feat(core): validate EE licenses against the Mastra license server (#17859)

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

Author: junydania

.changeset/thin-goats-trade.md

@@ -0,0 +1,12 @@
+---
+'@mastra/core': patch
+---
+
+License validation for EE features (RBAC, ACL, FGA, SSO) now checks your license key against the Mastra license server instead of validating it locally.
+
+**What changes for you**
+
+- Set `MASTRA_LICENSE_KEY` to your license key. `MASTRA_EE_LICENSE` continues to work as a supported legacy alias, so existing deployments are unaffected.
+- RBAC, ACL, and FGA are now enabled per-feature based on the entitlements your license plan includes, rather than a single blanket license check.
+- If the license server is briefly unreachable, previously validated licenses keep working (72-hour grace period), and validation never blocks startup — it runs in the background.
+- Development environments (`NODE_ENV` not set to production) are unaffected and keep full EE access without a license.

packages/core/package.json

@@ -281,6 +281,16 @@
         "default": "./dist/integration/index.cjs"
       }
     },
+    "./license": {
+      "import": {
+        "types": "./dist/license/index.d.ts",
+        "default": "./dist/license/index.js"
+      },
+      "require": {
+        "types": "./dist/license/index.d.ts",
+        "default": "./dist/license/index.cjs"
+      }
+    },
     "./llm": {
       "import": {
         "types": "./dist/llm/index.d.ts",

packages/core/src/auth/ee/__tests__/capabilities-fga.test.ts

@@ -103,7 +103,7 @@ describe('FGA Capability Detection', () => {
 
     expect('capabilities' in result && result.capabilities.fga).toBe(true);
     expect(warn).toHaveBeenCalledWith(
-      '[mastra/auth-ee] Mastra Enterprise features are enabled for local development, but no valid MASTRA_EE_LICENSE is configured. These features will be disabled in production without a valid license. Contact us to get a production license: https://mastra.ai/contact',
+      '[mastra/auth-ee] Mastra Enterprise features are enabled for local development, but no valid MASTRA_LICENSE_KEY is configured. These features will be disabled in production without a valid license. Contact us to get a production license: https://mastra.ai/contact',
     );
   });
 });

packages/core/src/auth/ee/capabilities.ts

@@ -9,7 +9,13 @@ import type { IACLProvider } from './interfaces/acl';
 import type { IFGAProvider } from './interfaces/fga';
 import type { IRBACProvider } from './interfaces/rbac';
 import type { EEUser } from './interfaces/user';
-import { isLicenseValid, isDevEnvironment, getSafeLicenseSummary, warnIfDevEENeedsLicense } from './license';
+import {
+  isLicenseValid,
+  isDevEnvironment,
+  isFeatureEnabled,
+  getSafeLicenseSummary,
+  warnIfDevEENeedsLicense,
+} from './license';
 
 /**
  * Public capabilities response (no authentication required).
@@ -254,6 +260,11 @@ export async function buildCapabilities(
   }
   const isLicensedOrCloud = hasLicense || isCloud || isSimple || isDev;
 
+  // Per-feature license gating: rbac/acl/fga additionally require the license
+  // entitlement (e.g. enterprise tier). Cloud, SimpleAuth and dev are exempt.
+  const isFeatureLicensed = (feature: string) =>
+    isCloud || isSimple || isDev || (hasLicense && isFeatureEnabled(feature));
+
   // Build login configuration (always public)
   let login: PublicAuthCapabilities['login'] = null;
 
@@ -323,18 +334,18 @@ export async function buildCapabilities(
 
   // Get RBAC provider from options (if configured)
   const rbacProvider = options?.rbac;
-  const hasRBAC = !!rbacProvider && isLicensedOrCloud;
+  const hasRBAC = !!rbacProvider && isFeatureLicensed('rbac');
 
   // Get FGA provider from options (if configured)
-  const hasFGA = !!options?.fga && isLicensedOrCloud;
+  const hasFGA = !!options?.fga && isFeatureLicensed('fga');
 
   // Build capability flags
   const capabilities: CapabilityFlags = {
     user: implementsInterface<IUserProvider>(auth, 'getCurrentUser') && isLicensedOrCloud,
     session: implementsInterface<ISessionProvider>(auth, 'createSession') && isLicensedOrCloud,
     sso: implementsInterface<ISSOProvider>(auth, 'getLoginUrl') && isLicensedOrCloud,
     rbac: hasRBAC,
-    acl: implementsInterface<IACLProvider>(auth, 'canAccess') && isLicensedOrCloud,
+    acl: implementsInterface<IACLProvider>(auth, 'canAccess') && isFeatureLicensed('acl'),
     fga: hasFGA,
   };
 

packages/core/src/auth/ee/index.ts

@@ -17,6 +17,7 @@ export * from './capabilities';
 // License
 export {
   validateLicense,
+  startLicenseValidation,
   isLicenseValid,
   isEELicenseValid,
   isFeatureEnabled,