fix(core): CompositeAuth duck-typing detection for interface capabilities (#16664)

Co-authored-by: Mastra Code (anthropic/claude-opus-4-6) <noreply@mastra.ai>

Author: rphansen91

.changeset/goofy-lines-fail.md

@@ -0,0 +1,6 @@
+---
+'@mastra/server': patch
+'@mastra/core': patch
+---
+
+Fixed CompositeAuth incorrectly advertising SSO, session, and user provider capabilities when no inner provider supports them. Studio would show an SSO login button even when no provider had SSO configured, leading to 401 errors on login attempts. The duck-typing check now verifies that interface methods are actual functions rather than just present on the prototype chain.

packages/core/src/auth/ee/capabilities.ts

@@ -111,7 +111,7 @@ export function isAuthenticated(
  * Check if an auth provider implements a specific interface.
  */
 function implementsInterface<T>(auth: unknown, method: keyof T): auth is T {
-  return auth !== null && typeof auth === 'object' && method in auth;
+  return auth !== null && typeof auth === 'object' && typeof (auth as any)[method] === 'function';
 }
 
 /**

packages/core/src/server/auth.test.ts

@@ -331,5 +331,46 @@ describe('Composite auth', () => {
         expect(authzResult).toBe(false);
       });
     });
+
+    describe('duck-typing detection', () => {
+      it('should NOT advertise SSO when no inner provider has it', () => {
+        const compositeAuth = new CompositeAuth([new MockAuthProvider(true, true)]);
+        expect(typeof (compositeAuth as any).getLoginUrl).not.toBe('function');
+        expect(typeof (compositeAuth as any).handleCallback).not.toBe('function');
+      });
+
+      it('should NOT advertise sessions when no inner provider has it', () => {
+        const compositeAuth = new CompositeAuth([new MockAuthProvider(true, true)]);
+        expect(typeof (compositeAuth as any).createSession).not.toBe('function');
+        expect(typeof (compositeAuth as any).getSessionIdFromRequest).not.toBe('function');
+      });
+
+      it('should NOT advertise user provider when no inner provider has it', () => {
+        const compositeAuth = new CompositeAuth([new MockAuthProvider(true, true)]);
+        expect(typeof (compositeAuth as any).getCurrentUser).not.toBe('function');
+        expect(typeof (compositeAuth as any).getUser).not.toBe('function');
+      });
+
+      it('should advertise SSO when an inner provider supports it', () => {
+        const ssoProvider = new MockAuthProvider(true, true) as any;
+        ssoProvider.getLoginUrl = () => 'https://example.com/login';
+        ssoProvider.handleCallback = async () => ({ user: { id: '1' } });
+        ssoProvider.getLoginButtonConfig = () => ({ provider: 'test', text: 'Sign in' });
+
+        const compositeAuth = new CompositeAuth([ssoProvider]);
+        expect(typeof (compositeAuth as any).getLoginUrl).toBe('function');
+        expect(typeof (compositeAuth as any).handleCallback).toBe('function');
+      });
+
+      it('should advertise user provider when an inner provider supports it', () => {
+        const userProvider = new MockAuthProvider(true, true) as any;
+        userProvider.getCurrentUser = async () => ({ id: '1' });
+        userProvider.getUser = async () => ({ id: '1' });
+
+        const compositeAuth = new CompositeAuth([userProvider]);
+        expect(typeof (compositeAuth as any).getCurrentUser).toBe('function');
+        expect(typeof (compositeAuth as any).getUser).toBe('function');
+      });
+    });
   });
 });

packages/core/src/server/composite-auth.ts

@@ -14,15 +14,25 @@ type PrimitiveAuthUser = string | number | boolean | bigint | symbol | null | un
 
 // Type guards for interface detection
 function isSSOProvider(p: unknown): p is ISSOProvider {
-  return p !== null && typeof p === 'object' && 'getLoginUrl' in p && 'handleCallback' in p;
+  return (
+    p !== null &&
+    typeof p === 'object' &&
+    typeof (p as any).getLoginUrl === 'function' &&
+    typeof (p as any).handleCallback === 'function'
+  );
 }
 
 function isSessionProvider(p: unknown): p is ISessionProvider {
-  return p !== null && typeof p === 'object' && 'validateSession' in p && 'createSession' in p;
+  return (
+    p !== null &&
+    typeof p === 'object' &&
+    typeof (p as any).validateSession === 'function' &&
+    typeof (p as any).createSession === 'function'
+  );
 }
 
 function isUserProvider(p: unknown): p is IUserProvider {
-  return p !== null && typeof p === 'object' && 'getCurrentUser' in p;
+  return p !== null && typeof p === 'object' && typeof (p as any).getCurrentUser === 'function';
 }
 
 function isObjectLike(value: unknown): value is object {
@@ -50,6 +60,25 @@ export class CompositeAuth
     if (providers.some(provider => typeof provider.mapUserToResourceId === 'function')) {
       this.mapUserToResourceId = user => this.mapAuthenticatedUserToResourceId(user);
     }
+
+    // Null out interface methods when no inner provider supports them.
+    // This ensures duck-typing checks (typeof auth.method === 'function')
+    // accurately reflect the composite's actual capabilities — preventing
+    // Studio from showing login options that no provider can handle.
+    if (!providers.some(isSSOProvider)) {
+      this.getLoginUrl = undefined as any;
+      this.handleCallback = undefined as any;
+      this.getLoginButtonConfig = undefined as any;
+    }
+    if (!providers.some(isSessionProvider)) {
+      this.createSession = undefined as any;
+      this.validateSession = undefined as any;
+      this.getSessionIdFromRequest = undefined as any;
+    }
+    if (!providers.some(isUserProvider)) {
+      this.getCurrentUser = undefined as any;
+      this.getUser = undefined as any;
+    }
   }
 
   // Find first provider implementing an interface

packages/server/src/server/handlers/auth.ts

@@ -122,7 +122,7 @@ function getFGAProvider(mastra: any): IFGAProvider<EEUser> | undefined {
  * Type guard to check if auth provider implements an interface.
  */
 function implementsInterface<T>(auth: unknown, method: keyof T): auth is T {
-  return auth !== null && typeof auth === 'object' && method in auth;
+  return auth !== null && typeof auth === 'object' && typeof (auth as any)[method] === 'function';
 }
 
 // ============================================================================