, metadata) {
const session = {
id: crypto.randomUUID(),
userId,
expiresAt: new Date(Date.now() + this.ttl),
createdAt: /* @__PURE__ */ new Date(),
metadata
};
this.sessions.set(session.id, session);
return session;
}
async validateSession(sessionId) {
const session = this.sessions.get(sessionId);
if (!session) return null;
if (session.expiresAt < /* @__PURE__ */ new Date()) {
this.sessions.delete(sessionId);
return null;
}
return session;
}
async destroySession(sessionId) {
this.sessions.delete(sessionId);
}
async refreshSession(sessionId) {
const session = await this.validateSession(sessionId);
if (!session) return null;
session.expiresAt = new Date(Date.now() + this.ttl);
this.sessions.set(sessionId, session);
return session;
}
getSessionIdFromRequest(request) {
const cookieHeader = request.headers.get("cookie");
if (!cookieHeader) return null;
const escapedName = escapeRegExp$1(this.cookieName);
return cookieHeader.match(new RegExp(`${escapedName}=([^;]+)`))?.[1] ?? null;
}
getSessionHeaders(session) {
const maxAge = Math.floor((session.expiresAt.getTime() - Date.now()) / 1e3);
return { "Set-Cookie": `${this.cookieName}=${session.id}; HttpOnly; SameSite=Lax; Path=${this.cookiePath}; Max-Age=${maxAge}` };
}
getClearSessionHeaders() {
return { "Set-Cookie": `${this.cookieName}=; HttpOnly; SameSite=Lax; Path=${this.cookiePath}; Max-Age=0` };
}
/**
* Clean up expired sessions.
*/
cleanup() {
const now = /* @__PURE__ */ new Date();
for (const [id, session] of this.sessions) if (session.expiresAt < now) this.sessions.delete(id);
}
/**
* Stop the cleanup timer.
*/
dispose() {
if (this.cleanupTimer) {
clearInterval(this.cleanupTimer);
this.cleanupTimer = null;
}
}
/**
* Get the number of active sessions (for debugging).
*/
getSessionCount() {
return this.sessions.size;
}
};
/**
* Signed cookie session provider.
*
* Stores session data in signed cookies. No server-side storage required.
*/
function escapeRegExp(str) {
return str.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
}
/**
* Signed cookie session provider.
*
* Stores session data in signed cookies. The session is validated
* by verifying the signature on each request.
*
* @example
* ```typescript
* const sessionProvider = new CookieSessionProvider({
* secret: process.env.SESSION_SECRET!,
* ttl: 7 * 24 * 60 * 60 * 1000, // 7 days
* });
* ```
*/
var CookieSessionProvider = class {
secret;
ttl;
cookieName;
cookiePath;
cookieDomain;
secure;
constructor(options) {
if (!options.secret || options.secret.length < 32) throw new Error("CookieSessionProvider requires a secret of at least 32 characters");
this.secret = options.secret;
this.ttl = options.ttl ?? 10080 * 60 * 1e3;
this.cookieName = options.cookieName ?? "mastra_session";
this.cookiePath = options.cookiePath ?? "/";
this.cookieDomain = options.cookieDomain;
this.secure = options.secure ?? process.env["NODE_ENV"] === "production";
}
async createSession(userId, metadata) {
const now = Date.now();
return {
id: crypto.randomUUID(),
userId,
expiresAt: new Date(now + this.ttl),
createdAt: new Date(now),
metadata
};
}
async validateSession(_sessionId) {
return null;
}
async destroySession(_sessionId) {}
async refreshSession(_sessionId) {
return null;
}
getSessionIdFromRequest(request) {
return this.getSessionFromCookie(request)?.id ?? null;
}
/**
* Get full session from cookie.
*/
getSessionFromCookie(request) {
const cookieHeader = request.headers.get("cookie");
if (!cookieHeader) return null;
const escapedName = escapeRegExp(this.cookieName);
const match = cookieHeader.match(new RegExp(`${escapedName}=([^;]+)`));
if (!match?.[1]) return null;
try {
const decoded = this.decodeAndVerify(match[1]);
if (!decoded) return null;
if (decoded.expiresAt < Date.now()) return null;
return {
id: decoded.id,
userId: decoded.userId,
expiresAt: new Date(decoded.expiresAt),
createdAt: new Date(decoded.createdAt),
metadata: decoded.metadata
};
} catch {
return null;
}
}
getSessionHeaders(session) {
const data = {
id: session.id,
userId: session.userId,
expiresAt: session.expiresAt.getTime(),
createdAt: session.createdAt.getTime(),
metadata: session.metadata
};
const encoded = this.signAndEncode(data);
const maxAge = Math.floor((session.expiresAt.getTime() - Date.now()) / 1e3);
let cookie = `${this.cookieName}=${encoded}; HttpOnly; SameSite=Lax; Path=${this.cookiePath}; Max-Age=${maxAge}`;
if (this.cookieDomain) cookie += `; Domain=${this.cookieDomain}`;
if (this.secure) cookie += "; Secure";
return { "Set-Cookie": cookie };
}
getClearSessionHeaders() {
let cookie = `${this.cookieName}=; HttpOnly; SameSite=Lax; Path=${this.cookiePath}; Max-Age=0`;
if (this.cookieDomain) cookie += `; Domain=${this.cookieDomain}`;
return { "Set-Cookie": cookie };
}
/**
* Sign and encode session data.
*/
signAndEncode(data) {
const json = JSON.stringify(data);
const signature = this.sign(json);
const payload = `${this.base64Encode(json)}.${signature}`;
return encodeURIComponent(payload);
}
/**
* Decode and verify session cookie.
*/
decodeAndVerify(cookie) {
try {
const [data, signature] = decodeURIComponent(cookie).split(".");
if (!data || !signature) return null;
const json = this.base64Decode(data);
const expectedSignature = this.sign(json);
if (!this.secureCompare(signature, expectedSignature)) return null;
return JSON.parse(json);
} catch {
return null;
}
}
/**
* Create HMAC-SHA256 signature.
*/
sign(data) {
return createHmac("sha256", this.secret).update(data).digest("base64url");
}
/**
* Base64 encode (consistent across Node.js and browser runtimes).
*/
base64Encode(str) {
const bytes = new TextEncoder().encode(str);
if (typeof Buffer !== "undefined") return Buffer.from(bytes).toString("base64");
let binary = "";
for (const byte of bytes) binary += String.fromCharCode(byte);
return btoa(binary);
}
/**
* Base64 decode (consistent across Node.js and browser runtimes).
*/
base64Decode(str) {
if (typeof Buffer !== "undefined") return Buffer.from(str, "base64").toString("utf-8");
const binary = atob(str);
const bytes = new Uint8Array(binary.length);
for (let i = 0; i < binary.length; i++) bytes[i] = binary.charCodeAt(i);
return new TextDecoder().decode(bytes);
}
/**
* Constant-time string comparison.
*/
secureCompare(a, b) {
if (a.length !== b.length) return false;
let result = 0;
for (let i = 0; i < a.length; i++) result |= a.charCodeAt(i) ^ b.charCodeAt(i);
return result === 0;
}
};
//#endregion
export { ACTIONS, CompositeAuth, CookieSessionProvider, DEFAULT_ROLES, FGADeniedError, MastraAuthProvider, MastraFGAPermissions, MemorySessionProvider, PERMISSIONS, PERMISSION_PATTERNS, RESOURCES, SimpleAuth, StaticRBACProvider, buildCapabilities, checkFGA, clearLicenseCache, getAgentFGAResourceId, getAgentToolFGAResourceId, getDefaultRole, getMCPToolFGAResourceId, getRequestHeader, getSafeLicenseSummary, getStandaloneToolFGAResourceId, getWebRequest, getWorkflowFGAResourceId, hasAuthInit, hasPermission, isAuthHttpHandler, isAuthenticated, isCredentialsProvider, isDevEnvironment, isEEEnabled, isEELicenseValid, isFeatureEnabled, isLicenseValid, isOrganizationsProvider, isSSOProvider, isSessionProvider, isUserProvider, isValidPermissionPattern, matchesPermission, requireFGA, resolvePermissions, resolvePermissionsFromMapping, startLicenseValidation, validateLicense, validatePermissions, warnIfDevEENeedsLicense };
//# sourceMappingURL=index.js.map