@adonis-agora/authkit-server 1.0.0-rc.7 → 1.0.0-rc.9

package/build/src/account/runtime.js

@@ -0,0 +1,623 @@
+import { joinAccountPath } from '../host/account_paths.js';
+import { resolveAccountRoles } from '../host/account_roles.js';
+import { ACCOUNT_SESSION_KEY } from '../host/account_session_key.js';
+import { readActiveOrgFromHostCtx, verifyActiveOrgMembership } from '../host/active_org_cookie.js';
+import { impersonationState } from '../host/impersonation_session.js';
+// ── process state (set when the console routes are mounted) ──────────────────────────────────────
+/** Built-in screens in the navigation, with their fixed order. */
+export const BUILTIN_NAV = [
+    { id: 'security', order: 10, label: 'account.security.title' },
+    { id: 'mfa', order: 20, label: 'account.mfa.title' },
+    { id: 'tokens', order: 30, label: 'account.tokens.title' },
+    { id: 'apps', order: 40, label: 'account.apps.title' },
+    { id: 'orgs', order: 50, label: 'account.orgs.title' },
+];
+let state = { pages: [], builtins: {}, registry: null };
+/** Called by `registerAuthHost` with the mounted screens and the frozen pages. */
+export function setAccountConsoleState(next) {
+    state = { ...state, ...next };
+}
+/** The served extension pages. */
+export function accountExtensionPages() {
+    return state.pages;
+}
+/** Resets the process state (tests). */
+export function resetAccountConsoleState() {
+    state = { pages: [], builtins: {}, registry: null };
+}
+export function findPageById(pageId) {
+    return state.pages.find((p) => p.page.id === pageId);
+}
+export function findPageBySegment(segment) {
+    return state.pages.find((p) => p.segment === segment);
+}
+/** Same-origin path of an extension page. */
+export function pageHref(page, query) {
+    const base = joinAccountPath(page.segment);
+    const qs = query ? new URLSearchParams(Object.entries(query).filter(([, v]) => v !== '')) : null;
+    const s = qs?.toString();
+    return s ? `${base}?${s}` : base;
+}
+// ── text ──────────────────────────────────────────────────────────────────────────────────────────
+/** Looks up a message: host catalog (overrides win), then the extension's own catalogs. */
+export function makeTranslator(hostMessages, locale, catalogs) {
+    const lookup = (key) => {
+        if (typeof hostMessages[key] === 'string')
+            return hostMessages[key];
+        for (const catalog of catalogs) {
+            const hit = catalog?.[locale]?.[key] ?? catalog?.[locale.split('-')[0] ?? '']?.[key];
+            if (typeof hit === 'string')
+                return hit;
+        }
+        for (const catalog of catalogs) {
+            const hit = catalog?.en?.[key];
+            if (typeof hit === 'string')
+                return hit;
+        }
+        return key;
+    };
+    return (text) => {
+        if (text === undefined || text === null)
+            return '';
+        if (typeof text === 'string')
+            return text;
+        if (typeof text !== 'object' || typeof text.key !== 'string')
+            return '';
+        const template = lookup(text.key);
+        const params = text.params;
+        if (!params)
+            return template;
+        return template.replace(/\{(\w+)\}/g, (match, name) => params[name] === undefined ? match : String(params[name]));
+    };
+}
+function fractionDigits(currency) {
+    try {
+        return (new Intl.NumberFormat('en', { style: 'currency', currency }).resolvedOptions()
+            .maximumFractionDigits ?? 2);
+    }
+    catch {
+        return 2;
+    }
+}
+function toDate(at) {
+    const d = at instanceof Date ? at : new Date(at);
+    return Number.isNaN(d.getTime()) ? null : d;
+}
+function relative(date, now, locale) {
+    const seconds = Math.round((date.getTime() - now.getTime()) / 1000);
+    const units = [
+        ['year', 31_536_000],
+        ['month', 2_592_000],
+        ['day', 86_400],
+        ['hour', 3600],
+        ['minute', 60],
+    ];
+    const rtf = new Intl.RelativeTimeFormat(locale, { numeric: 'auto' });
+    for (const [unit, size] of units) {
+        if (Math.abs(seconds) >= size)
+            return rtf.format(Math.round(seconds / size), unit);
+    }
+    return rtf.format(seconds, 'second');
+}
+export function formatValue(value, t, locale, now) {
+    try {
+        switch (value?.type) {
+            case 'text':
+                return { type: 'text', text: t(value.text) };
+            case 'badge':
+                return { type: 'badge', text: t(value.text), tone: value.tone ?? 'neutral' };
+            case 'money': {
+                const digits = fractionDigits(value.currency);
+                const major = value.amount / 10 ** digits;
+                return {
+                    type: 'money',
+                    text: new Intl.NumberFormat(locale, {
+                        style: 'currency',
+                        currency: value.currency,
+                    }).format(major),
+                    amount: value.amount,
+                    currency: value.currency,
+                };
+            }
+            case 'number': {
+                const n = new Intl.NumberFormat(locale).format(value.value);
+                const unit = value.unit ? t(value.unit) : '';
+                return { type: 'number', text: unit ? `${n} ${unit}` : n, value: value.value };
+            }
+            case 'date': {
+                const date = toDate(value.at);
+                if (!date)
+                    return { type: 'date', text: '' };
+                const style = value.style ?? 'date';
+                const text = style === 'relative'
+                    ? relative(date, now, locale)
+                    : new Intl.DateTimeFormat(locale, {
+                        dateStyle: 'medium',
+                        ...(style === 'datetime' ? { timeStyle: 'short' } : {}),
+                    }).format(date);
+                return { type: 'date', text, iso: date.toISOString() };
+            }
+            default:
+                return { type: 'text', text: '' };
+        }
+    }
+    catch {
+        return { type: 'text', text: '' };
+    }
+}
+// ── hrefs ─────────────────────────────────────────────────────────────────────────────────────────
+/**
+ * A safe href: an https URL when `external`, else a same-origin path (`/…`, never `//…` nor
+ * `/\…`). Anything else (`javascript:`, `data:`, protocol-relative) is `null`.
+ */
+export function safeHref(href, external) {
+    if (typeof href !== 'string' || href === '')
+        return null;
+    if (external) {
+        try {
+            const url = new URL(href);
+            return url.protocol === 'https:' ? url.toString() : null;
+        }
+        catch {
+            return null;
+        }
+    }
+    if (!href.startsWith('/') || href.startsWith('//') || href.startsWith('/\\'))
+        return null;
+    // Whitespace or control characters (code point < 0x20) never belong in a path.
+    if ([...href].some((ch) => ch.charCodeAt(0) < 0x20 || /\s/.test(ch)))
+        return null;
+    return href;
+}
+/** A script `src` a component block may load: same-origin, or https on an allowed origin. */
+export function safeScriptSrc(src, origins) {
+    const local = safeHref(src, false);
+    if (local)
+        return local;
+    if (typeof src !== 'string')
+        return null;
+    try {
+        const url = new URL(src);
+        return url.protocol === 'https:' && origins.includes(url.origin) ? url.toString() : null;
+    }
+    catch {
+        return null;
+    }
+}
+/** JSON for a `<script type="application/json">`: never closes the tag, never runs. */
+export function jsonForDataBlock(value) {
+    return JSON.stringify(value ?? {})
+        .replace(/</g, '\\u003c')
+        .replace(/>/g, '\\u003e')
+        .replace(/&/g, '\\u0026')
+        .replace(/\u2028/g, '\\u2028')
+        .replace(/\u2029/g, '\\u2029');
+}
+function resolveActions(input, refs) {
+    const out = [];
+    for (const ref of refs ?? []) {
+        const r = resolveAction(input.page, ref, input.t);
+        if (r)
+            out.push(r);
+    }
+    return out;
+}
+/** The button for `ref`, or `null` when the page has no such action. */
+export function resolveAction(page, ref, t) {
+    const action = page.page.actions?.[ref?.action];
+    if (!action || !Object.hasOwn(page.page.actions ?? {}, ref.action))
+        return null;
+    const target = typeof ref.target === 'string' ? ref.target : null;
+    const step = action.confirm !== undefined || (action.fields?.length ?? 0) > 0;
+    const base = `${joinAccountPath(page.segment)}/actions/${encodeURIComponent(ref.action)}`;
+    const qs = target !== null ? `?target=${encodeURIComponent(target)}` : '';
+    return {
+        action: ref.action,
+        target,
+        label: t(action.label),
+        tone: action.tone === 'danger' ? 'danger' : 'default',
+        sudo: action.sudo === true,
+        step,
+        href: step ? `${base}/confirm${qs}` : base,
+        postHref: base,
+        apiHref: `${joinAccountPath('api')}/x/${encodeURIComponent(page.page.id)}/actions/${encodeURIComponent(ref.action)}`,
+    };
+}
+function nextLink(input, cursor) {
+    if (typeof cursor !== 'string' || cursor === '')
+        return null;
+    return pageHref(input.page, {
+        cursor,
+        ...(input.query.tab ? { tab: input.query.tab } : {}),
+    });
+}
+let mountCounter = 0;
+/** Resolves one block; an unknown or malformed block becomes a warning notice. */
+export function resolveBlock(input, block) {
+    const { t, locale, now } = input;
+    const value = (v) => formatValue(v, t, locale, now);
+    const fallback = (why) => ({ kind: 'notice', tone: 'warning', text: why });
+    try {
+        switch (block?.kind) {
+            case 'notice':
+                return {
+                    kind: 'notice',
+                    tone: ['info', 'success', 'warning', 'danger'].includes(block.tone) ? block.tone : 'info',
+                    text: t(block.text),
+                };
+            case 'keyValue':
+                return {
+                    kind: 'keyValue',
+                    title: block.title ? t(block.title) : null,
+                    rows: (block.rows ?? []).map((row) => ({ label: t(row.label), value: value(row.value) })),
+                    actions: resolveActions(input, block.actions),
+                };
+            case 'list':
+                return {
+                    kind: 'list',
+                    title: block.title ? t(block.title) : null,
+                    empty: t(block.empty),
+                    items: (block.items ?? []).map((item) => ({
+                        title: t(item.title),
+                        subtitle: item.subtitle ? t(item.subtitle) : null,
+                        meta: (item.meta ?? []).map(value),
+                        badge: item.badge ? value(item.badge) : null,
+                        href: safeHref(item.href, item.external),
+                        external: item.external === true,
+                        actions: resolveActions(input, item.actions),
+                    })),
+                    nextHref: nextLink(input, block.nextCursor),
+                    nextCursor: block.nextCursor ?? null,
+                };
+            case 'table': {
+                const columns = (block.columns ?? []).map((c) => ({ id: c.id, label: t(c.label) }));
+                const rows = (block.rows ?? []).map((row) => ({
+                    cells: columns.map((c) => row.cells?.[c.id]
+                        ? value(row.cells[c.id])
+                        : { type: 'text', text: '' }),
+                    actions: resolveActions(input, row.actions),
+                }));
+                return {
+                    kind: 'table',
+                    title: block.title ? t(block.title) : null,
+                    empty: t(block.empty),
+                    columns,
+                    rows,
+                    hasActions: rows.some((r) => r.actions.length > 0),
+                    nextHref: nextLink(input, block.nextCursor),
+                    nextCursor: block.nextCursor ?? null,
+                };
+            }
+            case 'meter': {
+                const used = Number(block.used) || 0;
+                const limit = typeof block.limit === 'number' ? block.limit : null;
+                const unit = block.unit ? ` ${t(block.unit)}` : '';
+                const fmt = new Intl.NumberFormat(locale);
+                return {
+                    kind: 'meter',
+                    label: t(block.label),
+                    used,
+                    limit,
+                    percent: limit !== null && limit > 0 ? Math.min(100, Math.round((used / limit) * 100)) : null,
+                    text: limit !== null
+                        ? `${fmt.format(used)} / ${fmt.format(limit)}${unit}`
+                        : `${fmt.format(used)}${unit}`,
+                    resetsAt: block.resetsAt
+                        ? value({ type: 'date', at: block.resetsAt, style: 'relative' })
+                        : null,
+                };
+            }
+            case 'actions':
+                return { kind: 'actions', items: resolveActions(input, block.items) };
+            case 'link': {
+                const href = safeHref(block.href, block.external);
+                if (!href)
+                    return fallback(t({ key: 'account.extension.unsafe_link' }));
+                return { kind: 'link', label: t(block.label), href, external: block.external === true };
+            }
+            case 'toolPreview':
+                return {
+                    kind: 'toolPreview',
+                    title: t(block.title),
+                    tool: typeof block.tool === 'string' ? block.tool : null,
+                    subtitle: block.subtitle ? t(block.subtitle) : null,
+                    args: (block.args ?? []).map((a) => ({ label: t(a.label), value: value(a.value) })),
+                    body: block.body && typeof block.body.content === 'string'
+                        ? {
+                            format: block.body.format === 'json' ? 'json' : 'text',
+                            content: block.body.content,
+                        }
+                        : null,
+                    actions: resolveActions(input, block.actions),
+                };
+            case 'component': {
+                const provider = String(block.provider ?? '');
+                if (!/^[a-z0-9][a-z0-9-]{0,31}$/.test(provider)) {
+                    return fallback(t({ key: 'account.extension.unknown_block' }));
+                }
+                const scripts = [];
+                for (const script of (block.scripts ?? [])) {
+                    const src = safeScriptSrc(script?.src, input.page.scriptOrigins);
+                    if (!src)
+                        return fallback(t({ key: 'account.extension.unsafe_script' }));
+                    scripts.push({
+                        src,
+                        integrity: typeof script.integrity === 'string' ? script.integrity : null,
+                        module: script.module === true,
+                    });
+                }
+                const fb = block.fallback ? safeHref(block.fallback.href, block.fallback.external) : null;
+                mountCounter = (mountCounter + 1) % 1_000_000;
+                const props = (block.props ?? {});
+                return {
+                    kind: 'component',
+                    provider,
+                    mountId: `authkit-component-${input.page.page.id.replace(/\./g, '-')}-${mountCounter}`,
+                    scripts,
+                    propsJson: jsonForDataBlock(props),
+                    props,
+                    submit: block.submit ? resolveAction(input.page, block.submit, t) : null,
+                    fallback: fb && block.fallback
+                        ? {
+                            label: t(block.fallback.label),
+                            href: fb,
+                            external: block.fallback.external === true,
+                        }
+                        : null,
+                };
+            }
+            default:
+                return fallback(t({ key: 'account.extension.unknown_block' }));
+        }
+    }
+    catch {
+        return fallback(t({ key: 'account.extension.unknown_block' }));
+    }
+}
+export function resolvePageView(input) {
+    const tabs = (input.view.tabs ?? []).map((tab, index) => ({
+        id: tab.id,
+        label: input.t(tab.label),
+        href: pageHref(input.page, { tab: tab.id }),
+        active: input.query.tab ? input.query.tab === tab.id : index === 0,
+    }));
+    return {
+        id: input.page.page.id,
+        extension: input.page.extensionId,
+        title: input.t(input.page.page.title),
+        href: pageHref(input.page),
+        tabs,
+        blocks: (Array.isArray(input.view.blocks) ? input.view.blocks : []).map((b) => resolveBlock(input, b)),
+    };
+}
+const perRequest = new WeakMap();
+function tenantFrom(activeOrg) {
+    if (!activeOrg)
+        return null;
+    return {
+        id: activeOrg.id,
+        kind: 'organization',
+        source: 'authkit',
+        slug: activeOrg.slug,
+        role: activeOrg.role,
+    };
+}
+async function readActiveOrg(ctx, cfg, accountId) {
+    try {
+        const claimed = readActiveOrgFromHostCtx(ctx, { appKey: cfg.appKey });
+        const verified = await verifyActiveOrgMembership(cfg.accountStore, accountId, claimed);
+        return verified ? { id: verified.orgId, slug: verified.orgSlug, role: verified.orgRole } : null;
+    }
+    catch {
+        return null;
+    }
+}
+/** The console context of this request, built once. `null` without a signed-in account. */
+export function consoleRequest(ctx) {
+    const key = ctx;
+    const existing = perRequest.get(key);
+    if (existing)
+        return existing;
+    const built = (async () => {
+        const accountId = ctx.session?.get(ACCOUNT_SESSION_KEY);
+        if (!accountId)
+            return null;
+        const service = await ctx.containerResolver.make('authkit.server');
+        const cfg = service.config;
+        const account = (await cfg.accountStore.findById(accountId));
+        if (!account)
+            return null;
+        const roles = await resolveAccountRoles(cfg, account);
+        const activeOrg = await readActiveOrg(ctx, cfg, accountId);
+        const tenant = tenantFrom(activeOrg);
+        const config = cfg.accountConsole ?? {};
+        const summary = {
+            id: String(account.id),
+            email: account.email ?? null,
+            name: account.name ?? null,
+            roles,
+        };
+        const subject = config.subject
+            ? await config.subject(summary, { activeOrg, tenant })
+            : { type: 'User', id: summary.id };
+        const impersonation = impersonationState(ctx);
+        const locale = typeof cfg.locale === 'string' ? cfg.locale : 'en';
+        const base = {
+            account: summary,
+            activeOrg,
+            tenant,
+            subject,
+            impersonatedBy: impersonation.active ? (impersonation.impersonatorId ?? 'unknown') : null,
+            locale,
+            url(pageId, query) {
+                const page = findPageById(pageId);
+                return page ? pageHref(page, query) : joinAccountPath('');
+            },
+            make: (binding) => ctx.containerResolver.make(binding),
+            now: () => new Date(),
+        };
+        return {
+            base,
+            hostMessages: (cfg.messages ?? {}),
+            locale,
+            config,
+            cfg,
+            visible: new Map(),
+        };
+    })();
+    perRequest.set(key, built);
+    return built;
+}
+/** Validated query: `cursor` and `tab` only. */
+export function validatedQuery(raw) {
+    const out = {};
+    const cursor = raw.cursor;
+    if (typeof cursor === 'string' && cursor.length > 0 && cursor.length <= 512)
+        out.cursor = cursor;
+    const tab = raw.tab;
+    if (typeof tab === 'string' && /^[a-zA-Z0-9_-]{1,64}$/.test(tab))
+        out.tab = tab;
+    return out;
+}
+export function extensionContext(request, query) {
+    return { ...request.base, query };
+}
+/** The translator for one page (its extension's catalogs). */
+export function translatorFor(request, page) {
+    const registry = state.registry;
+    const catalogs = page
+        ? [registry?.extensions().find((e) => e.id === page.extensionId)?.messages]
+        : (registry?.extensions().map((e) => e.messages) ?? []);
+    return makeTranslator(request.hostMessages, request.locale, catalogs);
+}
+/** `page.visible(ctx)`, once per request; a throw hides the page. */
+export function isPageVisible(request, page) {
+    const cached = request.visible.get(page.page.id);
+    if (cached)
+        return cached;
+    const decided = (async () => {
+        if (typeof page.page.visible !== 'function')
+            return true;
+        try {
+            return (await page.page.visible(extensionContext(request, {}))) !== false;
+        }
+        catch (error) {
+            logExtensionError(page, 'visible', error);
+            return false;
+        }
+    })();
+    request.visible.set(page.page.id, decided);
+    return decided;
+}
+export function logExtensionError(page, where, error) {
+    const message = error instanceof Error ? error.message : String(error);
+    console.error(`authkit: account extension "${page.extensionId}" page "${page.page.id}" ${where}() failed: ${message}`);
+}
+/** Runs `fn` with a time budget. */
+export async function withTimeout(work, ms, what) {
+    let timer;
+    try {
+        return await Promise.race([
+            work,
+            new Promise((_, reject) => {
+                timer = setTimeout(() => reject(new Error(`${what} timed out after ${ms} ms`)), ms);
+            }),
+        ]);
+    }
+    finally {
+        if (timer !== undefined)
+            clearTimeout(timer);
+    }
+}
+/** Loads and resolves a page; a throw or timeout becomes a danger notice. */
+export async function loadResolvedPage(request, page, query) {
+    const t = translatorFor(request, page);
+    let view;
+    try {
+        const loaded = await withTimeout(page.page.load(extensionContext(request, query)), request.config.loadTimeoutMs ?? 5000, 'load()');
+        if (!loaded || typeof loaded !== 'object' || !Array.isArray(loaded.blocks)) {
+            throw new Error('load() must return { blocks: [...] }');
+        }
+        view = loaded;
+    }
+    catch (error) {
+        logExtensionError(page, 'load', error);
+        view = {
+            blocks: [{ kind: 'notice', tone: 'danger', text: { key: 'account.extension.load_failed' } }],
+        };
+    }
+    return resolvePageView({ page, view, t, locale: request.locale, now: request.base.now(), query });
+}
+const GROUP_ORDER = ['account', 'billing', 'ai', 'content'];
+/** Mounted built-in screens (id → path). */
+export function mountedBuiltins() {
+    return state.builtins;
+}
+/**
+ * The account console navigation: mounted built-in screens plus the extension pages visible to
+ * this account, sorted by `(group, order, id)`.
+ */
+export async function buildAccountNav(ctx, activeId) {
+    const request = await consoleRequest(ctx).catch(() => null);
+    const t = request
+        ? translatorFor(request, null)
+        : (text) => (typeof text === 'string' ? text : (text?.key ?? ''));
+    const host = (key) => (request ? (request.hostMessages[key] ?? key) : key);
+    const entries = [];
+    for (const builtin of BUILTIN_NAV) {
+        const href = state.builtins[builtin.id];
+        if (!href)
+            continue;
+        entries.push({
+            id: builtin.id,
+            label: host(builtin.label),
+            href,
+            active: activeId === builtin.id,
+            group: 'account',
+            order: builtin.order,
+        });
+    }
+    if (request) {
+        const visible = await Promise.all(state.pages.map((p) => isPageVisible(request, p)));
+        state.pages.forEach((page, index) => {
+            if (!visible[index] || page.page.nav === false)
+                return;
+            const nav = page.page.nav ?? {};
+            entries.push({
+                id: page.page.id,
+                label: t(nav.label ?? page.page.title),
+                href: pageHref(page),
+                active: activeId === page.page.id,
+                group: nav.group ?? 'account',
+                order: page.order,
+            });
+        });
+    }
+    return entries.sort((a, b) => GROUP_ORDER.indexOf(a.group) - GROUP_ORDER.indexOf(b.group) ||
+        a.order - b.order ||
+        (a.id < b.id ? -1 : a.id > b.id ? 1 : 0));
+}
+const NAV_VIEWS = {
+    'account/security': 'security',
+    'account/mfa': 'mfa',
+    'account/tokens': 'tokens',
+    'account/apps': 'apps',
+    'account/orgs': 'orgs',
+    'account/extension': 'extension',
+};
+/**
+ * The `accountNav` prop of an account screen (`null` for other views). Never throws: a broken
+ * extension leaves the built-in entries.
+ */
+export async function accountNavFor(ctx, view, props) {
+    const active = NAV_VIEWS[view];
+    if (!active)
+        return null;
+    const activeId = active === 'extension' ? (props.page?.id ?? null) : active;
+    try {
+        return await buildAccountNav(ctx, activeId);
+    }
+    catch {
+        return [];
+    }
+}

package/build/src/audit/audit_sink.d.ts

@@ -8,7 +8,7 @@
  * varre os `audit.record({ type: ... })` do `src/` e falha quando um evento
  * emitido não está aqui.
  */
-export declare const AUDIT_EVENT_TYPES: readonly ['login.success', 'login.failure', 'signup', 'password_reset.issued', 'password_reset.consumed', 'pat.issued', 'pat.revoked', 'pat.used', 'impersonation', 'impersonation.panel_viewed', 'impersonation.stopped', 'mfa.enabled', 'mfa.disabled', 'mfa.recovery_codes_regenerated', 'account.locked', 'passkey.registered', 'passkey.removed', 'email_verification.issued', 'email_verification.consumed', 'client.created', 'client.updated', 'client.deleted', 'session.revoked_all', 'password.changed', 'password.rehashed', 'email.change_requested', 'email.changed', 'login.new_ip_notified', 'login.new_device', 'login.otp_sent', 'login.otp_verified', 'login.otp_failed', 'login.otp_invalidated', 'bot_protection.rejected', 'grant.revoked_by_user', 'user.created', 'user.password_reset_sent', 'user.disabled', 'user.enabled', 'user.deleted', 'profile.updated', 'account.deleted', 'account.exported', 'keys.rotated', 'organization.created', 'organization.updated', 'organization.deleted', 'organization.member_added', 'organization.member_removed', 'organization.member_role_changed', 'organization.member_role_updated', 'organization.switched', 'organization.deactivated', 'organization.invitation_sent', 'organization.invitation_accepted', 'organization.invitation_revoked', 'email_change.requested', 'email_change.confirmed', 'email_change.cancelled', 'security_notice.sent', 'settings.updated', 'maintenance.enabled', 'maintenance.disabled', 'trusted_device.revoked', 'password.expired_change_forced', 'otp.locked', 'otp.unlocked', 'otp.unlock_failed', 'sudo.confirmed', 'session.single_enforced', 'account.expired_login_blocked', 'account.expiration_warned', 'login.magic_link_sent', 'session.revoked', 'account.signed_out_all', 'client.secret_regenerated', 'client.disabled', 'client.enabled', 'service_tenant.token_issued', 'roles_catalog.updated', 'agent.delegation_approved', 'agent.delegation_denied', 'agent.grant_revoked', 'agent.grant_revoked_by_admin', 'agent.allowed', 'agent.blocked', 'agent.registry_removed'];
+export declare const AUDIT_EVENT_TYPES: readonly ['login.success', 'login.failure', 'signup', 'password_reset.issued', 'password_reset.consumed', 'pat.issued', 'pat.revoked', 'pat.used', 'impersonation', 'impersonation.panel_viewed', 'impersonation.stopped', 'mfa.enabled', 'mfa.disabled', 'mfa.recovery_codes_regenerated', 'account.locked', 'passkey.registered', 'passkey.removed', 'email_verification.issued', 'email_verification.consumed', 'client.created', 'client.updated', 'client.deleted', 'session.revoked_all', 'password.changed', 'password.rehashed', 'email.change_requested', 'email.changed', 'login.new_ip_notified', 'login.new_device', 'login.otp_sent', 'login.otp_verified', 'login.otp_failed', 'login.otp_invalidated', 'bot_protection.rejected', 'grant.revoked_by_user', 'user.created', 'user.password_reset_sent', 'user.disabled', 'user.enabled', 'user.deleted', 'profile.updated', 'account.deleted', 'account.exported', 'keys.rotated', 'organization.created', 'organization.updated', 'organization.deleted', 'organization.member_added', 'organization.member_removed', 'organization.member_role_changed', 'organization.member_role_updated', 'organization.switched', 'organization.deactivated', 'organization.invitation_sent', 'organization.invitation_accepted', 'organization.invitation_revoked', 'email_change.requested', 'email_change.confirmed', 'email_change.cancelled', 'security_notice.sent', 'settings.updated', 'maintenance.enabled', 'maintenance.disabled', 'trusted_device.revoked', 'password.expired_change_forced', 'otp.locked', 'otp.unlocked', 'otp.unlock_failed', 'sudo.confirmed', 'session.single_enforced', 'account.expired_login_blocked', 'account.expiration_warned', 'login.magic_link_sent', 'session.revoked', 'account.signed_out_all', 'client.secret_regenerated', 'client.disabled', 'client.enabled', 'service_tenant.token_issued', 'roles_catalog.updated', 'agent.delegation_approved', 'agent.delegation_denied', 'agent.grant_revoked', 'agent.grant_revoked_by_admin', 'agent.allowed', 'agent.blocked', 'agent.registry_removed', 'account.extension.redirect', 'account.extension.action'];
 /** Tipos de eventos de auditoria relevantes para segurança emitidos pelo IdP. */
 export type AuditEventType = (typeof AUDIT_EVENT_TYPES)[number];
 /**

package/build/src/audit/audit_sink.js

@@ -124,4 +124,8 @@ export const AUDIT_EVENT_TYPES = [
     'agent.allowed',
     'agent.blocked',
     'agent.registry_removed',
+    // Console de conta: uma action de extension mandou o usuário para fora do app
+    // (`redirectTo.external`), ou uma action sensível (sudo/danger) rodou.
+    'account.extension.redirect',
+    'account.extension.action',
 ];