{"record":{"id":"4ccaaf44b18b0640","repo":"mastra-ai/mastra","slug":"workos-provider-requested-but-the-active-factory-a","errorCode":null,"errorMessage":"WorkOS provider requested but the active factory auth provider is not WorkOS","messagePattern":"WorkOS provider requested but the active factory auth provider is not WorkOS","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"mastracode/factory/src/auth.ts","lineNumber":335,"sourceCode":"    ensureUser: (c: Context) => ensureFactoryAuthUser(provider, c),\n    tenant: (c: Context) => factoryAuthTenant(c),\n    isOrganizationAdmin: (c: Context, organizationId: string) => isOrganizationAdmin(provider, c, organizationId),\n  };\n}\n\n/** True when the given provider is WorkOS. Gates WorkOS-only capabilities. */\nexport function isWorkOSAuth(provider: IMastraAuthProvider | undefined): boolean {\n  return provider instanceof MastraAuthWorkos;\n}\n\n/**\n * The raw WorkOS provider, for features that need the WorkOS client directly\n * (audit-log export, Admin Portal links). Callers must gate on\n * {@link isWorkOSAuth} first — throws when the provider is not WorkOS.\n */\nexport function getWorkOSProvider(provider: IMastraAuthProvider | undefined): MastraAuthWorkos {\n  if (provider instanceof MastraAuthWorkos) return provider;\n  throw new Error('WorkOS provider requested but the active factory auth provider is not WorkOS');\n}\n\n/**\n * Resolve the authenticated user for a request, stashing it on the context.\n *\n * The gate only authenticates non-`/auth/*` requests via the `Authorization`\n * header, so cookie-based browser navigations to public `/auth/*` routes (the\n * GitHub connect/callback flow) arrive without a gate-stashed user. This reads\n * the session cookie from the raw request the same way `/auth/me` does,\n * caches the result on the context, and returns it so downstream helpers like\n * {@link factoryAuthTenant} work uniformly on both gated and public routes.\n *\n * Returns `undefined` when there is no valid session (or auth is disabled).\n */\nexport async function ensureFactoryAuthUser(\n  provider: IMastraAuthProvider | undefined,\n  c: Context,\n): Promise<FactoryAuthUser | undefined> {","sourceCodeStart":317,"sourceCodeEnd":353,"githubUrl":"https://github.com/mastra-ai/mastra/blob/75dd419e613fe9c39f846ffc500716141b74fda6/mastracode/factory/src/auth.ts#L317-L353","documentation":"getWorkOSProvider returns the active factory auth provider narrowed to MastraAuthWorkos. It is documented to be called only after gating on isWorkOSAuth; if the active provider is a different auth provider (or undefined), it throws rather than returning the wrong client.","triggerScenarios":"Calling getWorkOSProvider(provider) with a provider that is not an instance of MastraAuthWorkos — e.g. the factory is configured with another auth provider (Keycloak, custom, none) or provider is undefined.","commonSituations":"Features like audit-log export or Admin Portal links run unconditionally in environments where the deployment uses a non-WorkOS auth provider; local/dev setups without WorkOS configured; provider never assigned before the feature path runs.","solutions":["Gate the call with isWorkOSAuth(provider) before invoking getWorkOSProvider.","Configure the factory's auth provider to WorkOS if WorkOS features are required in that environment.","Handle the undefined/mismatched-provider case gracefully (skip WorkOS-only features)."],"exampleFix":"// before\nconst workos = getWorkOSProvider(provider);\n// after\nif (isWorkOSAuth(provider)) {\n  const workos = getWorkOSProvider(provider);\n  // export audit logs...\n}","handlingStrategy":"type-guard","validationCode":"if (!provider || !isWorkOSAuth(provider)) {\n  // skip WorkOS-only feature or configure WorkOS as the factory auth provider\n  return;\n}","typeGuard":"function isWorkOSProvider(p: IMastraAuthProvider | undefined): p is MastraAuthWorkos {\n  return p instanceof MastraAuthWorkos;\n}","tryCatchPattern":"try {\n  const workos = getWorkOSProvider(provider);\n  // use workos client\n} catch (e) {\n  if ((e as Error).message.includes('not WorkOS')) {\n    console.warn('WorkOS features disabled: active auth provider is not WorkOS');\n    return;\n  }\n  throw e;\n}","preventionTips":["Always gate getWorkOSProvider behind isWorkOSAuth as documented","Feature-flag WorkOS-only paths (audit-log export, Admin Portal links) per environment","Verify the factory's configured auth provider at application startup"],"tags":["auth","workos","provider","guard"],"backgroundTag":"wrong-auth-provider","analyzedSha":"75dd419e613fe9c39f846ffc500716141b74fda6","analyzedAt":"2026-08-30T00:15:31.844Z","schemaVersion":2},"datasetVersion":"2026-08-30T08:17:16.595Z"}