@authup/server-core 1.0.0-beta.52 → 1.0.0-beta.54

package/dist/core/entities/consent/types.d.ts

@@ -0,0 +1,98 @@
+import type { Consent } from '@authup/core-kit';
+import type { IQuery } from '@rapiq/core';
+import type { ActorContext, EntityRepositoryFindManyResult } from '@authup/server-kit';
+export type ConsentOwner = {
+    sub: string;
+    subKind: string;
+};
+/**
+ * Max length of a single stored scope token — must equal the
+ * `auth_consents.scope` column width (varchar 128). A longer token (only
+ * reachable via a non-standard scope riding the `global` verifier bypass) is
+ * dropped at normalization rather than overflowing the column.
+ */
+export declare const CONSENT_SCOPE_MAX_LENGTH = 128;
+/**
+ * Filter keys a consent list query may target. Shared by the repository's
+ * rapiq `filters.allowed` so service and adapter can never drift.
+ */
+export declare const CONSENT_FILTER_KEYS: readonly ["id", "clientId", "realmId", "sub", "subKind", "scope"];
+export type ConsentFindManyOptions = {
+    /**
+     * Force the result to a single subject (self-service). Applied as a
+     * mandatory WHERE that a rapiq query filter cannot override.
+     */
+    owner?: ConsentOwner;
+    /**
+     * Restrict the result to a single realm (the `/realms/:realmId/consents`
+     * nested mount). Mandatory WHERE, not overridable by a rapiq filter.
+     */
+    realmId?: string;
+};
+export type ConsentServiceReadOptions = {
+    realmId?: string;
+};
+export type ConsentRecordInput = {
+    clientId: string;
+    realmId: string;
+    owner: ConsentOwner;
+    /**
+     * Raw scope representation(s) — normalized to lowercase tokens via
+     * `unwrapOAuth2Scope` before persistence.
+     */
+    scope: string | string[] | null;
+};
+export type ConsentCoveringInput = {
+    clientId: string;
+    owner: ConsentOwner;
+    scope: string | string[] | null;
+};
+export interface IConsentRepository {
+    findMany(query: IQuery, options?: ConsentFindManyOptions): Promise<EntityRepositoryFindManyResult<Consent>>;
+    findOneById(id: string): Promise<Consent | null>;
+    /**
+     * Covering-lookup source — query-cached
+     * (`CachePrefix.CONSENT_COVERING`, 60s), invalidated by the
+     * `ConsentEntitySubscriber` on insert/update/remove.
+     */
+    findAllBySubjectClient(clientId: string, owner: ConsentOwner): Promise<Consent[]>;
+    /**
+     * Union/keep: insert one row per missing scope token, never touching
+     * existing rows. Race-safe under the 4-column unique index.
+     */
+    insertMissing(input: {
+        clientId: string;
+        realmId: string;
+        owner: ConsentOwner;
+        scopes: string[];
+    }): Promise<void>;
+    remove(entity: Consent): Promise<void>;
+}
+export interface IConsentService {
+    /**
+     * List consents. An actor without `CONSENT_READ` is scoped to its own
+     * rows (self-service); an actor with `CONSENT_READ` sees every row its
+     * realm reach permits.
+     */
+    getMany(query: Record<string, any>, actor: ActorContext, options?: ConsentServiceReadOptions): Promise<EntityRepositoryFindManyResult<Consent>>;
+    /**
+     * Read a single consent by id. Own rows need no permission.
+     */
+    getOne(id: string, actor: ActorContext, options?: ConsentServiceReadOptions): Promise<Consent>;
+    /**
+     * Revoke (delete) a single consent by id. Own rows need no permission.
+     */
+    delete(id: string, actor: ActorContext, options?: ConsentServiceReadOptions): Promise<Consent>;
+    /**
+     * Flow integration (POST /authorize approval) — no permission checks:
+     * the subject consents to its own grant. Inputs are server-derived
+     * (verifier-stamped client/realm, token-derived subject), never raw
+     * client input.
+     */
+    record(input: ConsentRecordInput): Promise<void>;
+    /**
+     * Strict covering: every requested token has an unexpired row.
+     */
+    isCovering(input: ConsentCoveringInput): Promise<boolean>;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/core/entities/consent/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/consent/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAChD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,KAAK,EAAE,YAAY,EAAE,8BAA8B,EAAE,MAAM,oBAAoB,CAAC;AAEvF,MAAM,MAAM,YAAY,GAAG;IACvB,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,wBAAwB,MAAM,CAAC;AAE5C;;;GAGG;AACH,eAAO,MAAM,mBAAmB,mEAOtB,CAAC;AAEX,MAAM,MAAM,sBAAsB,GAAG;IACjC;;;OAGG;IACH,KAAK,CAAC,EAAE,YAAY,CAAC;IACrB;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF,MAAM,MAAM,yBAAyB,GAAG;IACpC,OAAO,CAAC,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAAG;IAC7B,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,YAAY,CAAC;IACpB;;;OAGG;IACH,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,IAAI,CAAC;CACnC,CAAC;AAEF,MAAM,MAAM,oBAAoB,GAAG;IAC/B,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,YAAY,CAAC;IACpB,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,IAAI,CAAC;CACnC,CAAC;AAEF,MAAM,WAAW,kBAAkB;IAC/B,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,sBAAsB,GAAG,OAAO,CAAC,8BAA8B,CAAC,OAAO,CAAC,CAAC,CAAC;IAE5G,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC;IAEjD;;;;OAIG;IACH,sBAAsB,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;IAElF;;;OAGG;IACH,aAAa,CAAC,KAAK,EAAE;QACjB,QAAQ,EAAE,MAAM,CAAC;QACjB,OAAO,EAAE,MAAM,CAAC;QAChB,KAAK,EAAE,YAAY,CAAC;QACpB,MAAM,EAAE,MAAM,EAAE,CAAA;KACnB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAElB,MAAM,CAAC,MAAM,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC1C;AAED,MAAM,WAAW,eAAe;IAC5B;;;;OAIG;IACH,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,OAAO,CAAC,EAAE,yBAAyB,GAAG,OAAO,CAAC,8BAA8B,CAAC,OAAO,CAAC,CAAC,CAAC;IAEhJ;;OAEG;IACH,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,OAAO,CAAC,EAAE,yBAAyB,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAE/F;;OAEG;IACH,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,OAAO,CAAC,EAAE,yBAAyB,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAE/F;;;;;OAKG;IACH,MAAM,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAEjD;;OAEG;IACH,UAAU,CAAC,KAAK,EAAE,oBAAoB,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CAC7D"}

package/dist/core/entities/consent/types.mjs

@@ -0,0 +1,25 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+//#region src/core/entities/consent/types.ts
+/**
+* Max length of a single stored scope token — must equal the
+* `auth_consents.scope` column width (varchar 128). A longer token (only
+* reachable via a non-standard scope riding the `global` verifier bypass) is
+* dropped at normalization rather than overflowing the column.
+*/ const CONSENT_SCOPE_MAX_LENGTH = 128;
+/**
+* Filter keys a consent list query may target. Shared by the repository's
+* rapiq `filters.allowed` so service and adapter can never drift.
+*/ const CONSENT_FILTER_KEYS = [
+	"id",
+	"clientId",
+	"realmId",
+	"sub",
+	"subKind",
+	"scope"
+];
+//#endregion
+export { CONSENT_FILTER_KEYS, CONSENT_SCOPE_MAX_LENGTH };
+
+//# sourceMappingURL=types.mjs.map

package/dist/core/entities/consent/types.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.mjs","names":["CONSENT_SCOPE_MAX_LENGTH","CONSENT_FILTER_KEYS"],"sources":["../../../../src/core/entities/consent/types.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { Consent } from '@authup/core-kit';\nimport type { IQuery } from '@rapiq/core';\nimport type { ActorContext, EntityRepositoryFindManyResult } from '@authup/server-kit';\n\nexport type ConsentOwner = {\n    sub: string,\n    subKind: string,\n};\n\n/**\n * Max length of a single stored scope token — must equal the\n * `auth_consents.scope` column width (varchar 128). A longer token (only\n * reachable via a non-standard scope riding the `global` verifier bypass) is\n * dropped at normalization rather than overflowing the column.\n */\nexport const CONSENT_SCOPE_MAX_LENGTH = 128;\n\n/**\n * Filter keys a consent list query may target. Shared by the repository's\n * rapiq `filters.allowed` so service and adapter can never drift.\n */\nexport const CONSENT_FILTER_KEYS = [\n    'id',\n    'clientId',\n    'realmId',\n    'sub',\n    'subKind',\n    'scope',\n] as const;\n\nexport type ConsentFindManyOptions = {\n    /**\n     * Force the result to a single subject (self-service). Applied as a\n     * mandatory WHERE that a rapiq query filter cannot override.\n     */\n    owner?: ConsentOwner,\n    /**\n     * Restrict the result to a single realm (the `/realms/:realmId/consents`\n     * nested mount). Mandatory WHERE, not overridable by a rapiq filter.\n     */\n    realmId?: string,\n};\n\nexport type ConsentServiceReadOptions = {\n    realmId?: string,\n};\n\nexport type ConsentRecordInput = {\n    clientId: string,\n    realmId: string,\n    owner: ConsentOwner,\n    /**\n     * Raw scope representation(s) — normalized to lowercase tokens via\n     * `unwrapOAuth2Scope` before persistence.\n     */\n    scope: string | string[] | null,\n};\n\nexport type ConsentCoveringInput = {\n    clientId: string,\n    owner: ConsentOwner,\n    scope: string | string[] | null,\n};\n\nexport interface IConsentRepository {\n    findMany(query: IQuery, options?: ConsentFindManyOptions): Promise<EntityRepositoryFindManyResult<Consent>>;\n\n    findOneById(id: string): Promise<Consent | null>;\n\n    /**\n     * Covering-lookup source — query-cached\n     * (`CachePrefix.CONSENT_COVERING`, 60s), invalidated by the\n     * `ConsentEntitySubscriber` on insert/update/remove.\n     */\n    findAllBySubjectClient(clientId: string, owner: ConsentOwner): Promise<Consent[]>;\n\n    /**\n     * Union/keep: insert one row per missing scope token, never touching\n     * existing rows. Race-safe under the 4-column unique index.\n     */\n    insertMissing(input: {\n        clientId: string, \n        realmId: string, \n        owner: ConsentOwner, \n        scopes: string[] \n    }): Promise<void>;\n\n    remove(entity: Consent): Promise<void>;\n}\n\nexport interface IConsentService {\n    /**\n     * List consents. An actor without `CONSENT_READ` is scoped to its own\n     * rows (self-service); an actor with `CONSENT_READ` sees every row its\n     * realm reach permits.\n     */\n    getMany(query: Record<string, any>, actor: ActorContext, options?: ConsentServiceReadOptions): Promise<EntityRepositoryFindManyResult<Consent>>;\n\n    /**\n     * Read a single consent by id. Own rows need no permission.\n     */\n    getOne(id: string, actor: ActorContext, options?: ConsentServiceReadOptions): Promise<Consent>;\n\n    /**\n     * Revoke (delete) a single consent by id. Own rows need no permission.\n     */\n    delete(id: string, actor: ActorContext, options?: ConsentServiceReadOptions): Promise<Consent>;\n\n    /**\n     * Flow integration (POST /authorize approval) — no permission checks:\n     * the subject consents to its own grant. Inputs are server-derived\n     * (verifier-stamped client/realm, token-derived subject), never raw\n     * client input.\n     */\n    record(input: ConsentRecordInput): Promise<void>;\n\n    /**\n     * Strict covering: every requested token has an unexpired row.\n     */\n    isCovering(input: ConsentCoveringInput): Promise<boolean>;\n}\n"],"mappings":";;;;;;;;;GAsBA,MAAaA,2BAA2B;;;;GAMxC,MAAaC,sBAAsB;CAC/B;CACA;CACA;CACA;CACA;CACA"}

package/dist/core/entities/event/constants.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Default retention for persisted security events in days (hosted-provider
+ * posture, Okta-parity; raise via eventLogRetentionDays /
+ * EVENT_LOG_RETENTION_DAYS, 0 = keep forever).
+ */
+export declare const EVENT_LOG_RETENTION_DAYS_DEFAULT = 90;
+//# sourceMappingURL=constants.d.ts.map

package/dist/core/entities/event/constants.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/event/constants.ts"],"names":[],"mappings":"AAOA;;;;GAIG;AACH,eAAO,MAAM,gCAAgC,KAAK,CAAC"}

package/dist/core/entities/event/constants.mjs

@@ -0,0 +1,13 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+//#region src/core/entities/event/constants.ts
+/**
+* Default retention for persisted security events in days (hosted-provider
+* posture, Okta-parity; raise via eventLogRetentionDays /
+* EVENT_LOG_RETENTION_DAYS, 0 = keep forever).
+*/ const EVENT_LOG_RETENTION_DAYS_DEFAULT = 90;
+//#endregion
+export { EVENT_LOG_RETENTION_DAYS_DEFAULT };
+
+//# sourceMappingURL=constants.mjs.map

package/dist/core/entities/event/constants.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"constants.mjs","names":["EVENT_LOG_RETENTION_DAYS_DEFAULT"],"sources":["../../../../src/core/entities/event/constants.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\n/**\n * Default retention for persisted security events in days (hosted-provider\n * posture, Okta-parity; raise via eventLogRetentionDays /\n * EVENT_LOG_RETENTION_DAYS, 0 = keep forever).\n */\nexport const EVENT_LOG_RETENTION_DAYS_DEFAULT = 90;\n"],"mappings":";;;;;;;;GAYA,MAAaA,mCAAmC"}

package/dist/core/entities/event/diff.d.ts

@@ -0,0 +1,20 @@
+/**
+ * Secret denylist for entity-diff keys (fail-closed: losing a
+ * "secretHashed flipped" diff entry is acceptable, leaking a hash is not).
+ * Shared with the sanitizer's `diff` branch so both boundaries agree.
+ */
+export declare const EVENT_DIFF_SECRET_KEY_REGEX: RegExp;
+export declare const EVENT_DIFF_VALUE_MAX_LENGTH = 512;
+export type EntityDiff = Record<string, {
+    next: unknown;
+    previous: unknown;
+}>;
+/**
+ * PII-safe scalar diff between the updated entity and its pre-mutation
+ * snapshot: only keys with scalar values (string/number/boolean/null) on BOTH
+ * sides, skipping timestamp columns (`*_at` / `*At`) and any key matching the
+ * secret denylist, including only keys whose value actually changed. String
+ * values are truncated to {@link EVENT_DIFF_VALUE_MAX_LENGTH}.
+ */
+export declare function buildEntityDiff(next: Record<string, any>, previous: Record<string, any>): EntityDiff;
+//# sourceMappingURL=diff.d.ts.map

package/dist/core/entities/event/diff.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"diff.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/event/diff.ts"],"names":[],"mappings":"AASA;;;;GAIG;AACH,eAAO,MAAM,2BAA2B,QAA6C,CAAC;AAEtF,eAAO,MAAM,2BAA2B,MAAM,CAAC;AAE/C,MAAM,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,EAAE;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,QAAQ,EAAE,OAAO,CAAA;CAAE,CAAC,CAAC;AAiB9E;;;;;;GAMG;AACH,wBAAgB,eAAe,CAC3B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAC9B,UAAU,CAmCZ"}

package/dist/core/entities/event/diff.mjs

@@ -0,0 +1,45 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { isEqual } from "smob";
+//#region src/core/entities/event/diff.ts
+/**
+* Secret denylist for entity-diff keys (fail-closed: losing a
+* "secretHashed flipped" diff entry is acceptable, leaking a hash is not).
+* Shared with the sanitizer's `diff` branch so both boundaries agree.
+*/ const EVENT_DIFF_SECRET_KEY_REGEX = /(password|secret|hash|token|credential)/i;
+const EVENT_DIFF_VALUE_MAX_LENGTH = 512;
+function isScalar(value) {
+	return value === null || typeof value === "string" || typeof value === "number" || typeof value === "boolean";
+}
+function truncateScalar(value) {
+	if (typeof value === "string" && value.length > 512) return value.substring(0, 512);
+	return value;
+}
+/**
+* PII-safe scalar diff between the updated entity and its pre-mutation
+* snapshot: only keys with scalar values (string/number/boolean/null) on BOTH
+* sides, skipping timestamp columns (`*_at` / `*At`) and any key matching the
+* secret denylist, including only keys whose value actually changed. String
+* values are truncated to {@link EVENT_DIFF_VALUE_MAX_LENGTH}.
+*/ function buildEntityDiff(next, previous) {
+	const output = {};
+	const keys = /* @__PURE__ */ new Set([...Object.keys(next), ...Object.keys(previous)]);
+	for (const key of keys) {
+		if (key.endsWith("_at") || key.endsWith("At")) continue;
+		if (EVENT_DIFF_SECRET_KEY_REGEX.test(key)) continue;
+		const nextValue = next[key];
+		const previousValue = previous[key];
+		if (!isScalar(nextValue) || !isScalar(previousValue)) continue;
+		if (isEqual(nextValue, previousValue)) continue;
+		output[key] = {
+			next: truncateScalar(nextValue),
+			previous: truncateScalar(previousValue)
+		};
+	}
+	return output;
+}
+//#endregion
+export { EVENT_DIFF_SECRET_KEY_REGEX, EVENT_DIFF_VALUE_MAX_LENGTH, buildEntityDiff };
+
+//# sourceMappingURL=diff.mjs.map

package/dist/core/entities/event/diff.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"diff.mjs","names":["isEqual","EVENT_DIFF_SECRET_KEY_REGEX","EVENT_DIFF_VALUE_MAX_LENGTH","isScalar","value","truncateScalar","length","substring","buildEntityDiff","next","previous","output","keys","Set","Object","key","endsWith","test","nextValue","previousValue"],"sources":["../../../../src/core/entities/event/diff.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { isEqual } from 'smob';\n\n/**\n * Secret denylist for entity-diff keys (fail-closed: losing a\n * \"secretHashed flipped\" diff entry is acceptable, leaking a hash is not).\n * Shared with the sanitizer's `diff` branch so both boundaries agree.\n */\nexport const EVENT_DIFF_SECRET_KEY_REGEX = /(password|secret|hash|token|credential)/i;\n\nexport const EVENT_DIFF_VALUE_MAX_LENGTH = 512;\n\nexport type EntityDiff = Record<string, { next: unknown, previous: unknown }>;\n\nfunction isScalar(value: unknown): value is string | number | boolean | null {\n    return value === null ||\n        typeof value === 'string' ||\n        typeof value === 'number' ||\n        typeof value === 'boolean';\n}\n\nfunction truncateScalar(value: string | number | boolean | null): string | number | boolean | null {\n    if (typeof value === 'string' && value.length > EVENT_DIFF_VALUE_MAX_LENGTH) {\n        return value.substring(0, EVENT_DIFF_VALUE_MAX_LENGTH);\n    }\n\n    return value;\n}\n\n/**\n * PII-safe scalar diff between the updated entity and its pre-mutation\n * snapshot: only keys with scalar values (string/number/boolean/null) on BOTH\n * sides, skipping timestamp columns (`*_at` / `*At`) and any key matching the\n * secret denylist, including only keys whose value actually changed. String\n * values are truncated to {@link EVENT_DIFF_VALUE_MAX_LENGTH}.\n */\nexport function buildEntityDiff(\n    next: Record<string, any>,\n    previous: Record<string, any>,\n): EntityDiff {\n    const output: EntityDiff = {};\n\n    const keys = new Set([\n        ...Object.keys(next),\n        ...Object.keys(previous),\n    ]);\n\n    for (const key of keys) {\n        if (key.endsWith('_at') || key.endsWith('At')) {\n            continue;\n        }\n\n        if (EVENT_DIFF_SECRET_KEY_REGEX.test(key)) {\n            continue;\n        }\n\n        const nextValue = next[key];\n        const previousValue = previous[key];\n\n        if (!isScalar(nextValue) || !isScalar(previousValue)) {\n            continue;\n        }\n\n        if (isEqual(nextValue, previousValue)) {\n            continue;\n        }\n\n        output[key] = {\n            next: truncateScalar(nextValue),\n            previous: truncateScalar(previousValue),\n        };\n    }\n\n    return output;\n}\n"],"mappings":";;;;;;;;;GAcA,MAAaC,8BAA8B;AAE3C,MAAaC,8BAA8B;AAI3C,SAASC,SAASC,OAAc;CAC5B,OAAOA,UAAU,QACb,OAAOA,UAAU,YACjB,OAAOA,UAAU,YACjB,OAAOA,UAAU;AACzB;AAEA,SAASC,eAAeD,OAAuC;CAC3D,IAAI,OAAOA,UAAU,YAAYA,MAAME,SAAAA,KACnC,OAAOF,MAAMG,UAAU,GAAA,GAAGL;CAG9B,OAAOE;AACX;;;;;;;GASA,SAAgBI,gBACZC,MACAC,UAA6B;CAE7B,MAAMC,SAAqB,CAAC;CAE5B,MAAMC,uBAAO,IAAIC,IAAI,CAAA,GACdC,OAAOF,KAAKH,IAAAA,GAAAA,GACZK,OAAOF,KAAKF,QAAAA,CAAAA,CAClB;CAED,KAAK,MAAMK,OAAOH,MAAM;EACpB,IAAIG,IAAIC,SAAS,KAAA,KAAUD,IAAIC,SAAS,IAAA,GACpC;EAGJ,IAAIf,4BAA4BgB,KAAKF,GAAAA,GACjC;EAGJ,MAAMG,YAAYT,KAAKM;EACvB,MAAMI,gBAAgBT,SAASK;EAE/B,IAAI,CAACZ,SAASe,SAAAA,KAAc,CAACf,SAASgB,aAAAA,GAClC;EAGJ,IAAInB,QAAQkB,WAAWC,aAAAA,GACnB;EAGJR,OAAOI,OAAO;GACVN,MAAMJ,eAAea,SAAAA;GACrBR,UAAUL,eAAec,aAAAA;EAC7B;CACJ;CAEA,OAAOR;AACX"}

package/dist/core/entities/event/entity-event-handler.d.ts

@@ -0,0 +1,19 @@
+import type { DomainEventPublishContext, IDomainEventHandler } from '@authup/server-kit';
+import type { EntityEventHandlerOptions, EventRequestContext, IEventService } from './types.ts';
+export type EntityEventHandlerContext = {
+    eventService: IEventService;
+    requestContext?: () => EventRequestContext | undefined;
+    options?: EntityEventHandlerOptions;
+};
+/**
+ * Bridges every entity create/update/delete published on the
+ * DomainEventPublisher bus into the auth_events audit table (scope `entity`).
+ */
+export declare class EntityEventHandler implements IDomainEventHandler {
+    protected eventService: IEventService;
+    protected requestContext?: () => EventRequestContext | undefined;
+    protected options: EntityEventHandlerOptions;
+    constructor(ctx: EntityEventHandlerContext);
+    handle(ctx: DomainEventPublishContext): Promise<void>;
+}
+//# sourceMappingURL=entity-event-handler.d.ts.map

package/dist/core/entities/event/entity-event-handler.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"entity-event-handler.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/event/entity-event-handler.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,yBAAyB,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAEzF,OAAO,KAAK,EACR,yBAAyB,EACzB,mBAAmB,EACnB,aAAa,EAChB,MAAM,YAAY,CAAC;AAEpB,MAAM,MAAM,yBAAyB,GAAG;IACpC,YAAY,EAAE,aAAa,CAAC;IAC5B,cAAc,CAAC,EAAE,MAAM,mBAAmB,GAAG,SAAS,CAAC;IACvD,OAAO,CAAC,EAAE,yBAAyB,CAAC;CACvC,CAAC;AAwCF;;;GAGG;AACH,qBAAa,kBAAmB,YAAW,mBAAmB;IAC1D,SAAS,CAAC,YAAY,EAAG,aAAa,CAAC;IAEvC,SAAS,CAAC,cAAc,CAAC,EAAG,MAAM,mBAAmB,GAAG,SAAS,CAAC;IAElE,SAAS,CAAC,OAAO,EAAG,yBAAyB,CAAC;gBAElC,GAAG,EAAE,yBAAyB;IAMpC,MAAM,CAAC,GAAG,EAAE,yBAAyB,GAAG,OAAO,CAAC,IAAI,CAAC;CAqD9D"}

package/dist/core/entities/event/entity-event-handler.mjs

@@ -0,0 +1,98 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { buildEntityDiff } from "./diff.mjs";
+import { hasOwnProperty, isObject } from "@authup/kit";
+import { EntityDefaultEventName, EntityType, EventName, EventScope } from "@authup/core-kit";
+//#region src/core/entities/event/entity-event-handler.ts
+const ENTITY_EVENT_NAME_MAP = {
+	[EntityDefaultEventName.CREATED]: EventName.CREATED,
+	[EntityDefaultEventName.UPDATED]: EventName.UPDATED,
+	[EntityDefaultEventName.DELETED]: EventName.DELETED
+};
+const ENTITY_REALM_KEY_MAP = {
+	[EntityType.CLIENT]: "realmId",
+	[EntityType.CLIENT_PERMISSION]: "clientRealmId",
+	[EntityType.CLIENT_ROLE]: "clientRealmId",
+	[EntityType.CLIENT_SCOPE]: "clientRealmId",
+	[EntityType.CONSENT]: "realmId",
+	[EntityType.EVENT]: "realmId",
+	[EntityType.IDENTITY_PROVIDER]: "realmId",
+	[EntityType.IDENTITY_PROVIDER_ACCOUNT]: "userRealmId",
+	[EntityType.IDENTITY_PROVIDER_ATTRIBUTE]: "realmId",
+	[EntityType.IDENTITY_PROVIDER_ATTRIBUTE_MAPPING]: "providerRealmId",
+	[EntityType.IDENTITY_PROVIDER_PERMISSION_MAPPING]: "providerRealmId",
+	[EntityType.IDENTITY_PROVIDER_ROLE_MAPPING]: "providerRealmId",
+	[EntityType.KEY]: "realmId",
+	[EntityType.POLICY]: "realmId",
+	[EntityType.POLICY_ATTRIBUTE]: "realmId",
+	[EntityType.PERMISSION]: "realmId",
+	[EntityType.PERMISSION_POLICY]: "permissionRealmId",
+	[EntityType.REALM]: "id",
+	[EntityType.ROLE]: "realmId",
+	[EntityType.ROLE_ATTRIBUTE]: "realmId",
+	[EntityType.ROLE_PERMISSION]: "roleRealmId",
+	[EntityType.SCOPE]: "realmId",
+	[EntityType.SESSION]: "realmId",
+	[EntityType.TRUST_ANCHOR]: "realmId",
+	[EntityType.USER]: "realmId",
+	[EntityType.USER_ATTRIBUTE]: "realmId",
+	[EntityType.USER_AUTHENTICATOR]: "realmId",
+	[EntityType.USER_PERMISSION]: "userRealmId",
+	[EntityType.USER_ROLE]: "userRealmId"
+};
+/**
+* Bridges every entity create/update/delete published on the
+* DomainEventPublisher bus into the auth_events audit table (scope `entity`).
+*/ var EntityEventHandler = class {
+	eventService;
+	requestContext;
+	options;
+	constructor(ctx) {
+		this.eventService = ctx.eventService;
+		this.requestContext = ctx.requestContext;
+		this.options = ctx.options ?? {};
+	}
+	async handle(ctx) {
+		try {
+			if (ctx.content.type === "event") return;
+			const name = ENTITY_EVENT_NAME_MAP[ctx.content.event];
+			if (!name) return;
+			const refId = ctx.content.data?.id ?? null;
+			const realmIdCurrent = resolveEntityRealmId(ctx.content.type, ctx.content.data);
+			const realmId = typeof realmIdCurrent === "undefined" ? resolveEntityRealmId(ctx.content.type, ctx.dataPrevious) ?? null : realmIdCurrent;
+			const requestContext = this.requestContext ? this.requestContext() : void 0;
+			let data = null;
+			if (name === EventName.UPDATED && isObject(ctx.content.data) && isObject(ctx.dataPrevious)) {
+				const diff = buildEntityDiff(ctx.content.data, ctx.dataPrevious);
+				if (Object.keys(diff).length > 0) data = { diff };
+			}
+			await this.eventService.record({
+				scope: EventScope.ENTITY,
+				name,
+				refType: ctx.content.type,
+				refId,
+				realmId,
+				actorType: requestContext?.actorType ?? null,
+				actorId: requestContext?.actorId ?? null,
+				actorName: requestContext?.actorName ?? null,
+				requestPath: requestContext?.requestPath ?? null,
+				requestMethod: requestContext?.requestMethod ?? null,
+				requestIpAddress: requestContext?.requestIpAddress ?? null,
+				requestUserAgent: requestContext?.requestUserAgent ?? null,
+				data,
+				retentionDays: this.options.retentionDays
+			});
+		} catch {}
+	}
+};
+function resolveEntityRealmId(type, data) {
+	if (!isObject(data)) return;
+	const key = ENTITY_REALM_KEY_MAP[type] ?? "realmId";
+	if (!hasOwnProperty(data, key)) return;
+	return typeof data[key] === "string" ? data[key] : null;
+}
+//#endregion
+export { EntityEventHandler };
+
+//# sourceMappingURL=entity-event-handler.mjs.map

package/dist/core/entities/event/entity-event-handler.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"entity-event-handler.mjs","names":["EntityDefaultEventName","EntityType","EventName","EventScope","hasOwnProperty","isObject","buildEntityDiff","ENTITY_EVENT_NAME_MAP","CREATED","UPDATED","DELETED","ENTITY_REALM_KEY_MAP","CLIENT","CLIENT_PERMISSION","CLIENT_ROLE","CLIENT_SCOPE","CONSENT","EVENT","IDENTITY_PROVIDER","IDENTITY_PROVIDER_ACCOUNT","IDENTITY_PROVIDER_ATTRIBUTE","IDENTITY_PROVIDER_ATTRIBUTE_MAPPING","IDENTITY_PROVIDER_PERMISSION_MAPPING","IDENTITY_PROVIDER_ROLE_MAPPING","KEY","POLICY","POLICY_ATTRIBUTE","PERMISSION","PERMISSION_POLICY","REALM","ROLE","ROLE_ATTRIBUTE","ROLE_PERMISSION","SCOPE","SESSION","TRUST_ANCHOR","USER","USER_ATTRIBUTE","USER_AUTHENTICATOR","USER_PERMISSION","USER_ROLE","EntityEventHandler","eventService","requestContext","options","ctx","handle","content","type","name","event","refId","data","id","realmIdCurrent","resolveEntityRealmId","realmId","dataPrevious","undefined","diff","Object","keys","length","record","scope","ENTITY","refType","actorType","actorId","actorName","requestPath","requestMethod","requestIpAddress","requestUserAgent","retentionDays","key"],"sources":["../../../../src/core/entities/event/entity-event-handler.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport {\n    EntityDefaultEventName,\n    EntityType,\n    EventName,\n    EventScope,\n} from '@authup/core-kit';\nimport { hasOwnProperty, isObject } from '@authup/kit';\nimport type { DomainEventPublishContext, IDomainEventHandler } from '@authup/server-kit';\nimport { buildEntityDiff } from './diff.ts';\nimport type {\n    EntityEventHandlerOptions,\n    EventRequestContext,\n    IEventService,\n} from './types.ts';\n\nexport type EntityEventHandlerContext = {\n    eventService: IEventService,\n    requestContext?: () => EventRequestContext | undefined,\n    options?: EntityEventHandlerOptions,\n};\n\nconst ENTITY_EVENT_NAME_MAP : Record<string, `${EventName}`> = {\n    [EntityDefaultEventName.CREATED]: EventName.CREATED,\n    [EntityDefaultEventName.UPDATED]: EventName.UPDATED,\n    [EntityDefaultEventName.DELETED]: EventName.DELETED,\n};\n\nconst ENTITY_REALM_KEY_MAP : Record<`${EntityType}`, string> = {\n    [EntityType.CLIENT]: 'realmId',\n    [EntityType.CLIENT_PERMISSION]: 'clientRealmId',\n    [EntityType.CLIENT_ROLE]: 'clientRealmId',\n    [EntityType.CLIENT_SCOPE]: 'clientRealmId',\n    [EntityType.CONSENT]: 'realmId',\n    [EntityType.EVENT]: 'realmId',\n    [EntityType.IDENTITY_PROVIDER]: 'realmId',\n    [EntityType.IDENTITY_PROVIDER_ACCOUNT]: 'userRealmId',\n    [EntityType.IDENTITY_PROVIDER_ATTRIBUTE]: 'realmId',\n    [EntityType.IDENTITY_PROVIDER_ATTRIBUTE_MAPPING]: 'providerRealmId',\n    [EntityType.IDENTITY_PROVIDER_PERMISSION_MAPPING]: 'providerRealmId',\n    [EntityType.IDENTITY_PROVIDER_ROLE_MAPPING]: 'providerRealmId',\n    [EntityType.KEY]: 'realmId',\n    [EntityType.POLICY]: 'realmId',\n    [EntityType.POLICY_ATTRIBUTE]: 'realmId',\n    [EntityType.PERMISSION]: 'realmId',\n    [EntityType.PERMISSION_POLICY]: 'permissionRealmId',\n    [EntityType.REALM]: 'id',\n    [EntityType.ROLE]: 'realmId',\n    [EntityType.ROLE_ATTRIBUTE]: 'realmId',\n    [EntityType.ROLE_PERMISSION]: 'roleRealmId',\n    [EntityType.SCOPE]: 'realmId',\n    [EntityType.SESSION]: 'realmId',\n    [EntityType.TRUST_ANCHOR]: 'realmId',\n    [EntityType.USER]: 'realmId',\n    [EntityType.USER_ATTRIBUTE]: 'realmId',\n    [EntityType.USER_AUTHENTICATOR]: 'realmId',\n    [EntityType.USER_PERMISSION]: 'userRealmId',\n    [EntityType.USER_ROLE]: 'userRealmId',\n};\n\n/**\n * Bridges every entity create/update/delete published on the\n * DomainEventPublisher bus into the auth_events audit table (scope `entity`).\n */\nexport class EntityEventHandler implements IDomainEventHandler {\n    protected eventService : IEventService;\n\n    protected requestContext? : () => EventRequestContext | undefined;\n\n    protected options : EntityEventHandlerOptions;\n\n    constructor(ctx: EntityEventHandlerContext) {\n        this.eventService = ctx.eventService;\n        this.requestContext = ctx.requestContext;\n        this.options = ctx.options ?? {};\n    }\n\n    async handle(ctx: DomainEventPublishContext): Promise<void> {\n        try {\n            // recursion guard — no event subscriber exists today (the\n            // auth_events entity is deliberately subscriber-less), so this is\n            // defense in depth against an audit-write feedback loop.\n            if (ctx.content.type === 'event') {\n                return;\n            }\n\n            const name = ENTITY_EVENT_NAME_MAP[ctx.content.event];\n            if (!name) {\n                return;\n            }\n\n            const refId = ctx.content.data?.id ?? null;\n            const realmIdCurrent = resolveEntityRealmId(ctx.content.type, ctx.content.data);\n            const realmId = typeof realmIdCurrent === 'undefined' ?\n                (resolveEntityRealmId(ctx.content.type, ctx.dataPrevious) ?? null) :\n                realmIdCurrent;\n\n            const requestContext = this.requestContext ?\n                this.requestContext() :\n                undefined;\n\n            let data : Record<string, any> | null = null;\n            if (name === EventName.UPDATED && isObject(ctx.content.data) && isObject(ctx.dataPrevious)) {\n                const diff = buildEntityDiff(ctx.content.data, ctx.dataPrevious);\n                if (Object.keys(diff).length > 0) {\n                    data = { diff };\n                }\n            }\n\n            await this.eventService.record({\n                scope: EventScope.ENTITY,\n                name,\n                refType: ctx.content.type,\n                refId,\n                realmId,\n                actorType: requestContext?.actorType ?? null,\n                actorId: requestContext?.actorId ?? null,\n                actorName: requestContext?.actorName ?? null,\n                requestPath: requestContext?.requestPath ?? null,\n                requestMethod: requestContext?.requestMethod ?? null,\n                requestIpAddress: requestContext?.requestIpAddress ?? null,\n                requestUserAgent: requestContext?.requestUserAgent ?? null,\n                data,\n                retentionDays: this.options.retentionDays,\n            });\n        } catch {\n            // record() never throws, but the bridge itself must also never\n            // fail the originating publish.\n        }\n    }\n}\n\nfunction resolveEntityRealmId(\n    type: string,\n    data: unknown,\n): string | null | undefined {\n    if (!isObject(data)) {\n        return undefined;\n    }\n\n    const key = ENTITY_REALM_KEY_MAP[type as `${EntityType}`] ?? 'realmId';\n    if (!hasOwnProperty(data, key)) {\n        return undefined;\n    }\n\n    return typeof data[key] === 'string' ? data[key] : null;\n}\n"],"mappings":";;;;;;;AA4BA,MAAMO,wBAAyD;EAC1DP,uBAAuBQ,UAAUN,UAAUM;EAC3CR,uBAAuBS,UAAUP,UAAUO;EAC3CT,uBAAuBU,UAAUR,UAAUQ;AAChD;AAEA,MAAMC,uBAAyD;EAC1DV,WAAWW,SAAS;EACpBX,WAAWY,oBAAoB;EAC/BZ,WAAWa,cAAc;EACzBb,WAAWc,eAAe;EAC1Bd,WAAWe,UAAU;EACrBf,WAAWgB,QAAQ;EACnBhB,WAAWiB,oBAAoB;EAC/BjB,WAAWkB,4BAA4B;EACvClB,WAAWmB,8BAA8B;EACzCnB,WAAWoB,sCAAsC;EACjDpB,WAAWqB,uCAAuC;EAClDrB,WAAWsB,iCAAiC;EAC5CtB,WAAWuB,MAAM;EACjBvB,WAAWwB,SAAS;EACpBxB,WAAWyB,mBAAmB;EAC9BzB,WAAW0B,aAAa;EACxB1B,WAAW2B,oBAAoB;EAC/B3B,WAAW4B,QAAQ;EACnB5B,WAAW6B,OAAO;EAClB7B,WAAW8B,iBAAiB;EAC5B9B,WAAW+B,kBAAkB;EAC7B/B,WAAWgC,QAAQ;EACnBhC,WAAWiC,UAAU;EACrBjC,WAAWkC,eAAe;EAC1BlC,WAAWmC,OAAO;EAClBnC,WAAWoC,iBAAiB;EAC5BpC,WAAWqC,qBAAqB;EAChCrC,WAAWsC,kBAAkB;EAC7BtC,WAAWuC,YAAY;AAC5B;;;;GAMA,IAAaC,qBAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEV,YAAYC,KAAgC;EACxC,KAAKH,eAAeG,IAAIH;EACxB,KAAKC,iBAAiBE,IAAIF;EAC1B,KAAKC,UAAUC,IAAID,WAAW,CAAC;CACnC;CAEA,MAAME,OAAOD,KAA+C;EACxD,IAAI;GAIA,IAAIA,IAAIE,QAAQC,SAAS,SACrB;GAGJ,MAAMC,OAAO1C,sBAAsBsC,IAAIE,QAAQG;GAC/C,IAAI,CAACD,MACD;GAGJ,MAAME,QAAQN,IAAIE,QAAQK,MAAMC,MAAM;GACtC,MAAMC,iBAAiBC,qBAAqBV,IAAIE,QAAQC,MAAMH,IAAIE,QAAQK,IAAI;GAC9E,MAAMI,UAAU,OAAOF,mBAAmB,cACrCC,qBAAqBV,IAAIE,QAAQC,MAAMH,IAAIY,YAAY,KAAK,OAC7DH;GAEJ,MAAMX,iBAAiB,KAAKA,iBACxB,KAAKA,eAAc,IACnBe,KAAAA;GAEJ,IAAIN,OAAoC;GACxC,IAAIH,SAAS/C,UAAUO,WAAWJ,SAASwC,IAAIE,QAAQK,IAAI,KAAK/C,SAASwC,IAAIY,YAAY,GAAG;IACxF,MAAME,OAAOrD,gBAAgBuC,IAAIE,QAAQK,MAAMP,IAAIY,YAAY;IAC/D,IAAIG,OAAOC,KAAKF,IAAAA,CAAAA,CAAMG,SAAS,GAC3BV,OAAO,EAAEO,KAAK;GAEtB;GAEA,MAAM,KAAKjB,aAAaqB,OAAO;IAC3BC,OAAO7D,WAAW8D;IAClBhB;IACAiB,SAASrB,IAAIE,QAAQC;IACrBG;IACAK;IACAW,WAAWxB,gBAAgBwB,aAAa;IACxCC,SAASzB,gBAAgByB,WAAW;IACpCC,WAAW1B,gBAAgB0B,aAAa;IACxCC,aAAa3B,gBAAgB2B,eAAe;IAC5CC,eAAe5B,gBAAgB4B,iBAAiB;IAChDC,kBAAkB7B,gBAAgB6B,oBAAoB;IACtDC,kBAAkB9B,gBAAgB8B,oBAAoB;IACtDrB;IACAsB,eAAe,KAAK9B,QAAQ8B;GAChC,CAAA;EACJ,QAAQ,CAGR;CACJ;AACJ;AAEA,SAASnB,qBACLP,MACAI,MAAa;CAEb,IAAI,CAAC/C,SAAS+C,IAAAA,GACV;CAGJ,MAAMuB,MAAMhE,qBAAqBqC,SAA4B;CAC7D,IAAI,CAAC5C,eAAegD,MAAMuB,GAAAA,GACtB;CAGJ,OAAO,OAAOvB,KAAKuB,SAAS,WAAWvB,KAAKuB,OAAO;AACvD"}

package/dist/core/entities/event/index.d.ts

@@ -0,0 +1,8 @@
+export * from './constants.ts';
+export * from './diff.ts';
+export * from './entity-event-handler.ts';
+export * from './sanitize.ts';
+export * from './service.ts';
+export * from './types.ts';
+export * from './schema.ts';
+//# sourceMappingURL=index.d.ts.map

package/dist/core/entities/event/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/event/index.ts"],"names":[],"mappings":"AAOA,cAAc,gBAAgB,CAAC;AAC/B,cAAc,WAAW,CAAC;AAC1B,cAAc,2BAA2B,CAAC;AAC1C,cAAc,eAAe,CAAC;AAC9B,cAAc,cAAc,CAAC;AAC7B,cAAc,YAAY,CAAC;AAC3B,cAAc,aAAa,CAAC"}

package/dist/core/entities/event/index.mjs

@@ -0,0 +1,10 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { eventSchema } from "./schema.mjs";
+import { EVENT_LOG_RETENTION_DAYS_DEFAULT } from "./constants.mjs";
+import { EVENT_DIFF_SECRET_KEY_REGEX, EVENT_DIFF_VALUE_MAX_LENGTH, buildEntityDiff } from "./diff.mjs";
+import { EntityEventHandler } from "./entity-event-handler.mjs";
+import { sanitizeEventData } from "./sanitize.mjs";
+import { EventService } from "./service.mjs";
+export { EVENT_DIFF_SECRET_KEY_REGEX, EVENT_DIFF_VALUE_MAX_LENGTH, EVENT_LOG_RETENTION_DAYS_DEFAULT, EntityEventHandler, EventService, buildEntityDiff, eventSchema, sanitizeEventData };

package/dist/core/entities/event/sanitize.d.ts

@@ -0,0 +1,2 @@
+export declare function sanitizeEventData(input?: Record<string, any> | null): Record<string, any> | null;
+//# sourceMappingURL=sanitize.d.ts.map

package/dist/core/entities/event/sanitize.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sanitize.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/event/sanitize.ts"],"names":[],"mappings":"AAqGA,wBAAgB,iBAAiB,CAC7B,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,IAAI,GACnC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,IAAI,CA6B5B"}

package/dist/core/entities/event/sanitize.mjs

@@ -0,0 +1,83 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { EVENT_DIFF_SECRET_KEY_REGEX } from "./diff.mjs";
+import { isObject } from "@authup/kit";
+//#region src/core/entities/event/sanitize.ts
+/**
+* The central PII/credential write boundary for event context data.
+*
+* Allowlist-first: only these keys survive, and only with scalar values —
+* objects and arrays are dropped outright, so a nested structure can never
+* smuggle a secret past the boundary (this subsumes a denylist: password,
+* client_secret, code, code_verifier, *token* etc. are simply never listed).
+* sessionId / jti / revokedSessionId are opaque correlation ids, not PII.
+* name / use / status / enabled / force describe key & trust-anchor lifecycle
+* operations (issue #3269) — canonical identifiers and enum/flag metadata,
+* never material. kind is the MFA authenticator kind (totp/email/...).
+*
+* The single structured exception is `diff` (entity-CRUD bridge): it survives
+* only as a one-level object of `{ next, previous }` scalar pairs, keys
+* re-checked against the diff secret denylist — the write boundary stays the
+* choke point even though buildEntityDiff pre-sanitizes.
+*/ const DATA_KEY_ALLOW_LIST = [
+	"grantType",
+	"scope",
+	"responseType",
+	"prompt",
+	"error",
+	"errorCode",
+	"reason",
+	"clientName",
+	"realmName",
+	"sessionId",
+	"jti",
+	"revokedSessionId",
+	"name",
+	"use",
+	"status",
+	"enabled",
+	"force",
+	"kind"
+];
+const DATA_VALUE_MAX_LENGTH = 512;
+function isDiffScalar(value) {
+	return value === null || typeof value === "string" || typeof value === "number" || typeof value === "boolean";
+}
+function truncateDiffScalar(value) {
+	if (typeof value === "string" && value.length > DATA_VALUE_MAX_LENGTH) return value.substring(0, DATA_VALUE_MAX_LENGTH);
+	return value;
+}
+function sanitizeDiff(input) {
+	if (!isObject(input)) return null;
+	const output = {};
+	for (const [key, entry] of Object.entries(input)) {
+		if (EVENT_DIFF_SECRET_KEY_REGEX.test(key)) continue;
+		if (!isObject(entry)) continue;
+		const { next, previous } = entry;
+		if (!isDiffScalar(next) || !isDiffScalar(previous)) continue;
+		output[key] = {
+			next: truncateDiffScalar(next),
+			previous: truncateDiffScalar(previous)
+		};
+	}
+	if (Object.keys(output).length === 0) return null;
+	return output;
+}
+function sanitizeEventData(input) {
+	if (!input) return null;
+	const output = {};
+	for (const key of DATA_KEY_ALLOW_LIST) {
+		const value = input[key];
+		if (typeof value === "string") output[key] = value.length > DATA_VALUE_MAX_LENGTH ? value.substring(0, DATA_VALUE_MAX_LENGTH) : value;
+		else if (typeof value === "number" || typeof value === "boolean") output[key] = value;
+	}
+	const diff = sanitizeDiff(input.diff);
+	if (diff) output.diff = diff;
+	if (Object.keys(output).length === 0) return null;
+	return output;
+}
+//#endregion
+export { sanitizeEventData };
+
+//# sourceMappingURL=sanitize.mjs.map

package/dist/core/entities/event/sanitize.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"sanitize.mjs","names":["isObject","EVENT_DIFF_SECRET_KEY_REGEX","DATA_KEY_ALLOW_LIST","DATA_VALUE_MAX_LENGTH","isDiffScalar","value","truncateDiffScalar","length","substring","sanitizeDiff","input","output","key","entry","Object","entries","test","next","previous","keys","sanitizeEventData","diff"],"sources":["../../../../src/core/entities/event/sanitize.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { isObject } from '@authup/kit';\nimport { EVENT_DIFF_SECRET_KEY_REGEX } from './diff.ts';\n\n/**\n * The central PII/credential write boundary for event context data.\n *\n * Allowlist-first: only these keys survive, and only with scalar values —\n * objects and arrays are dropped outright, so a nested structure can never\n * smuggle a secret past the boundary (this subsumes a denylist: password,\n * client_secret, code, code_verifier, *token* etc. are simply never listed).\n * sessionId / jti / revokedSessionId are opaque correlation ids, not PII.\n * name / use / status / enabled / force describe key & trust-anchor lifecycle\n * operations (issue #3269) — canonical identifiers and enum/flag metadata,\n * never material. kind is the MFA authenticator kind (totp/email/...).\n *\n * The single structured exception is `diff` (entity-CRUD bridge): it survives\n * only as a one-level object of `{ next, previous }` scalar pairs, keys\n * re-checked against the diff secret denylist — the write boundary stays the\n * choke point even though buildEntityDiff pre-sanitizes.\n */\nconst DATA_KEY_ALLOW_LIST = [\n    'grantType',\n    'scope',\n    'responseType',\n    'prompt',\n    'error',\n    'errorCode',\n    'reason',\n    'clientName',\n    'realmName',\n    'sessionId',\n    'jti',\n    'revokedSessionId',\n    'name',\n    'use',\n    'status',\n    'enabled',\n    'force',\n    'kind',\n] as const;\n\nconst DATA_VALUE_MAX_LENGTH = 512;\n\nfunction isDiffScalar(value: unknown): value is string | number | boolean | null {\n    return value === null ||\n        typeof value === 'string' ||\n        typeof value === 'number' ||\n        typeof value === 'boolean';\n}\n\nfunction truncateDiffScalar(\n    value: string | number | boolean | null,\n): string | number | boolean | null {\n    if (typeof value === 'string' && value.length > DATA_VALUE_MAX_LENGTH) {\n        return value.substring(0, DATA_VALUE_MAX_LENGTH);\n    }\n\n    return value;\n}\n\nfunction sanitizeDiff(input: unknown): Record<string, any> | null {\n    if (!isObject(input)) {\n        return null;\n    }\n\n    const output: Record<string, any> = {};\n\n    for (const [key, entry] of Object.entries(input)) {\n        if (EVENT_DIFF_SECRET_KEY_REGEX.test(key)) {\n            continue;\n        }\n\n        if (!isObject(entry)) {\n            continue;\n        }\n\n        const { next, previous } = entry;\n        if (!isDiffScalar(next) || !isDiffScalar(previous)) {\n            continue;\n        }\n\n        output[key] = {\n            next: truncateDiffScalar(next),\n            previous: truncateDiffScalar(previous),\n        };\n    }\n\n    if (Object.keys(output).length === 0) {\n        return null;\n    }\n\n    return output;\n}\n\nexport function sanitizeEventData(\n    input?: Record<string, any> | null,\n): Record<string, any> | null {\n    if (!input) {\n        return null;\n    }\n\n    const output: Record<string, any> = {};\n\n    for (const key of DATA_KEY_ALLOW_LIST) {\n        const value = input[key];\n\n        if (typeof value === 'string') {\n            output[key] = value.length > DATA_VALUE_MAX_LENGTH ?\n                value.substring(0, DATA_VALUE_MAX_LENGTH) :\n                value;\n        } else if (typeof value === 'number' || typeof value === 'boolean') {\n            output[key] = value;\n        }\n    }\n\n    const diff = sanitizeDiff(input.diff);\n    if (diff) {\n        output.diff = diff;\n    }\n\n    if (Object.keys(output).length === 0) {\n        return null;\n    }\n\n    return output;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;GA2BA,MAAME,sBAAsB;CACxB;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;;AAGJ,MAAMC,wBAAwB;AAE9B,SAASC,aAAaC,OAAc;CAChC,OAAOA,UAAU,QACb,OAAOA,UAAU,YACjB,OAAOA,UAAU,YACjB,OAAOA,UAAU;AACzB;AAEA,SAASC,mBACLD,OAAuC;CAEvC,IAAI,OAAOA,UAAU,YAAYA,MAAME,SAASJ,uBAC5C,OAAOE,MAAMG,UAAU,GAAGL,qBAAAA;CAG9B,OAAOE;AACX;AAEA,SAASI,aAAaC,OAAc;CAChC,IAAI,CAACV,SAASU,KAAAA,GACV,OAAO;CAGX,MAAMC,SAA8B,CAAC;CAErC,KAAK,MAAM,CAACC,KAAKC,UAAUC,OAAOC,QAAQL,KAAAA,GAAQ;EAC9C,IAAIT,4BAA4Be,KAAKJ,GAAAA,GACjC;EAGJ,IAAI,CAACZ,SAASa,KAAAA,GACV;EAGJ,MAAM,EAAEI,MAAMC,aAAaL;EAC3B,IAAI,CAACT,aAAaa,IAAAA,KAAS,CAACb,aAAac,QAAAA,GACrC;EAGJP,OAAOC,OAAO;GACVK,MAAMX,mBAAmBW,IAAAA;GACzBC,UAAUZ,mBAAmBY,QAAAA;EACjC;CACJ;CAEA,IAAIJ,OAAOK,KAAKR,MAAAA,CAAAA,CAAQJ,WAAW,GAC/B,OAAO;CAGX,OAAOI;AACX;AAEA,SAAgBS,kBACZV,OAAkC;CAElC,IAAI,CAACA,OACD,OAAO;CAGX,MAAMC,SAA8B,CAAC;CAErC,KAAK,MAAMC,OAAOV,qBAAqB;EACnC,MAAMG,QAAQK,MAAME;EAEpB,IAAI,OAAOP,UAAU,UACjBM,OAAOC,OAAOP,MAAME,SAASJ,wBACzBE,MAAMG,UAAU,GAAGL,qBAAAA,IACnBE;OACD,IAAI,OAAOA,UAAU,YAAY,OAAOA,UAAU,WACrDM,OAAOC,OAAOP;CAEtB;CAEA,MAAMgB,OAAOZ,aAAaC,MAAMW,IAAI;CACpC,IAAIA,MACAV,OAAOU,OAAOA;CAGlB,IAAIP,OAAOK,KAAKR,MAAAA,CAAAA,CAAQJ,WAAW,GAC/B,OAAO;CAGX,OAAOI;AACX"}

package/dist/core/entities/event/schema.d.ts

@@ -0,0 +1,3 @@
+import type { Event } from '@authup/core-kit';
+export declare const eventSchema: import("@rapiq/core").Schema<Event, any>;
+//# sourceMappingURL=schema.d.ts.map

package/dist/core/entities/event/schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/event/schema.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAG9C,eAAO,MAAM,WAAW,0CA4CtB,CAAC"}

package/dist/core/entities/event/schema.mjs

@@ -0,0 +1,51 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { EntityType } from "@authup/core-kit";
+import { defineSchema } from "@rapiq/core";
+//#region src/core/entities/event/schema.ts
+const eventSchema = defineSchema({
+	name: EntityType.EVENT,
+	fields: { allowed: [
+		"id",
+		"scope",
+		"name",
+		"refType",
+		"refId",
+		"clientId",
+		"actorType",
+		"actorId",
+		"actorName",
+		"requestPath",
+		"requestMethod",
+		"requestIpAddress",
+		"requestUserAgent",
+		"realmId",
+		"data",
+		"expiring",
+		"expiresAt",
+		"createdAt"
+	] },
+	filters: { allowed: [
+		"id",
+		"scope",
+		"name",
+		"refType",
+		"refId",
+		"clientId",
+		"actorType",
+		"actorId",
+		"actorName",
+		"requestIpAddress",
+		"realmId",
+		"expiring",
+		"createdAt"
+	] },
+	relations: { allowed: [] },
+	sort: { allowed: ["createdAt"] },
+	pagination: { maxLimit: 50 }
+});
+//#endregion
+export { eventSchema };
+
+//# sourceMappingURL=schema.mjs.map

package/dist/core/entities/event/schema.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.mjs","names":["defineSchema","EntityType","eventSchema","name","EVENT","fields","allowed","filters","relations","sort","pagination","maxLimit"],"sources":["../../../../src/core/entities/event/schema.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { defineSchema } from '@rapiq/core';\nimport type { Event } from '@authup/core-kit';\nimport { EntityType } from '@authup/core-kit';\n\nexport const eventSchema = defineSchema<Event>({\n    name: EntityType.EVENT,\n    fields: {\n        allowed: [\n            'id',\n            'scope',\n            'name',\n            'refType',\n            'refId',\n            'clientId',\n            'actorType',\n            'actorId',\n            'actorName',\n            'requestPath',\n            'requestMethod',\n            'requestIpAddress',\n            'requestUserAgent',\n            'realmId',\n            'data',\n            'expiring',\n            'expiresAt',\n            'createdAt',\n        ],\n    },\n    filters: {\n        allowed: [\n            'id',\n            'scope',\n            'name',\n            'refType',\n            'refId',\n            'clientId',\n            'actorType',\n            'actorId',\n            'actorName',\n            'requestIpAddress',\n            'realmId',\n            'expiring',\n            'createdAt',\n        ], \n    },\n    relations: { allowed: [] },\n    sort: { allowed: ['createdAt'] },\n    pagination: { maxLimit: 50 },\n});\n"],"mappings":";;;;;;AAWA,MAAaE,cAAcF,aAAoB;CAC3CG,MAAMF,WAAWG;CACjBC,QAAQ,EACJC,SAAS;EACL;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;GAER;CACAC,SAAS,EACLD,SAAS;EACL;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;GAER;CACAE,WAAW,EAAEF,SAAS,CAAA,EAAG;CACzBG,MAAM,EAAEH,SAAS,CAAC,WAAA,EAAa;CAC/BI,YAAY,EAAEC,UAAU,GAAG;AAC/B,CAAA"}

package/dist/core/entities/event/service.d.ts

@@ -0,0 +1,22 @@
+import type { Event } from '@authup/core-kit';
+import { AbstractEntityService } from '@authup/server-kit';
+import type { ActorContext, EntityRepositoryFindManyResult, Logger } from '@authup/server-kit';
+import type { EventReadVisibility, EventRecordInput, EventServiceOptions, EventServiceReadOptions, IEventRepository, IEventService } from './types.ts';
+export type EventServiceContext = {
+    repository: IEventRepository;
+    options?: EventServiceOptions;
+    logger?: Logger;
+};
+export declare class EventService extends AbstractEntityService implements IEventService {
+    protected repository: IEventRepository;
+    protected options: EventServiceOptions;
+    protected logger?: Logger;
+    constructor(ctx: EventServiceContext);
+    protected isOwnedBy(entity: Event, actor: ActorContext): boolean;
+    protected canReadRealm(actor: ActorContext, realmId: string | null): Promise<boolean>;
+    protected resolveReadVisibility(actor: ActorContext): Promise<EventReadVisibility | undefined>;
+    record(input: EventRecordInput): Promise<void>;
+    getMany(query: Record<string, any>, actor: ActorContext, options?: EventServiceReadOptions): Promise<EntityRepositoryFindManyResult<Event>>;
+    getOne(id: string, actor: ActorContext, options?: EventServiceReadOptions): Promise<Event>;
+}
+//# sourceMappingURL=service.d.ts.map

package/dist/core/entities/event/service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/event/service.ts"],"names":[],"mappings":"AAgBA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAE9C,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAC3D,OAAO,KAAK,EAAE,YAAY,EAAE,8BAA8B,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAG/F,OAAO,KAAK,EACR,mBAAmB,EACnB,gBAAgB,EAChB,mBAAmB,EACnB,uBAAuB,EACvB,gBAAgB,EAChB,aAAa,EAChB,MAAM,YAAY,CAAC;AAIpB,MAAM,MAAM,mBAAmB,GAAG;IAC9B,UAAU,EAAE,gBAAgB,CAAC;IAC7B,OAAO,CAAC,EAAE,mBAAmB,CAAC;IAC9B,MAAM,CAAC,EAAE,MAAM,CAAC;CACnB,CAAC;AAIF,qBAAa,YAAa,SAAQ,qBAAsB,YAAW,aAAa;IAC5E,SAAS,CAAC,UAAU,EAAE,gBAAgB,CAAC;IAEvC,SAAS,CAAC,OAAO,EAAE,mBAAmB,CAAC;IAEvC,SAAS,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;gBAEd,GAAG,EAAE,mBAAmB;IAQpC,SAAS,CAAC,SAAS,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO;cAOhD,YAAY,CAAC,KAAK,EAAE,YAAY,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC;cAmB3E,qBAAqB,CAAC,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,mBAAmB,GAAG,SAAS,CAAC;IA8B9F,MAAM,CAAC,KAAK,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC;IAqD9C,OAAO,CACT,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC1B,KAAK,EAAE,YAAY,EACnB,OAAO,GAAE,uBAA4B,GACtC,OAAO,CAAC,8BAA8B,CAAC,KAAK,CAAC,CAAC;IAsF3C,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,OAAO,GAAE,uBAA4B,GAAG,OAAO,CAAC,KAAK,CAAC;CAmBvG"}