@authup/server-core 1.0.0-beta.51 → 1.0.0-beta.53

package/dist/core/entities/event/entity-event-handler.mjs

@@ -0,0 +1,100 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { buildEntityDiff } from "./diff.mjs";
+import { hasOwnProperty, isObject } from "@authup/kit";
+import { EntityDefaultEventName, EntityType, EventName, EventScope } from "@authup/core-kit";
+//#region src/core/entities/event/entity-event-handler.ts
+const ENTITY_EVENT_NAME_MAP = {
+	[EntityDefaultEventName.CREATED]: EventName.CREATED,
+	[EntityDefaultEventName.UPDATED]: EventName.UPDATED,
+	[EntityDefaultEventName.DELETED]: EventName.DELETED
+};
+const ENTITY_REALM_KEY_MAP = {
+	[EntityType.CLIENT]: "realm_id",
+	[EntityType.CLIENT_PERMISSION]: "client_realm_id",
+	[EntityType.CLIENT_ROLE]: "client_realm_id",
+	[EntityType.CLIENT_SCOPE]: "client_realm_id",
+	[EntityType.CONSENT]: "realm_id",
+	[EntityType.EVENT]: "realm_id",
+	[EntityType.IDENTITY_PROVIDER]: "realm_id",
+	[EntityType.IDENTITY_PROVIDER_ACCOUNT]: "user_realm_id",
+	[EntityType.IDENTITY_PROVIDER_ATTRIBUTE]: "realm_id",
+	[EntityType.IDENTITY_PROVIDER_ATTRIBUTE_MAPPING]: "provider_realm_id",
+	[EntityType.IDENTITY_PROVIDER_PERMISSION_MAPPING]: "provider_realm_id",
+	[EntityType.IDENTITY_PROVIDER_ROLE_MAPPING]: "provider_realm_id",
+	[EntityType.KEY]: "realm_id",
+	[EntityType.POLICY]: "realm_id",
+	[EntityType.POLICY_ATTRIBUTE]: "realm_id",
+	[EntityType.PERMISSION]: "realm_id",
+	[EntityType.PERMISSION_POLICY]: "permission_realm_id",
+	[EntityType.REALM]: "id",
+	[EntityType.ROBOT]: "realm_id",
+	[EntityType.ROBOT_PERMISSION]: "robot_realm_id",
+	[EntityType.ROBOT_ROLE]: "robot_realm_id",
+	[EntityType.ROLE]: "realm_id",
+	[EntityType.ROLE_ATTRIBUTE]: "realm_id",
+	[EntityType.ROLE_PERMISSION]: "role_realm_id",
+	[EntityType.SCOPE]: "realm_id",
+	[EntityType.SESSION]: "realm_id",
+	[EntityType.TRUST_ANCHOR]: "realm_id",
+	[EntityType.USER]: "realm_id",
+	[EntityType.USER_ATTRIBUTE]: "realm_id",
+	[EntityType.USER_PERMISSION]: "user_realm_id",
+	[EntityType.USER_ROLE]: "user_realm_id"
+};
+/**
+* Bridges every entity create/update/delete published on the
+* DomainEventPublisher bus into the auth_events audit table (scope `entity`).
+*/ var EntityEventHandler = class {
+	eventService;
+	requestContext;
+	options;
+	constructor(ctx) {
+		this.eventService = ctx.eventService;
+		this.requestContext = ctx.requestContext;
+		this.options = ctx.options ?? {};
+	}
+	async handle(ctx) {
+		try {
+			if (ctx.content.type === "event") return;
+			const name = ENTITY_EVENT_NAME_MAP[ctx.content.event];
+			if (!name) return;
+			const refId = ctx.content.data?.id ?? null;
+			const realmIdCurrent = resolveEntityRealmId(ctx.content.type, ctx.content.data);
+			const realmId = typeof realmIdCurrent === "undefined" ? resolveEntityRealmId(ctx.content.type, ctx.dataPrevious) ?? null : realmIdCurrent;
+			const requestContext = this.requestContext ? this.requestContext() : void 0;
+			let data = null;
+			if (name === EventName.UPDATED && isObject(ctx.content.data) && isObject(ctx.dataPrevious)) {
+				const diff = buildEntityDiff(ctx.content.data, ctx.dataPrevious);
+				if (Object.keys(diff).length > 0) data = { diff };
+			}
+			await this.eventService.record({
+				scope: EventScope.ENTITY,
+				name,
+				refType: ctx.content.type,
+				refId,
+				realmId,
+				actorType: requestContext?.actorType ?? null,
+				actorId: requestContext?.actorId ?? null,
+				actorName: requestContext?.actorName ?? null,
+				requestPath: requestContext?.requestPath ?? null,
+				requestMethod: requestContext?.requestMethod ?? null,
+				requestIpAddress: requestContext?.requestIpAddress ?? null,
+				requestUserAgent: requestContext?.requestUserAgent ?? null,
+				data,
+				retentionDays: this.options.retentionDays
+			});
+		} catch {}
+	}
+};
+function resolveEntityRealmId(type, data) {
+	if (!isObject(data)) return;
+	const key = ENTITY_REALM_KEY_MAP[type] ?? "realm_id";
+	if (!hasOwnProperty(data, key)) return;
+	return typeof data[key] === "string" ? data[key] : null;
+}
+//#endregion
+export { EntityEventHandler };
+
+//# sourceMappingURL=entity-event-handler.mjs.map

package/dist/core/entities/event/entity-event-handler.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"entity-event-handler.mjs","names":["EntityDefaultEventName","EntityType","EventName","EventScope","hasOwnProperty","isObject","buildEntityDiff","ENTITY_EVENT_NAME_MAP","CREATED","UPDATED","DELETED","ENTITY_REALM_KEY_MAP","CLIENT","CLIENT_PERMISSION","CLIENT_ROLE","CLIENT_SCOPE","CONSENT","EVENT","IDENTITY_PROVIDER","IDENTITY_PROVIDER_ACCOUNT","IDENTITY_PROVIDER_ATTRIBUTE","IDENTITY_PROVIDER_ATTRIBUTE_MAPPING","IDENTITY_PROVIDER_PERMISSION_MAPPING","IDENTITY_PROVIDER_ROLE_MAPPING","KEY","POLICY","POLICY_ATTRIBUTE","PERMISSION","PERMISSION_POLICY","REALM","ROBOT","ROBOT_PERMISSION","ROBOT_ROLE","ROLE","ROLE_ATTRIBUTE","ROLE_PERMISSION","SCOPE","SESSION","TRUST_ANCHOR","USER","USER_ATTRIBUTE","USER_PERMISSION","USER_ROLE","EntityEventHandler","eventService","requestContext","options","ctx","handle","content","type","name","event","refId","data","id","realmIdCurrent","resolveEntityRealmId","realmId","dataPrevious","undefined","diff","Object","keys","length","record","scope","ENTITY","refType","actorType","actorId","actorName","requestPath","requestMethod","requestIpAddress","requestUserAgent","retentionDays","key"],"sources":["../../../../src/core/entities/event/entity-event-handler.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport {\n    EntityDefaultEventName,\n    EntityType,\n    EventName,\n    EventScope,\n} from '@authup/core-kit';\nimport { hasOwnProperty, isObject } from '@authup/kit';\nimport type { DomainEventPublishContext, IDomainEventHandler } from '@authup/server-kit';\nimport { buildEntityDiff } from './diff.ts';\nimport type {\n    EntityEventHandlerOptions,\n    EventRequestContext,\n    IEventService,\n} from './types.ts';\n\nexport type EntityEventHandlerContext = {\n    eventService: IEventService,\n    requestContext?: () => EventRequestContext | undefined,\n    options?: EntityEventHandlerOptions,\n};\n\nconst ENTITY_EVENT_NAME_MAP : Record<string, `${EventName}`> = {\n    [EntityDefaultEventName.CREATED]: EventName.CREATED,\n    [EntityDefaultEventName.UPDATED]: EventName.UPDATED,\n    [EntityDefaultEventName.DELETED]: EventName.DELETED,\n};\n\nconst ENTITY_REALM_KEY_MAP : Record<`${EntityType}`, string> = {\n    [EntityType.CLIENT]: 'realm_id',\n    [EntityType.CLIENT_PERMISSION]: 'client_realm_id',\n    [EntityType.CLIENT_ROLE]: 'client_realm_id',\n    [EntityType.CLIENT_SCOPE]: 'client_realm_id',\n    [EntityType.CONSENT]: 'realm_id',\n    [EntityType.EVENT]: 'realm_id',\n    [EntityType.IDENTITY_PROVIDER]: 'realm_id',\n    [EntityType.IDENTITY_PROVIDER_ACCOUNT]: 'user_realm_id',\n    [EntityType.IDENTITY_PROVIDER_ATTRIBUTE]: 'realm_id',\n    [EntityType.IDENTITY_PROVIDER_ATTRIBUTE_MAPPING]: 'provider_realm_id',\n    [EntityType.IDENTITY_PROVIDER_PERMISSION_MAPPING]: 'provider_realm_id',\n    [EntityType.IDENTITY_PROVIDER_ROLE_MAPPING]: 'provider_realm_id',\n    [EntityType.KEY]: 'realm_id',\n    [EntityType.POLICY]: 'realm_id',\n    [EntityType.POLICY_ATTRIBUTE]: 'realm_id',\n    [EntityType.PERMISSION]: 'realm_id',\n    [EntityType.PERMISSION_POLICY]: 'permission_realm_id',\n    [EntityType.REALM]: 'id',\n    [EntityType.ROBOT]: 'realm_id',\n    [EntityType.ROBOT_PERMISSION]: 'robot_realm_id',\n    [EntityType.ROBOT_ROLE]: 'robot_realm_id',\n    [EntityType.ROLE]: 'realm_id',\n    [EntityType.ROLE_ATTRIBUTE]: 'realm_id',\n    [EntityType.ROLE_PERMISSION]: 'role_realm_id',\n    [EntityType.SCOPE]: 'realm_id',\n    [EntityType.SESSION]: 'realm_id',\n    [EntityType.TRUST_ANCHOR]: 'realm_id',\n    [EntityType.USER]: 'realm_id',\n    [EntityType.USER_ATTRIBUTE]: 'realm_id',\n    [EntityType.USER_PERMISSION]: 'user_realm_id',\n    [EntityType.USER_ROLE]: 'user_realm_id',\n};\n\n/**\n * Bridges every entity create/update/delete published on the\n * DomainEventPublisher bus into the auth_events audit table (scope `entity`).\n */\nexport class EntityEventHandler implements IDomainEventHandler {\n    protected eventService : IEventService;\n\n    protected requestContext? : () => EventRequestContext | undefined;\n\n    protected options : EntityEventHandlerOptions;\n\n    constructor(ctx: EntityEventHandlerContext) {\n        this.eventService = ctx.eventService;\n        this.requestContext = ctx.requestContext;\n        this.options = ctx.options ?? {};\n    }\n\n    async handle(ctx: DomainEventPublishContext): Promise<void> {\n        try {\n            // recursion guard — no event subscriber exists today (the\n            // auth_events entity is deliberately subscriber-less), so this is\n            // defense in depth against an audit-write feedback loop.\n            if (ctx.content.type === 'event') {\n                return;\n            }\n\n            const name = ENTITY_EVENT_NAME_MAP[ctx.content.event];\n            if (!name) {\n                return;\n            }\n\n            const refId = ctx.content.data?.id ?? null;\n            const realmIdCurrent = resolveEntityRealmId(ctx.content.type, ctx.content.data);\n            const realmId = typeof realmIdCurrent === 'undefined' ?\n                (resolveEntityRealmId(ctx.content.type, ctx.dataPrevious) ?? null) :\n                realmIdCurrent;\n\n            const requestContext = this.requestContext ?\n                this.requestContext() :\n                undefined;\n\n            let data : Record<string, any> | null = null;\n            if (name === EventName.UPDATED && isObject(ctx.content.data) && isObject(ctx.dataPrevious)) {\n                const diff = buildEntityDiff(ctx.content.data, ctx.dataPrevious);\n                if (Object.keys(diff).length > 0) {\n                    data = { diff };\n                }\n            }\n\n            await this.eventService.record({\n                scope: EventScope.ENTITY,\n                name,\n                refType: ctx.content.type,\n                refId,\n                realmId,\n                actorType: requestContext?.actorType ?? null,\n                actorId: requestContext?.actorId ?? null,\n                actorName: requestContext?.actorName ?? null,\n                requestPath: requestContext?.requestPath ?? null,\n                requestMethod: requestContext?.requestMethod ?? null,\n                requestIpAddress: requestContext?.requestIpAddress ?? null,\n                requestUserAgent: requestContext?.requestUserAgent ?? null,\n                data,\n                retentionDays: this.options.retentionDays,\n            });\n        } catch {\n            // record() never throws, but the bridge itself must also never\n            // fail the originating publish.\n        }\n    }\n}\n\nfunction resolveEntityRealmId(\n    type: string,\n    data: unknown,\n): string | null | undefined {\n    if (!isObject(data)) {\n        return undefined;\n    }\n\n    const key = ENTITY_REALM_KEY_MAP[type as `${EntityType}`] ?? 'realm_id';\n    if (!hasOwnProperty(data, key)) {\n        return undefined;\n    }\n\n    return typeof data[key] === 'string' ? data[key] : null;\n}\n"],"mappings":";;;;;;;AA4BA,MAAMO,wBAAyD;EAC1DP,uBAAuBQ,UAAUN,UAAUM;EAC3CR,uBAAuBS,UAAUP,UAAUO;EAC3CT,uBAAuBU,UAAUR,UAAUQ;AAChD;AAEA,MAAMC,uBAAyD;EAC1DV,WAAWW,SAAS;EACpBX,WAAWY,oBAAoB;EAC/BZ,WAAWa,cAAc;EACzBb,WAAWc,eAAe;EAC1Bd,WAAWe,UAAU;EACrBf,WAAWgB,QAAQ;EACnBhB,WAAWiB,oBAAoB;EAC/BjB,WAAWkB,4BAA4B;EACvClB,WAAWmB,8BAA8B;EACzCnB,WAAWoB,sCAAsC;EACjDpB,WAAWqB,uCAAuC;EAClDrB,WAAWsB,iCAAiC;EAC5CtB,WAAWuB,MAAM;EACjBvB,WAAWwB,SAAS;EACpBxB,WAAWyB,mBAAmB;EAC9BzB,WAAW0B,aAAa;EACxB1B,WAAW2B,oBAAoB;EAC/B3B,WAAW4B,QAAQ;EACnB5B,WAAW6B,QAAQ;EACnB7B,WAAW8B,mBAAmB;EAC9B9B,WAAW+B,aAAa;EACxB/B,WAAWgC,OAAO;EAClBhC,WAAWiC,iBAAiB;EAC5BjC,WAAWkC,kBAAkB;EAC7BlC,WAAWmC,QAAQ;EACnBnC,WAAWoC,UAAU;EACrBpC,WAAWqC,eAAe;EAC1BrC,WAAWsC,OAAO;EAClBtC,WAAWuC,iBAAiB;EAC5BvC,WAAWwC,kBAAkB;EAC7BxC,WAAWyC,YAAY;AAC5B;;;;GAMA,IAAaC,qBAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEV,YAAYC,KAAgC;EACxC,KAAKH,eAAeG,IAAIH;EACxB,KAAKC,iBAAiBE,IAAIF;EAC1B,KAAKC,UAAUC,IAAID,WAAW,CAAC;CACnC;CAEA,MAAME,OAAOD,KAA+C;EACxD,IAAI;GAIA,IAAIA,IAAIE,QAAQC,SAAS,SACrB;GAGJ,MAAMC,OAAO5C,sBAAsBwC,IAAIE,QAAQG;GAC/C,IAAI,CAACD,MACD;GAGJ,MAAME,QAAQN,IAAIE,QAAQK,MAAMC,MAAM;GACtC,MAAMC,iBAAiBC,qBAAqBV,IAAIE,QAAQC,MAAMH,IAAIE,QAAQK,IAAI;GAC9E,MAAMI,UAAU,OAAOF,mBAAmB,cACrCC,qBAAqBV,IAAIE,QAAQC,MAAMH,IAAIY,YAAY,KAAK,OAC7DH;GAEJ,MAAMX,iBAAiB,KAAKA,iBACxB,KAAKA,eAAc,IACnBe,KAAAA;GAEJ,IAAIN,OAAoC;GACxC,IAAIH,SAASjD,UAAUO,WAAWJ,SAAS0C,IAAIE,QAAQK,IAAI,KAAKjD,SAAS0C,IAAIY,YAAY,GAAG;IACxF,MAAME,OAAOvD,gBAAgByC,IAAIE,QAAQK,MAAMP,IAAIY,YAAY;IAC/D,IAAIG,OAAOC,KAAKF,IAAAA,CAAAA,CAAMG,SAAS,GAC3BV,OAAO,EAAEO,KAAK;GAEtB;GAEA,MAAM,KAAKjB,aAAaqB,OAAO;IAC3BC,OAAO/D,WAAWgE;IAClBhB;IACAiB,SAASrB,IAAIE,QAAQC;IACrBG;IACAK;IACAW,WAAWxB,gBAAgBwB,aAAa;IACxCC,SAASzB,gBAAgByB,WAAW;IACpCC,WAAW1B,gBAAgB0B,aAAa;IACxCC,aAAa3B,gBAAgB2B,eAAe;IAC5CC,eAAe5B,gBAAgB4B,iBAAiB;IAChDC,kBAAkB7B,gBAAgB6B,oBAAoB;IACtDC,kBAAkB9B,gBAAgB8B,oBAAoB;IACtDrB;IACAsB,eAAe,KAAK9B,QAAQ8B;GAChC,CAAA;EACJ,QAAQ,CAGR;CACJ;AACJ;AAEA,SAASnB,qBACLP,MACAI,MAAa;CAEb,IAAI,CAACjD,SAASiD,IAAAA,GACV;CAGJ,MAAMuB,MAAMlE,qBAAqBuC,SAA4B;CAC7D,IAAI,CAAC9C,eAAekD,MAAMuB,GAAAA,GACtB;CAGJ,OAAO,OAAOvB,KAAKuB,SAAS,WAAWvB,KAAKuB,OAAO;AACvD"}

package/dist/core/entities/event/index.d.ts

@@ -0,0 +1,7 @@
+export * from './constants.ts';
+export * from './diff.ts';
+export * from './entity-event-handler.ts';
+export * from './sanitize.ts';
+export * from './service.ts';
+export * from './types.ts';
+//# sourceMappingURL=index.d.ts.map

package/dist/core/entities/event/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/event/index.ts"],"names":[],"mappings":"AAOA,cAAc,gBAAgB,CAAC;AAC/B,cAAc,WAAW,CAAC;AAC1B,cAAc,2BAA2B,CAAC;AAC1C,cAAc,eAAe,CAAC;AAC9B,cAAc,cAAc,CAAC;AAC7B,cAAc,YAAY,CAAC"}

package/dist/core/entities/event/index.mjs

@@ -0,0 +1,9 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { EVENT_LOG_RETENTION_DAYS_DEFAULT } from "./constants.mjs";
+import { EVENT_DIFF_SECRET_KEY_REGEX, EVENT_DIFF_VALUE_MAX_LENGTH, buildEntityDiff } from "./diff.mjs";
+import { EntityEventHandler } from "./entity-event-handler.mjs";
+import { sanitizeEventData } from "./sanitize.mjs";
+import { EventService } from "./service.mjs";
+export { EVENT_DIFF_SECRET_KEY_REGEX, EVENT_DIFF_VALUE_MAX_LENGTH, EVENT_LOG_RETENTION_DAYS_DEFAULT, EntityEventHandler, EventService, buildEntityDiff, sanitizeEventData };

package/dist/core/entities/event/sanitize.d.ts

@@ -0,0 +1,2 @@
+export declare function sanitizeEventData(input?: Record<string, any> | null): Record<string, any> | null;
+//# sourceMappingURL=sanitize.d.ts.map

package/dist/core/entities/event/sanitize.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sanitize.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/event/sanitize.ts"],"names":[],"mappings":"AAqGA,wBAAgB,iBAAiB,CAC7B,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,IAAI,GACnC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,IAAI,CA6B5B"}

package/dist/core/entities/event/sanitize.mjs

@@ -0,0 +1,83 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { EVENT_DIFF_SECRET_KEY_REGEX } from "./diff.mjs";
+import { isObject } from "@authup/kit";
+//#region src/core/entities/event/sanitize.ts
+/**
+* The central PII/credential write boundary for event context data.
+*
+* Allowlist-first: only these keys survive, and only with scalar values —
+* objects and arrays are dropped outright, so a nested structure can never
+* smuggle a secret past the boundary (this subsumes a denylist: password,
+* client_secret, code, code_verifier, *token* etc. are simply never listed).
+* session_id / jti / revoked_session_id are opaque correlation ids, not PII.
+* name / use / status / enabled / force describe key & trust-anchor lifecycle
+* operations (issue #3269) — canonical identifiers and enum/flag metadata,
+* never material. kind is the MFA authenticator kind (totp/email/...).
+*
+* The single structured exception is `diff` (entity-CRUD bridge): it survives
+* only as a one-level object of `{ next, previous }` scalar pairs, keys
+* re-checked against the diff secret denylist — the write boundary stays the
+* choke point even though buildEntityDiff pre-sanitizes.
+*/ const DATA_KEY_ALLOW_LIST = [
+	"grant_type",
+	"scope",
+	"response_type",
+	"prompt",
+	"error",
+	"error_code",
+	"reason",
+	"client_name",
+	"realm_name",
+	"session_id",
+	"jti",
+	"revoked_session_id",
+	"name",
+	"use",
+	"status",
+	"enabled",
+	"force",
+	"kind"
+];
+const DATA_VALUE_MAX_LENGTH = 512;
+function isDiffScalar(value) {
+	return value === null || typeof value === "string" || typeof value === "number" || typeof value === "boolean";
+}
+function truncateDiffScalar(value) {
+	if (typeof value === "string" && value.length > DATA_VALUE_MAX_LENGTH) return value.substring(0, DATA_VALUE_MAX_LENGTH);
+	return value;
+}
+function sanitizeDiff(input) {
+	if (!isObject(input)) return null;
+	const output = {};
+	for (const [key, entry] of Object.entries(input)) {
+		if (EVENT_DIFF_SECRET_KEY_REGEX.test(key)) continue;
+		if (!isObject(entry)) continue;
+		const { next, previous } = entry;
+		if (!isDiffScalar(next) || !isDiffScalar(previous)) continue;
+		output[key] = {
+			next: truncateDiffScalar(next),
+			previous: truncateDiffScalar(previous)
+		};
+	}
+	if (Object.keys(output).length === 0) return null;
+	return output;
+}
+function sanitizeEventData(input) {
+	if (!input) return null;
+	const output = {};
+	for (const key of DATA_KEY_ALLOW_LIST) {
+		const value = input[key];
+		if (typeof value === "string") output[key] = value.length > DATA_VALUE_MAX_LENGTH ? value.substring(0, DATA_VALUE_MAX_LENGTH) : value;
+		else if (typeof value === "number" || typeof value === "boolean") output[key] = value;
+	}
+	const diff = sanitizeDiff(input.diff);
+	if (diff) output.diff = diff;
+	if (Object.keys(output).length === 0) return null;
+	return output;
+}
+//#endregion
+export { sanitizeEventData };
+
+//# sourceMappingURL=sanitize.mjs.map

package/dist/core/entities/event/sanitize.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"sanitize.mjs","names":["isObject","EVENT_DIFF_SECRET_KEY_REGEX","DATA_KEY_ALLOW_LIST","DATA_VALUE_MAX_LENGTH","isDiffScalar","value","truncateDiffScalar","length","substring","sanitizeDiff","input","output","key","entry","Object","entries","test","next","previous","keys","sanitizeEventData","diff"],"sources":["../../../../src/core/entities/event/sanitize.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { isObject } from '@authup/kit';\nimport { EVENT_DIFF_SECRET_KEY_REGEX } from './diff.ts';\n\n/**\n * The central PII/credential write boundary for event context data.\n *\n * Allowlist-first: only these keys survive, and only with scalar values —\n * objects and arrays are dropped outright, so a nested structure can never\n * smuggle a secret past the boundary (this subsumes a denylist: password,\n * client_secret, code, code_verifier, *token* etc. are simply never listed).\n * session_id / jti / revoked_session_id are opaque correlation ids, not PII.\n * name / use / status / enabled / force describe key & trust-anchor lifecycle\n * operations (issue #3269) — canonical identifiers and enum/flag metadata,\n * never material. kind is the MFA authenticator kind (totp/email/...).\n *\n * The single structured exception is `diff` (entity-CRUD bridge): it survives\n * only as a one-level object of `{ next, previous }` scalar pairs, keys\n * re-checked against the diff secret denylist — the write boundary stays the\n * choke point even though buildEntityDiff pre-sanitizes.\n */\nconst DATA_KEY_ALLOW_LIST = [\n    'grant_type',\n    'scope',\n    'response_type',\n    'prompt',\n    'error',\n    'error_code',\n    'reason',\n    'client_name',\n    'realm_name',\n    'session_id',\n    'jti',\n    'revoked_session_id',\n    'name',\n    'use',\n    'status',\n    'enabled',\n    'force',\n    'kind',\n] as const;\n\nconst DATA_VALUE_MAX_LENGTH = 512;\n\nfunction isDiffScalar(value: unknown): value is string | number | boolean | null {\n    return value === null ||\n        typeof value === 'string' ||\n        typeof value === 'number' ||\n        typeof value === 'boolean';\n}\n\nfunction truncateDiffScalar(\n    value: string | number | boolean | null,\n): string | number | boolean | null {\n    if (typeof value === 'string' && value.length > DATA_VALUE_MAX_LENGTH) {\n        return value.substring(0, DATA_VALUE_MAX_LENGTH);\n    }\n\n    return value;\n}\n\nfunction sanitizeDiff(input: unknown): Record<string, any> | null {\n    if (!isObject(input)) {\n        return null;\n    }\n\n    const output: Record<string, any> = {};\n\n    for (const [key, entry] of Object.entries(input)) {\n        if (EVENT_DIFF_SECRET_KEY_REGEX.test(key)) {\n            continue;\n        }\n\n        if (!isObject(entry)) {\n            continue;\n        }\n\n        const { next, previous } = entry;\n        if (!isDiffScalar(next) || !isDiffScalar(previous)) {\n            continue;\n        }\n\n        output[key] = {\n            next: truncateDiffScalar(next),\n            previous: truncateDiffScalar(previous),\n        };\n    }\n\n    if (Object.keys(output).length === 0) {\n        return null;\n    }\n\n    return output;\n}\n\nexport function sanitizeEventData(\n    input?: Record<string, any> | null,\n): Record<string, any> | null {\n    if (!input) {\n        return null;\n    }\n\n    const output: Record<string, any> = {};\n\n    for (const key of DATA_KEY_ALLOW_LIST) {\n        const value = input[key];\n\n        if (typeof value === 'string') {\n            output[key] = value.length > DATA_VALUE_MAX_LENGTH ?\n                value.substring(0, DATA_VALUE_MAX_LENGTH) :\n                value;\n        } else if (typeof value === 'number' || typeof value === 'boolean') {\n            output[key] = value;\n        }\n    }\n\n    const diff = sanitizeDiff(input.diff);\n    if (diff) {\n        output.diff = diff;\n    }\n\n    if (Object.keys(output).length === 0) {\n        return null;\n    }\n\n    return output;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;GA2BA,MAAME,sBAAsB;CACxB;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;;AAGJ,MAAMC,wBAAwB;AAE9B,SAASC,aAAaC,OAAc;CAChC,OAAOA,UAAU,QACb,OAAOA,UAAU,YACjB,OAAOA,UAAU,YACjB,OAAOA,UAAU;AACzB;AAEA,SAASC,mBACLD,OAAuC;CAEvC,IAAI,OAAOA,UAAU,YAAYA,MAAME,SAASJ,uBAC5C,OAAOE,MAAMG,UAAU,GAAGL,qBAAAA;CAG9B,OAAOE;AACX;AAEA,SAASI,aAAaC,OAAc;CAChC,IAAI,CAACV,SAASU,KAAAA,GACV,OAAO;CAGX,MAAMC,SAA8B,CAAC;CAErC,KAAK,MAAM,CAACC,KAAKC,UAAUC,OAAOC,QAAQL,KAAAA,GAAQ;EAC9C,IAAIT,4BAA4Be,KAAKJ,GAAAA,GACjC;EAGJ,IAAI,CAACZ,SAASa,KAAAA,GACV;EAGJ,MAAM,EAAEI,MAAMC,aAAaL;EAC3B,IAAI,CAACT,aAAaa,IAAAA,KAAS,CAACb,aAAac,QAAAA,GACrC;EAGJP,OAAOC,OAAO;GACVK,MAAMX,mBAAmBW,IAAAA;GACzBC,UAAUZ,mBAAmBY,QAAAA;EACjC;CACJ;CAEA,IAAIJ,OAAOK,KAAKR,MAAAA,CAAAA,CAAQJ,WAAW,GAC/B,OAAO;CAGX,OAAOI;AACX;AAEA,SAAgBS,kBACZV,OAAkC;CAElC,IAAI,CAACA,OACD,OAAO;CAGX,MAAMC,SAA8B,CAAC;CAErC,KAAK,MAAMC,OAAOV,qBAAqB;EACnC,MAAMG,QAAQK,MAAME;EAEpB,IAAI,OAAOP,UAAU,UACjBM,OAAOC,OAAOP,MAAME,SAASJ,wBACzBE,MAAMG,UAAU,GAAGL,qBAAAA,IACnBE;OACD,IAAI,OAAOA,UAAU,YAAY,OAAOA,UAAU,WACrDM,OAAOC,OAAOP;CAEtB;CAEA,MAAMgB,OAAOZ,aAAaC,MAAMW,IAAI;CACpC,IAAIA,MACAV,OAAOU,OAAOA;CAGlB,IAAIP,OAAOK,KAAKR,MAAAA,CAAAA,CAAQJ,WAAW,GAC/B,OAAO;CAGX,OAAOI;AACX"}

package/dist/core/entities/event/service.d.ts

@@ -0,0 +1,22 @@
+import type { Event } from '@authup/core-kit';
+import { AbstractEntityService } from '@authup/server-kit';
+import type { ActorContext, EntityRepositoryFindManyResult, Logger } from '@authup/server-kit';
+import type { EventReadVisibility, EventRecordInput, EventServiceOptions, EventServiceReadOptions, IEventRepository, IEventService } from './types.ts';
+export type EventServiceContext = {
+    repository: IEventRepository;
+    options?: EventServiceOptions;
+    logger?: Logger;
+};
+export declare class EventService extends AbstractEntityService implements IEventService {
+    protected repository: IEventRepository;
+    protected options: EventServiceOptions;
+    protected logger?: Logger;
+    constructor(ctx: EventServiceContext);
+    protected isOwnedBy(entity: Event, actor: ActorContext): boolean;
+    protected canReadRealm(actor: ActorContext, realmId: string | null): Promise<boolean>;
+    protected resolveReadVisibility(actor: ActorContext): Promise<EventReadVisibility | undefined>;
+    record(input: EventRecordInput): Promise<void>;
+    getMany(query: Record<string, any>, actor: ActorContext, options?: EventServiceReadOptions): Promise<EntityRepositoryFindManyResult<Event>>;
+    getOne(id: string, actor: ActorContext, options?: EventServiceReadOptions): Promise<Event>;
+}
+//# sourceMappingURL=service.d.ts.map

package/dist/core/entities/event/service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/event/service.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAE9C,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAC3D,OAAO,KAAK,EAAE,YAAY,EAAE,8BAA8B,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAG/F,OAAO,KAAK,EACR,mBAAmB,EACnB,gBAAgB,EAChB,mBAAmB,EACnB,uBAAuB,EACvB,gBAAgB,EAChB,aAAa,EAChB,MAAM,YAAY,CAAC;AAEpB,MAAM,MAAM,mBAAmB,GAAG;IAC9B,UAAU,EAAE,gBAAgB,CAAC;IAC7B,OAAO,CAAC,EAAE,mBAAmB,CAAC;IAC9B,MAAM,CAAC,EAAE,MAAM,CAAC;CACnB,CAAC;AAIF,qBAAa,YAAa,SAAQ,qBAAsB,YAAW,aAAa;IAC5E,SAAS,CAAC,UAAU,EAAE,gBAAgB,CAAC;IAEvC,SAAS,CAAC,OAAO,EAAE,mBAAmB,CAAC;IAEvC,SAAS,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;gBAEd,GAAG,EAAE,mBAAmB;IAQpC,SAAS,CAAC,SAAS,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO;cAOhD,YAAY,CAAC,KAAK,EAAE,YAAY,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC;cAmB3E,qBAAqB,CAAC,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,mBAAmB,GAAG,SAAS,CAAC;IA8B9F,MAAM,CAAC,KAAK,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC;IAqD9C,OAAO,CACT,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC1B,KAAK,EAAE,YAAY,EACnB,OAAO,GAAE,uBAA4B,GACtC,OAAO,CAAC,8BAA8B,CAAC,KAAK,CAAC,CAAC;IA2D3C,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,OAAO,GAAE,uBAA4B,GAAG,OAAO,CAAC,KAAK,CAAC;CAmBvG"}

package/dist/core/entities/event/service.mjs

@@ -0,0 +1,169 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import "./constants.mjs";
+import { sanitizeEventData } from "./sanitize.mjs";
+import { PermissionName } from "@authup/core-kit";
+import { AbstractEntityService } from "@authup/server-kit";
+import { BuiltInPolicyType, definePolicyData } from "@authup/access";
+import { EntityNotFoundError } from "@authup/errors";
+import { randomUUID } from "node:crypto";
+//#region src/core/entities/event/service.ts
+const DAY_IN_MS = 864e5;
+var EventService = class extends AbstractEntityService {
+	repository;
+	options;
+	logger;
+	constructor(ctx) {
+		super();
+		this.repository = ctx.repository;
+		this.options = ctx.options ?? {};
+		this.logger = ctx.logger;
+	}
+	isOwnedBy(entity, actor) {
+		return !!actor.identity && !!entity.actor_id && entity.actor_id === actor.identity.data.id && entity.actor_type === actor.identity.type;
+	}
+	async canReadRealm(actor, realmId) {
+		try {
+			await actor.permissionEvaluator.evaluate({
+				name: PermissionName.EVENT_READ,
+				data: definePolicyData({ [BuiltInPolicyType.REALM_MATCH]: realmId }),
+				options: { policiesIncluded: [
+					BuiltInPolicyType.COMPOSITE,
+					BuiltInPolicyType.PERMISSION_BINDING,
+					BuiltInPolicyType.REALM_MATCH
+				] }
+			});
+			return true;
+		} catch {
+			return false;
+		}
+	}
+	async resolveReadVisibility(actor) {
+		const actorRealmId = this.getActorRealmId(actor);
+		let foreignRealmId = randomUUID();
+		while (foreignRealmId === actorRealmId) foreignRealmId = randomUUID();
+		if (await this.canReadRealm(actor, foreignRealmId)) return;
+		const realmIds = [];
+		if (actorRealmId && await this.canReadRealm(actor, actorRealmId)) realmIds.push(actorRealmId);
+		if (await this.canReadRealm(actor, null)) realmIds.push(null);
+		return {
+			realmIds,
+			...actor.identity ? { owner: {
+				actorId: actor.identity.data.id,
+				actorType: actor.identity.type
+			} } : {}
+		};
+	}
+	async record(input) {
+		const data = sanitizeEventData(input.data);
+		this.logger?.info(`audit: ${input.scope}.${input.name}`, {
+			scope: input.scope,
+			name: input.name,
+			ref_type: input.refType ?? null,
+			ref_id: input.refId ?? null,
+			client_id: input.clientId ?? null,
+			actor_type: input.actorType ?? null,
+			actor_id: input.actorId ?? null,
+			realm_id: input.realmId ?? null,
+			...data ? { data } : {}
+		});
+		if (this.options.enabled === false) return;
+		try {
+			const retentionDays = input.retentionDays ?? this.options.retentionDays ?? 90;
+			const entity = this.repository.create({
+				id: randomUUID(),
+				scope: input.scope,
+				name: input.name,
+				ref_type: truncate(input.refType, 64),
+				ref_id: truncate(input.refId, 64),
+				client_id: input.clientId ?? null,
+				actor_type: input.actorType ?? null,
+				actor_id: input.actorId ?? null,
+				actor_name: truncate(input.actorName, 128),
+				request_path: truncate(input.requestPath, 256),
+				request_method: truncate(input.requestMethod, 10),
+				request_ip_address: truncate(input.requestIpAddress, 45),
+				request_user_agent: truncate(input.requestUserAgent, 512),
+				realm_id: input.realmId ?? null,
+				data,
+				expiring: retentionDays > 0,
+				expires_at: retentionDays > 0 ? new Date(Date.now() + retentionDays * DAY_IN_MS).toISOString() : null
+			});
+			await this.repository.save(entity);
+		} catch {
+			this.logger?.warn(`Recording the audit event ${input.scope}.${input.name} failed.`);
+		}
+	}
+	async getMany(query, actor, options = {}) {
+		let canReadAll = true;
+		try {
+			await actor.permissionEvaluator.preEvaluate({ name: PermissionName.EVENT_READ });
+		} catch (e) {
+			if (!actor.identity) throw e;
+			canReadAll = false;
+		}
+		if (!canReadAll) return this.repository.findMany(query, {
+			owner: {
+				actorId: actor.identity.data.id,
+				actorType: actor.identity.type
+			},
+			...options.realmId ? { realmId: options.realmId } : {}
+		});
+		const visibility = await this.resolveReadVisibility(actor);
+		const { data: entities, meta } = await this.repository.findMany(query, {
+			...options.realmId ? { realmId: options.realmId } : {},
+			...visibility ? { visibility } : {}
+		});
+		const data = [];
+		for (const entity of entities) {
+			if (this.isOwnedBy(entity, actor)) {
+				data.push(entity);
+				continue;
+			}
+			try {
+				await actor.permissionEvaluator.evaluate({
+					name: PermissionName.EVENT_READ,
+					data: definePolicyData({
+						[BuiltInPolicyType.ATTRIBUTES]: entity,
+						...this.resourceRealmMatch(entity)
+					})
+				});
+				data.push(entity);
+			} catch {
+				continue;
+			}
+		}
+		return {
+			data,
+			meta: {
+				...meta,
+				total: meta.total - (entities.length - data.length)
+			}
+		};
+	}
+	async getOne(id, actor, options = {}) {
+		const entity = await this.repository.findOneById(id);
+		if (!entity || options.realmId && entity.realm_id !== options.realmId) throw new EntityNotFoundError();
+		if (!this.isOwnedBy(entity, actor)) {
+			await actor.permissionEvaluator.preEvaluate({ name: PermissionName.EVENT_READ });
+			await actor.permissionEvaluator.evaluate({
+				name: PermissionName.EVENT_READ,
+				data: definePolicyData({
+					[BuiltInPolicyType.ATTRIBUTES]: entity,
+					...this.resourceRealmMatch(entity)
+				})
+			});
+		}
+		return entity;
+	}
+};
+function truncate(value, maxLength) {
+	if (typeof value !== "string") return null;
+	if (value.length <= maxLength) return value;
+	return value.substring(0, maxLength);
+}
+//#endregion
+export { EventService };
+
+//# sourceMappingURL=service.mjs.map

package/dist/core/entities/event/service.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"service.mjs","names":["randomUUID","BuiltInPolicyType","definePolicyData","PermissionName","EntityNotFoundError","AbstractEntityService","EVENT_LOG_RETENTION_DAYS_DEFAULT","sanitizeEventData","DAY_IN_MS","EventService","repository","options","logger","ctx","isOwnedBy","entity","actor","identity","actor_id","data","id","actor_type","type","canReadRealm","realmId","permissionEvaluator","evaluate","name","EVENT_READ","REALM_MATCH","policiesIncluded","COMPOSITE","PERMISSION_BINDING","resolveReadVisibility","actorRealmId","getActorRealmId","foreignRealmId","undefined","realmIds","push","owner","actorId","actorType","record","input","info","scope","ref_type","refType","ref_id","refId","client_id","clientId","realm_id","enabled","retentionDays","create","truncate","actor_name","actorName","request_path","requestPath","request_method","requestMethod","request_ip_address","requestIpAddress","request_user_agent","requestUserAgent","expiring","expires_at","Date","now","toISOString","save","warn","getMany","query","canReadAll","preEvaluate","e","findMany","visibility","entities","meta","ATTRIBUTES","resourceRealmMatch","total","length","getOne","findOneById","value","maxLength","substring"],"sources":["../../../../src/core/entities/event/service.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { randomUUID } from 'node:crypto';\nimport { BuiltInPolicyType, definePolicyData } from '@authup/access';\nimport { PermissionName } from '@authup/core-kit';\nimport type { Event } from '@authup/core-kit';\nimport { EntityNotFoundError } from '@authup/errors';\nimport { AbstractEntityService } from '@authup/server-kit';\nimport type { ActorContext, EntityRepositoryFindManyResult, Logger } from '@authup/server-kit';\nimport { EVENT_LOG_RETENTION_DAYS_DEFAULT } from './constants.ts';\nimport { sanitizeEventData } from './sanitize.ts';\nimport type {\n    EventReadVisibility,\n    EventRecordInput,\n    EventServiceOptions,\n    EventServiceReadOptions,\n    IEventRepository,\n    IEventService,\n} from './types.ts';\n\nexport type EventServiceContext = {\n    repository: IEventRepository,\n    options?: EventServiceOptions,\n    logger?: Logger,\n};\n\nconst DAY_IN_MS = 86_400_000;\n\nexport class EventService extends AbstractEntityService implements IEventService {\n    protected repository: IEventRepository;\n\n    protected options: EventServiceOptions;\n\n    protected logger?: Logger;\n\n    constructor(ctx: EventServiceContext) {\n        super();\n\n        this.repository = ctx.repository;\n        this.options = ctx.options ?? {};\n        this.logger = ctx.logger;\n    }\n\n    protected isOwnedBy(entity: Event, actor: ActorContext): boolean {\n        return !!actor.identity &&\n            !!entity.actor_id &&\n            entity.actor_id === actor.identity.data.id &&\n            entity.actor_type === actor.identity.type;\n    }\n\n    protected async canReadRealm(actor: ActorContext, realmId: string | null): Promise<boolean> {\n        try {\n            await actor.permissionEvaluator.evaluate({\n                name: PermissionName.EVENT_READ,\n                data: definePolicyData({ [BuiltInPolicyType.REALM_MATCH]: realmId }),\n                options: {\n                    policiesIncluded: [\n                        BuiltInPolicyType.COMPOSITE,\n                        BuiltInPolicyType.PERMISSION_BINDING,\n                        BuiltInPolicyType.REALM_MATCH,\n                    ],\n                },\n            });\n            return true;\n        } catch {\n            return false;\n        }\n    }\n\n    protected async resolveReadVisibility(actor: ActorContext): Promise<EventReadVisibility | undefined> {\n        const actorRealmId = this.getActorRealmId(actor);\n        let foreignRealmId = randomUUID();\n        while (foreignRealmId === actorRealmId) {\n            foreignRealmId = randomUUID();\n        }\n\n        if (await this.canReadRealm(actor, foreignRealmId)) {\n            return undefined;\n        }\n\n        const realmIds: Array<string | null> = [];\n        if (actorRealmId && await this.canReadRealm(actor, actorRealmId)) {\n            realmIds.push(actorRealmId);\n        }\n        if (await this.canReadRealm(actor, null)) {\n            realmIds.push(null);\n        }\n\n        return {\n            realmIds,\n            ...(actor.identity ? {\n                owner: {\n                    actorId: actor.identity.data.id,\n                    actorType: actor.identity.type,\n                },\n            } : {}),\n        };\n    }\n\n    async record(input: EventRecordInput): Promise<void> {\n        const data = sanitizeEventData(input.data);\n\n        // complementary structured log line — fires even when persistence is\n        // disabled, so a SIEM/Loki pipeline can pick the events up for free.\n        this.logger?.info(`audit: ${input.scope}.${input.name}`, {\n            scope: input.scope,\n            name: input.name,\n            ref_type: input.refType ?? null,\n            ref_id: input.refId ?? null,\n            client_id: input.clientId ?? null,\n            actor_type: input.actorType ?? null,\n            actor_id: input.actorId ?? null,\n            realm_id: input.realmId ?? null,\n            ...(data ? { data } : {}),\n        });\n\n        if (this.options.enabled === false) {\n            return;\n        }\n\n        try {\n            const retentionDays = input.retentionDays ?? this.options.retentionDays ?? EVENT_LOG_RETENTION_DAYS_DEFAULT;\n\n            const entity = this.repository.create({\n                id: randomUUID(),\n                scope: input.scope,\n                name: input.name,\n                ref_type: truncate(input.refType, 64),\n                ref_id: truncate(input.refId, 64),\n                client_id: input.clientId ?? null,\n                actor_type: input.actorType ?? null,\n                actor_id: input.actorId ?? null,\n                actor_name: truncate(input.actorName, 128),\n                request_path: truncate(input.requestPath, 256),\n                request_method: truncate(input.requestMethod, 10),\n                request_ip_address: truncate(input.requestIpAddress, 45),\n                request_user_agent: truncate(input.requestUserAgent, 512),\n                realm_id: input.realmId ?? null,\n                data,\n                expiring: retentionDays > 0,\n                expires_at: retentionDays > 0 ?\n                    new Date(Date.now() + (retentionDays * DAY_IN_MS)).toISOString() :\n                    null,\n            });\n\n            await this.repository.save(entity);\n        } catch {\n            // an audit write failure must never fail the originating operation\n            this.logger?.warn(`Recording the audit event ${input.scope}.${input.name} failed.`);\n        }\n    }\n\n    async getMany(\n        query: Record<string, any>,\n        actor: ActorContext,\n        options: EventServiceReadOptions = {},\n    ): Promise<EntityRepositoryFindManyResult<Event>> {\n        let canReadAll = true;\n        try {\n            await actor.permissionEvaluator.preEvaluate({ name: PermissionName.EVENT_READ });\n        } catch (e) {\n            if (!actor.identity) {\n                throw e;\n            }\n            canReadAll = false;\n        }\n\n        if (!canReadAll) {\n            // self-service: only the actor's own rows (\"my sign-in history\")\n            return this.repository.findMany(query, {\n                owner: {\n                    actorId: actor.identity!.data.id,\n                    actorType: actor.identity!.type,\n                },\n                ...(options.realmId ? { realmId: options.realmId } : {}),\n            });\n        }\n\n        const visibility = await this.resolveReadVisibility(actor);\n        const { data: entities, meta } = await this.repository.findMany(query, {\n            ...(options.realmId ? { realmId: options.realmId } : {}),\n            ...(visibility ? { visibility } : {}),\n        });\n\n        const data: Event[] = [];\n\n        for (const entity of entities) {\n            if (this.isOwnedBy(entity, actor)) {\n                data.push(entity);\n                continue;\n            }\n\n            try {\n                await actor.permissionEvaluator.evaluate({\n                    name: PermissionName.EVENT_READ,\n                    data: definePolicyData({\n                        [BuiltInPolicyType.ATTRIBUTES]: entity,\n                        ...this.resourceRealmMatch(entity),\n                    }),\n                });\n                data.push(entity);\n            } catch {\n                continue;\n            }\n        }\n\n        return {\n            data,\n            meta: {\n                ...meta,\n                total: meta.total - (entities.length - data.length),\n            },\n        };\n    }\n\n    async getOne(id: string, actor: ActorContext, options: EventServiceReadOptions = {}): Promise<Event> {\n        const entity = await this.repository.findOneById(id);\n        if (!entity || (options.realmId && entity.realm_id !== options.realmId)) {\n            throw new EntityNotFoundError();\n        }\n\n        if (!this.isOwnedBy(entity, actor)) {\n            await actor.permissionEvaluator.preEvaluate({ name: PermissionName.EVENT_READ });\n            await actor.permissionEvaluator.evaluate({\n                name: PermissionName.EVENT_READ,\n                data: definePolicyData({\n                    [BuiltInPolicyType.ATTRIBUTES]: entity,\n                    ...this.resourceRealmMatch(entity),\n                }),\n            });\n        }\n\n        return entity;\n    }\n}\n\nfunction truncate(value: string | null | undefined, maxLength: number): string | null {\n    if (typeof value !== 'string') {\n        return null;\n    }\n\n    if (value.length <= maxLength) {\n        return value;\n    }\n\n    return value.substring(0, maxLength);\n}\n"],"mappings":";;;;;;;;;;;AA+BA,MAAMQ,YAAY;AAElB,IAAaC,eAAb,cAAkCJ,sBAAAA;CACpBK;CAEAC;CAEAC;CAEV,YAAYC,KAA0B;EAClC,MAAK;EAEL,KAAKH,aAAaG,IAAIH;EACtB,KAAKC,UAAUE,IAAIF,WAAW,CAAC;EAC/B,KAAKC,SAASC,IAAID;CACtB;CAEUE,UAAUC,QAAeC,OAA8B;EAC7D,OAAO,CAAC,CAACA,MAAMC,YACX,CAAC,CAACF,OAAOG,YACTH,OAAOG,aAAaF,MAAMC,SAASE,KAAKC,MACxCL,OAAOM,eAAeL,MAAMC,SAASK;CAC7C;CAEA,MAAgBC,aAAaP,OAAqBQ,SAA0C;EACxF,IAAI;GACA,MAAMR,MAAMS,oBAAoBC,SAAS;IACrCC,MAAMxB,eAAeyB;IACrBT,MAAMjB,iBAAiB,GAAGD,kBAAkB4B,cAAcL,QAAQ,CAAA;IAClEb,SAAS,EACLmB,kBAAkB;KACd7B,kBAAkB8B;KAClB9B,kBAAkB+B;KAClB/B,kBAAkB4B;MAE1B;GACJ,CAAA;GACA,OAAO;EACX,QAAQ;GACJ,OAAO;EACX;CACJ;CAEA,MAAgBI,sBAAsBjB,OAA+D;EACjG,MAAMkB,eAAe,KAAKC,gBAAgBnB,KAAAA;EAC1C,IAAIoB,iBAAiBpC,WAAAA;EACrB,OAAOoC,mBAAmBF,cACtBE,iBAAiBpC,WAAAA;EAGrB,IAAI,MAAM,KAAKuB,aAAaP,OAAOoB,cAAAA,GAC/B;EAGJ,MAAME,WAAiC,CAAA;EACvC,IAAIJ,gBAAgB,MAAM,KAAKX,aAAaP,OAAOkB,YAAAA,GAC/CI,SAASC,KAAKL,YAAAA;EAElB,IAAI,MAAM,KAAKX,aAAaP,OAAO,IAAA,GAC/BsB,SAASC,KAAK,IAAA;EAGlB,OAAO;GACHD;GACA,GAAItB,MAAMC,WAAW,EACjBuB,OAAO;IACHC,SAASzB,MAAMC,SAASE,KAAKC;IAC7BsB,WAAW1B,MAAMC,SAASK;GAC9B,EACJ,IAAI,CAAC;EACT;CACJ;CAEA,MAAMqB,OAAOC,OAAwC;EACjD,MAAMzB,OAAOZ,kBAAkBqC,MAAMzB,IAAI;EAIzC,KAAKP,QAAQiC,KAAK,UAAUD,MAAME,MAAM,GAAGF,MAAMjB,QAAQ;GACrDmB,OAAOF,MAAME;GACbnB,MAAMiB,MAAMjB;GACZoB,UAAUH,MAAMI,WAAW;GAC3BC,QAAQL,MAAMM,SAAS;GACvBC,WAAWP,MAAMQ,YAAY;GAC7B/B,YAAYuB,MAAMF,aAAa;GAC/BxB,UAAU0B,MAAMH,WAAW;GAC3BY,UAAUT,MAAMpB,WAAW;GAC3B,GAAIL,OAAO,EAAEA,KAAK,IAAI,CAAC;EAC3B,CAAA;EAEA,IAAI,KAAKR,QAAQ2C,YAAY,OACzB;EAGJ,IAAI;GACA,MAAMC,gBAAgBX,MAAMW,iBAAiB,KAAK5C,QAAQ4C,iBAAAA;GAE1D,MAAMxC,SAAS,KAAKL,WAAW8C,OAAO;IAClCpC,IAAIpB,WAAAA;IACJ8C,OAAOF,MAAME;IACbnB,MAAMiB,MAAMjB;IACZoB,UAAUU,SAASb,MAAMI,SAAS,EAAA;IAClCC,QAAQQ,SAASb,MAAMM,OAAO,EAAA;IAC9BC,WAAWP,MAAMQ,YAAY;IAC7B/B,YAAYuB,MAAMF,aAAa;IAC/BxB,UAAU0B,MAAMH,WAAW;IAC3BiB,YAAYD,SAASb,MAAMe,WAAW,GAAA;IACtCC,cAAcH,SAASb,MAAMiB,aAAa,GAAA;IAC1CC,gBAAgBL,SAASb,MAAMmB,eAAe,EAAA;IAC9CC,oBAAoBP,SAASb,MAAMqB,kBAAkB,EAAA;IACrDC,oBAAoBT,SAASb,MAAMuB,kBAAkB,GAAA;IACrDd,UAAUT,MAAMpB,WAAW;IAC3BL;IACAiD,UAAUb,gBAAgB;IAC1Bc,YAAYd,gBAAgB,IACxB,IAAIe,KAAKA,KAAKC,IAAG,IAAMhB,gBAAgB/C,SAAAA,CAAAA,CAAYgE,YAAW,IAC9D;GACR,CAAA;GAEA,MAAM,KAAK9D,WAAW+D,KAAK1D,MAAAA;EAC/B,QAAQ;GAEJ,KAAKH,QAAQ8D,KAAK,6BAA6B9B,MAAME,MAAM,GAAGF,MAAMjB,KAAK,SAAS;EACtF;CACJ;CAEA,MAAMgD,QACFC,OACA5D,OACAL,UAAmC,CAAC,GACU;EAC9C,IAAIkE,aAAa;EACjB,IAAI;GACA,MAAM7D,MAAMS,oBAAoBqD,YAAY,EAAEnD,MAAMxB,eAAeyB,WAAW,CAAA;EAClF,SAASmD,GAAG;GACR,IAAI,CAAC/D,MAAMC,UACP,MAAM8D;GAEVF,aAAa;EACjB;EAEA,IAAI,CAACA,YAED,OAAO,KAAKnE,WAAWsE,SAASJ,OAAO;GACnCpC,OAAO;IACHC,SAASzB,MAAMC,SAAUE,KAAKC;IAC9BsB,WAAW1B,MAAMC,SAAUK;GAC/B;GACA,GAAIX,QAAQa,UAAU,EAAEA,SAASb,QAAQa,QAAQ,IAAI,CAAC;EAC1D,CAAA;EAGJ,MAAMyD,aAAa,MAAM,KAAKhD,sBAAsBjB,KAAAA;EACpD,MAAM,EAAEG,MAAM+D,UAAUC,SAAS,MAAM,KAAKzE,WAAWsE,SAASJ,OAAO;GACnE,GAAIjE,QAAQa,UAAU,EAAEA,SAASb,QAAQa,QAAQ,IAAI,CAAC;GACtD,GAAIyD,aAAa,EAAEA,WAAW,IAAI,CAAC;EACvC,CAAA;EAEA,MAAM9D,OAAgB,CAAA;EAEtB,KAAK,MAAMJ,UAAUmE,UAAU;GAC3B,IAAI,KAAKpE,UAAUC,QAAQC,KAAAA,GAAQ;IAC/BG,KAAKoB,KAAKxB,MAAAA;IACV;GACJ;GAEA,IAAI;IACA,MAAMC,MAAMS,oBAAoBC,SAAS;KACrCC,MAAMxB,eAAeyB;KACrBT,MAAMjB,iBAAiB;OAClBD,kBAAkBmF,aAAarE;MAChC,GAAG,KAAKsE,mBAAmBtE,MAAAA;KAC/B,CAAA;IACJ,CAAA;IACAI,KAAKoB,KAAKxB,MAAAA;GACd,QAAQ;IACJ;GACJ;EACJ;EAEA,OAAO;GACHI;GACAgE,MAAM;IACF,GAAGA;IACHG,OAAOH,KAAKG,SAASJ,SAASK,SAASpE,KAAKoE;GAChD;EACJ;CACJ;CAEA,MAAMC,OAAOpE,IAAYJ,OAAqBL,UAAmC,CAAC,GAAmB;EACjG,MAAMI,SAAS,MAAM,KAAKL,WAAW+E,YAAYrE,EAAAA;EACjD,IAAI,CAACL,UAAWJ,QAAQa,WAAWT,OAAOsC,aAAa1C,QAAQa,SAC3D,MAAM,IAAIpB,oBAAAA;EAGd,IAAI,CAAC,KAAKU,UAAUC,QAAQC,KAAAA,GAAQ;GAChC,MAAMA,MAAMS,oBAAoBqD,YAAY,EAAEnD,MAAMxB,eAAeyB,WAAW,CAAA;GAC9E,MAAMZ,MAAMS,oBAAoBC,SAAS;IACrCC,MAAMxB,eAAeyB;IACrBT,MAAMjB,iBAAiB;MAClBD,kBAAkBmF,aAAarE;KAChC,GAAG,KAAKsE,mBAAmBtE,MAAAA;IAC/B,CAAA;GACJ,CAAA;EACJ;EAEA,OAAOA;CACX;AACJ;AAEA,SAAS0C,SAASiC,OAAkCC,WAAiB;CACjE,IAAI,OAAOD,UAAU,UACjB,OAAO;CAGX,IAAIA,MAAMH,UAAUI,WAChB,OAAOD;CAGX,OAAOA,MAAME,UAAU,GAAGD,SAAAA;AAC9B"}

package/dist/core/entities/event/types.d.ts

@@ -0,0 +1,124 @@
+import type { Event, EventName, EventScope, IdentityType } from '@authup/core-kit';
+import type { ActorContext, EntityRepositoryFindManyResult } from '@authup/server-kit';
+export type EventOwner = {
+    actorId: string;
+    actorType: string;
+};
+export type EventReadVisibility = {
+    owner?: EventOwner;
+    realmIds: Array<string | null>;
+};
+export type EventFindManyOptions = {
+    /**
+     * Mandatory owner constraint (self-service scope) — not overridable by a
+     * rapiq filter.
+     */
+    owner?: EventOwner;
+    realmId?: string;
+    /**
+     * Rows reachable through the actor's realm-scoped permission, plus the
+     * actor's own rows. Applied before pagination so meta.total cannot include
+     * events outside that reach.
+     */
+    visibility?: EventReadVisibility;
+};
+export type EventCountRecentFilter = {
+    name: `${EventName}`;
+    actorName?: string;
+    requestIpAddress?: string;
+    realmId?: string | null;
+    /**
+     * Window start (iso) — only rows created after this instant count.
+     */
+    since: string;
+};
+export interface IEventRepository {
+    create(data: Partial<Event>): Event;
+    save(entity: Event): Promise<Event>;
+    findMany(query: Record<string, any>, options?: EventFindManyOptions): Promise<EntityRepositoryFindManyResult<Event>>;
+    findOneById(id: string): Promise<Event | null>;
+    countRecent(filter: EventCountRecentFilter): Promise<number>;
+    /**
+     * Retention sweep: drop every expiring row whose expires_at lies before
+     * the given instant (non-expiring rows are kept forever). Returns the
+     * number of removed rows.
+     */
+    deleteExpired(now: string): Promise<number>;
+}
+export type EventRecordInput = {
+    scope: `${EventScope}`;
+    name: `${EventName}`;
+    refType?: string | null;
+    refId?: string | null;
+    clientId?: string | null;
+    actorType?: `${IdentityType}` | null;
+    actorId?: string | null;
+    actorName?: string | null;
+    requestPath?: string | null;
+    requestMethod?: string | null;
+    requestIpAddress?: string | null;
+    requestUserAgent?: string | null;
+    realmId?: string | null;
+    data?: Record<string, any> | null;
+    /**
+     * Per-event retention override in days — wins over the service-level
+     * retentionDays; 0 = keep forever. expiring/expires_at derive from the
+     * effective value.
+     */
+    retentionDays?: number;
+};
+export type EventServiceOptions = {
+    /**
+     * config.eventLogEnabled — when false, record() only emits the structured
+     * log line and persists nothing.
+     */
+    enabled?: boolean;
+    /**
+     * config.eventLogRetentionDays — stamped per row as expiring/expires_at
+     * at write time; 0 = keep forever (expiring stays false, expires_at null).
+     */
+    retentionDays?: number;
+};
+export type EventServiceReadOptions = {
+    realmId?: string;
+};
+/**
+ * Actor + request attribution for entity-CRUD audit rows. The shape is
+ * defined here (core) so core never imports from adapters/http — the wiring
+ * injects the HTTP adapter's AsyncLocalStorage getter, and writes outside an
+ * HTTP request (provisioning, CLI, cron) simply resolve to undefined.
+ */
+export type EventRequestContext = {
+    actorType: `${IdentityType}` | null;
+    actorId: string | null;
+    actorName: string | null;
+    requestPath: string | null;
+    requestMethod: string | null;
+    requestIpAddress: string | null;
+    requestUserAgent: string | null;
+};
+export type EntityEventHandlerOptions = {
+    /**
+     * Per-row retention (days) for entity-CRUD audit rows — entity churn
+     * self-prunes on a short TTL (config eventLogEntityRetentionDays).
+     */
+    retentionDays?: number;
+};
+export interface IEventService {
+    /**
+     * Persist an audit event. Fire-and-forget-safe: never throws — a write
+     * failure must not fail the originating auth operation.
+     */
+    record(input: EventRecordInput): Promise<void>;
+    /**
+     * List audit events. An actor without EVENT_READ is scoped to its own
+     * rows ("my sign-in history"); an actor with EVENT_READ sees every row
+     * its realm reach permits.
+     */
+    getMany(query: Record<string, any>, actor: ActorContext, options?: EventServiceReadOptions): Promise<EntityRepositoryFindManyResult<Event>>;
+    /**
+     * Read a single audit event. Own rows need no permission.
+     */
+    getOne(id: string, actor: ActorContext, options?: EventServiceReadOptions): Promise<Event>;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/core/entities/event/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/event/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EACR,KAAK,EACL,SAAS,EACT,UAAU,EACV,YAAY,EACf,MAAM,kBAAkB,CAAC;AAC1B,OAAO,KAAK,EAAE,YAAY,EAAE,8BAA8B,EAAE,MAAM,oBAAoB,CAAC;AAEvF,MAAM,MAAM,UAAU,GAAG;IACrB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;CACrB,CAAC;AAEF,MAAM,MAAM,mBAAmB,GAAG;IAC9B,KAAK,CAAC,EAAE,UAAU,CAAC;IACnB,QAAQ,EAAE,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;CAClC,CAAC;AAEF,MAAM,MAAM,oBAAoB,GAAG;IAC/B;;;OAGG;IACH,KAAK,CAAC,EAAE,UAAU,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;OAIG;IACH,UAAU,CAAC,EAAE,mBAAmB,CAAC;CACpC,CAAC;AAEF,MAAM,MAAM,sBAAsB,GAAG;IACjC,IAAI,EAAE,GAAG,SAAS,EAAE,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB;;OAEG;IACH,KAAK,EAAE,MAAM,CAAC;CACjB,CAAC;AAEF,MAAM,WAAW,gBAAgB;IAC7B,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,KAAK,CAAC,GAAG,KAAK,CAAC;IAEpC,IAAI,CAAC,MAAM,EAAE,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;IAEpC,QAAQ,CACJ,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC1B,OAAO,CAAC,EAAE,oBAAoB,GAC/B,OAAO,CAAC,8BAA8B,CAAC,KAAK,CAAC,CAAC,CAAC;IAElD,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC;IAE/C,WAAW,CAAC,MAAM,EAAE,sBAAsB,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAE7D;;;;OAIG;IACH,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CAC/C;AAED,MAAM,MAAM,gBAAgB,GAAG;IAC3B,KAAK,EAAE,GAAG,UAAU,EAAE,CAAC;IACvB,IAAI,EAAE,GAAG,SAAS,EAAE,CAAC;IACrB,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,SAAS,CAAC,EAAE,GAAG,YAAY,EAAE,GAAG,IAAI,CAAC;IACrC,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,IAAI,CAAC;IAClC;;;;OAIG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;CAC1B,CAAC;AAEF,MAAM,MAAM,mBAAmB,GAAG;IAC9B;;;OAGG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;;OAGG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;CAC1B,CAAC;AAEF,MAAM,MAAM,uBAAuB,GAAG;IAClC,OAAO,CAAC,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF;;;;;GAKG;AACH,MAAM,MAAM,mBAAmB,GAAG;IAC9B,SAAS,EAAE,GAAG,YAAY,EAAE,GAAG,IAAI,CAAC;IACpC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;CACnC,CAAC;AAEF,MAAM,MAAM,yBAAyB,GAAG;IACpC;;;OAGG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;CAC1B,CAAC;AAEF,MAAM,WAAW,aAAa;IAC1B;;;OAGG;IACH,MAAM,CAAC,KAAK,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE/C;;;;OAIG;IACH,OAAO,CACH,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC1B,KAAK,EAAE,YAAY,EACnB,OAAO,CAAC,EAAE,uBAAuB,GAClC,OAAO,CAAC,8BAA8B,CAAC,KAAK,CAAC,CAAC,CAAC;IAElD;;OAEG;IACH,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,OAAO,CAAC,EAAE,uBAAuB,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;CAC9F"}

package/dist/core/entities/event/types.mjs

@@ -0,0 +1,4 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+export {};

package/dist/core/entities/identity-provider-role-mapping/service.mjs

@@ -5,7 +5,7 @@ import { ValidatorGroup } from "@authup/kit";
 import { IdentityProviderRoleMappingValidator, PermissionName } from "@authup/core-kit";
 import { JunctionEntityService } from "@authup/server-kit";
 import { BuiltInPolicyType, PermissionError, definePolicyData } from "@authup/access";
-import { BadRequestError, EntityConflictError, EntityNotFoundError } from "@authup/errors";
+import { EntityConflictError, EntityNotFoundError, ValidationError } from "@authup/errors";
 //#region src/core/entities/identity-provider-role-mapping/service.ts
 var IdentityProviderRoleMappingService = class extends JunctionEntityService {
 	ownerRealmKey = "provider_realm_id";
@@ -50,7 +50,7 @@ var IdentityProviderRoleMappingService = class extends JunctionEntityService {
 		})) throw new EntityConflictError({ entity: "identity-provider-role-mapping" });
 		if (validated.provider) validated.provider_realm_id = validated.provider.realm_id;
 		if (validated.role) validated.role_realm_id = validated.role.realm_id;
-		if (validated.role_realm_id && validated.provider_realm_id && validated.role_realm_id !== validated.provider_realm_id) throw new BadRequestError("It is not possible to map an identity provider to a role of another realm.");
+		if (validated.role_realm_id && validated.provider_realm_id && validated.role_realm_id !== validated.provider_realm_id) throw new ValidationError("It is not possible to map an identity provider to a role of another realm.");
 		if (validated.role && actor.identity) {
 			if (!await this.identityPermissionProvider.isSuperset({
 				type: actor.identity.type,