@authup/server-core 1.0.0-beta.52 → 1.0.0-beta.53

package/dist/core/entities/consent/types.mjs

@@ -0,0 +1,25 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+//#region src/core/entities/consent/types.ts
+/**
+* Max length of a single stored scope token — must equal the
+* `auth_consents.scope` column width (varchar 128). A longer token (only
+* reachable via a non-standard scope riding the `global` verifier bypass) is
+* dropped at normalization rather than overflowing the column.
+*/ const CONSENT_SCOPE_MAX_LENGTH = 128;
+/**
+* Filter keys a consent list query may target. Shared by the repository's
+* rapiq `filters.allowed` so service and adapter can never drift.
+*/ const CONSENT_FILTER_KEYS = [
+	"id",
+	"client_id",
+	"realm_id",
+	"sub",
+	"sub_kind",
+	"scope"
+];
+//#endregion
+export { CONSENT_FILTER_KEYS, CONSENT_SCOPE_MAX_LENGTH };
+
+//# sourceMappingURL=types.mjs.map

package/dist/core/entities/consent/types.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.mjs","names":["CONSENT_SCOPE_MAX_LENGTH","CONSENT_FILTER_KEYS"],"sources":["../../../../src/core/entities/consent/types.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { Consent } from '@authup/core-kit';\nimport type { ActorContext, EntityRepositoryFindManyResult } from '@authup/server-kit';\n\nexport type ConsentOwner = {\n    sub: string,\n    subKind: string,\n};\n\n/**\n * Max length of a single stored scope token — must equal the\n * `auth_consents.scope` column width (varchar 128). A longer token (only\n * reachable via a non-standard scope riding the `global` verifier bypass) is\n * dropped at normalization rather than overflowing the column.\n */\nexport const CONSENT_SCOPE_MAX_LENGTH = 128;\n\n/**\n * Filter keys a consent list query may target. Shared by the repository's\n * rapiq `filters.allowed` so service and adapter can never drift.\n */\nexport const CONSENT_FILTER_KEYS = [\n    'id',\n    'client_id',\n    'realm_id',\n    'sub',\n    'sub_kind',\n    'scope',\n] as const;\n\nexport type ConsentFindManyOptions = {\n    /**\n     * Force the result to a single subject (self-service). Applied as a\n     * mandatory WHERE that a rapiq query filter cannot override.\n     */\n    owner?: ConsentOwner,\n    /**\n     * Restrict the result to a single realm (the `/realms/:realmId/consents`\n     * nested mount). Mandatory WHERE, not overridable by a rapiq filter.\n     */\n    realmId?: string,\n};\n\nexport type ConsentServiceReadOptions = {\n    realmId?: string,\n};\n\nexport type ConsentRecordInput = {\n    clientId: string,\n    realmId: string,\n    owner: ConsentOwner,\n    /**\n     * Raw scope representation(s) — normalized to lowercase tokens via\n     * `unwrapOAuth2Scope` before persistence.\n     */\n    scope: string | string[] | null,\n};\n\nexport type ConsentCoveringInput = {\n    clientId: string,\n    owner: ConsentOwner,\n    scope: string | string[] | null,\n};\n\nexport interface IConsentRepository {\n    findMany(query: Record<string, any>, options?: ConsentFindManyOptions): Promise<EntityRepositoryFindManyResult<Consent>>;\n\n    findOneById(id: string): Promise<Consent | null>;\n\n    /**\n     * Covering-lookup source — query-cached\n     * (`CachePrefix.CONSENT_COVERING`, 60s), invalidated by the\n     * `ConsentEntitySubscriber` on insert/update/remove.\n     */\n    findAllBySubjectClient(clientId: string, owner: ConsentOwner): Promise<Consent[]>;\n\n    /**\n     * Union/keep: insert one row per missing scope token, never touching\n     * existing rows. Race-safe under the 4-column unique index.\n     */\n    insertMissing(input: {\n        clientId: string, \n        realmId: string, \n        owner: ConsentOwner, \n        scopes: string[] \n    }): Promise<void>;\n\n    remove(entity: Consent): Promise<void>;\n}\n\nexport interface IConsentService {\n    /**\n     * List consents. An actor without `CONSENT_READ` is scoped to its own\n     * rows (self-service); an actor with `CONSENT_READ` sees every row its\n     * realm reach permits.\n     */\n    getMany(query: Record<string, any>, actor: ActorContext, options?: ConsentServiceReadOptions): Promise<EntityRepositoryFindManyResult<Consent>>;\n\n    /**\n     * Read a single consent by id. Own rows need no permission.\n     */\n    getOne(id: string, actor: ActorContext, options?: ConsentServiceReadOptions): Promise<Consent>;\n\n    /**\n     * Revoke (delete) a single consent by id. Own rows need no permission.\n     */\n    delete(id: string, actor: ActorContext, options?: ConsentServiceReadOptions): Promise<Consent>;\n\n    /**\n     * Flow integration (POST /authorize approval) — no permission checks:\n     * the subject consents to its own grant. Inputs are server-derived\n     * (verifier-stamped client/realm, token-derived subject), never raw\n     * client input.\n     */\n    record(input: ConsentRecordInput): Promise<void>;\n\n    /**\n     * Strict covering: every requested token has an unexpired row.\n     */\n    isCovering(input: ConsentCoveringInput): Promise<boolean>;\n}\n"],"mappings":";;;;;;;;;GAqBA,MAAaA,2BAA2B;;;;GAMxC,MAAaC,sBAAsB;CAC/B;CACA;CACA;CACA;CACA;CACA"}

package/dist/core/entities/event/constants.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Default retention for persisted security events in days (hosted-provider
+ * posture, Okta-parity; raise via eventLogRetentionDays /
+ * EVENT_LOG_RETENTION_DAYS, 0 = keep forever).
+ */
+export declare const EVENT_LOG_RETENTION_DAYS_DEFAULT = 90;
+//# sourceMappingURL=constants.d.ts.map

package/dist/core/entities/event/constants.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/event/constants.ts"],"names":[],"mappings":"AAOA;;;;GAIG;AACH,eAAO,MAAM,gCAAgC,KAAK,CAAC"}

package/dist/core/entities/event/constants.mjs

@@ -0,0 +1,13 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+//#region src/core/entities/event/constants.ts
+/**
+* Default retention for persisted security events in days (hosted-provider
+* posture, Okta-parity; raise via eventLogRetentionDays /
+* EVENT_LOG_RETENTION_DAYS, 0 = keep forever).
+*/ const EVENT_LOG_RETENTION_DAYS_DEFAULT = 90;
+//#endregion
+export { EVENT_LOG_RETENTION_DAYS_DEFAULT };
+
+//# sourceMappingURL=constants.mjs.map

package/dist/core/entities/event/constants.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"constants.mjs","names":["EVENT_LOG_RETENTION_DAYS_DEFAULT"],"sources":["../../../../src/core/entities/event/constants.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\n/**\n * Default retention for persisted security events in days (hosted-provider\n * posture, Okta-parity; raise via eventLogRetentionDays /\n * EVENT_LOG_RETENTION_DAYS, 0 = keep forever).\n */\nexport const EVENT_LOG_RETENTION_DAYS_DEFAULT = 90;\n"],"mappings":";;;;;;;;GAYA,MAAaA,mCAAmC"}

package/dist/core/entities/event/diff.d.ts

@@ -0,0 +1,20 @@
+/**
+ * Secret denylist for entity-diff keys (fail-closed: losing a
+ * "secret_hashed flipped" diff entry is acceptable, leaking a hash is not).
+ * Shared with the sanitizer's `diff` branch so both boundaries agree.
+ */
+export declare const EVENT_DIFF_SECRET_KEY_REGEX: RegExp;
+export declare const EVENT_DIFF_VALUE_MAX_LENGTH = 512;
+export type EntityDiff = Record<string, {
+    next: unknown;
+    previous: unknown;
+}>;
+/**
+ * PII-safe scalar diff between the updated entity and its pre-mutation
+ * snapshot: only keys with scalar values (string/number/boolean/null) on BOTH
+ * sides, skipping timestamp columns (`*_at`) and any key matching the secret
+ * denylist, including only keys whose value actually changed. String values
+ * are truncated to {@link EVENT_DIFF_VALUE_MAX_LENGTH}.
+ */
+export declare function buildEntityDiff(next: Record<string, any>, previous: Record<string, any>): EntityDiff;
+//# sourceMappingURL=diff.d.ts.map

package/dist/core/entities/event/diff.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"diff.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/event/diff.ts"],"names":[],"mappings":"AASA;;;;GAIG;AACH,eAAO,MAAM,2BAA2B,QAA6C,CAAC;AAEtF,eAAO,MAAM,2BAA2B,MAAM,CAAC;AAE/C,MAAM,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,EAAE;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,QAAQ,EAAE,OAAO,CAAA;CAAE,CAAC,CAAC;AAiB9E;;;;;;GAMG;AACH,wBAAgB,eAAe,CAC3B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAC9B,UAAU,CAmCZ"}

package/dist/core/entities/event/diff.mjs

@@ -0,0 +1,45 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { isEqual } from "smob";
+//#region src/core/entities/event/diff.ts
+/**
+* Secret denylist for entity-diff keys (fail-closed: losing a
+* "secret_hashed flipped" diff entry is acceptable, leaking a hash is not).
+* Shared with the sanitizer's `diff` branch so both boundaries agree.
+*/ const EVENT_DIFF_SECRET_KEY_REGEX = /(password|secret|hash|token|credential)/i;
+const EVENT_DIFF_VALUE_MAX_LENGTH = 512;
+function isScalar(value) {
+	return value === null || typeof value === "string" || typeof value === "number" || typeof value === "boolean";
+}
+function truncateScalar(value) {
+	if (typeof value === "string" && value.length > 512) return value.substring(0, 512);
+	return value;
+}
+/**
+* PII-safe scalar diff between the updated entity and its pre-mutation
+* snapshot: only keys with scalar values (string/number/boolean/null) on BOTH
+* sides, skipping timestamp columns (`*_at`) and any key matching the secret
+* denylist, including only keys whose value actually changed. String values
+* are truncated to {@link EVENT_DIFF_VALUE_MAX_LENGTH}.
+*/ function buildEntityDiff(next, previous) {
+	const output = {};
+	const keys = /* @__PURE__ */ new Set([...Object.keys(next), ...Object.keys(previous)]);
+	for (const key of keys) {
+		if (key.endsWith("_at")) continue;
+		if (EVENT_DIFF_SECRET_KEY_REGEX.test(key)) continue;
+		const nextValue = next[key];
+		const previousValue = previous[key];
+		if (!isScalar(nextValue) || !isScalar(previousValue)) continue;
+		if (isEqual(nextValue, previousValue)) continue;
+		output[key] = {
+			next: truncateScalar(nextValue),
+			previous: truncateScalar(previousValue)
+		};
+	}
+	return output;
+}
+//#endregion
+export { EVENT_DIFF_SECRET_KEY_REGEX, EVENT_DIFF_VALUE_MAX_LENGTH, buildEntityDiff };
+
+//# sourceMappingURL=diff.mjs.map

package/dist/core/entities/event/diff.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"diff.mjs","names":["isEqual","EVENT_DIFF_SECRET_KEY_REGEX","EVENT_DIFF_VALUE_MAX_LENGTH","isScalar","value","truncateScalar","length","substring","buildEntityDiff","next","previous","output","keys","Set","Object","key","endsWith","test","nextValue","previousValue"],"sources":["../../../../src/core/entities/event/diff.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { isEqual } from 'smob';\n\n/**\n * Secret denylist for entity-diff keys (fail-closed: losing a\n * \"secret_hashed flipped\" diff entry is acceptable, leaking a hash is not).\n * Shared with the sanitizer's `diff` branch so both boundaries agree.\n */\nexport const EVENT_DIFF_SECRET_KEY_REGEX = /(password|secret|hash|token|credential)/i;\n\nexport const EVENT_DIFF_VALUE_MAX_LENGTH = 512;\n\nexport type EntityDiff = Record<string, { next: unknown, previous: unknown }>;\n\nfunction isScalar(value: unknown): value is string | number | boolean | null {\n    return value === null ||\n        typeof value === 'string' ||\n        typeof value === 'number' ||\n        typeof value === 'boolean';\n}\n\nfunction truncateScalar(value: string | number | boolean | null): string | number | boolean | null {\n    if (typeof value === 'string' && value.length > EVENT_DIFF_VALUE_MAX_LENGTH) {\n        return value.substring(0, EVENT_DIFF_VALUE_MAX_LENGTH);\n    }\n\n    return value;\n}\n\n/**\n * PII-safe scalar diff between the updated entity and its pre-mutation\n * snapshot: only keys with scalar values (string/number/boolean/null) on BOTH\n * sides, skipping timestamp columns (`*_at`) and any key matching the secret\n * denylist, including only keys whose value actually changed. String values\n * are truncated to {@link EVENT_DIFF_VALUE_MAX_LENGTH}.\n */\nexport function buildEntityDiff(\n    next: Record<string, any>,\n    previous: Record<string, any>,\n): EntityDiff {\n    const output: EntityDiff = {};\n\n    const keys = new Set([\n        ...Object.keys(next),\n        ...Object.keys(previous),\n    ]);\n\n    for (const key of keys) {\n        if (key.endsWith('_at')) {\n            continue;\n        }\n\n        if (EVENT_DIFF_SECRET_KEY_REGEX.test(key)) {\n            continue;\n        }\n\n        const nextValue = next[key];\n        const previousValue = previous[key];\n\n        if (!isScalar(nextValue) || !isScalar(previousValue)) {\n            continue;\n        }\n\n        if (isEqual(nextValue, previousValue)) {\n            continue;\n        }\n\n        output[key] = {\n            next: truncateScalar(nextValue),\n            previous: truncateScalar(previousValue),\n        };\n    }\n\n    return output;\n}\n"],"mappings":";;;;;;;;;GAcA,MAAaC,8BAA8B;AAE3C,MAAaC,8BAA8B;AAI3C,SAASC,SAASC,OAAc;CAC5B,OAAOA,UAAU,QACb,OAAOA,UAAU,YACjB,OAAOA,UAAU,YACjB,OAAOA,UAAU;AACzB;AAEA,SAASC,eAAeD,OAAuC;CAC3D,IAAI,OAAOA,UAAU,YAAYA,MAAME,SAAAA,KACnC,OAAOF,MAAMG,UAAU,GAAA,GAAGL;CAG9B,OAAOE;AACX;;;;;;;GASA,SAAgBI,gBACZC,MACAC,UAA6B;CAE7B,MAAMC,SAAqB,CAAC;CAE5B,MAAMC,uBAAO,IAAIC,IAAI,CAAA,GACdC,OAAOF,KAAKH,IAAAA,GAAAA,GACZK,OAAOF,KAAKF,QAAAA,CAAAA,CAClB;CAED,KAAK,MAAMK,OAAOH,MAAM;EACpB,IAAIG,IAAIC,SAAS,KAAA,GACb;EAGJ,IAAIf,4BAA4BgB,KAAKF,GAAAA,GACjC;EAGJ,MAAMG,YAAYT,KAAKM;EACvB,MAAMI,gBAAgBT,SAASK;EAE/B,IAAI,CAACZ,SAASe,SAAAA,KAAc,CAACf,SAASgB,aAAAA,GAClC;EAGJ,IAAInB,QAAQkB,WAAWC,aAAAA,GACnB;EAGJR,OAAOI,OAAO;GACVN,MAAMJ,eAAea,SAAAA;GACrBR,UAAUL,eAAec,aAAAA;EAC7B;CACJ;CAEA,OAAOR;AACX"}

package/dist/core/entities/event/entity-event-handler.d.ts

@@ -0,0 +1,19 @@
+import type { DomainEventPublishContext, IDomainEventHandler } from '@authup/server-kit';
+import type { EntityEventHandlerOptions, EventRequestContext, IEventService } from './types.ts';
+export type EntityEventHandlerContext = {
+    eventService: IEventService;
+    requestContext?: () => EventRequestContext | undefined;
+    options?: EntityEventHandlerOptions;
+};
+/**
+ * Bridges every entity create/update/delete published on the
+ * DomainEventPublisher bus into the auth_events audit table (scope `entity`).
+ */
+export declare class EntityEventHandler implements IDomainEventHandler {
+    protected eventService: IEventService;
+    protected requestContext?: () => EventRequestContext | undefined;
+    protected options: EntityEventHandlerOptions;
+    constructor(ctx: EntityEventHandlerContext);
+    handle(ctx: DomainEventPublishContext): Promise<void>;
+}
+//# sourceMappingURL=entity-event-handler.d.ts.map

package/dist/core/entities/event/entity-event-handler.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"entity-event-handler.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/event/entity-event-handler.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,yBAAyB,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAEzF,OAAO,KAAK,EACR,yBAAyB,EACzB,mBAAmB,EACnB,aAAa,EAChB,MAAM,YAAY,CAAC;AAEpB,MAAM,MAAM,yBAAyB,GAAG;IACpC,YAAY,EAAE,aAAa,CAAC;IAC5B,cAAc,CAAC,EAAE,MAAM,mBAAmB,GAAG,SAAS,CAAC;IACvD,OAAO,CAAC,EAAE,yBAAyB,CAAC;CACvC,CAAC;AA0CF;;;GAGG;AACH,qBAAa,kBAAmB,YAAW,mBAAmB;IAC1D,SAAS,CAAC,YAAY,EAAG,aAAa,CAAC;IAEvC,SAAS,CAAC,cAAc,CAAC,EAAG,MAAM,mBAAmB,GAAG,SAAS,CAAC;IAElE,SAAS,CAAC,OAAO,EAAG,yBAAyB,CAAC;gBAElC,GAAG,EAAE,yBAAyB;IAMpC,MAAM,CAAC,GAAG,EAAE,yBAAyB,GAAG,OAAO,CAAC,IAAI,CAAC;CAqD9D"}

package/dist/core/entities/event/entity-event-handler.mjs

@@ -0,0 +1,100 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { buildEntityDiff } from "./diff.mjs";
+import { hasOwnProperty, isObject } from "@authup/kit";
+import { EntityDefaultEventName, EntityType, EventName, EventScope } from "@authup/core-kit";
+//#region src/core/entities/event/entity-event-handler.ts
+const ENTITY_EVENT_NAME_MAP = {
+	[EntityDefaultEventName.CREATED]: EventName.CREATED,
+	[EntityDefaultEventName.UPDATED]: EventName.UPDATED,
+	[EntityDefaultEventName.DELETED]: EventName.DELETED
+};
+const ENTITY_REALM_KEY_MAP = {
+	[EntityType.CLIENT]: "realm_id",
+	[EntityType.CLIENT_PERMISSION]: "client_realm_id",
+	[EntityType.CLIENT_ROLE]: "client_realm_id",
+	[EntityType.CLIENT_SCOPE]: "client_realm_id",
+	[EntityType.CONSENT]: "realm_id",
+	[EntityType.EVENT]: "realm_id",
+	[EntityType.IDENTITY_PROVIDER]: "realm_id",
+	[EntityType.IDENTITY_PROVIDER_ACCOUNT]: "user_realm_id",
+	[EntityType.IDENTITY_PROVIDER_ATTRIBUTE]: "realm_id",
+	[EntityType.IDENTITY_PROVIDER_ATTRIBUTE_MAPPING]: "provider_realm_id",
+	[EntityType.IDENTITY_PROVIDER_PERMISSION_MAPPING]: "provider_realm_id",
+	[EntityType.IDENTITY_PROVIDER_ROLE_MAPPING]: "provider_realm_id",
+	[EntityType.KEY]: "realm_id",
+	[EntityType.POLICY]: "realm_id",
+	[EntityType.POLICY_ATTRIBUTE]: "realm_id",
+	[EntityType.PERMISSION]: "realm_id",
+	[EntityType.PERMISSION_POLICY]: "permission_realm_id",
+	[EntityType.REALM]: "id",
+	[EntityType.ROBOT]: "realm_id",
+	[EntityType.ROBOT_PERMISSION]: "robot_realm_id",
+	[EntityType.ROBOT_ROLE]: "robot_realm_id",
+	[EntityType.ROLE]: "realm_id",
+	[EntityType.ROLE_ATTRIBUTE]: "realm_id",
+	[EntityType.ROLE_PERMISSION]: "role_realm_id",
+	[EntityType.SCOPE]: "realm_id",
+	[EntityType.SESSION]: "realm_id",
+	[EntityType.TRUST_ANCHOR]: "realm_id",
+	[EntityType.USER]: "realm_id",
+	[EntityType.USER_ATTRIBUTE]: "realm_id",
+	[EntityType.USER_PERMISSION]: "user_realm_id",
+	[EntityType.USER_ROLE]: "user_realm_id"
+};
+/**
+* Bridges every entity create/update/delete published on the
+* DomainEventPublisher bus into the auth_events audit table (scope `entity`).
+*/ var EntityEventHandler = class {
+	eventService;
+	requestContext;
+	options;
+	constructor(ctx) {
+		this.eventService = ctx.eventService;
+		this.requestContext = ctx.requestContext;
+		this.options = ctx.options ?? {};
+	}
+	async handle(ctx) {
+		try {
+			if (ctx.content.type === "event") return;
+			const name = ENTITY_EVENT_NAME_MAP[ctx.content.event];
+			if (!name) return;
+			const refId = ctx.content.data?.id ?? null;
+			const realmIdCurrent = resolveEntityRealmId(ctx.content.type, ctx.content.data);
+			const realmId = typeof realmIdCurrent === "undefined" ? resolveEntityRealmId(ctx.content.type, ctx.dataPrevious) ?? null : realmIdCurrent;
+			const requestContext = this.requestContext ? this.requestContext() : void 0;
+			let data = null;
+			if (name === EventName.UPDATED && isObject(ctx.content.data) && isObject(ctx.dataPrevious)) {
+				const diff = buildEntityDiff(ctx.content.data, ctx.dataPrevious);
+				if (Object.keys(diff).length > 0) data = { diff };
+			}
+			await this.eventService.record({
+				scope: EventScope.ENTITY,
+				name,
+				refType: ctx.content.type,
+				refId,
+				realmId,
+				actorType: requestContext?.actorType ?? null,
+				actorId: requestContext?.actorId ?? null,
+				actorName: requestContext?.actorName ?? null,
+				requestPath: requestContext?.requestPath ?? null,
+				requestMethod: requestContext?.requestMethod ?? null,
+				requestIpAddress: requestContext?.requestIpAddress ?? null,
+				requestUserAgent: requestContext?.requestUserAgent ?? null,
+				data,
+				retentionDays: this.options.retentionDays
+			});
+		} catch {}
+	}
+};
+function resolveEntityRealmId(type, data) {
+	if (!isObject(data)) return;
+	const key = ENTITY_REALM_KEY_MAP[type] ?? "realm_id";
+	if (!hasOwnProperty(data, key)) return;
+	return typeof data[key] === "string" ? data[key] : null;
+}
+//#endregion
+export { EntityEventHandler };
+
+//# sourceMappingURL=entity-event-handler.mjs.map

package/dist/core/entities/event/entity-event-handler.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"entity-event-handler.mjs","names":["EntityDefaultEventName","EntityType","EventName","EventScope","hasOwnProperty","isObject","buildEntityDiff","ENTITY_EVENT_NAME_MAP","CREATED","UPDATED","DELETED","ENTITY_REALM_KEY_MAP","CLIENT","CLIENT_PERMISSION","CLIENT_ROLE","CLIENT_SCOPE","CONSENT","EVENT","IDENTITY_PROVIDER","IDENTITY_PROVIDER_ACCOUNT","IDENTITY_PROVIDER_ATTRIBUTE","IDENTITY_PROVIDER_ATTRIBUTE_MAPPING","IDENTITY_PROVIDER_PERMISSION_MAPPING","IDENTITY_PROVIDER_ROLE_MAPPING","KEY","POLICY","POLICY_ATTRIBUTE","PERMISSION","PERMISSION_POLICY","REALM","ROBOT","ROBOT_PERMISSION","ROBOT_ROLE","ROLE","ROLE_ATTRIBUTE","ROLE_PERMISSION","SCOPE","SESSION","TRUST_ANCHOR","USER","USER_ATTRIBUTE","USER_PERMISSION","USER_ROLE","EntityEventHandler","eventService","requestContext","options","ctx","handle","content","type","name","event","refId","data","id","realmIdCurrent","resolveEntityRealmId","realmId","dataPrevious","undefined","diff","Object","keys","length","record","scope","ENTITY","refType","actorType","actorId","actorName","requestPath","requestMethod","requestIpAddress","requestUserAgent","retentionDays","key"],"sources":["../../../../src/core/entities/event/entity-event-handler.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport {\n    EntityDefaultEventName,\n    EntityType,\n    EventName,\n    EventScope,\n} from '@authup/core-kit';\nimport { hasOwnProperty, isObject } from '@authup/kit';\nimport type { DomainEventPublishContext, IDomainEventHandler } from '@authup/server-kit';\nimport { buildEntityDiff } from './diff.ts';\nimport type {\n    EntityEventHandlerOptions,\n    EventRequestContext,\n    IEventService,\n} from './types.ts';\n\nexport type EntityEventHandlerContext = {\n    eventService: IEventService,\n    requestContext?: () => EventRequestContext | undefined,\n    options?: EntityEventHandlerOptions,\n};\n\nconst ENTITY_EVENT_NAME_MAP : Record<string, `${EventName}`> = {\n    [EntityDefaultEventName.CREATED]: EventName.CREATED,\n    [EntityDefaultEventName.UPDATED]: EventName.UPDATED,\n    [EntityDefaultEventName.DELETED]: EventName.DELETED,\n};\n\nconst ENTITY_REALM_KEY_MAP : Record<`${EntityType}`, string> = {\n    [EntityType.CLIENT]: 'realm_id',\n    [EntityType.CLIENT_PERMISSION]: 'client_realm_id',\n    [EntityType.CLIENT_ROLE]: 'client_realm_id',\n    [EntityType.CLIENT_SCOPE]: 'client_realm_id',\n    [EntityType.CONSENT]: 'realm_id',\n    [EntityType.EVENT]: 'realm_id',\n    [EntityType.IDENTITY_PROVIDER]: 'realm_id',\n    [EntityType.IDENTITY_PROVIDER_ACCOUNT]: 'user_realm_id',\n    [EntityType.IDENTITY_PROVIDER_ATTRIBUTE]: 'realm_id',\n    [EntityType.IDENTITY_PROVIDER_ATTRIBUTE_MAPPING]: 'provider_realm_id',\n    [EntityType.IDENTITY_PROVIDER_PERMISSION_MAPPING]: 'provider_realm_id',\n    [EntityType.IDENTITY_PROVIDER_ROLE_MAPPING]: 'provider_realm_id',\n    [EntityType.KEY]: 'realm_id',\n    [EntityType.POLICY]: 'realm_id',\n    [EntityType.POLICY_ATTRIBUTE]: 'realm_id',\n    [EntityType.PERMISSION]: 'realm_id',\n    [EntityType.PERMISSION_POLICY]: 'permission_realm_id',\n    [EntityType.REALM]: 'id',\n    [EntityType.ROBOT]: 'realm_id',\n    [EntityType.ROBOT_PERMISSION]: 'robot_realm_id',\n    [EntityType.ROBOT_ROLE]: 'robot_realm_id',\n    [EntityType.ROLE]: 'realm_id',\n    [EntityType.ROLE_ATTRIBUTE]: 'realm_id',\n    [EntityType.ROLE_PERMISSION]: 'role_realm_id',\n    [EntityType.SCOPE]: 'realm_id',\n    [EntityType.SESSION]: 'realm_id',\n    [EntityType.TRUST_ANCHOR]: 'realm_id',\n    [EntityType.USER]: 'realm_id',\n    [EntityType.USER_ATTRIBUTE]: 'realm_id',\n    [EntityType.USER_PERMISSION]: 'user_realm_id',\n    [EntityType.USER_ROLE]: 'user_realm_id',\n};\n\n/**\n * Bridges every entity create/update/delete published on the\n * DomainEventPublisher bus into the auth_events audit table (scope `entity`).\n */\nexport class EntityEventHandler implements IDomainEventHandler {\n    protected eventService : IEventService;\n\n    protected requestContext? : () => EventRequestContext | undefined;\n\n    protected options : EntityEventHandlerOptions;\n\n    constructor(ctx: EntityEventHandlerContext) {\n        this.eventService = ctx.eventService;\n        this.requestContext = ctx.requestContext;\n        this.options = ctx.options ?? {};\n    }\n\n    async handle(ctx: DomainEventPublishContext): Promise<void> {\n        try {\n            // recursion guard — no event subscriber exists today (the\n            // auth_events entity is deliberately subscriber-less), so this is\n            // defense in depth against an audit-write feedback loop.\n            if (ctx.content.type === 'event') {\n                return;\n            }\n\n            const name = ENTITY_EVENT_NAME_MAP[ctx.content.event];\n            if (!name) {\n                return;\n            }\n\n            const refId = ctx.content.data?.id ?? null;\n            const realmIdCurrent = resolveEntityRealmId(ctx.content.type, ctx.content.data);\n            const realmId = typeof realmIdCurrent === 'undefined' ?\n                (resolveEntityRealmId(ctx.content.type, ctx.dataPrevious) ?? null) :\n                realmIdCurrent;\n\n            const requestContext = this.requestContext ?\n                this.requestContext() :\n                undefined;\n\n            let data : Record<string, any> | null = null;\n            if (name === EventName.UPDATED && isObject(ctx.content.data) && isObject(ctx.dataPrevious)) {\n                const diff = buildEntityDiff(ctx.content.data, ctx.dataPrevious);\n                if (Object.keys(diff).length > 0) {\n                    data = { diff };\n                }\n            }\n\n            await this.eventService.record({\n                scope: EventScope.ENTITY,\n                name,\n                refType: ctx.content.type,\n                refId,\n                realmId,\n                actorType: requestContext?.actorType ?? null,\n                actorId: requestContext?.actorId ?? null,\n                actorName: requestContext?.actorName ?? null,\n                requestPath: requestContext?.requestPath ?? null,\n                requestMethod: requestContext?.requestMethod ?? null,\n                requestIpAddress: requestContext?.requestIpAddress ?? null,\n                requestUserAgent: requestContext?.requestUserAgent ?? null,\n                data,\n                retentionDays: this.options.retentionDays,\n            });\n        } catch {\n            // record() never throws, but the bridge itself must also never\n            // fail the originating publish.\n        }\n    }\n}\n\nfunction resolveEntityRealmId(\n    type: string,\n    data: unknown,\n): string | null | undefined {\n    if (!isObject(data)) {\n        return undefined;\n    }\n\n    const key = ENTITY_REALM_KEY_MAP[type as `${EntityType}`] ?? 'realm_id';\n    if (!hasOwnProperty(data, key)) {\n        return undefined;\n    }\n\n    return typeof data[key] === 'string' ? data[key] : null;\n}\n"],"mappings":";;;;;;;AA4BA,MAAMO,wBAAyD;EAC1DP,uBAAuBQ,UAAUN,UAAUM;EAC3CR,uBAAuBS,UAAUP,UAAUO;EAC3CT,uBAAuBU,UAAUR,UAAUQ;AAChD;AAEA,MAAMC,uBAAyD;EAC1DV,WAAWW,SAAS;EACpBX,WAAWY,oBAAoB;EAC/BZ,WAAWa,cAAc;EACzBb,WAAWc,eAAe;EAC1Bd,WAAWe,UAAU;EACrBf,WAAWgB,QAAQ;EACnBhB,WAAWiB,oBAAoB;EAC/BjB,WAAWkB,4BAA4B;EACvClB,WAAWmB,8BAA8B;EACzCnB,WAAWoB,sCAAsC;EACjDpB,WAAWqB,uCAAuC;EAClDrB,WAAWsB,iCAAiC;EAC5CtB,WAAWuB,MAAM;EACjBvB,WAAWwB,SAAS;EACpBxB,WAAWyB,mBAAmB;EAC9BzB,WAAW0B,aAAa;EACxB1B,WAAW2B,oBAAoB;EAC/B3B,WAAW4B,QAAQ;EACnB5B,WAAW6B,QAAQ;EACnB7B,WAAW8B,mBAAmB;EAC9B9B,WAAW+B,aAAa;EACxB/B,WAAWgC,OAAO;EAClBhC,WAAWiC,iBAAiB;EAC5BjC,WAAWkC,kBAAkB;EAC7BlC,WAAWmC,QAAQ;EACnBnC,WAAWoC,UAAU;EACrBpC,WAAWqC,eAAe;EAC1BrC,WAAWsC,OAAO;EAClBtC,WAAWuC,iBAAiB;EAC5BvC,WAAWwC,kBAAkB;EAC7BxC,WAAWyC,YAAY;AAC5B;;;;GAMA,IAAaC,qBAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEV,YAAYC,KAAgC;EACxC,KAAKH,eAAeG,IAAIH;EACxB,KAAKC,iBAAiBE,IAAIF;EAC1B,KAAKC,UAAUC,IAAID,WAAW,CAAC;CACnC;CAEA,MAAME,OAAOD,KAA+C;EACxD,IAAI;GAIA,IAAIA,IAAIE,QAAQC,SAAS,SACrB;GAGJ,MAAMC,OAAO5C,sBAAsBwC,IAAIE,QAAQG;GAC/C,IAAI,CAACD,MACD;GAGJ,MAAME,QAAQN,IAAIE,QAAQK,MAAMC,MAAM;GACtC,MAAMC,iBAAiBC,qBAAqBV,IAAIE,QAAQC,MAAMH,IAAIE,QAAQK,IAAI;GAC9E,MAAMI,UAAU,OAAOF,mBAAmB,cACrCC,qBAAqBV,IAAIE,QAAQC,MAAMH,IAAIY,YAAY,KAAK,OAC7DH;GAEJ,MAAMX,iBAAiB,KAAKA,iBACxB,KAAKA,eAAc,IACnBe,KAAAA;GAEJ,IAAIN,OAAoC;GACxC,IAAIH,SAASjD,UAAUO,WAAWJ,SAAS0C,IAAIE,QAAQK,IAAI,KAAKjD,SAAS0C,IAAIY,YAAY,GAAG;IACxF,MAAME,OAAOvD,gBAAgByC,IAAIE,QAAQK,MAAMP,IAAIY,YAAY;IAC/D,IAAIG,OAAOC,KAAKF,IAAAA,CAAAA,CAAMG,SAAS,GAC3BV,OAAO,EAAEO,KAAK;GAEtB;GAEA,MAAM,KAAKjB,aAAaqB,OAAO;IAC3BC,OAAO/D,WAAWgE;IAClBhB;IACAiB,SAASrB,IAAIE,QAAQC;IACrBG;IACAK;IACAW,WAAWxB,gBAAgBwB,aAAa;IACxCC,SAASzB,gBAAgByB,WAAW;IACpCC,WAAW1B,gBAAgB0B,aAAa;IACxCC,aAAa3B,gBAAgB2B,eAAe;IAC5CC,eAAe5B,gBAAgB4B,iBAAiB;IAChDC,kBAAkB7B,gBAAgB6B,oBAAoB;IACtDC,kBAAkB9B,gBAAgB8B,oBAAoB;IACtDrB;IACAsB,eAAe,KAAK9B,QAAQ8B;GAChC,CAAA;EACJ,QAAQ,CAGR;CACJ;AACJ;AAEA,SAASnB,qBACLP,MACAI,MAAa;CAEb,IAAI,CAACjD,SAASiD,IAAAA,GACV;CAGJ,MAAMuB,MAAMlE,qBAAqBuC,SAA4B;CAC7D,IAAI,CAAC9C,eAAekD,MAAMuB,GAAAA,GACtB;CAGJ,OAAO,OAAOvB,KAAKuB,SAAS,WAAWvB,KAAKuB,OAAO;AACvD"}

package/dist/core/entities/event/index.d.ts

@@ -0,0 +1,7 @@
+export * from './constants.ts';
+export * from './diff.ts';
+export * from './entity-event-handler.ts';
+export * from './sanitize.ts';
+export * from './service.ts';
+export * from './types.ts';
+//# sourceMappingURL=index.d.ts.map

package/dist/core/entities/event/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/event/index.ts"],"names":[],"mappings":"AAOA,cAAc,gBAAgB,CAAC;AAC/B,cAAc,WAAW,CAAC;AAC1B,cAAc,2BAA2B,CAAC;AAC1C,cAAc,eAAe,CAAC;AAC9B,cAAc,cAAc,CAAC;AAC7B,cAAc,YAAY,CAAC"}

package/dist/core/entities/event/index.mjs

@@ -0,0 +1,9 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { EVENT_LOG_RETENTION_DAYS_DEFAULT } from "./constants.mjs";
+import { EVENT_DIFF_SECRET_KEY_REGEX, EVENT_DIFF_VALUE_MAX_LENGTH, buildEntityDiff } from "./diff.mjs";
+import { EntityEventHandler } from "./entity-event-handler.mjs";
+import { sanitizeEventData } from "./sanitize.mjs";
+import { EventService } from "./service.mjs";
+export { EVENT_DIFF_SECRET_KEY_REGEX, EVENT_DIFF_VALUE_MAX_LENGTH, EVENT_LOG_RETENTION_DAYS_DEFAULT, EntityEventHandler, EventService, buildEntityDiff, sanitizeEventData };

package/dist/core/entities/event/sanitize.d.ts

@@ -0,0 +1,2 @@
+export declare function sanitizeEventData(input?: Record<string, any> | null): Record<string, any> | null;
+//# sourceMappingURL=sanitize.d.ts.map

package/dist/core/entities/event/sanitize.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sanitize.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/event/sanitize.ts"],"names":[],"mappings":"AAqGA,wBAAgB,iBAAiB,CAC7B,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,IAAI,GACnC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,IAAI,CA6B5B"}

package/dist/core/entities/event/sanitize.mjs

@@ -0,0 +1,83 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { EVENT_DIFF_SECRET_KEY_REGEX } from "./diff.mjs";
+import { isObject } from "@authup/kit";
+//#region src/core/entities/event/sanitize.ts
+/**
+* The central PII/credential write boundary for event context data.
+*
+* Allowlist-first: only these keys survive, and only with scalar values —
+* objects and arrays are dropped outright, so a nested structure can never
+* smuggle a secret past the boundary (this subsumes a denylist: password,
+* client_secret, code, code_verifier, *token* etc. are simply never listed).
+* session_id / jti / revoked_session_id are opaque correlation ids, not PII.
+* name / use / status / enabled / force describe key & trust-anchor lifecycle
+* operations (issue #3269) — canonical identifiers and enum/flag metadata,
+* never material. kind is the MFA authenticator kind (totp/email/...).
+*
+* The single structured exception is `diff` (entity-CRUD bridge): it survives
+* only as a one-level object of `{ next, previous }` scalar pairs, keys
+* re-checked against the diff secret denylist — the write boundary stays the
+* choke point even though buildEntityDiff pre-sanitizes.
+*/ const DATA_KEY_ALLOW_LIST = [
+	"grant_type",
+	"scope",
+	"response_type",
+	"prompt",
+	"error",
+	"error_code",
+	"reason",
+	"client_name",
+	"realm_name",
+	"session_id",
+	"jti",
+	"revoked_session_id",
+	"name",
+	"use",
+	"status",
+	"enabled",
+	"force",
+	"kind"
+];
+const DATA_VALUE_MAX_LENGTH = 512;
+function isDiffScalar(value) {
+	return value === null || typeof value === "string" || typeof value === "number" || typeof value === "boolean";
+}
+function truncateDiffScalar(value) {
+	if (typeof value === "string" && value.length > DATA_VALUE_MAX_LENGTH) return value.substring(0, DATA_VALUE_MAX_LENGTH);
+	return value;
+}
+function sanitizeDiff(input) {
+	if (!isObject(input)) return null;
+	const output = {};
+	for (const [key, entry] of Object.entries(input)) {
+		if (EVENT_DIFF_SECRET_KEY_REGEX.test(key)) continue;
+		if (!isObject(entry)) continue;
+		const { next, previous } = entry;
+		if (!isDiffScalar(next) || !isDiffScalar(previous)) continue;
+		output[key] = {
+			next: truncateDiffScalar(next),
+			previous: truncateDiffScalar(previous)
+		};
+	}
+	if (Object.keys(output).length === 0) return null;
+	return output;
+}
+function sanitizeEventData(input) {
+	if (!input) return null;
+	const output = {};
+	for (const key of DATA_KEY_ALLOW_LIST) {
+		const value = input[key];
+		if (typeof value === "string") output[key] = value.length > DATA_VALUE_MAX_LENGTH ? value.substring(0, DATA_VALUE_MAX_LENGTH) : value;
+		else if (typeof value === "number" || typeof value === "boolean") output[key] = value;
+	}
+	const diff = sanitizeDiff(input.diff);
+	if (diff) output.diff = diff;
+	if (Object.keys(output).length === 0) return null;
+	return output;
+}
+//#endregion
+export { sanitizeEventData };
+
+//# sourceMappingURL=sanitize.mjs.map

package/dist/core/entities/event/sanitize.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"sanitize.mjs","names":["isObject","EVENT_DIFF_SECRET_KEY_REGEX","DATA_KEY_ALLOW_LIST","DATA_VALUE_MAX_LENGTH","isDiffScalar","value","truncateDiffScalar","length","substring","sanitizeDiff","input","output","key","entry","Object","entries","test","next","previous","keys","sanitizeEventData","diff"],"sources":["../../../../src/core/entities/event/sanitize.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { isObject } from '@authup/kit';\nimport { EVENT_DIFF_SECRET_KEY_REGEX } from './diff.ts';\n\n/**\n * The central PII/credential write boundary for event context data.\n *\n * Allowlist-first: only these keys survive, and only with scalar values —\n * objects and arrays are dropped outright, so a nested structure can never\n * smuggle a secret past the boundary (this subsumes a denylist: password,\n * client_secret, code, code_verifier, *token* etc. are simply never listed).\n * session_id / jti / revoked_session_id are opaque correlation ids, not PII.\n * name / use / status / enabled / force describe key & trust-anchor lifecycle\n * operations (issue #3269) — canonical identifiers and enum/flag metadata,\n * never material. kind is the MFA authenticator kind (totp/email/...).\n *\n * The single structured exception is `diff` (entity-CRUD bridge): it survives\n * only as a one-level object of `{ next, previous }` scalar pairs, keys\n * re-checked against the diff secret denylist — the write boundary stays the\n * choke point even though buildEntityDiff pre-sanitizes.\n */\nconst DATA_KEY_ALLOW_LIST = [\n    'grant_type',\n    'scope',\n    'response_type',\n    'prompt',\n    'error',\n    'error_code',\n    'reason',\n    'client_name',\n    'realm_name',\n    'session_id',\n    'jti',\n    'revoked_session_id',\n    'name',\n    'use',\n    'status',\n    'enabled',\n    'force',\n    'kind',\n] as const;\n\nconst DATA_VALUE_MAX_LENGTH = 512;\n\nfunction isDiffScalar(value: unknown): value is string | number | boolean | null {\n    return value === null ||\n        typeof value === 'string' ||\n        typeof value === 'number' ||\n        typeof value === 'boolean';\n}\n\nfunction truncateDiffScalar(\n    value: string | number | boolean | null,\n): string | number | boolean | null {\n    if (typeof value === 'string' && value.length > DATA_VALUE_MAX_LENGTH) {\n        return value.substring(0, DATA_VALUE_MAX_LENGTH);\n    }\n\n    return value;\n}\n\nfunction sanitizeDiff(input: unknown): Record<string, any> | null {\n    if (!isObject(input)) {\n        return null;\n    }\n\n    const output: Record<string, any> = {};\n\n    for (const [key, entry] of Object.entries(input)) {\n        if (EVENT_DIFF_SECRET_KEY_REGEX.test(key)) {\n            continue;\n        }\n\n        if (!isObject(entry)) {\n            continue;\n        }\n\n        const { next, previous } = entry;\n        if (!isDiffScalar(next) || !isDiffScalar(previous)) {\n            continue;\n        }\n\n        output[key] = {\n            next: truncateDiffScalar(next),\n            previous: truncateDiffScalar(previous),\n        };\n    }\n\n    if (Object.keys(output).length === 0) {\n        return null;\n    }\n\n    return output;\n}\n\nexport function sanitizeEventData(\n    input?: Record<string, any> | null,\n): Record<string, any> | null {\n    if (!input) {\n        return null;\n    }\n\n    const output: Record<string, any> = {};\n\n    for (const key of DATA_KEY_ALLOW_LIST) {\n        const value = input[key];\n\n        if (typeof value === 'string') {\n            output[key] = value.length > DATA_VALUE_MAX_LENGTH ?\n                value.substring(0, DATA_VALUE_MAX_LENGTH) :\n                value;\n        } else if (typeof value === 'number' || typeof value === 'boolean') {\n            output[key] = value;\n        }\n    }\n\n    const diff = sanitizeDiff(input.diff);\n    if (diff) {\n        output.diff = diff;\n    }\n\n    if (Object.keys(output).length === 0) {\n        return null;\n    }\n\n    return output;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;GA2BA,MAAME,sBAAsB;CACxB;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;;AAGJ,MAAMC,wBAAwB;AAE9B,SAASC,aAAaC,OAAc;CAChC,OAAOA,UAAU,QACb,OAAOA,UAAU,YACjB,OAAOA,UAAU,YACjB,OAAOA,UAAU;AACzB;AAEA,SAASC,mBACLD,OAAuC;CAEvC,IAAI,OAAOA,UAAU,YAAYA,MAAME,SAASJ,uBAC5C,OAAOE,MAAMG,UAAU,GAAGL,qBAAAA;CAG9B,OAAOE;AACX;AAEA,SAASI,aAAaC,OAAc;CAChC,IAAI,CAACV,SAASU,KAAAA,GACV,OAAO;CAGX,MAAMC,SAA8B,CAAC;CAErC,KAAK,MAAM,CAACC,KAAKC,UAAUC,OAAOC,QAAQL,KAAAA,GAAQ;EAC9C,IAAIT,4BAA4Be,KAAKJ,GAAAA,GACjC;EAGJ,IAAI,CAACZ,SAASa,KAAAA,GACV;EAGJ,MAAM,EAAEI,MAAMC,aAAaL;EAC3B,IAAI,CAACT,aAAaa,IAAAA,KAAS,CAACb,aAAac,QAAAA,GACrC;EAGJP,OAAOC,OAAO;GACVK,MAAMX,mBAAmBW,IAAAA;GACzBC,UAAUZ,mBAAmBY,QAAAA;EACjC;CACJ;CAEA,IAAIJ,OAAOK,KAAKR,MAAAA,CAAAA,CAAQJ,WAAW,GAC/B,OAAO;CAGX,OAAOI;AACX;AAEA,SAAgBS,kBACZV,OAAkC;CAElC,IAAI,CAACA,OACD,OAAO;CAGX,MAAMC,SAA8B,CAAC;CAErC,KAAK,MAAMC,OAAOV,qBAAqB;EACnC,MAAMG,QAAQK,MAAME;EAEpB,IAAI,OAAOP,UAAU,UACjBM,OAAOC,OAAOP,MAAME,SAASJ,wBACzBE,MAAMG,UAAU,GAAGL,qBAAAA,IACnBE;OACD,IAAI,OAAOA,UAAU,YAAY,OAAOA,UAAU,WACrDM,OAAOC,OAAOP;CAEtB;CAEA,MAAMgB,OAAOZ,aAAaC,MAAMW,IAAI;CACpC,IAAIA,MACAV,OAAOU,OAAOA;CAGlB,IAAIP,OAAOK,KAAKR,MAAAA,CAAAA,CAAQJ,WAAW,GAC/B,OAAO;CAGX,OAAOI;AACX"}

package/dist/core/entities/event/service.d.ts

@@ -0,0 +1,22 @@
+import type { Event } from '@authup/core-kit';
+import { AbstractEntityService } from '@authup/server-kit';
+import type { ActorContext, EntityRepositoryFindManyResult, Logger } from '@authup/server-kit';
+import type { EventReadVisibility, EventRecordInput, EventServiceOptions, EventServiceReadOptions, IEventRepository, IEventService } from './types.ts';
+export type EventServiceContext = {
+    repository: IEventRepository;
+    options?: EventServiceOptions;
+    logger?: Logger;
+};
+export declare class EventService extends AbstractEntityService implements IEventService {
+    protected repository: IEventRepository;
+    protected options: EventServiceOptions;
+    protected logger?: Logger;
+    constructor(ctx: EventServiceContext);
+    protected isOwnedBy(entity: Event, actor: ActorContext): boolean;
+    protected canReadRealm(actor: ActorContext, realmId: string | null): Promise<boolean>;
+    protected resolveReadVisibility(actor: ActorContext): Promise<EventReadVisibility | undefined>;
+    record(input: EventRecordInput): Promise<void>;
+    getMany(query: Record<string, any>, actor: ActorContext, options?: EventServiceReadOptions): Promise<EntityRepositoryFindManyResult<Event>>;
+    getOne(id: string, actor: ActorContext, options?: EventServiceReadOptions): Promise<Event>;
+}
+//# sourceMappingURL=service.d.ts.map

package/dist/core/entities/event/service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/event/service.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAE9C,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAC3D,OAAO,KAAK,EAAE,YAAY,EAAE,8BAA8B,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAG/F,OAAO,KAAK,EACR,mBAAmB,EACnB,gBAAgB,EAChB,mBAAmB,EACnB,uBAAuB,EACvB,gBAAgB,EAChB,aAAa,EAChB,MAAM,YAAY,CAAC;AAEpB,MAAM,MAAM,mBAAmB,GAAG;IAC9B,UAAU,EAAE,gBAAgB,CAAC;IAC7B,OAAO,CAAC,EAAE,mBAAmB,CAAC;IAC9B,MAAM,CAAC,EAAE,MAAM,CAAC;CACnB,CAAC;AAIF,qBAAa,YAAa,SAAQ,qBAAsB,YAAW,aAAa;IAC5E,SAAS,CAAC,UAAU,EAAE,gBAAgB,CAAC;IAEvC,SAAS,CAAC,OAAO,EAAE,mBAAmB,CAAC;IAEvC,SAAS,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;gBAEd,GAAG,EAAE,mBAAmB;IAQpC,SAAS,CAAC,SAAS,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO;cAOhD,YAAY,CAAC,KAAK,EAAE,YAAY,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC;cAmB3E,qBAAqB,CAAC,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,mBAAmB,GAAG,SAAS,CAAC;IA8B9F,MAAM,CAAC,KAAK,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC;IAqD9C,OAAO,CACT,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC1B,KAAK,EAAE,YAAY,EACnB,OAAO,GAAE,uBAA4B,GACtC,OAAO,CAAC,8BAA8B,CAAC,KAAK,CAAC,CAAC;IA2D3C,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,OAAO,GAAE,uBAA4B,GAAG,OAAO,CAAC,KAAK,CAAC;CAmBvG"}

package/dist/core/entities/event/service.mjs

@@ -0,0 +1,169 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import "./constants.mjs";
+import { sanitizeEventData } from "./sanitize.mjs";
+import { PermissionName } from "@authup/core-kit";
+import { AbstractEntityService } from "@authup/server-kit";
+import { BuiltInPolicyType, definePolicyData } from "@authup/access";
+import { EntityNotFoundError } from "@authup/errors";
+import { randomUUID } from "node:crypto";
+//#region src/core/entities/event/service.ts
+const DAY_IN_MS = 864e5;
+var EventService = class extends AbstractEntityService {
+	repository;
+	options;
+	logger;
+	constructor(ctx) {
+		super();
+		this.repository = ctx.repository;
+		this.options = ctx.options ?? {};
+		this.logger = ctx.logger;
+	}
+	isOwnedBy(entity, actor) {
+		return !!actor.identity && !!entity.actor_id && entity.actor_id === actor.identity.data.id && entity.actor_type === actor.identity.type;
+	}
+	async canReadRealm(actor, realmId) {
+		try {
+			await actor.permissionEvaluator.evaluate({
+				name: PermissionName.EVENT_READ,
+				data: definePolicyData({ [BuiltInPolicyType.REALM_MATCH]: realmId }),
+				options: { policiesIncluded: [
+					BuiltInPolicyType.COMPOSITE,
+					BuiltInPolicyType.PERMISSION_BINDING,
+					BuiltInPolicyType.REALM_MATCH
+				] }
+			});
+			return true;
+		} catch {
+			return false;
+		}
+	}
+	async resolveReadVisibility(actor) {
+		const actorRealmId = this.getActorRealmId(actor);
+		let foreignRealmId = randomUUID();
+		while (foreignRealmId === actorRealmId) foreignRealmId = randomUUID();
+		if (await this.canReadRealm(actor, foreignRealmId)) return;
+		const realmIds = [];
+		if (actorRealmId && await this.canReadRealm(actor, actorRealmId)) realmIds.push(actorRealmId);
+		if (await this.canReadRealm(actor, null)) realmIds.push(null);
+		return {
+			realmIds,
+			...actor.identity ? { owner: {
+				actorId: actor.identity.data.id,
+				actorType: actor.identity.type
+			} } : {}
+		};
+	}
+	async record(input) {
+		const data = sanitizeEventData(input.data);
+		this.logger?.info(`audit: ${input.scope}.${input.name}`, {
+			scope: input.scope,
+			name: input.name,
+			ref_type: input.refType ?? null,
+			ref_id: input.refId ?? null,
+			client_id: input.clientId ?? null,
+			actor_type: input.actorType ?? null,
+			actor_id: input.actorId ?? null,
+			realm_id: input.realmId ?? null,
+			...data ? { data } : {}
+		});
+		if (this.options.enabled === false) return;
+		try {
+			const retentionDays = input.retentionDays ?? this.options.retentionDays ?? 90;
+			const entity = this.repository.create({
+				id: randomUUID(),
+				scope: input.scope,
+				name: input.name,
+				ref_type: truncate(input.refType, 64),
+				ref_id: truncate(input.refId, 64),
+				client_id: input.clientId ?? null,
+				actor_type: input.actorType ?? null,
+				actor_id: input.actorId ?? null,
+				actor_name: truncate(input.actorName, 128),
+				request_path: truncate(input.requestPath, 256),
+				request_method: truncate(input.requestMethod, 10),
+				request_ip_address: truncate(input.requestIpAddress, 45),
+				request_user_agent: truncate(input.requestUserAgent, 512),
+				realm_id: input.realmId ?? null,
+				data,
+				expiring: retentionDays > 0,
+				expires_at: retentionDays > 0 ? new Date(Date.now() + retentionDays * DAY_IN_MS).toISOString() : null
+			});
+			await this.repository.save(entity);
+		} catch {
+			this.logger?.warn(`Recording the audit event ${input.scope}.${input.name} failed.`);
+		}
+	}
+	async getMany(query, actor, options = {}) {
+		let canReadAll = true;
+		try {
+			await actor.permissionEvaluator.preEvaluate({ name: PermissionName.EVENT_READ });
+		} catch (e) {
+			if (!actor.identity) throw e;
+			canReadAll = false;
+		}
+		if (!canReadAll) return this.repository.findMany(query, {
+			owner: {
+				actorId: actor.identity.data.id,
+				actorType: actor.identity.type
+			},
+			...options.realmId ? { realmId: options.realmId } : {}
+		});
+		const visibility = await this.resolveReadVisibility(actor);
+		const { data: entities, meta } = await this.repository.findMany(query, {
+			...options.realmId ? { realmId: options.realmId } : {},
+			...visibility ? { visibility } : {}
+		});
+		const data = [];
+		for (const entity of entities) {
+			if (this.isOwnedBy(entity, actor)) {
+				data.push(entity);
+				continue;
+			}
+			try {
+				await actor.permissionEvaluator.evaluate({
+					name: PermissionName.EVENT_READ,
+					data: definePolicyData({
+						[BuiltInPolicyType.ATTRIBUTES]: entity,
+						...this.resourceRealmMatch(entity)
+					})
+				});
+				data.push(entity);
+			} catch {
+				continue;
+			}
+		}
+		return {
+			data,
+			meta: {
+				...meta,
+				total: meta.total - (entities.length - data.length)
+			}
+		};
+	}
+	async getOne(id, actor, options = {}) {
+		const entity = await this.repository.findOneById(id);
+		if (!entity || options.realmId && entity.realm_id !== options.realmId) throw new EntityNotFoundError();
+		if (!this.isOwnedBy(entity, actor)) {
+			await actor.permissionEvaluator.preEvaluate({ name: PermissionName.EVENT_READ });
+			await actor.permissionEvaluator.evaluate({
+				name: PermissionName.EVENT_READ,
+				data: definePolicyData({
+					[BuiltInPolicyType.ATTRIBUTES]: entity,
+					...this.resourceRealmMatch(entity)
+				})
+			});
+		}
+		return entity;
+	}
+};
+function truncate(value, maxLength) {
+	if (typeof value !== "string") return null;
+	if (value.length <= maxLength) return value;
+	return value.substring(0, maxLength);
+}
+//#endregion
+export { EventService };
+
+//# sourceMappingURL=service.mjs.map