fix: use mastra__userPermissions key to match main branch pattern

The auth middleware sets both 'mastra__userPermissions' and 'userPermissions'
for backward compatibility, but main branch uses the namespaced key. Restoring
consistency with main.

Co-Authored-By: Mastra Code (anthropic/claude-opus-4-5) <noreply@mastra.ai>

Author: rphansen91

server-adapters/express/src/index.ts

@@ -548,7 +548,7 @@ export class MastraServer extends MastraServerBase<Application, Request, Respons
         if (authConfig) {
           const hasPermission = await loadHasPermission();
           if (hasPermission) {
-            const userPermissions = requestContext.get('userPermissions') as string[] | undefined;
+            const userPermissions = requestContext.get('mastra__userPermissions') as string[] | undefined;
             const permissionError = this.checkRoutePermission(route, userPermissions, hasPermission, requestContext);
 
             if (permissionError) {
@@ -656,7 +656,7 @@ export class MastraServer extends MastraServerBase<Application, Request, Respons
           if (authConfig) {
             const hasPermission = await loadHasPermission();
             if (hasPermission) {
-              const userPermissions = requestContext.get('userPermissions') as string[] | undefined;
+              const userPermissions = requestContext.get('mastra__userPermissions') as string[] | undefined;
               const permissionError = this.checkRoutePermission(
                 serverRoute,
                 userPermissions,

server-adapters/fastify/src/index.ts

@@ -638,7 +638,7 @@ export class MastraServer extends MastraServerBase<FastifyInstance, FastifyReque
       if (authConfig) {
         const hasPermission = await loadHasPermission();
         if (hasPermission) {
-          const userPermissions = requestContext.get('userPermissions') as string[] | undefined;
+          const userPermissions = requestContext.get('mastra__userPermissions') as string[] | undefined;
           const permissionError = this.checkRoutePermission(route, userPermissions, hasPermission, requestContext);
 
           if (permissionError) {
@@ -781,7 +781,7 @@ export class MastraServer extends MastraServerBase<FastifyInstance, FastifyReque
           }
 
           if (hasPermission) {
-            const userPermissions = requestContext.get('userPermissions') as string[] | undefined;
+            const userPermissions = requestContext.get('mastra__userPermissions') as string[] | undefined;
             const permissionError = this.checkRoutePermission(
               serverRoute,
               userPermissions,

server-adapters/hono/src/index.ts

@@ -528,7 +528,7 @@ export class MastraServer extends MastraServerBase<HonoApp, HonoRequest, Context
         if (authConfig) {
           const hasPermission = await loadHasPermission();
           if (hasPermission) {
-            const userPermissions = requestContext.get('userPermissions') as string[] | undefined;
+            const userPermissions = requestContext.get('mastra__userPermissions') as string[] | undefined;
             const permissionError = this.checkRoutePermission(route, userPermissions, hasPermission, requestContext);
 
             if (permissionError) {
@@ -646,7 +646,7 @@ export class MastraServer extends MastraServerBase<HonoApp, HonoRequest, Context
         if (authConfig) {
           const hasPermission = await loadHasPermission();
           if (hasPermission) {
-            const userPermissions = requestContext.get('userPermissions') as string[] | undefined;
+            const userPermissions = requestContext.get('mastra__userPermissions') as string[] | undefined;
             const permissionError = this.checkRoutePermission(
               serverRoute,
               userPermissions,

server-adapters/koa/src/index.ts

@@ -471,7 +471,7 @@ export class MastraServer extends MastraServerBase<Koa, Context, Context> {
     if (authConfig) {
       const hasPermission = await loadHasPermission();
       if (hasPermission) {
-        const userPermissions = requestContext.get('userPermissions') as string[] | undefined;
+        const userPermissions = requestContext.get('mastra__userPermissions') as string[] | undefined;
         const permissionError = this.checkRoutePermission(route, userPermissions, hasPermission, requestContext);
 
         if (permissionError) {
@@ -931,7 +931,7 @@ export class MastraServer extends MastraServerBase<Koa, Context, Context> {
           if (authConfig) {
             const hasPermission = await loadHasPermission();
             if (hasPermission) {
-              const userPermissions = requestContext.get('userPermissions') as string[] | undefined;
+              const userPermissions = requestContext.get('mastra__userPermissions') as string[] | undefined;
               const permissionError = server.checkRoutePermission(
                 serverRoute,
                 userPermissions,