Repository navigation
fix(agents): authenticate Mastra's built-in routes (foreman-359q) - #60
Merged
Merged
Conversation
server.auth was never set, so Mastra let every built-in /api route through: memory threads, stored agents, agent-controller sessions keyed by a resourceId in the URL, a2a, background tasks. Set it to Foreman's identity resolver (Supabase JWT or fmn_ key). Those routes trust the caller's resourceId, so authorize also closes /api/* to signed-in users; the web app never calls them. Studio still works under mastra dev, and requiresAuth:false routes (native channel webhooks) are unaffected. The chat-kit middleware and /chat share one identity lookup per request. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01JGhMwdrzUdii5pspk2YmwG
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
hamchowderr
marked this pull request as ready for review
October 22, 2026 17:40
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
This branch was successfully deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Before:
server.authwas never set, so Mastra let every built-in/api/*route through to anyone (checkRouteAuthin@mastra/serverreturns early when no auth is configured). That covered memory threads, stored agents, the agent-controller session routes that take the user id from the URL, a2a, and background tasks, plus our own/background-tasks/stream.After: Mastra authenticates its built-in routes and our
apiRouteswith Foreman's identity resolver, which accepts a Supabase JWT or anfmn_key. Signing in isn't enough for the built-in/api/*routes, because they accept any resourceId or thread id the caller sends, so one user could read another user's threads.authorizetherefore denies them to signed-in users too. The web app never calls them; it uses the chat-kit routes, which scope by user. Two things keep working:mastra dev, uses the samex-mastra-dev-playgroundrule Mastra applies when no auth is set.requiresAuth: false, such as the native channel webhooks, skip the check entirely.How:
lib/server-auth.tsexports a plainMastraAuthConfig(authenticateTokenandauthorize), and the Mastra instance sets it asserver.auth. Identity is memoised per request, so the chat-kit middleware, Mastra's route auth and/chatshare one lookup. Our own Hono routes are dispatched inserver.middlewareand already check auth themselves, so nothing changes for them. Finding 1 of the Mastra/Zapier audit.Checked:
tsc, Biome, vitest 558 passed / 10 skipped, plus new unit tests intests/unit/server-auth.test.ts. I haven't exercised this against a running server. That still needs checking: Studio undermastra dev, the web chat signed in, andcurl /api/memory/threadsreturning 401.Generated by Claude Code