@authup/server-core 1.0.0-beta.53 → 1.0.0-beta.54

package/dist/core/entities/event/diff.d.ts

@@ -1,6 +1,6 @@
 /**
  * Secret denylist for entity-diff keys (fail-closed: losing a
- * "secret_hashed flipped" diff entry is acceptable, leaking a hash is not).
+ * "secretHashed flipped" diff entry is acceptable, leaking a hash is not).
  * Shared with the sanitizer's `diff` branch so both boundaries agree.
  */
 export declare const EVENT_DIFF_SECRET_KEY_REGEX: RegExp;
@@ -12,9 +12,9 @@ export type EntityDiff = Record<string, {
 /**
  * PII-safe scalar diff between the updated entity and its pre-mutation
  * snapshot: only keys with scalar values (string/number/boolean/null) on BOTH
- * sides, skipping timestamp columns (`*_at`) and any key matching the secret
- * denylist, including only keys whose value actually changed. String values
- * are truncated to {@link EVENT_DIFF_VALUE_MAX_LENGTH}.
+ * sides, skipping timestamp columns (`*_at` / `*At`) and any key matching the
+ * secret denylist, including only keys whose value actually changed. String
+ * values are truncated to {@link EVENT_DIFF_VALUE_MAX_LENGTH}.
  */
 export declare function buildEntityDiff(next: Record<string, any>, previous: Record<string, any>): EntityDiff;
 //# sourceMappingURL=diff.d.ts.map

package/dist/core/entities/event/diff.mjs

@@ -5,7 +5,7 @@ import { isEqual } from "smob";
 //#region src/core/entities/event/diff.ts
 /**
 * Secret denylist for entity-diff keys (fail-closed: losing a
-* "secret_hashed flipped" diff entry is acceptable, leaking a hash is not).
+* "secretHashed flipped" diff entry is acceptable, leaking a hash is not).
 * Shared with the sanitizer's `diff` branch so both boundaries agree.
 */ const EVENT_DIFF_SECRET_KEY_REGEX = /(password|secret|hash|token|credential)/i;
 const EVENT_DIFF_VALUE_MAX_LENGTH = 512;
@@ -19,14 +19,14 @@ function truncateScalar(value) {
 /**
 * PII-safe scalar diff between the updated entity and its pre-mutation
 * snapshot: only keys with scalar values (string/number/boolean/null) on BOTH
-* sides, skipping timestamp columns (`*_at`) and any key matching the secret
-* denylist, including only keys whose value actually changed. String values
-* are truncated to {@link EVENT_DIFF_VALUE_MAX_LENGTH}.
+* sides, skipping timestamp columns (`*_at` / `*At`) and any key matching the
+* secret denylist, including only keys whose value actually changed. String
+* values are truncated to {@link EVENT_DIFF_VALUE_MAX_LENGTH}.
 */ function buildEntityDiff(next, previous) {
 	const output = {};
 	const keys = /* @__PURE__ */ new Set([...Object.keys(next), ...Object.keys(previous)]);
 	for (const key of keys) {
-		if (key.endsWith("_at")) continue;
+		if (key.endsWith("_at") || key.endsWith("At")) continue;
 		if (EVENT_DIFF_SECRET_KEY_REGEX.test(key)) continue;
 		const nextValue = next[key];
 		const previousValue = previous[key];

package/dist/core/entities/event/diff.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"diff.mjs","names":["isEqual","EVENT_DIFF_SECRET_KEY_REGEX","EVENT_DIFF_VALUE_MAX_LENGTH","isScalar","value","truncateScalar","length","substring","buildEntityDiff","next","previous","output","keys","Set","Object","key","endsWith","test","nextValue","previousValue"],"sources":["../../../../src/core/entities/event/diff.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { isEqual } from 'smob';\n\n/**\n * Secret denylist for entity-diff keys (fail-closed: losing a\n * \"secret_hashed flipped\" diff entry is acceptable, leaking a hash is not).\n * Shared with the sanitizer's `diff` branch so both boundaries agree.\n */\nexport const EVENT_DIFF_SECRET_KEY_REGEX = /(password|secret|hash|token|credential)/i;\n\nexport const EVENT_DIFF_VALUE_MAX_LENGTH = 512;\n\nexport type EntityDiff = Record<string, { next: unknown, previous: unknown }>;\n\nfunction isScalar(value: unknown): value is string | number | boolean | null {\n    return value === null ||\n        typeof value === 'string' ||\n        typeof value === 'number' ||\n        typeof value === 'boolean';\n}\n\nfunction truncateScalar(value: string | number | boolean | null): string | number | boolean | null {\n    if (typeof value === 'string' && value.length > EVENT_DIFF_VALUE_MAX_LENGTH) {\n        return value.substring(0, EVENT_DIFF_VALUE_MAX_LENGTH);\n    }\n\n    return value;\n}\n\n/**\n * PII-safe scalar diff between the updated entity and its pre-mutation\n * snapshot: only keys with scalar values (string/number/boolean/null) on BOTH\n * sides, skipping timestamp columns (`*_at`) and any key matching the secret\n * denylist, including only keys whose value actually changed. String values\n * are truncated to {@link EVENT_DIFF_VALUE_MAX_LENGTH}.\n */\nexport function buildEntityDiff(\n    next: Record<string, any>,\n    previous: Record<string, any>,\n): EntityDiff {\n    const output: EntityDiff = {};\n\n    const keys = new Set([\n        ...Object.keys(next),\n        ...Object.keys(previous),\n    ]);\n\n    for (const key of keys) {\n        if (key.endsWith('_at')) {\n            continue;\n        }\n\n        if (EVENT_DIFF_SECRET_KEY_REGEX.test(key)) {\n            continue;\n        }\n\n        const nextValue = next[key];\n        const previousValue = previous[key];\n\n        if (!isScalar(nextValue) || !isScalar(previousValue)) {\n            continue;\n        }\n\n        if (isEqual(nextValue, previousValue)) {\n            continue;\n        }\n\n        output[key] = {\n            next: truncateScalar(nextValue),\n            previous: truncateScalar(previousValue),\n        };\n    }\n\n    return output;\n}\n"],"mappings":";;;;;;;;;GAcA,MAAaC,8BAA8B;AAE3C,MAAaC,8BAA8B;AAI3C,SAASC,SAASC,OAAc;CAC5B,OAAOA,UAAU,QACb,OAAOA,UAAU,YACjB,OAAOA,UAAU,YACjB,OAAOA,UAAU;AACzB;AAEA,SAASC,eAAeD,OAAuC;CAC3D,IAAI,OAAOA,UAAU,YAAYA,MAAME,SAAAA,KACnC,OAAOF,MAAMG,UAAU,GAAA,GAAGL;CAG9B,OAAOE;AACX;;;;;;;GASA,SAAgBI,gBACZC,MACAC,UAA6B;CAE7B,MAAMC,SAAqB,CAAC;CAE5B,MAAMC,uBAAO,IAAIC,IAAI,CAAA,GACdC,OAAOF,KAAKH,IAAAA,GAAAA,GACZK,OAAOF,KAAKF,QAAAA,CAAAA,CAClB;CAED,KAAK,MAAMK,OAAOH,MAAM;EACpB,IAAIG,IAAIC,SAAS,KAAA,GACb;EAGJ,IAAIf,4BAA4BgB,KAAKF,GAAAA,GACjC;EAGJ,MAAMG,YAAYT,KAAKM;EACvB,MAAMI,gBAAgBT,SAASK;EAE/B,IAAI,CAACZ,SAASe,SAAAA,KAAc,CAACf,SAASgB,aAAAA,GAClC;EAGJ,IAAInB,QAAQkB,WAAWC,aAAAA,GACnB;EAGJR,OAAOI,OAAO;GACVN,MAAMJ,eAAea,SAAAA;GACrBR,UAAUL,eAAec,aAAAA;EAC7B;CACJ;CAEA,OAAOR;AACX"}
+{"version":3,"file":"diff.mjs","names":["isEqual","EVENT_DIFF_SECRET_KEY_REGEX","EVENT_DIFF_VALUE_MAX_LENGTH","isScalar","value","truncateScalar","length","substring","buildEntityDiff","next","previous","output","keys","Set","Object","key","endsWith","test","nextValue","previousValue"],"sources":["../../../../src/core/entities/event/diff.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { isEqual } from 'smob';\n\n/**\n * Secret denylist for entity-diff keys (fail-closed: losing a\n * \"secretHashed flipped\" diff entry is acceptable, leaking a hash is not).\n * Shared with the sanitizer's `diff` branch so both boundaries agree.\n */\nexport const EVENT_DIFF_SECRET_KEY_REGEX = /(password|secret|hash|token|credential)/i;\n\nexport const EVENT_DIFF_VALUE_MAX_LENGTH = 512;\n\nexport type EntityDiff = Record<string, { next: unknown, previous: unknown }>;\n\nfunction isScalar(value: unknown): value is string | number | boolean | null {\n    return value === null ||\n        typeof value === 'string' ||\n        typeof value === 'number' ||\n        typeof value === 'boolean';\n}\n\nfunction truncateScalar(value: string | number | boolean | null): string | number | boolean | null {\n    if (typeof value === 'string' && value.length > EVENT_DIFF_VALUE_MAX_LENGTH) {\n        return value.substring(0, EVENT_DIFF_VALUE_MAX_LENGTH);\n    }\n\n    return value;\n}\n\n/**\n * PII-safe scalar diff between the updated entity and its pre-mutation\n * snapshot: only keys with scalar values (string/number/boolean/null) on BOTH\n * sides, skipping timestamp columns (`*_at` / `*At`) and any key matching the\n * secret denylist, including only keys whose value actually changed. String\n * values are truncated to {@link EVENT_DIFF_VALUE_MAX_LENGTH}.\n */\nexport function buildEntityDiff(\n    next: Record<string, any>,\n    previous: Record<string, any>,\n): EntityDiff {\n    const output: EntityDiff = {};\n\n    const keys = new Set([\n        ...Object.keys(next),\n        ...Object.keys(previous),\n    ]);\n\n    for (const key of keys) {\n        if (key.endsWith('_at') || key.endsWith('At')) {\n            continue;\n        }\n\n        if (EVENT_DIFF_SECRET_KEY_REGEX.test(key)) {\n            continue;\n        }\n\n        const nextValue = next[key];\n        const previousValue = previous[key];\n\n        if (!isScalar(nextValue) || !isScalar(previousValue)) {\n            continue;\n        }\n\n        if (isEqual(nextValue, previousValue)) {\n            continue;\n        }\n\n        output[key] = {\n            next: truncateScalar(nextValue),\n            previous: truncateScalar(previousValue),\n        };\n    }\n\n    return output;\n}\n"],"mappings":";;;;;;;;;GAcA,MAAaC,8BAA8B;AAE3C,MAAaC,8BAA8B;AAI3C,SAASC,SAASC,OAAc;CAC5B,OAAOA,UAAU,QACb,OAAOA,UAAU,YACjB,OAAOA,UAAU,YACjB,OAAOA,UAAU;AACzB;AAEA,SAASC,eAAeD,OAAuC;CAC3D,IAAI,OAAOA,UAAU,YAAYA,MAAME,SAAAA,KACnC,OAAOF,MAAMG,UAAU,GAAA,GAAGL;CAG9B,OAAOE;AACX;;;;;;;GASA,SAAgBI,gBACZC,MACAC,UAA6B;CAE7B,MAAMC,SAAqB,CAAC;CAE5B,MAAMC,uBAAO,IAAIC,IAAI,CAAA,GACdC,OAAOF,KAAKH,IAAAA,GAAAA,GACZK,OAAOF,KAAKF,QAAAA,CAAAA,CAClB;CAED,KAAK,MAAMK,OAAOH,MAAM;EACpB,IAAIG,IAAIC,SAAS,KAAA,KAAUD,IAAIC,SAAS,IAAA,GACpC;EAGJ,IAAIf,4BAA4BgB,KAAKF,GAAAA,GACjC;EAGJ,MAAMG,YAAYT,KAAKM;EACvB,MAAMI,gBAAgBT,SAASK;EAE/B,IAAI,CAACZ,SAASe,SAAAA,KAAc,CAACf,SAASgB,aAAAA,GAClC;EAGJ,IAAInB,QAAQkB,WAAWC,aAAAA,GACnB;EAGJR,OAAOI,OAAO;GACVN,MAAMJ,eAAea,SAAAA;GACrBR,UAAUL,eAAec,aAAAA;EAC7B;CACJ;CAEA,OAAOR;AACX"}

package/dist/core/entities/event/entity-event-handler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"entity-event-handler.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/event/entity-event-handler.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,yBAAyB,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAEzF,OAAO,KAAK,EACR,yBAAyB,EACzB,mBAAmB,EACnB,aAAa,EAChB,MAAM,YAAY,CAAC;AAEpB,MAAM,MAAM,yBAAyB,GAAG;IACpC,YAAY,EAAE,aAAa,CAAC;IAC5B,cAAc,CAAC,EAAE,MAAM,mBAAmB,GAAG,SAAS,CAAC;IACvD,OAAO,CAAC,EAAE,yBAAyB,CAAC;CACvC,CAAC;AA0CF;;;GAGG;AACH,qBAAa,kBAAmB,YAAW,mBAAmB;IAC1D,SAAS,CAAC,YAAY,EAAG,aAAa,CAAC;IAEvC,SAAS,CAAC,cAAc,CAAC,EAAG,MAAM,mBAAmB,GAAG,SAAS,CAAC;IAElE,SAAS,CAAC,OAAO,EAAG,yBAAyB,CAAC;gBAElC,GAAG,EAAE,yBAAyB;IAMpC,MAAM,CAAC,GAAG,EAAE,yBAAyB,GAAG,OAAO,CAAC,IAAI,CAAC;CAqD9D"}
+{"version":3,"file":"entity-event-handler.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/event/entity-event-handler.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,yBAAyB,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAEzF,OAAO,KAAK,EACR,yBAAyB,EACzB,mBAAmB,EACnB,aAAa,EAChB,MAAM,YAAY,CAAC;AAEpB,MAAM,MAAM,yBAAyB,GAAG;IACpC,YAAY,EAAE,aAAa,CAAC;IAC5B,cAAc,CAAC,EAAE,MAAM,mBAAmB,GAAG,SAAS,CAAC;IACvD,OAAO,CAAC,EAAE,yBAAyB,CAAC;CACvC,CAAC;AAwCF;;;GAGG;AACH,qBAAa,kBAAmB,YAAW,mBAAmB;IAC1D,SAAS,CAAC,YAAY,EAAG,aAAa,CAAC;IAEvC,SAAS,CAAC,cAAc,CAAC,EAAG,MAAM,mBAAmB,GAAG,SAAS,CAAC;IAElE,SAAS,CAAC,OAAO,EAAG,yBAAyB,CAAC;gBAElC,GAAG,EAAE,yBAAyB;IAMpC,MAAM,CAAC,GAAG,EAAE,yBAAyB,GAAG,OAAO,CAAC,IAAI,CAAC;CAqD9D"}

package/dist/core/entities/event/entity-event-handler.mjs

@@ -11,37 +11,35 @@ const ENTITY_EVENT_NAME_MAP = {
 	[EntityDefaultEventName.DELETED]: EventName.DELETED
 };
 const ENTITY_REALM_KEY_MAP = {
-	[EntityType.CLIENT]: "realm_id",
-	[EntityType.CLIENT_PERMISSION]: "client_realm_id",
-	[EntityType.CLIENT_ROLE]: "client_realm_id",
-	[EntityType.CLIENT_SCOPE]: "client_realm_id",
-	[EntityType.CONSENT]: "realm_id",
-	[EntityType.EVENT]: "realm_id",
-	[EntityType.IDENTITY_PROVIDER]: "realm_id",
-	[EntityType.IDENTITY_PROVIDER_ACCOUNT]: "user_realm_id",
-	[EntityType.IDENTITY_PROVIDER_ATTRIBUTE]: "realm_id",
-	[EntityType.IDENTITY_PROVIDER_ATTRIBUTE_MAPPING]: "provider_realm_id",
-	[EntityType.IDENTITY_PROVIDER_PERMISSION_MAPPING]: "provider_realm_id",
-	[EntityType.IDENTITY_PROVIDER_ROLE_MAPPING]: "provider_realm_id",
-	[EntityType.KEY]: "realm_id",
-	[EntityType.POLICY]: "realm_id",
-	[EntityType.POLICY_ATTRIBUTE]: "realm_id",
-	[EntityType.PERMISSION]: "realm_id",
-	[EntityType.PERMISSION_POLICY]: "permission_realm_id",
+	[EntityType.CLIENT]: "realmId",
+	[EntityType.CLIENT_PERMISSION]: "clientRealmId",
+	[EntityType.CLIENT_ROLE]: "clientRealmId",
+	[EntityType.CLIENT_SCOPE]: "clientRealmId",
+	[EntityType.CONSENT]: "realmId",
+	[EntityType.EVENT]: "realmId",
+	[EntityType.IDENTITY_PROVIDER]: "realmId",
+	[EntityType.IDENTITY_PROVIDER_ACCOUNT]: "userRealmId",
+	[EntityType.IDENTITY_PROVIDER_ATTRIBUTE]: "realmId",
+	[EntityType.IDENTITY_PROVIDER_ATTRIBUTE_MAPPING]: "providerRealmId",
+	[EntityType.IDENTITY_PROVIDER_PERMISSION_MAPPING]: "providerRealmId",
+	[EntityType.IDENTITY_PROVIDER_ROLE_MAPPING]: "providerRealmId",
+	[EntityType.KEY]: "realmId",
+	[EntityType.POLICY]: "realmId",
+	[EntityType.POLICY_ATTRIBUTE]: "realmId",
+	[EntityType.PERMISSION]: "realmId",
+	[EntityType.PERMISSION_POLICY]: "permissionRealmId",
 	[EntityType.REALM]: "id",
-	[EntityType.ROBOT]: "realm_id",
-	[EntityType.ROBOT_PERMISSION]: "robot_realm_id",
-	[EntityType.ROBOT_ROLE]: "robot_realm_id",
-	[EntityType.ROLE]: "realm_id",
-	[EntityType.ROLE_ATTRIBUTE]: "realm_id",
-	[EntityType.ROLE_PERMISSION]: "role_realm_id",
-	[EntityType.SCOPE]: "realm_id",
-	[EntityType.SESSION]: "realm_id",
-	[EntityType.TRUST_ANCHOR]: "realm_id",
-	[EntityType.USER]: "realm_id",
-	[EntityType.USER_ATTRIBUTE]: "realm_id",
-	[EntityType.USER_PERMISSION]: "user_realm_id",
-	[EntityType.USER_ROLE]: "user_realm_id"
+	[EntityType.ROLE]: "realmId",
+	[EntityType.ROLE_ATTRIBUTE]: "realmId",
+	[EntityType.ROLE_PERMISSION]: "roleRealmId",
+	[EntityType.SCOPE]: "realmId",
+	[EntityType.SESSION]: "realmId",
+	[EntityType.TRUST_ANCHOR]: "realmId",
+	[EntityType.USER]: "realmId",
+	[EntityType.USER_ATTRIBUTE]: "realmId",
+	[EntityType.USER_AUTHENTICATOR]: "realmId",
+	[EntityType.USER_PERMISSION]: "userRealmId",
+	[EntityType.USER_ROLE]: "userRealmId"
 };
 /**
 * Bridges every entity create/update/delete published on the
@@ -90,7 +88,7 @@ const ENTITY_REALM_KEY_MAP = {
 };
 function resolveEntityRealmId(type, data) {
 	if (!isObject(data)) return;
-	const key = ENTITY_REALM_KEY_MAP[type] ?? "realm_id";
+	const key = ENTITY_REALM_KEY_MAP[type] ?? "realmId";
 	if (!hasOwnProperty(data, key)) return;
 	return typeof data[key] === "string" ? data[key] : null;
 }

package/dist/core/entities/event/entity-event-handler.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"entity-event-handler.mjs","names":["EntityDefaultEventName","EntityType","EventName","EventScope","hasOwnProperty","isObject","buildEntityDiff","ENTITY_EVENT_NAME_MAP","CREATED","UPDATED","DELETED","ENTITY_REALM_KEY_MAP","CLIENT","CLIENT_PERMISSION","CLIENT_ROLE","CLIENT_SCOPE","CONSENT","EVENT","IDENTITY_PROVIDER","IDENTITY_PROVIDER_ACCOUNT","IDENTITY_PROVIDER_ATTRIBUTE","IDENTITY_PROVIDER_ATTRIBUTE_MAPPING","IDENTITY_PROVIDER_PERMISSION_MAPPING","IDENTITY_PROVIDER_ROLE_MAPPING","KEY","POLICY","POLICY_ATTRIBUTE","PERMISSION","PERMISSION_POLICY","REALM","ROBOT","ROBOT_PERMISSION","ROBOT_ROLE","ROLE","ROLE_ATTRIBUTE","ROLE_PERMISSION","SCOPE","SESSION","TRUST_ANCHOR","USER","USER_ATTRIBUTE","USER_PERMISSION","USER_ROLE","EntityEventHandler","eventService","requestContext","options","ctx","handle","content","type","name","event","refId","data","id","realmIdCurrent","resolveEntityRealmId","realmId","dataPrevious","undefined","diff","Object","keys","length","record","scope","ENTITY","refType","actorType","actorId","actorName","requestPath","requestMethod","requestIpAddress","requestUserAgent","retentionDays","key"],"sources":["../../../../src/core/entities/event/entity-event-handler.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport {\n    EntityDefaultEventName,\n    EntityType,\n    EventName,\n    EventScope,\n} from '@authup/core-kit';\nimport { hasOwnProperty, isObject } from '@authup/kit';\nimport type { DomainEventPublishContext, IDomainEventHandler } from '@authup/server-kit';\nimport { buildEntityDiff } from './diff.ts';\nimport type {\n    EntityEventHandlerOptions,\n    EventRequestContext,\n    IEventService,\n} from './types.ts';\n\nexport type EntityEventHandlerContext = {\n    eventService: IEventService,\n    requestContext?: () => EventRequestContext | undefined,\n    options?: EntityEventHandlerOptions,\n};\n\nconst ENTITY_EVENT_NAME_MAP : Record<string, `${EventName}`> = {\n    [EntityDefaultEventName.CREATED]: EventName.CREATED,\n    [EntityDefaultEventName.UPDATED]: EventName.UPDATED,\n    [EntityDefaultEventName.DELETED]: EventName.DELETED,\n};\n\nconst ENTITY_REALM_KEY_MAP : Record<`${EntityType}`, string> = {\n    [EntityType.CLIENT]: 'realm_id',\n    [EntityType.CLIENT_PERMISSION]: 'client_realm_id',\n    [EntityType.CLIENT_ROLE]: 'client_realm_id',\n    [EntityType.CLIENT_SCOPE]: 'client_realm_id',\n    [EntityType.CONSENT]: 'realm_id',\n    [EntityType.EVENT]: 'realm_id',\n    [EntityType.IDENTITY_PROVIDER]: 'realm_id',\n    [EntityType.IDENTITY_PROVIDER_ACCOUNT]: 'user_realm_id',\n    [EntityType.IDENTITY_PROVIDER_ATTRIBUTE]: 'realm_id',\n    [EntityType.IDENTITY_PROVIDER_ATTRIBUTE_MAPPING]: 'provider_realm_id',\n    [EntityType.IDENTITY_PROVIDER_PERMISSION_MAPPING]: 'provider_realm_id',\n    [EntityType.IDENTITY_PROVIDER_ROLE_MAPPING]: 'provider_realm_id',\n    [EntityType.KEY]: 'realm_id',\n    [EntityType.POLICY]: 'realm_id',\n    [EntityType.POLICY_ATTRIBUTE]: 'realm_id',\n    [EntityType.PERMISSION]: 'realm_id',\n    [EntityType.PERMISSION_POLICY]: 'permission_realm_id',\n    [EntityType.REALM]: 'id',\n    [EntityType.ROBOT]: 'realm_id',\n    [EntityType.ROBOT_PERMISSION]: 'robot_realm_id',\n    [EntityType.ROBOT_ROLE]: 'robot_realm_id',\n    [EntityType.ROLE]: 'realm_id',\n    [EntityType.ROLE_ATTRIBUTE]: 'realm_id',\n    [EntityType.ROLE_PERMISSION]: 'role_realm_id',\n    [EntityType.SCOPE]: 'realm_id',\n    [EntityType.SESSION]: 'realm_id',\n    [EntityType.TRUST_ANCHOR]: 'realm_id',\n    [EntityType.USER]: 'realm_id',\n    [EntityType.USER_ATTRIBUTE]: 'realm_id',\n    [EntityType.USER_PERMISSION]: 'user_realm_id',\n    [EntityType.USER_ROLE]: 'user_realm_id',\n};\n\n/**\n * Bridges every entity create/update/delete published on the\n * DomainEventPublisher bus into the auth_events audit table (scope `entity`).\n */\nexport class EntityEventHandler implements IDomainEventHandler {\n    protected eventService : IEventService;\n\n    protected requestContext? : () => EventRequestContext | undefined;\n\n    protected options : EntityEventHandlerOptions;\n\n    constructor(ctx: EntityEventHandlerContext) {\n        this.eventService = ctx.eventService;\n        this.requestContext = ctx.requestContext;\n        this.options = ctx.options ?? {};\n    }\n\n    async handle(ctx: DomainEventPublishContext): Promise<void> {\n        try {\n            // recursion guard — no event subscriber exists today (the\n            // auth_events entity is deliberately subscriber-less), so this is\n            // defense in depth against an audit-write feedback loop.\n            if (ctx.content.type === 'event') {\n                return;\n            }\n\n            const name = ENTITY_EVENT_NAME_MAP[ctx.content.event];\n            if (!name) {\n                return;\n            }\n\n            const refId = ctx.content.data?.id ?? null;\n            const realmIdCurrent = resolveEntityRealmId(ctx.content.type, ctx.content.data);\n            const realmId = typeof realmIdCurrent === 'undefined' ?\n                (resolveEntityRealmId(ctx.content.type, ctx.dataPrevious) ?? null) :\n                realmIdCurrent;\n\n            const requestContext = this.requestContext ?\n                this.requestContext() :\n                undefined;\n\n            let data : Record<string, any> | null = null;\n            if (name === EventName.UPDATED && isObject(ctx.content.data) && isObject(ctx.dataPrevious)) {\n                const diff = buildEntityDiff(ctx.content.data, ctx.dataPrevious);\n                if (Object.keys(diff).length > 0) {\n                    data = { diff };\n                }\n            }\n\n            await this.eventService.record({\n                scope: EventScope.ENTITY,\n                name,\n                refType: ctx.content.type,\n                refId,\n                realmId,\n                actorType: requestContext?.actorType ?? null,\n                actorId: requestContext?.actorId ?? null,\n                actorName: requestContext?.actorName ?? null,\n                requestPath: requestContext?.requestPath ?? null,\n                requestMethod: requestContext?.requestMethod ?? null,\n                requestIpAddress: requestContext?.requestIpAddress ?? null,\n                requestUserAgent: requestContext?.requestUserAgent ?? null,\n                data,\n                retentionDays: this.options.retentionDays,\n            });\n        } catch {\n            // record() never throws, but the bridge itself must also never\n            // fail the originating publish.\n        }\n    }\n}\n\nfunction resolveEntityRealmId(\n    type: string,\n    data: unknown,\n): string | null | undefined {\n    if (!isObject(data)) {\n        return undefined;\n    }\n\n    const key = ENTITY_REALM_KEY_MAP[type as `${EntityType}`] ?? 'realm_id';\n    if (!hasOwnProperty(data, key)) {\n        return undefined;\n    }\n\n    return typeof data[key] === 'string' ? data[key] : null;\n}\n"],"mappings":";;;;;;;AA4BA,MAAMO,wBAAyD;EAC1DP,uBAAuBQ,UAAUN,UAAUM;EAC3CR,uBAAuBS,UAAUP,UAAUO;EAC3CT,uBAAuBU,UAAUR,UAAUQ;AAChD;AAEA,MAAMC,uBAAyD;EAC1DV,WAAWW,SAAS;EACpBX,WAAWY,oBAAoB;EAC/BZ,WAAWa,cAAc;EACzBb,WAAWc,eAAe;EAC1Bd,WAAWe,UAAU;EACrBf,WAAWgB,QAAQ;EACnBhB,WAAWiB,oBAAoB;EAC/BjB,WAAWkB,4BAA4B;EACvClB,WAAWmB,8BAA8B;EACzCnB,WAAWoB,sCAAsC;EACjDpB,WAAWqB,uCAAuC;EAClDrB,WAAWsB,iCAAiC;EAC5CtB,WAAWuB,MAAM;EACjBvB,WAAWwB,SAAS;EACpBxB,WAAWyB,mBAAmB;EAC9BzB,WAAW0B,aAAa;EACxB1B,WAAW2B,oBAAoB;EAC/B3B,WAAW4B,QAAQ;EACnB5B,WAAW6B,QAAQ;EACnB7B,WAAW8B,mBAAmB;EAC9B9B,WAAW+B,aAAa;EACxB/B,WAAWgC,OAAO;EAClBhC,WAAWiC,iBAAiB;EAC5BjC,WAAWkC,kBAAkB;EAC7BlC,WAAWmC,QAAQ;EACnBnC,WAAWoC,UAAU;EACrBpC,WAAWqC,eAAe;EAC1BrC,WAAWsC,OAAO;EAClBtC,WAAWuC,iBAAiB;EAC5BvC,WAAWwC,kBAAkB;EAC7BxC,WAAWyC,YAAY;AAC5B;;;;GAMA,IAAaC,qBAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEV,YAAYC,KAAgC;EACxC,KAAKH,eAAeG,IAAIH;EACxB,KAAKC,iBAAiBE,IAAIF;EAC1B,KAAKC,UAAUC,IAAID,WAAW,CAAC;CACnC;CAEA,MAAME,OAAOD,KAA+C;EACxD,IAAI;GAIA,IAAIA,IAAIE,QAAQC,SAAS,SACrB;GAGJ,MAAMC,OAAO5C,sBAAsBwC,IAAIE,QAAQG;GAC/C,IAAI,CAACD,MACD;GAGJ,MAAME,QAAQN,IAAIE,QAAQK,MAAMC,MAAM;GACtC,MAAMC,iBAAiBC,qBAAqBV,IAAIE,QAAQC,MAAMH,IAAIE,QAAQK,IAAI;GAC9E,MAAMI,UAAU,OAAOF,mBAAmB,cACrCC,qBAAqBV,IAAIE,QAAQC,MAAMH,IAAIY,YAAY,KAAK,OAC7DH;GAEJ,MAAMX,iBAAiB,KAAKA,iBACxB,KAAKA,eAAc,IACnBe,KAAAA;GAEJ,IAAIN,OAAoC;GACxC,IAAIH,SAASjD,UAAUO,WAAWJ,SAAS0C,IAAIE,QAAQK,IAAI,KAAKjD,SAAS0C,IAAIY,YAAY,GAAG;IACxF,MAAME,OAAOvD,gBAAgByC,IAAIE,QAAQK,MAAMP,IAAIY,YAAY;IAC/D,IAAIG,OAAOC,KAAKF,IAAAA,CAAAA,CAAMG,SAAS,GAC3BV,OAAO,EAAEO,KAAK;GAEtB;GAEA,MAAM,KAAKjB,aAAaqB,OAAO;IAC3BC,OAAO/D,WAAWgE;IAClBhB;IACAiB,SAASrB,IAAIE,QAAQC;IACrBG;IACAK;IACAW,WAAWxB,gBAAgBwB,aAAa;IACxCC,SAASzB,gBAAgByB,WAAW;IACpCC,WAAW1B,gBAAgB0B,aAAa;IACxCC,aAAa3B,gBAAgB2B,eAAe;IAC5CC,eAAe5B,gBAAgB4B,iBAAiB;IAChDC,kBAAkB7B,gBAAgB6B,oBAAoB;IACtDC,kBAAkB9B,gBAAgB8B,oBAAoB;IACtDrB;IACAsB,eAAe,KAAK9B,QAAQ8B;GAChC,CAAA;EACJ,QAAQ,CAGR;CACJ;AACJ;AAEA,SAASnB,qBACLP,MACAI,MAAa;CAEb,IAAI,CAACjD,SAASiD,IAAAA,GACV;CAGJ,MAAMuB,MAAMlE,qBAAqBuC,SAA4B;CAC7D,IAAI,CAAC9C,eAAekD,MAAMuB,GAAAA,GACtB;CAGJ,OAAO,OAAOvB,KAAKuB,SAAS,WAAWvB,KAAKuB,OAAO;AACvD"}
+{"version":3,"file":"entity-event-handler.mjs","names":["EntityDefaultEventName","EntityType","EventName","EventScope","hasOwnProperty","isObject","buildEntityDiff","ENTITY_EVENT_NAME_MAP","CREATED","UPDATED","DELETED","ENTITY_REALM_KEY_MAP","CLIENT","CLIENT_PERMISSION","CLIENT_ROLE","CLIENT_SCOPE","CONSENT","EVENT","IDENTITY_PROVIDER","IDENTITY_PROVIDER_ACCOUNT","IDENTITY_PROVIDER_ATTRIBUTE","IDENTITY_PROVIDER_ATTRIBUTE_MAPPING","IDENTITY_PROVIDER_PERMISSION_MAPPING","IDENTITY_PROVIDER_ROLE_MAPPING","KEY","POLICY","POLICY_ATTRIBUTE","PERMISSION","PERMISSION_POLICY","REALM","ROLE","ROLE_ATTRIBUTE","ROLE_PERMISSION","SCOPE","SESSION","TRUST_ANCHOR","USER","USER_ATTRIBUTE","USER_AUTHENTICATOR","USER_PERMISSION","USER_ROLE","EntityEventHandler","eventService","requestContext","options","ctx","handle","content","type","name","event","refId","data","id","realmIdCurrent","resolveEntityRealmId","realmId","dataPrevious","undefined","diff","Object","keys","length","record","scope","ENTITY","refType","actorType","actorId","actorName","requestPath","requestMethod","requestIpAddress","requestUserAgent","retentionDays","key"],"sources":["../../../../src/core/entities/event/entity-event-handler.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport {\n    EntityDefaultEventName,\n    EntityType,\n    EventName,\n    EventScope,\n} from '@authup/core-kit';\nimport { hasOwnProperty, isObject } from '@authup/kit';\nimport type { DomainEventPublishContext, IDomainEventHandler } from '@authup/server-kit';\nimport { buildEntityDiff } from './diff.ts';\nimport type {\n    EntityEventHandlerOptions,\n    EventRequestContext,\n    IEventService,\n} from './types.ts';\n\nexport type EntityEventHandlerContext = {\n    eventService: IEventService,\n    requestContext?: () => EventRequestContext | undefined,\n    options?: EntityEventHandlerOptions,\n};\n\nconst ENTITY_EVENT_NAME_MAP : Record<string, `${EventName}`> = {\n    [EntityDefaultEventName.CREATED]: EventName.CREATED,\n    [EntityDefaultEventName.UPDATED]: EventName.UPDATED,\n    [EntityDefaultEventName.DELETED]: EventName.DELETED,\n};\n\nconst ENTITY_REALM_KEY_MAP : Record<`${EntityType}`, string> = {\n    [EntityType.CLIENT]: 'realmId',\n    [EntityType.CLIENT_PERMISSION]: 'clientRealmId',\n    [EntityType.CLIENT_ROLE]: 'clientRealmId',\n    [EntityType.CLIENT_SCOPE]: 'clientRealmId',\n    [EntityType.CONSENT]: 'realmId',\n    [EntityType.EVENT]: 'realmId',\n    [EntityType.IDENTITY_PROVIDER]: 'realmId',\n    [EntityType.IDENTITY_PROVIDER_ACCOUNT]: 'userRealmId',\n    [EntityType.IDENTITY_PROVIDER_ATTRIBUTE]: 'realmId',\n    [EntityType.IDENTITY_PROVIDER_ATTRIBUTE_MAPPING]: 'providerRealmId',\n    [EntityType.IDENTITY_PROVIDER_PERMISSION_MAPPING]: 'providerRealmId',\n    [EntityType.IDENTITY_PROVIDER_ROLE_MAPPING]: 'providerRealmId',\n    [EntityType.KEY]: 'realmId',\n    [EntityType.POLICY]: 'realmId',\n    [EntityType.POLICY_ATTRIBUTE]: 'realmId',\n    [EntityType.PERMISSION]: 'realmId',\n    [EntityType.PERMISSION_POLICY]: 'permissionRealmId',\n    [EntityType.REALM]: 'id',\n    [EntityType.ROLE]: 'realmId',\n    [EntityType.ROLE_ATTRIBUTE]: 'realmId',\n    [EntityType.ROLE_PERMISSION]: 'roleRealmId',\n    [EntityType.SCOPE]: 'realmId',\n    [EntityType.SESSION]: 'realmId',\n    [EntityType.TRUST_ANCHOR]: 'realmId',\n    [EntityType.USER]: 'realmId',\n    [EntityType.USER_ATTRIBUTE]: 'realmId',\n    [EntityType.USER_AUTHENTICATOR]: 'realmId',\n    [EntityType.USER_PERMISSION]: 'userRealmId',\n    [EntityType.USER_ROLE]: 'userRealmId',\n};\n\n/**\n * Bridges every entity create/update/delete published on the\n * DomainEventPublisher bus into the auth_events audit table (scope `entity`).\n */\nexport class EntityEventHandler implements IDomainEventHandler {\n    protected eventService : IEventService;\n\n    protected requestContext? : () => EventRequestContext | undefined;\n\n    protected options : EntityEventHandlerOptions;\n\n    constructor(ctx: EntityEventHandlerContext) {\n        this.eventService = ctx.eventService;\n        this.requestContext = ctx.requestContext;\n        this.options = ctx.options ?? {};\n    }\n\n    async handle(ctx: DomainEventPublishContext): Promise<void> {\n        try {\n            // recursion guard — no event subscriber exists today (the\n            // auth_events entity is deliberately subscriber-less), so this is\n            // defense in depth against an audit-write feedback loop.\n            if (ctx.content.type === 'event') {\n                return;\n            }\n\n            const name = ENTITY_EVENT_NAME_MAP[ctx.content.event];\n            if (!name) {\n                return;\n            }\n\n            const refId = ctx.content.data?.id ?? null;\n            const realmIdCurrent = resolveEntityRealmId(ctx.content.type, ctx.content.data);\n            const realmId = typeof realmIdCurrent === 'undefined' ?\n                (resolveEntityRealmId(ctx.content.type, ctx.dataPrevious) ?? null) :\n                realmIdCurrent;\n\n            const requestContext = this.requestContext ?\n                this.requestContext() :\n                undefined;\n\n            let data : Record<string, any> | null = null;\n            if (name === EventName.UPDATED && isObject(ctx.content.data) && isObject(ctx.dataPrevious)) {\n                const diff = buildEntityDiff(ctx.content.data, ctx.dataPrevious);\n                if (Object.keys(diff).length > 0) {\n                    data = { diff };\n                }\n            }\n\n            await this.eventService.record({\n                scope: EventScope.ENTITY,\n                name,\n                refType: ctx.content.type,\n                refId,\n                realmId,\n                actorType: requestContext?.actorType ?? null,\n                actorId: requestContext?.actorId ?? null,\n                actorName: requestContext?.actorName ?? null,\n                requestPath: requestContext?.requestPath ?? null,\n                requestMethod: requestContext?.requestMethod ?? null,\n                requestIpAddress: requestContext?.requestIpAddress ?? null,\n                requestUserAgent: requestContext?.requestUserAgent ?? null,\n                data,\n                retentionDays: this.options.retentionDays,\n            });\n        } catch {\n            // record() never throws, but the bridge itself must also never\n            // fail the originating publish.\n        }\n    }\n}\n\nfunction resolveEntityRealmId(\n    type: string,\n    data: unknown,\n): string | null | undefined {\n    if (!isObject(data)) {\n        return undefined;\n    }\n\n    const key = ENTITY_REALM_KEY_MAP[type as `${EntityType}`] ?? 'realmId';\n    if (!hasOwnProperty(data, key)) {\n        return undefined;\n    }\n\n    return typeof data[key] === 'string' ? data[key] : null;\n}\n"],"mappings":";;;;;;;AA4BA,MAAMO,wBAAyD;EAC1DP,uBAAuBQ,UAAUN,UAAUM;EAC3CR,uBAAuBS,UAAUP,UAAUO;EAC3CT,uBAAuBU,UAAUR,UAAUQ;AAChD;AAEA,MAAMC,uBAAyD;EAC1DV,WAAWW,SAAS;EACpBX,WAAWY,oBAAoB;EAC/BZ,WAAWa,cAAc;EACzBb,WAAWc,eAAe;EAC1Bd,WAAWe,UAAU;EACrBf,WAAWgB,QAAQ;EACnBhB,WAAWiB,oBAAoB;EAC/BjB,WAAWkB,4BAA4B;EACvClB,WAAWmB,8BAA8B;EACzCnB,WAAWoB,sCAAsC;EACjDpB,WAAWqB,uCAAuC;EAClDrB,WAAWsB,iCAAiC;EAC5CtB,WAAWuB,MAAM;EACjBvB,WAAWwB,SAAS;EACpBxB,WAAWyB,mBAAmB;EAC9BzB,WAAW0B,aAAa;EACxB1B,WAAW2B,oBAAoB;EAC/B3B,WAAW4B,QAAQ;EACnB5B,WAAW6B,OAAO;EAClB7B,WAAW8B,iBAAiB;EAC5B9B,WAAW+B,kBAAkB;EAC7B/B,WAAWgC,QAAQ;EACnBhC,WAAWiC,UAAU;EACrBjC,WAAWkC,eAAe;EAC1BlC,WAAWmC,OAAO;EAClBnC,WAAWoC,iBAAiB;EAC5BpC,WAAWqC,qBAAqB;EAChCrC,WAAWsC,kBAAkB;EAC7BtC,WAAWuC,YAAY;AAC5B;;;;GAMA,IAAaC,qBAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEV,YAAYC,KAAgC;EACxC,KAAKH,eAAeG,IAAIH;EACxB,KAAKC,iBAAiBE,IAAIF;EAC1B,KAAKC,UAAUC,IAAID,WAAW,CAAC;CACnC;CAEA,MAAME,OAAOD,KAA+C;EACxD,IAAI;GAIA,IAAIA,IAAIE,QAAQC,SAAS,SACrB;GAGJ,MAAMC,OAAO1C,sBAAsBsC,IAAIE,QAAQG;GAC/C,IAAI,CAACD,MACD;GAGJ,MAAME,QAAQN,IAAIE,QAAQK,MAAMC,MAAM;GACtC,MAAMC,iBAAiBC,qBAAqBV,IAAIE,QAAQC,MAAMH,IAAIE,QAAQK,IAAI;GAC9E,MAAMI,UAAU,OAAOF,mBAAmB,cACrCC,qBAAqBV,IAAIE,QAAQC,MAAMH,IAAIY,YAAY,KAAK,OAC7DH;GAEJ,MAAMX,iBAAiB,KAAKA,iBACxB,KAAKA,eAAc,IACnBe,KAAAA;GAEJ,IAAIN,OAAoC;GACxC,IAAIH,SAAS/C,UAAUO,WAAWJ,SAASwC,IAAIE,QAAQK,IAAI,KAAK/C,SAASwC,IAAIY,YAAY,GAAG;IACxF,MAAME,OAAOrD,gBAAgBuC,IAAIE,QAAQK,MAAMP,IAAIY,YAAY;IAC/D,IAAIG,OAAOC,KAAKF,IAAAA,CAAAA,CAAMG,SAAS,GAC3BV,OAAO,EAAEO,KAAK;GAEtB;GAEA,MAAM,KAAKjB,aAAaqB,OAAO;IAC3BC,OAAO7D,WAAW8D;IAClBhB;IACAiB,SAASrB,IAAIE,QAAQC;IACrBG;IACAK;IACAW,WAAWxB,gBAAgBwB,aAAa;IACxCC,SAASzB,gBAAgByB,WAAW;IACpCC,WAAW1B,gBAAgB0B,aAAa;IACxCC,aAAa3B,gBAAgB2B,eAAe;IAC5CC,eAAe5B,gBAAgB4B,iBAAiB;IAChDC,kBAAkB7B,gBAAgB6B,oBAAoB;IACtDC,kBAAkB9B,gBAAgB8B,oBAAoB;IACtDrB;IACAsB,eAAe,KAAK9B,QAAQ8B;GAChC,CAAA;EACJ,QAAQ,CAGR;CACJ;AACJ;AAEA,SAASnB,qBACLP,MACAI,MAAa;CAEb,IAAI,CAAC/C,SAAS+C,IAAAA,GACV;CAGJ,MAAMuB,MAAMhE,qBAAqBqC,SAA4B;CAC7D,IAAI,CAAC5C,eAAegD,MAAMuB,GAAAA,GACtB;CAGJ,OAAO,OAAOvB,KAAKuB,SAAS,WAAWvB,KAAKuB,OAAO;AACvD"}

package/dist/core/entities/event/index.d.ts

@@ -4,4 +4,5 @@ export * from './entity-event-handler.ts';
 export * from './sanitize.ts';
 export * from './service.ts';
 export * from './types.ts';
+export * from './schema.ts';
 //# sourceMappingURL=index.d.ts.map

package/dist/core/entities/event/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/event/index.ts"],"names":[],"mappings":"AAOA,cAAc,gBAAgB,CAAC;AAC/B,cAAc,WAAW,CAAC;AAC1B,cAAc,2BAA2B,CAAC;AAC1C,cAAc,eAAe,CAAC;AAC9B,cAAc,cAAc,CAAC;AAC7B,cAAc,YAAY,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/event/index.ts"],"names":[],"mappings":"AAOA,cAAc,gBAAgB,CAAC;AAC/B,cAAc,WAAW,CAAC;AAC1B,cAAc,2BAA2B,CAAC;AAC1C,cAAc,eAAe,CAAC;AAC9B,cAAc,cAAc,CAAC;AAC7B,cAAc,YAAY,CAAC;AAC3B,cAAc,aAAa,CAAC"}

package/dist/core/entities/event/index.mjs

@@ -1,9 +1,10 @@
 import "node:path";
 import "node:url";
 import.meta.url;
+import { eventSchema } from "./schema.mjs";
 import { EVENT_LOG_RETENTION_DAYS_DEFAULT } from "./constants.mjs";
 import { EVENT_DIFF_SECRET_KEY_REGEX, EVENT_DIFF_VALUE_MAX_LENGTH, buildEntityDiff } from "./diff.mjs";
 import { EntityEventHandler } from "./entity-event-handler.mjs";
 import { sanitizeEventData } from "./sanitize.mjs";
 import { EventService } from "./service.mjs";
-export { EVENT_DIFF_SECRET_KEY_REGEX, EVENT_DIFF_VALUE_MAX_LENGTH, EVENT_LOG_RETENTION_DAYS_DEFAULT, EntityEventHandler, EventService, buildEntityDiff, sanitizeEventData };
+export { EVENT_DIFF_SECRET_KEY_REGEX, EVENT_DIFF_VALUE_MAX_LENGTH, EVENT_LOG_RETENTION_DAYS_DEFAULT, EntityEventHandler, EventService, buildEntityDiff, eventSchema, sanitizeEventData };

package/dist/core/entities/event/sanitize.mjs

@@ -11,7 +11,7 @@ import { isObject } from "@authup/kit";
 * objects and arrays are dropped outright, so a nested structure can never
 * smuggle a secret past the boundary (this subsumes a denylist: password,
 * client_secret, code, code_verifier, *token* etc. are simply never listed).
-* session_id / jti / revoked_session_id are opaque correlation ids, not PII.
+* sessionId / jti / revokedSessionId are opaque correlation ids, not PII.
 * name / use / status / enabled / force describe key & trust-anchor lifecycle
 * operations (issue #3269) — canonical identifiers and enum/flag metadata,
 * never material. kind is the MFA authenticator kind (totp/email/...).
@@ -21,18 +21,18 @@ import { isObject } from "@authup/kit";
 * re-checked against the diff secret denylist — the write boundary stays the
 * choke point even though buildEntityDiff pre-sanitizes.
 */ const DATA_KEY_ALLOW_LIST = [
-	"grant_type",
+	"grantType",
 	"scope",
-	"response_type",
+	"responseType",
 	"prompt",
 	"error",
-	"error_code",
+	"errorCode",
 	"reason",
-	"client_name",
-	"realm_name",
-	"session_id",
+	"clientName",
+	"realmName",
+	"sessionId",
 	"jti",
-	"revoked_session_id",
+	"revokedSessionId",
 	"name",
 	"use",
 	"status",

package/dist/core/entities/event/sanitize.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"sanitize.mjs","names":["isObject","EVENT_DIFF_SECRET_KEY_REGEX","DATA_KEY_ALLOW_LIST","DATA_VALUE_MAX_LENGTH","isDiffScalar","value","truncateDiffScalar","length","substring","sanitizeDiff","input","output","key","entry","Object","entries","test","next","previous","keys","sanitizeEventData","diff"],"sources":["../../../../src/core/entities/event/sanitize.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { isObject } from '@authup/kit';\nimport { EVENT_DIFF_SECRET_KEY_REGEX } from './diff.ts';\n\n/**\n * The central PII/credential write boundary for event context data.\n *\n * Allowlist-first: only these keys survive, and only with scalar values —\n * objects and arrays are dropped outright, so a nested structure can never\n * smuggle a secret past the boundary (this subsumes a denylist: password,\n * client_secret, code, code_verifier, *token* etc. are simply never listed).\n * session_id / jti / revoked_session_id are opaque correlation ids, not PII.\n * name / use / status / enabled / force describe key & trust-anchor lifecycle\n * operations (issue #3269) — canonical identifiers and enum/flag metadata,\n * never material. kind is the MFA authenticator kind (totp/email/...).\n *\n * The single structured exception is `diff` (entity-CRUD bridge): it survives\n * only as a one-level object of `{ next, previous }` scalar pairs, keys\n * re-checked against the diff secret denylist — the write boundary stays the\n * choke point even though buildEntityDiff pre-sanitizes.\n */\nconst DATA_KEY_ALLOW_LIST = [\n    'grant_type',\n    'scope',\n    'response_type',\n    'prompt',\n    'error',\n    'error_code',\n    'reason',\n    'client_name',\n    'realm_name',\n    'session_id',\n    'jti',\n    'revoked_session_id',\n    'name',\n    'use',\n    'status',\n    'enabled',\n    'force',\n    'kind',\n] as const;\n\nconst DATA_VALUE_MAX_LENGTH = 512;\n\nfunction isDiffScalar(value: unknown): value is string | number | boolean | null {\n    return value === null ||\n        typeof value === 'string' ||\n        typeof value === 'number' ||\n        typeof value === 'boolean';\n}\n\nfunction truncateDiffScalar(\n    value: string | number | boolean | null,\n): string | number | boolean | null {\n    if (typeof value === 'string' && value.length > DATA_VALUE_MAX_LENGTH) {\n        return value.substring(0, DATA_VALUE_MAX_LENGTH);\n    }\n\n    return value;\n}\n\nfunction sanitizeDiff(input: unknown): Record<string, any> | null {\n    if (!isObject(input)) {\n        return null;\n    }\n\n    const output: Record<string, any> = {};\n\n    for (const [key, entry] of Object.entries(input)) {\n        if (EVENT_DIFF_SECRET_KEY_REGEX.test(key)) {\n            continue;\n        }\n\n        if (!isObject(entry)) {\n            continue;\n        }\n\n        const { next, previous } = entry;\n        if (!isDiffScalar(next) || !isDiffScalar(previous)) {\n            continue;\n        }\n\n        output[key] = {\n            next: truncateDiffScalar(next),\n            previous: truncateDiffScalar(previous),\n        };\n    }\n\n    if (Object.keys(output).length === 0) {\n        return null;\n    }\n\n    return output;\n}\n\nexport function sanitizeEventData(\n    input?: Record<string, any> | null,\n): Record<string, any> | null {\n    if (!input) {\n        return null;\n    }\n\n    const output: Record<string, any> = {};\n\n    for (const key of DATA_KEY_ALLOW_LIST) {\n        const value = input[key];\n\n        if (typeof value === 'string') {\n            output[key] = value.length > DATA_VALUE_MAX_LENGTH ?\n                value.substring(0, DATA_VALUE_MAX_LENGTH) :\n                value;\n        } else if (typeof value === 'number' || typeof value === 'boolean') {\n            output[key] = value;\n        }\n    }\n\n    const diff = sanitizeDiff(input.diff);\n    if (diff) {\n        output.diff = diff;\n    }\n\n    if (Object.keys(output).length === 0) {\n        return null;\n    }\n\n    return output;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;GA2BA,MAAME,sBAAsB;CACxB;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;;AAGJ,MAAMC,wBAAwB;AAE9B,SAASC,aAAaC,OAAc;CAChC,OAAOA,UAAU,QACb,OAAOA,UAAU,YACjB,OAAOA,UAAU,YACjB,OAAOA,UAAU;AACzB;AAEA,SAASC,mBACLD,OAAuC;CAEvC,IAAI,OAAOA,UAAU,YAAYA,MAAME,SAASJ,uBAC5C,OAAOE,MAAMG,UAAU,GAAGL,qBAAAA;CAG9B,OAAOE;AACX;AAEA,SAASI,aAAaC,OAAc;CAChC,IAAI,CAACV,SAASU,KAAAA,GACV,OAAO;CAGX,MAAMC,SAA8B,CAAC;CAErC,KAAK,MAAM,CAACC,KAAKC,UAAUC,OAAOC,QAAQL,KAAAA,GAAQ;EAC9C,IAAIT,4BAA4Be,KAAKJ,GAAAA,GACjC;EAGJ,IAAI,CAACZ,SAASa,KAAAA,GACV;EAGJ,MAAM,EAAEI,MAAMC,aAAaL;EAC3B,IAAI,CAACT,aAAaa,IAAAA,KAAS,CAACb,aAAac,QAAAA,GACrC;EAGJP,OAAOC,OAAO;GACVK,MAAMX,mBAAmBW,IAAAA;GACzBC,UAAUZ,mBAAmBY,QAAAA;EACjC;CACJ;CAEA,IAAIJ,OAAOK,KAAKR,MAAAA,CAAAA,CAAQJ,WAAW,GAC/B,OAAO;CAGX,OAAOI;AACX;AAEA,SAAgBS,kBACZV,OAAkC;CAElC,IAAI,CAACA,OACD,OAAO;CAGX,MAAMC,SAA8B,CAAC;CAErC,KAAK,MAAMC,OAAOV,qBAAqB;EACnC,MAAMG,QAAQK,MAAME;EAEpB,IAAI,OAAOP,UAAU,UACjBM,OAAOC,OAAOP,MAAME,SAASJ,wBACzBE,MAAMG,UAAU,GAAGL,qBAAAA,IACnBE;OACD,IAAI,OAAOA,UAAU,YAAY,OAAOA,UAAU,WACrDM,OAAOC,OAAOP;CAEtB;CAEA,MAAMgB,OAAOZ,aAAaC,MAAMW,IAAI;CACpC,IAAIA,MACAV,OAAOU,OAAOA;CAGlB,IAAIP,OAAOK,KAAKR,MAAAA,CAAAA,CAAQJ,WAAW,GAC/B,OAAO;CAGX,OAAOI;AACX"}
+{"version":3,"file":"sanitize.mjs","names":["isObject","EVENT_DIFF_SECRET_KEY_REGEX","DATA_KEY_ALLOW_LIST","DATA_VALUE_MAX_LENGTH","isDiffScalar","value","truncateDiffScalar","length","substring","sanitizeDiff","input","output","key","entry","Object","entries","test","next","previous","keys","sanitizeEventData","diff"],"sources":["../../../../src/core/entities/event/sanitize.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { isObject } from '@authup/kit';\nimport { EVENT_DIFF_SECRET_KEY_REGEX } from './diff.ts';\n\n/**\n * The central PII/credential write boundary for event context data.\n *\n * Allowlist-first: only these keys survive, and only with scalar values —\n * objects and arrays are dropped outright, so a nested structure can never\n * smuggle a secret past the boundary (this subsumes a denylist: password,\n * client_secret, code, code_verifier, *token* etc. are simply never listed).\n * sessionId / jti / revokedSessionId are opaque correlation ids, not PII.\n * name / use / status / enabled / force describe key & trust-anchor lifecycle\n * operations (issue #3269) — canonical identifiers and enum/flag metadata,\n * never material. kind is the MFA authenticator kind (totp/email/...).\n *\n * The single structured exception is `diff` (entity-CRUD bridge): it survives\n * only as a one-level object of `{ next, previous }` scalar pairs, keys\n * re-checked against the diff secret denylist — the write boundary stays the\n * choke point even though buildEntityDiff pre-sanitizes.\n */\nconst DATA_KEY_ALLOW_LIST = [\n    'grantType',\n    'scope',\n    'responseType',\n    'prompt',\n    'error',\n    'errorCode',\n    'reason',\n    'clientName',\n    'realmName',\n    'sessionId',\n    'jti',\n    'revokedSessionId',\n    'name',\n    'use',\n    'status',\n    'enabled',\n    'force',\n    'kind',\n] as const;\n\nconst DATA_VALUE_MAX_LENGTH = 512;\n\nfunction isDiffScalar(value: unknown): value is string | number | boolean | null {\n    return value === null ||\n        typeof value === 'string' ||\n        typeof value === 'number' ||\n        typeof value === 'boolean';\n}\n\nfunction truncateDiffScalar(\n    value: string | number | boolean | null,\n): string | number | boolean | null {\n    if (typeof value === 'string' && value.length > DATA_VALUE_MAX_LENGTH) {\n        return value.substring(0, DATA_VALUE_MAX_LENGTH);\n    }\n\n    return value;\n}\n\nfunction sanitizeDiff(input: unknown): Record<string, any> | null {\n    if (!isObject(input)) {\n        return null;\n    }\n\n    const output: Record<string, any> = {};\n\n    for (const [key, entry] of Object.entries(input)) {\n        if (EVENT_DIFF_SECRET_KEY_REGEX.test(key)) {\n            continue;\n        }\n\n        if (!isObject(entry)) {\n            continue;\n        }\n\n        const { next, previous } = entry;\n        if (!isDiffScalar(next) || !isDiffScalar(previous)) {\n            continue;\n        }\n\n        output[key] = {\n            next: truncateDiffScalar(next),\n            previous: truncateDiffScalar(previous),\n        };\n    }\n\n    if (Object.keys(output).length === 0) {\n        return null;\n    }\n\n    return output;\n}\n\nexport function sanitizeEventData(\n    input?: Record<string, any> | null,\n): Record<string, any> | null {\n    if (!input) {\n        return null;\n    }\n\n    const output: Record<string, any> = {};\n\n    for (const key of DATA_KEY_ALLOW_LIST) {\n        const value = input[key];\n\n        if (typeof value === 'string') {\n            output[key] = value.length > DATA_VALUE_MAX_LENGTH ?\n                value.substring(0, DATA_VALUE_MAX_LENGTH) :\n                value;\n        } else if (typeof value === 'number' || typeof value === 'boolean') {\n            output[key] = value;\n        }\n    }\n\n    const diff = sanitizeDiff(input.diff);\n    if (diff) {\n        output.diff = diff;\n    }\n\n    if (Object.keys(output).length === 0) {\n        return null;\n    }\n\n    return output;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;GA2BA,MAAME,sBAAsB;CACxB;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;;AAGJ,MAAMC,wBAAwB;AAE9B,SAASC,aAAaC,OAAc;CAChC,OAAOA,UAAU,QACb,OAAOA,UAAU,YACjB,OAAOA,UAAU,YACjB,OAAOA,UAAU;AACzB;AAEA,SAASC,mBACLD,OAAuC;CAEvC,IAAI,OAAOA,UAAU,YAAYA,MAAME,SAASJ,uBAC5C,OAAOE,MAAMG,UAAU,GAAGL,qBAAAA;CAG9B,OAAOE;AACX;AAEA,SAASI,aAAaC,OAAc;CAChC,IAAI,CAACV,SAASU,KAAAA,GACV,OAAO;CAGX,MAAMC,SAA8B,CAAC;CAErC,KAAK,MAAM,CAACC,KAAKC,UAAUC,OAAOC,QAAQL,KAAAA,GAAQ;EAC9C,IAAIT,4BAA4Be,KAAKJ,GAAAA,GACjC;EAGJ,IAAI,CAACZ,SAASa,KAAAA,GACV;EAGJ,MAAM,EAAEI,MAAMC,aAAaL;EAC3B,IAAI,CAACT,aAAaa,IAAAA,KAAS,CAACb,aAAac,QAAAA,GACrC;EAGJP,OAAOC,OAAO;GACVK,MAAMX,mBAAmBW,IAAAA;GACzBC,UAAUZ,mBAAmBY,QAAAA;EACjC;CACJ;CAEA,IAAIJ,OAAOK,KAAKR,MAAAA,CAAAA,CAAQJ,WAAW,GAC/B,OAAO;CAGX,OAAOI;AACX;AAEA,SAAgBS,kBACZV,OAAkC;CAElC,IAAI,CAACA,OACD,OAAO;CAGX,MAAMC,SAA8B,CAAC;CAErC,KAAK,MAAMC,OAAOV,qBAAqB;EACnC,MAAMG,QAAQK,MAAME;EAEpB,IAAI,OAAOP,UAAU,UACjBM,OAAOC,OAAOP,MAAME,SAASJ,wBACzBE,MAAMG,UAAU,GAAGL,qBAAAA,IACnBE;OACD,IAAI,OAAOA,UAAU,YAAY,OAAOA,UAAU,WACrDM,OAAOC,OAAOP;CAEtB;CAEA,MAAMgB,OAAOZ,aAAaC,MAAMW,IAAI;CACpC,IAAIA,MACAV,OAAOU,OAAOA;CAGlB,IAAIP,OAAOK,KAAKR,MAAAA,CAAAA,CAAQJ,WAAW,GAC/B,OAAO;CAGX,OAAOI;AACX"}

package/dist/core/entities/event/schema.d.ts

@@ -0,0 +1,3 @@
+import type { Event } from '@authup/core-kit';
+export declare const eventSchema: import("@rapiq/core").Schema<Event, any>;
+//# sourceMappingURL=schema.d.ts.map

package/dist/core/entities/event/schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/event/schema.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAG9C,eAAO,MAAM,WAAW,0CA4CtB,CAAC"}

package/dist/core/entities/event/schema.mjs

@@ -0,0 +1,51 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+import { EntityType } from "@authup/core-kit";
+import { defineSchema } from "@rapiq/core";
+//#region src/core/entities/event/schema.ts
+const eventSchema = defineSchema({
+	name: EntityType.EVENT,
+	fields: { allowed: [
+		"id",
+		"scope",
+		"name",
+		"refType",
+		"refId",
+		"clientId",
+		"actorType",
+		"actorId",
+		"actorName",
+		"requestPath",
+		"requestMethod",
+		"requestIpAddress",
+		"requestUserAgent",
+		"realmId",
+		"data",
+		"expiring",
+		"expiresAt",
+		"createdAt"
+	] },
+	filters: { allowed: [
+		"id",
+		"scope",
+		"name",
+		"refType",
+		"refId",
+		"clientId",
+		"actorType",
+		"actorId",
+		"actorName",
+		"requestIpAddress",
+		"realmId",
+		"expiring",
+		"createdAt"
+	] },
+	relations: { allowed: [] },
+	sort: { allowed: ["createdAt"] },
+	pagination: { maxLimit: 50 }
+});
+//#endregion
+export { eventSchema };
+
+//# sourceMappingURL=schema.mjs.map

package/dist/core/entities/event/schema.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.mjs","names":["defineSchema","EntityType","eventSchema","name","EVENT","fields","allowed","filters","relations","sort","pagination","maxLimit"],"sources":["../../../../src/core/entities/event/schema.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { defineSchema } from '@rapiq/core';\nimport type { Event } from '@authup/core-kit';\nimport { EntityType } from '@authup/core-kit';\n\nexport const eventSchema = defineSchema<Event>({\n    name: EntityType.EVENT,\n    fields: {\n        allowed: [\n            'id',\n            'scope',\n            'name',\n            'refType',\n            'refId',\n            'clientId',\n            'actorType',\n            'actorId',\n            'actorName',\n            'requestPath',\n            'requestMethod',\n            'requestIpAddress',\n            'requestUserAgent',\n            'realmId',\n            'data',\n            'expiring',\n            'expiresAt',\n            'createdAt',\n        ],\n    },\n    filters: {\n        allowed: [\n            'id',\n            'scope',\n            'name',\n            'refType',\n            'refId',\n            'clientId',\n            'actorType',\n            'actorId',\n            'actorName',\n            'requestIpAddress',\n            'realmId',\n            'expiring',\n            'createdAt',\n        ], \n    },\n    relations: { allowed: [] },\n    sort: { allowed: ['createdAt'] },\n    pagination: { maxLimit: 50 },\n});\n"],"mappings":";;;;;;AAWA,MAAaE,cAAcF,aAAoB;CAC3CG,MAAMF,WAAWG;CACjBC,QAAQ,EACJC,SAAS;EACL;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;GAER;CACAC,SAAS,EACLD,SAAS;EACL;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;GAER;CACAE,WAAW,EAAEF,SAAS,CAAA,EAAG;CACzBG,MAAM,EAAEH,SAAS,CAAC,WAAA,EAAa;CAC/BI,YAAY,EAAEC,UAAU,GAAG;AAC/B,CAAA"}

package/dist/core/entities/event/service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/event/service.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAE9C,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAC3D,OAAO,KAAK,EAAE,YAAY,EAAE,8BAA8B,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAG/F,OAAO,KAAK,EACR,mBAAmB,EACnB,gBAAgB,EAChB,mBAAmB,EACnB,uBAAuB,EACvB,gBAAgB,EAChB,aAAa,EAChB,MAAM,YAAY,CAAC;AAEpB,MAAM,MAAM,mBAAmB,GAAG;IAC9B,UAAU,EAAE,gBAAgB,CAAC;IAC7B,OAAO,CAAC,EAAE,mBAAmB,CAAC;IAC9B,MAAM,CAAC,EAAE,MAAM,CAAC;CACnB,CAAC;AAIF,qBAAa,YAAa,SAAQ,qBAAsB,YAAW,aAAa;IAC5E,SAAS,CAAC,UAAU,EAAE,gBAAgB,CAAC;IAEvC,SAAS,CAAC,OAAO,EAAE,mBAAmB,CAAC;IAEvC,SAAS,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;gBAEd,GAAG,EAAE,mBAAmB;IAQpC,SAAS,CAAC,SAAS,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO;cAOhD,YAAY,CAAC,KAAK,EAAE,YAAY,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC;cAmB3E,qBAAqB,CAAC,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,mBAAmB,GAAG,SAAS,CAAC;IA8B9F,MAAM,CAAC,KAAK,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC;IAqD9C,OAAO,CACT,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC1B,KAAK,EAAE,YAAY,EACnB,OAAO,GAAE,uBAA4B,GACtC,OAAO,CAAC,8BAA8B,CAAC,KAAK,CAAC,CAAC;IA2D3C,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,OAAO,GAAE,uBAA4B,GAAG,OAAO,CAAC,KAAK,CAAC;CAmBvG"}
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/event/service.ts"],"names":[],"mappings":"AAgBA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAE9C,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAC3D,OAAO,KAAK,EAAE,YAAY,EAAE,8BAA8B,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAG/F,OAAO,KAAK,EACR,mBAAmB,EACnB,gBAAgB,EAChB,mBAAmB,EACnB,uBAAuB,EACvB,gBAAgB,EAChB,aAAa,EAChB,MAAM,YAAY,CAAC;AAIpB,MAAM,MAAM,mBAAmB,GAAG;IAC9B,UAAU,EAAE,gBAAgB,CAAC;IAC7B,OAAO,CAAC,EAAE,mBAAmB,CAAC;IAC9B,MAAM,CAAC,EAAE,MAAM,CAAC;CACnB,CAAC;AAIF,qBAAa,YAAa,SAAQ,qBAAsB,YAAW,aAAa;IAC5E,SAAS,CAAC,UAAU,EAAE,gBAAgB,CAAC;IAEvC,SAAS,CAAC,OAAO,EAAE,mBAAmB,CAAC;IAEvC,SAAS,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;gBAEd,GAAG,EAAE,mBAAmB;IAQpC,SAAS,CAAC,SAAS,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO;cAOhD,YAAY,CAAC,KAAK,EAAE,YAAY,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC;cAmB3E,qBAAqB,CAAC,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,mBAAmB,GAAG,SAAS,CAAC;IA8B9F,MAAM,CAAC,KAAK,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC;IAqD9C,OAAO,CACT,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC1B,KAAK,EAAE,YAAY,EACnB,OAAO,GAAE,uBAA4B,GACtC,OAAO,CAAC,8BAA8B,CAAC,KAAK,CAAC,CAAC;IAsF3C,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,OAAO,GAAE,uBAA4B,GAAG,OAAO,CAAC,KAAK,CAAC;CAmBvG"}

package/dist/core/entities/event/service.mjs

@@ -1,12 +1,16 @@
 import "node:path";
 import "node:url";
 import.meta.url;
+import { eventSchema } from "./schema.mjs";
+import { appendQueryConditions, decodeQuery } from "../../query/module.mjs";
+import "../../query/index.mjs";
 import "./constants.mjs";
 import { sanitizeEventData } from "./sanitize.mjs";
 import { PermissionName } from "@authup/core-kit";
 import { AbstractEntityService } from "@authup/server-kit";
 import { BuiltInPolicyType, definePolicyData } from "@authup/access";
 import { EntityNotFoundError } from "@authup/errors";
+import { and, eq, inArray, or } from "@rapiq/core";
 import { randomUUID } from "node:crypto";
 //#region src/core/entities/event/service.ts
 const DAY_IN_MS = 864e5;
@@ -21,7 +25,7 @@ var EventService = class extends AbstractEntityService {
 		this.logger = ctx.logger;
 	}
 	isOwnedBy(entity, actor) {
-		return !!actor.identity && !!entity.actor_id && entity.actor_id === actor.identity.data.id && entity.actor_type === actor.identity.type;
+		return !!actor.identity && !!entity.actorId && entity.actorId === actor.identity.data.id && entity.actorType === actor.identity.type;
 	}
 	async canReadRealm(actor, realmId) {
 		try {
@@ -60,12 +64,12 @@ var EventService = class extends AbstractEntityService {
 		this.logger?.info(`audit: ${input.scope}.${input.name}`, {
 			scope: input.scope,
 			name: input.name,
-			ref_type: input.refType ?? null,
-			ref_id: input.refId ?? null,
-			client_id: input.clientId ?? null,
-			actor_type: input.actorType ?? null,
-			actor_id: input.actorId ?? null,
-			realm_id: input.realmId ?? null,
+			refType: input.refType ?? null,
+			refId: input.refId ?? null,
+			clientId: input.clientId ?? null,
+			actorType: input.actorType ?? null,
+			actorId: input.actorId ?? null,
+			realmId: input.realmId ?? null,
 			...data ? { data } : {}
 		});
 		if (this.options.enabled === false) return;
@@ -75,20 +79,20 @@ var EventService = class extends AbstractEntityService {
 				id: randomUUID(),
 				scope: input.scope,
 				name: input.name,
-				ref_type: truncate(input.refType, 64),
-				ref_id: truncate(input.refId, 64),
-				client_id: input.clientId ?? null,
-				actor_type: input.actorType ?? null,
-				actor_id: input.actorId ?? null,
-				actor_name: truncate(input.actorName, 128),
-				request_path: truncate(input.requestPath, 256),
-				request_method: truncate(input.requestMethod, 10),
-				request_ip_address: truncate(input.requestIpAddress, 45),
-				request_user_agent: truncate(input.requestUserAgent, 512),
-				realm_id: input.realmId ?? null,
+				refType: truncate(input.refType, 64),
+				refId: truncate(input.refId, 64),
+				clientId: input.clientId ?? null,
+				actorType: input.actorType ?? null,
+				actorId: input.actorId ?? null,
+				actorName: truncate(input.actorName, 128),
+				requestPath: truncate(input.requestPath, 256),
+				requestMethod: truncate(input.requestMethod, 10),
+				requestIpAddress: truncate(input.requestIpAddress, 45),
+				requestUserAgent: truncate(input.requestUserAgent, 512),
+				realmId: input.realmId ?? null,
 				data,
 				expiring: retentionDays > 0,
-				expires_at: retentionDays > 0 ? new Date(Date.now() + retentionDays * DAY_IN_MS).toISOString() : null
+				expiresAt: retentionDays > 0 ? new Date(Date.now() + retentionDays * DAY_IN_MS).toISOString() : null
 			});
 			await this.repository.save(entity);
 		} catch {
@@ -96,6 +100,10 @@ var EventService = class extends AbstractEntityService {
 		}
 	}
 	async getMany(query, actor, options = {}) {
+		const parsed = await decodeQuery(query, {
+			schema: eventSchema,
+			actor
+		});
 		let canReadAll = true;
 		try {
 			await actor.permissionEvaluator.preEvaluate({ name: PermissionName.EVENT_READ });
@@ -103,15 +111,23 @@ var EventService = class extends AbstractEntityService {
 			if (!actor.identity) throw e;
 			canReadAll = false;
 		}
-		if (!canReadAll) return this.repository.findMany(query, {
+		if (!canReadAll) return this.repository.findMany(parsed, {
 			owner: {
 				actorId: actor.identity.data.id,
 				actorType: actor.identity.type
 			},
 			...options.realmId ? { realmId: options.realmId } : {}
 		});
+		const compiled = await actor.permissionEvaluator.compile({ name: PermissionName.EVENT_READ });
+		if (compiled.verdict !== "post") {
+			const ownership = actor.identity ? and(eq("actorId", actor.identity.data.id), eq("actorType", actor.identity.type)) : null;
+			let scoped = parsed;
+			if (compiled.verdict === "deny") scoped = appendQueryConditions(parsed, ownership ?? inArray("id", []));
+			else if (compiled.verdict === "conditional") scoped = appendQueryConditions(parsed, ownership ? or(ownership, compiled.condition) : compiled.condition);
+			return this.repository.findMany(scoped, { ...options.realmId ? { realmId: options.realmId } : {} });
+		}
 		const visibility = await this.resolveReadVisibility(actor);
-		const { data: entities, meta } = await this.repository.findMany(query, {
+		const { data: entities, meta } = await this.repository.findMany(parsed, {
 			...options.realmId ? { realmId: options.realmId } : {},
 			...visibility ? { visibility } : {}
 		});
@@ -144,7 +160,7 @@ var EventService = class extends AbstractEntityService {
 	}
 	async getOne(id, actor, options = {}) {
 		const entity = await this.repository.findOneById(id);
-		if (!entity || options.realmId && entity.realm_id !== options.realmId) throw new EntityNotFoundError();
+		if (!entity || options.realmId && entity.realmId !== options.realmId) throw new EntityNotFoundError();
 		if (!this.isOwnedBy(entity, actor)) {
 			await actor.permissionEvaluator.preEvaluate({ name: PermissionName.EVENT_READ });
 			await actor.permissionEvaluator.evaluate({

package/dist/core/entities/event/service.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"service.mjs","names":["randomUUID","BuiltInPolicyType","definePolicyData","PermissionName","EntityNotFoundError","AbstractEntityService","EVENT_LOG_RETENTION_DAYS_DEFAULT","sanitizeEventData","DAY_IN_MS","EventService","repository","options","logger","ctx","isOwnedBy","entity","actor","identity","actor_id","data","id","actor_type","type","canReadRealm","realmId","permissionEvaluator","evaluate","name","EVENT_READ","REALM_MATCH","policiesIncluded","COMPOSITE","PERMISSION_BINDING","resolveReadVisibility","actorRealmId","getActorRealmId","foreignRealmId","undefined","realmIds","push","owner","actorId","actorType","record","input","info","scope","ref_type","refType","ref_id","refId","client_id","clientId","realm_id","enabled","retentionDays","create","truncate","actor_name","actorName","request_path","requestPath","request_method","requestMethod","request_ip_address","requestIpAddress","request_user_agent","requestUserAgent","expiring","expires_at","Date","now","toISOString","save","warn","getMany","query","canReadAll","preEvaluate","e","findMany","visibility","entities","meta","ATTRIBUTES","resourceRealmMatch","total","length","getOne","findOneById","value","maxLength","substring"],"sources":["../../../../src/core/entities/event/service.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { randomUUID } from 'node:crypto';\nimport { BuiltInPolicyType, definePolicyData } from '@authup/access';\nimport { PermissionName } from '@authup/core-kit';\nimport type { Event } from '@authup/core-kit';\nimport { EntityNotFoundError } from '@authup/errors';\nimport { AbstractEntityService } from '@authup/server-kit';\nimport type { ActorContext, EntityRepositoryFindManyResult, Logger } from '@authup/server-kit';\nimport { EVENT_LOG_RETENTION_DAYS_DEFAULT } from './constants.ts';\nimport { sanitizeEventData } from './sanitize.ts';\nimport type {\n    EventReadVisibility,\n    EventRecordInput,\n    EventServiceOptions,\n    EventServiceReadOptions,\n    IEventRepository,\n    IEventService,\n} from './types.ts';\n\nexport type EventServiceContext = {\n    repository: IEventRepository,\n    options?: EventServiceOptions,\n    logger?: Logger,\n};\n\nconst DAY_IN_MS = 86_400_000;\n\nexport class EventService extends AbstractEntityService implements IEventService {\n    protected repository: IEventRepository;\n\n    protected options: EventServiceOptions;\n\n    protected logger?: Logger;\n\n    constructor(ctx: EventServiceContext) {\n        super();\n\n        this.repository = ctx.repository;\n        this.options = ctx.options ?? {};\n        this.logger = ctx.logger;\n    }\n\n    protected isOwnedBy(entity: Event, actor: ActorContext): boolean {\n        return !!actor.identity &&\n            !!entity.actor_id &&\n            entity.actor_id === actor.identity.data.id &&\n            entity.actor_type === actor.identity.type;\n    }\n\n    protected async canReadRealm(actor: ActorContext, realmId: string | null): Promise<boolean> {\n        try {\n            await actor.permissionEvaluator.evaluate({\n                name: PermissionName.EVENT_READ,\n                data: definePolicyData({ [BuiltInPolicyType.REALM_MATCH]: realmId }),\n                options: {\n                    policiesIncluded: [\n                        BuiltInPolicyType.COMPOSITE,\n                        BuiltInPolicyType.PERMISSION_BINDING,\n                        BuiltInPolicyType.REALM_MATCH,\n                    ],\n                },\n            });\n            return true;\n        } catch {\n            return false;\n        }\n    }\n\n    protected async resolveReadVisibility(actor: ActorContext): Promise<EventReadVisibility | undefined> {\n        const actorRealmId = this.getActorRealmId(actor);\n        let foreignRealmId = randomUUID();\n        while (foreignRealmId === actorRealmId) {\n            foreignRealmId = randomUUID();\n        }\n\n        if (await this.canReadRealm(actor, foreignRealmId)) {\n            return undefined;\n        }\n\n        const realmIds: Array<string | null> = [];\n        if (actorRealmId && await this.canReadRealm(actor, actorRealmId)) {\n            realmIds.push(actorRealmId);\n        }\n        if (await this.canReadRealm(actor, null)) {\n            realmIds.push(null);\n        }\n\n        return {\n            realmIds,\n            ...(actor.identity ? {\n                owner: {\n                    actorId: actor.identity.data.id,\n                    actorType: actor.identity.type,\n                },\n            } : {}),\n        };\n    }\n\n    async record(input: EventRecordInput): Promise<void> {\n        const data = sanitizeEventData(input.data);\n\n        // complementary structured log line — fires even when persistence is\n        // disabled, so a SIEM/Loki pipeline can pick the events up for free.\n        this.logger?.info(`audit: ${input.scope}.${input.name}`, {\n            scope: input.scope,\n            name: input.name,\n            ref_type: input.refType ?? null,\n            ref_id: input.refId ?? null,\n            client_id: input.clientId ?? null,\n            actor_type: input.actorType ?? null,\n            actor_id: input.actorId ?? null,\n            realm_id: input.realmId ?? null,\n            ...(data ? { data } : {}),\n        });\n\n        if (this.options.enabled === false) {\n            return;\n        }\n\n        try {\n            const retentionDays = input.retentionDays ?? this.options.retentionDays ?? EVENT_LOG_RETENTION_DAYS_DEFAULT;\n\n            const entity = this.repository.create({\n                id: randomUUID(),\n                scope: input.scope,\n                name: input.name,\n                ref_type: truncate(input.refType, 64),\n                ref_id: truncate(input.refId, 64),\n                client_id: input.clientId ?? null,\n                actor_type: input.actorType ?? null,\n                actor_id: input.actorId ?? null,\n                actor_name: truncate(input.actorName, 128),\n                request_path: truncate(input.requestPath, 256),\n                request_method: truncate(input.requestMethod, 10),\n                request_ip_address: truncate(input.requestIpAddress, 45),\n                request_user_agent: truncate(input.requestUserAgent, 512),\n                realm_id: input.realmId ?? null,\n                data,\n                expiring: retentionDays > 0,\n                expires_at: retentionDays > 0 ?\n                    new Date(Date.now() + (retentionDays * DAY_IN_MS)).toISOString() :\n                    null,\n            });\n\n            await this.repository.save(entity);\n        } catch {\n            // an audit write failure must never fail the originating operation\n            this.logger?.warn(`Recording the audit event ${input.scope}.${input.name} failed.`);\n        }\n    }\n\n    async getMany(\n        query: Record<string, any>,\n        actor: ActorContext,\n        options: EventServiceReadOptions = {},\n    ): Promise<EntityRepositoryFindManyResult<Event>> {\n        let canReadAll = true;\n        try {\n            await actor.permissionEvaluator.preEvaluate({ name: PermissionName.EVENT_READ });\n        } catch (e) {\n            if (!actor.identity) {\n                throw e;\n            }\n            canReadAll = false;\n        }\n\n        if (!canReadAll) {\n            // self-service: only the actor's own rows (\"my sign-in history\")\n            return this.repository.findMany(query, {\n                owner: {\n                    actorId: actor.identity!.data.id,\n                    actorType: actor.identity!.type,\n                },\n                ...(options.realmId ? { realmId: options.realmId } : {}),\n            });\n        }\n\n        const visibility = await this.resolveReadVisibility(actor);\n        const { data: entities, meta } = await this.repository.findMany(query, {\n            ...(options.realmId ? { realmId: options.realmId } : {}),\n            ...(visibility ? { visibility } : {}),\n        });\n\n        const data: Event[] = [];\n\n        for (const entity of entities) {\n            if (this.isOwnedBy(entity, actor)) {\n                data.push(entity);\n                continue;\n            }\n\n            try {\n                await actor.permissionEvaluator.evaluate({\n                    name: PermissionName.EVENT_READ,\n                    data: definePolicyData({\n                        [BuiltInPolicyType.ATTRIBUTES]: entity,\n                        ...this.resourceRealmMatch(entity),\n                    }),\n                });\n                data.push(entity);\n            } catch {\n                continue;\n            }\n        }\n\n        return {\n            data,\n            meta: {\n                ...meta,\n                total: meta.total - (entities.length - data.length),\n            },\n        };\n    }\n\n    async getOne(id: string, actor: ActorContext, options: EventServiceReadOptions = {}): Promise<Event> {\n        const entity = await this.repository.findOneById(id);\n        if (!entity || (options.realmId && entity.realm_id !== options.realmId)) {\n            throw new EntityNotFoundError();\n        }\n\n        if (!this.isOwnedBy(entity, actor)) {\n            await actor.permissionEvaluator.preEvaluate({ name: PermissionName.EVENT_READ });\n            await actor.permissionEvaluator.evaluate({\n                name: PermissionName.EVENT_READ,\n                data: definePolicyData({\n                    [BuiltInPolicyType.ATTRIBUTES]: entity,\n                    ...this.resourceRealmMatch(entity),\n                }),\n            });\n        }\n\n        return entity;\n    }\n}\n\nfunction truncate(value: string | null | undefined, maxLength: number): string | null {\n    if (typeof value !== 'string') {\n        return null;\n    }\n\n    if (value.length <= maxLength) {\n        return value;\n    }\n\n    return value.substring(0, maxLength);\n}\n"],"mappings":";;;;;;;;;;;AA+BA,MAAMQ,YAAY;AAElB,IAAaC,eAAb,cAAkCJ,sBAAAA;CACpBK;CAEAC;CAEAC;CAEV,YAAYC,KAA0B;EAClC,MAAK;EAEL,KAAKH,aAAaG,IAAIH;EACtB,KAAKC,UAAUE,IAAIF,WAAW,CAAC;EAC/B,KAAKC,SAASC,IAAID;CACtB;CAEUE,UAAUC,QAAeC,OAA8B;EAC7D,OAAO,CAAC,CAACA,MAAMC,YACX,CAAC,CAACF,OAAOG,YACTH,OAAOG,aAAaF,MAAMC,SAASE,KAAKC,MACxCL,OAAOM,eAAeL,MAAMC,SAASK;CAC7C;CAEA,MAAgBC,aAAaP,OAAqBQ,SAA0C;EACxF,IAAI;GACA,MAAMR,MAAMS,oBAAoBC,SAAS;IACrCC,MAAMxB,eAAeyB;IACrBT,MAAMjB,iBAAiB,GAAGD,kBAAkB4B,cAAcL,QAAQ,CAAA;IAClEb,SAAS,EACLmB,kBAAkB;KACd7B,kBAAkB8B;KAClB9B,kBAAkB+B;KAClB/B,kBAAkB4B;MAE1B;GACJ,CAAA;GACA,OAAO;EACX,QAAQ;GACJ,OAAO;EACX;CACJ;CAEA,MAAgBI,sBAAsBjB,OAA+D;EACjG,MAAMkB,eAAe,KAAKC,gBAAgBnB,KAAAA;EAC1C,IAAIoB,iBAAiBpC,WAAAA;EACrB,OAAOoC,mBAAmBF,cACtBE,iBAAiBpC,WAAAA;EAGrB,IAAI,MAAM,KAAKuB,aAAaP,OAAOoB,cAAAA,GAC/B;EAGJ,MAAME,WAAiC,CAAA;EACvC,IAAIJ,gBAAgB,MAAM,KAAKX,aAAaP,OAAOkB,YAAAA,GAC/CI,SAASC,KAAKL,YAAAA;EAElB,IAAI,MAAM,KAAKX,aAAaP,OAAO,IAAA,GAC/BsB,SAASC,KAAK,IAAA;EAGlB,OAAO;GACHD;GACA,GAAItB,MAAMC,WAAW,EACjBuB,OAAO;IACHC,SAASzB,MAAMC,SAASE,KAAKC;IAC7BsB,WAAW1B,MAAMC,SAASK;GAC9B,EACJ,IAAI,CAAC;EACT;CACJ;CAEA,MAAMqB,OAAOC,OAAwC;EACjD,MAAMzB,OAAOZ,kBAAkBqC,MAAMzB,IAAI;EAIzC,KAAKP,QAAQiC,KAAK,UAAUD,MAAME,MAAM,GAAGF,MAAMjB,QAAQ;GACrDmB,OAAOF,MAAME;GACbnB,MAAMiB,MAAMjB;GACZoB,UAAUH,MAAMI,WAAW;GAC3BC,QAAQL,MAAMM,SAAS;GACvBC,WAAWP,MAAMQ,YAAY;GAC7B/B,YAAYuB,MAAMF,aAAa;GAC/BxB,UAAU0B,MAAMH,WAAW;GAC3BY,UAAUT,MAAMpB,WAAW;GAC3B,GAAIL,OAAO,EAAEA,KAAK,IAAI,CAAC;EAC3B,CAAA;EAEA,IAAI,KAAKR,QAAQ2C,YAAY,OACzB;EAGJ,IAAI;GACA,MAAMC,gBAAgBX,MAAMW,iBAAiB,KAAK5C,QAAQ4C,iBAAAA;GAE1D,MAAMxC,SAAS,KAAKL,WAAW8C,OAAO;IAClCpC,IAAIpB,WAAAA;IACJ8C,OAAOF,MAAME;IACbnB,MAAMiB,MAAMjB;IACZoB,UAAUU,SAASb,MAAMI,SAAS,EAAA;IAClCC,QAAQQ,SAASb,MAAMM,OAAO,EAAA;IAC9BC,WAAWP,MAAMQ,YAAY;IAC7B/B,YAAYuB,MAAMF,aAAa;IAC/BxB,UAAU0B,MAAMH,WAAW;IAC3BiB,YAAYD,SAASb,MAAMe,WAAW,GAAA;IACtCC,cAAcH,SAASb,MAAMiB,aAAa,GAAA;IAC1CC,gBAAgBL,SAASb,MAAMmB,eAAe,EAAA;IAC9CC,oBAAoBP,SAASb,MAAMqB,kBAAkB,EAAA;IACrDC,oBAAoBT,SAASb,MAAMuB,kBAAkB,GAAA;IACrDd,UAAUT,MAAMpB,WAAW;IAC3BL;IACAiD,UAAUb,gBAAgB;IAC1Bc,YAAYd,gBAAgB,IACxB,IAAIe,KAAKA,KAAKC,IAAG,IAAMhB,gBAAgB/C,SAAAA,CAAAA,CAAYgE,YAAW,IAC9D;GACR,CAAA;GAEA,MAAM,KAAK9D,WAAW+D,KAAK1D,MAAAA;EAC/B,QAAQ;GAEJ,KAAKH,QAAQ8D,KAAK,6BAA6B9B,MAAME,MAAM,GAAGF,MAAMjB,KAAK,SAAS;EACtF;CACJ;CAEA,MAAMgD,QACFC,OACA5D,OACAL,UAAmC,CAAC,GACU;EAC9C,IAAIkE,aAAa;EACjB,IAAI;GACA,MAAM7D,MAAMS,oBAAoBqD,YAAY,EAAEnD,MAAMxB,eAAeyB,WAAW,CAAA;EAClF,SAASmD,GAAG;GACR,IAAI,CAAC/D,MAAMC,UACP,MAAM8D;GAEVF,aAAa;EACjB;EAEA,IAAI,CAACA,YAED,OAAO,KAAKnE,WAAWsE,SAASJ,OAAO;GACnCpC,OAAO;IACHC,SAASzB,MAAMC,SAAUE,KAAKC;IAC9BsB,WAAW1B,MAAMC,SAAUK;GAC/B;GACA,GAAIX,QAAQa,UAAU,EAAEA,SAASb,QAAQa,QAAQ,IAAI,CAAC;EAC1D,CAAA;EAGJ,MAAMyD,aAAa,MAAM,KAAKhD,sBAAsBjB,KAAAA;EACpD,MAAM,EAAEG,MAAM+D,UAAUC,SAAS,MAAM,KAAKzE,WAAWsE,SAASJ,OAAO;GACnE,GAAIjE,QAAQa,UAAU,EAAEA,SAASb,QAAQa,QAAQ,IAAI,CAAC;GACtD,GAAIyD,aAAa,EAAEA,WAAW,IAAI,CAAC;EACvC,CAAA;EAEA,MAAM9D,OAAgB,CAAA;EAEtB,KAAK,MAAMJ,UAAUmE,UAAU;GAC3B,IAAI,KAAKpE,UAAUC,QAAQC,KAAAA,GAAQ;IAC/BG,KAAKoB,KAAKxB,MAAAA;IACV;GACJ;GAEA,IAAI;IACA,MAAMC,MAAMS,oBAAoBC,SAAS;KACrCC,MAAMxB,eAAeyB;KACrBT,MAAMjB,iBAAiB;OAClBD,kBAAkBmF,aAAarE;MAChC,GAAG,KAAKsE,mBAAmBtE,MAAAA;KAC/B,CAAA;IACJ,CAAA;IACAI,KAAKoB,KAAKxB,MAAAA;GACd,QAAQ;IACJ;GACJ;EACJ;EAEA,OAAO;GACHI;GACAgE,MAAM;IACF,GAAGA;IACHG,OAAOH,KAAKG,SAASJ,SAASK,SAASpE,KAAKoE;GAChD;EACJ;CACJ;CAEA,MAAMC,OAAOpE,IAAYJ,OAAqBL,UAAmC,CAAC,GAAmB;EACjG,MAAMI,SAAS,MAAM,KAAKL,WAAW+E,YAAYrE,EAAAA;EACjD,IAAI,CAACL,UAAWJ,QAAQa,WAAWT,OAAOsC,aAAa1C,QAAQa,SAC3D,MAAM,IAAIpB,oBAAAA;EAGd,IAAI,CAAC,KAAKU,UAAUC,QAAQC,KAAAA,GAAQ;GAChC,MAAMA,MAAMS,oBAAoBqD,YAAY,EAAEnD,MAAMxB,eAAeyB,WAAW,CAAA;GAC9E,MAAMZ,MAAMS,oBAAoBC,SAAS;IACrCC,MAAMxB,eAAeyB;IACrBT,MAAMjB,iBAAiB;MAClBD,kBAAkBmF,aAAarE;KAChC,GAAG,KAAKsE,mBAAmBtE,MAAAA;IAC/B,CAAA;GACJ,CAAA;EACJ;EAEA,OAAOA;CACX;AACJ;AAEA,SAAS0C,SAASiC,OAAkCC,WAAiB;CACjE,IAAI,OAAOD,UAAU,UACjB,OAAO;CAGX,IAAIA,MAAMH,UAAUI,WAChB,OAAOD;CAGX,OAAOA,MAAME,UAAU,GAAGD,SAAAA;AAC9B"}
+{"version":3,"file":"service.mjs","names":["randomUUID","BuiltInPolicyType","definePolicyData","and","eq","inArray","or","PermissionName","EntityNotFoundError","AbstractEntityService","EVENT_LOG_RETENTION_DAYS_DEFAULT","sanitizeEventData","appendQueryConditions","decodeQuery","eventSchema","DAY_IN_MS","EventService","repository","options","logger","ctx","isOwnedBy","entity","actor","identity","actorId","data","id","actorType","type","canReadRealm","realmId","permissionEvaluator","evaluate","name","EVENT_READ","REALM_MATCH","policiesIncluded","COMPOSITE","PERMISSION_BINDING","resolveReadVisibility","actorRealmId","getActorRealmId","foreignRealmId","undefined","realmIds","push","owner","record","input","info","scope","refType","refId","clientId","enabled","retentionDays","create","truncate","actorName","requestPath","requestMethod","requestIpAddress","requestUserAgent","expiring","expiresAt","Date","now","toISOString","save","warn","getMany","query","parsed","schema","canReadAll","preEvaluate","e","findMany","compiled","compile","verdict","ownership","scoped","condition","visibility","entities","meta","ATTRIBUTES","resourceRealmMatch","total","length","getOne","findOneById","value","maxLength","substring"],"sources":["../../../../src/core/entities/event/service.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { randomUUID } from 'node:crypto';\nimport { BuiltInPolicyType, definePolicyData } from '@authup/access';\nimport {\n    and, \n    eq, \n    inArray, \n    or,\n} from '@rapiq/core';\nimport { PermissionName } from '@authup/core-kit';\nimport type { Event } from '@authup/core-kit';\nimport { EntityNotFoundError } from '@authup/errors';\nimport { AbstractEntityService } from '@authup/server-kit';\nimport type { ActorContext, EntityRepositoryFindManyResult, Logger } from '@authup/server-kit';\nimport { EVENT_LOG_RETENTION_DAYS_DEFAULT } from './constants.ts';\nimport { sanitizeEventData } from './sanitize.ts';\nimport type {\n    EventReadVisibility,\n    EventRecordInput,\n    EventServiceOptions,\n    EventServiceReadOptions,\n    IEventRepository,\n    IEventService,\n} from './types.ts';\nimport { appendQueryConditions, decodeQuery } from '../../query/index.ts';\nimport { eventSchema } from './schema.ts';\n\nexport type EventServiceContext = {\n    repository: IEventRepository,\n    options?: EventServiceOptions,\n    logger?: Logger,\n};\n\nconst DAY_IN_MS = 86_400_000;\n\nexport class EventService extends AbstractEntityService implements IEventService {\n    protected repository: IEventRepository;\n\n    protected options: EventServiceOptions;\n\n    protected logger?: Logger;\n\n    constructor(ctx: EventServiceContext) {\n        super();\n\n        this.repository = ctx.repository;\n        this.options = ctx.options ?? {};\n        this.logger = ctx.logger;\n    }\n\n    protected isOwnedBy(entity: Event, actor: ActorContext): boolean {\n        return !!actor.identity &&\n            !!entity.actorId &&\n            entity.actorId === actor.identity.data.id &&\n            entity.actorType === actor.identity.type;\n    }\n\n    protected async canReadRealm(actor: ActorContext, realmId: string | null): Promise<boolean> {\n        try {\n            await actor.permissionEvaluator.evaluate({\n                name: PermissionName.EVENT_READ,\n                data: definePolicyData({ [BuiltInPolicyType.REALM_MATCH]: realmId }),\n                options: {\n                    policiesIncluded: [\n                        BuiltInPolicyType.COMPOSITE,\n                        BuiltInPolicyType.PERMISSION_BINDING,\n                        BuiltInPolicyType.REALM_MATCH,\n                    ],\n                },\n            });\n            return true;\n        } catch {\n            return false;\n        }\n    }\n\n    protected async resolveReadVisibility(actor: ActorContext): Promise<EventReadVisibility | undefined> {\n        const actorRealmId = this.getActorRealmId(actor);\n        let foreignRealmId = randomUUID();\n        while (foreignRealmId === actorRealmId) {\n            foreignRealmId = randomUUID();\n        }\n\n        if (await this.canReadRealm(actor, foreignRealmId)) {\n            return undefined;\n        }\n\n        const realmIds: Array<string | null> = [];\n        if (actorRealmId && await this.canReadRealm(actor, actorRealmId)) {\n            realmIds.push(actorRealmId);\n        }\n        if (await this.canReadRealm(actor, null)) {\n            realmIds.push(null);\n        }\n\n        return {\n            realmIds,\n            ...(actor.identity ? {\n                owner: {\n                    actorId: actor.identity.data.id,\n                    actorType: actor.identity.type,\n                },\n            } : {}),\n        };\n    }\n\n    async record(input: EventRecordInput): Promise<void> {\n        const data = sanitizeEventData(input.data);\n\n        // complementary structured log line — fires even when persistence is\n        // disabled, so a SIEM/Loki pipeline can pick the events up for free.\n        this.logger?.info(`audit: ${input.scope}.${input.name}`, {\n            scope: input.scope,\n            name: input.name,\n            refType: input.refType ?? null,\n            refId: input.refId ?? null,\n            clientId: input.clientId ?? null,\n            actorType: input.actorType ?? null,\n            actorId: input.actorId ?? null,\n            realmId: input.realmId ?? null,\n            ...(data ? { data } : {}),\n        });\n\n        if (this.options.enabled === false) {\n            return;\n        }\n\n        try {\n            const retentionDays = input.retentionDays ?? this.options.retentionDays ?? EVENT_LOG_RETENTION_DAYS_DEFAULT;\n\n            const entity = this.repository.create({\n                id: randomUUID(),\n                scope: input.scope,\n                name: input.name,\n                refType: truncate(input.refType, 64),\n                refId: truncate(input.refId, 64),\n                clientId: input.clientId ?? null,\n                actorType: input.actorType ?? null,\n                actorId: input.actorId ?? null,\n                actorName: truncate(input.actorName, 128),\n                requestPath: truncate(input.requestPath, 256),\n                requestMethod: truncate(input.requestMethod, 10),\n                requestIpAddress: truncate(input.requestIpAddress, 45),\n                requestUserAgent: truncate(input.requestUserAgent, 512),\n                realmId: input.realmId ?? null,\n                data,\n                expiring: retentionDays > 0,\n                expiresAt: retentionDays > 0 ?\n                    new Date(Date.now() + (retentionDays * DAY_IN_MS)).toISOString() :\n                    null,\n            });\n\n            await this.repository.save(entity);\n        } catch {\n            // an audit write failure must never fail the originating operation\n            this.logger?.warn(`Recording the audit event ${input.scope}.${input.name} failed.`);\n        }\n    }\n\n    async getMany(\n        query: Record<string, any>,\n        actor: ActorContext,\n        options: EventServiceReadOptions = {},\n    ): Promise<EntityRepositoryFindManyResult<Event>> {\n        const parsed = await decodeQuery(query, { schema: eventSchema, actor });\n\n        let canReadAll = true;\n        try {\n            await actor.permissionEvaluator.preEvaluate({ name: PermissionName.EVENT_READ });\n        } catch (e) {\n            if (!actor.identity) {\n                throw e;\n            }\n            canReadAll = false;\n        }\n\n        if (!canReadAll) {\n            // self-service: only the actor's own rows (\"my sign-in history\")\n            return this.repository.findMany(parsed, {\n                owner: {\n                    actorId: actor.identity!.data.id,\n                    actorType: actor.identity!.type,\n                },\n                ...(options.realmId ? { realmId: options.realmId } : {}),\n            });\n        }\n\n        // Compile EVENT_READ into a row condition (#3286 phase 3). Own rows are\n        // always readable, so ownership composes as an OR-alternative — the whole\n        // gate runs as WHERE (replacing the probe-based visibility derivation, and\n        // additionally covering junction ATTRIBUTES policies the probe excluded)\n        // and pagination/totals stay exact. A non-expressible policy falls back to\n        // the probe + per-row loop below.\n        const compiled = await actor.permissionEvaluator.compile({ name: PermissionName.EVENT_READ });\n        if (compiled.verdict !== 'post') {\n            const ownership = actor.identity ?\n                and(eq('actorId', actor.identity.data.id), eq('actorType', actor.identity.type)) :\n                null;\n\n            let scoped = parsed;\n            if (compiled.verdict === 'deny') {\n                scoped = appendQueryConditions(parsed, ownership ?? inArray('id', []));\n            } else if (compiled.verdict === 'conditional') {\n                scoped = appendQueryConditions(\n                    parsed,\n                    ownership ? or(ownership, compiled.condition) : compiled.condition,\n                );\n            }\n\n            return this.repository.findMany(scoped, { ...(options.realmId ? { realmId: options.realmId } : {}) });\n        }\n\n        const visibility = await this.resolveReadVisibility(actor);\n        const { data: entities, meta } = await this.repository.findMany(parsed, {\n            ...(options.realmId ? { realmId: options.realmId } : {}),\n            ...(visibility ? { visibility } : {}),\n        });\n\n        const data: Event[] = [];\n\n        for (const entity of entities) {\n            if (this.isOwnedBy(entity, actor)) {\n                data.push(entity);\n                continue;\n            }\n\n            try {\n                await actor.permissionEvaluator.evaluate({\n                    name: PermissionName.EVENT_READ,\n                    data: definePolicyData({\n                        [BuiltInPolicyType.ATTRIBUTES]: entity,\n                        ...this.resourceRealmMatch(entity),\n                    }),\n                });\n                data.push(entity);\n            } catch {\n                continue;\n            }\n        }\n\n        return {\n            data,\n            meta: {\n                ...meta,\n                total: meta.total - (entities.length - data.length),\n            },\n        };\n    }\n\n    async getOne(id: string, actor: ActorContext, options: EventServiceReadOptions = {}): Promise<Event> {\n        const entity = await this.repository.findOneById(id);\n        if (!entity || (options.realmId && entity.realmId !== options.realmId)) {\n            throw new EntityNotFoundError();\n        }\n\n        if (!this.isOwnedBy(entity, actor)) {\n            await actor.permissionEvaluator.preEvaluate({ name: PermissionName.EVENT_READ });\n            await actor.permissionEvaluator.evaluate({\n                name: PermissionName.EVENT_READ,\n                data: definePolicyData({\n                    [BuiltInPolicyType.ATTRIBUTES]: entity,\n                    ...this.resourceRealmMatch(entity),\n                }),\n            });\n        }\n\n        return entity;\n    }\n}\n\nfunction truncate(value: string | null | undefined, maxLength: number): string | null {\n    if (typeof value !== 'string') {\n        return null;\n    }\n\n    if (value.length <= maxLength) {\n        return value;\n    }\n\n    return value.substring(0, maxLength);\n}\n"],"mappings":";;;;;;;;;;;;;;;AAuCA,MAAMe,YAAY;AAElB,IAAaC,eAAb,cAAkCP,sBAAAA;CACpBQ;CAEAC;CAEAC;CAEV,YAAYC,KAA0B;EAClC,MAAK;EAEL,KAAKH,aAAaG,IAAIH;EACtB,KAAKC,UAAUE,IAAIF,WAAW,CAAC;EAC/B,KAAKC,SAASC,IAAID;CACtB;CAEUE,UAAUC,QAAeC,OAA8B;EAC7D,OAAO,CAAC,CAACA,MAAMC,YACX,CAAC,CAACF,OAAOG,WACTH,OAAOG,YAAYF,MAAMC,SAASE,KAAKC,MACvCL,OAAOM,cAAcL,MAAMC,SAASK;CAC5C;CAEA,MAAgBC,aAAaP,OAAqBQ,SAA0C;EACxF,IAAI;GACA,MAAMR,MAAMS,oBAAoBC,SAAS;IACrCC,MAAM3B,eAAe4B;IACrBT,MAAMxB,iBAAiB,GAAGD,kBAAkBmC,cAAcL,QAAQ,CAAA;IAClEb,SAAS,EACLmB,kBAAkB;KACdpC,kBAAkBqC;KAClBrC,kBAAkBsC;KAClBtC,kBAAkBmC;MAE1B;GACJ,CAAA;GACA,OAAO;EACX,QAAQ;GACJ,OAAO;EACX;CACJ;CAEA,MAAgBI,sBAAsBjB,OAA+D;EACjG,MAAMkB,eAAe,KAAKC,gBAAgBnB,KAAAA;EAC1C,IAAIoB,iBAAiB3C,WAAAA;EACrB,OAAO2C,mBAAmBF,cACtBE,iBAAiB3C,WAAAA;EAGrB,IAAI,MAAM,KAAK8B,aAAaP,OAAOoB,cAAAA,GAC/B;EAGJ,MAAME,WAAiC,CAAA;EACvC,IAAIJ,gBAAgB,MAAM,KAAKX,aAAaP,OAAOkB,YAAAA,GAC/CI,SAASC,KAAKL,YAAAA;EAElB,IAAI,MAAM,KAAKX,aAAaP,OAAO,IAAA,GAC/BsB,SAASC,KAAK,IAAA;EAGlB,OAAO;GACHD;GACA,GAAItB,MAAMC,WAAW,EACjBuB,OAAO;IACHtB,SAASF,MAAMC,SAASE,KAAKC;IAC7BC,WAAWL,MAAMC,SAASK;GAC9B,EACJ,IAAI,CAAC;EACT;CACJ;CAEA,MAAMmB,OAAOC,OAAwC;EACjD,MAAMvB,OAAOf,kBAAkBsC,MAAMvB,IAAI;EAIzC,KAAKP,QAAQ+B,KAAK,UAAUD,MAAME,MAAM,GAAGF,MAAMf,QAAQ;GACrDiB,OAAOF,MAAME;GACbjB,MAAMe,MAAMf;GACZkB,SAASH,MAAMG,WAAW;GAC1BC,OAAOJ,MAAMI,SAAS;GACtBC,UAAUL,MAAMK,YAAY;GAC5B1B,WAAWqB,MAAMrB,aAAa;GAC9BH,SAASwB,MAAMxB,WAAW;GAC1BM,SAASkB,MAAMlB,WAAW;GAC1B,GAAIL,OAAO,EAAEA,KAAK,IAAI,CAAC;EAC3B,CAAA;EAEA,IAAI,KAAKR,QAAQqC,YAAY,OACzB;EAGJ,IAAI;GACA,MAAMC,gBAAgBP,MAAMO,iBAAiB,KAAKtC,QAAQsC,iBAAAA;GAE1D,MAAMlC,SAAS,KAAKL,WAAWwC,OAAO;IAClC9B,IAAI3B,WAAAA;IACJmD,OAAOF,MAAME;IACbjB,MAAMe,MAAMf;IACZkB,SAASM,SAAST,MAAMG,SAAS,EAAA;IACjCC,OAAOK,SAAST,MAAMI,OAAO,EAAA;IAC7BC,UAAUL,MAAMK,YAAY;IAC5B1B,WAAWqB,MAAMrB,aAAa;IAC9BH,SAASwB,MAAMxB,WAAW;IAC1BkC,WAAWD,SAAST,MAAMU,WAAW,GAAA;IACrCC,aAAaF,SAAST,MAAMW,aAAa,GAAA;IACzCC,eAAeH,SAAST,MAAMY,eAAe,EAAA;IAC7CC,kBAAkBJ,SAAST,MAAMa,kBAAkB,EAAA;IACnDC,kBAAkBL,SAAST,MAAMc,kBAAkB,GAAA;IACnDhC,SAASkB,MAAMlB,WAAW;IAC1BL;IACAsC,UAAUR,gBAAgB;IAC1BS,WAAWT,gBAAgB,IACvB,IAAIU,KAAKA,KAAKC,IAAG,IAAMX,gBAAgBzC,SAAAA,CAAAA,CAAYqD,YAAW,IAC9D;GACR,CAAA;GAEA,MAAM,KAAKnD,WAAWoD,KAAK/C,MAAAA;EAC/B,QAAQ;GAEJ,KAAKH,QAAQmD,KAAK,6BAA6BrB,MAAME,MAAM,GAAGF,MAAMf,KAAK,SAAS;EACtF;CACJ;CAEA,MAAMqC,QACFC,OACAjD,OACAL,UAAmC,CAAC,GACU;EAC9C,MAAMuD,SAAS,MAAM5D,YAAY2D,OAAO;GAAEE,QAAQ5D;GAAaS;EAAM,CAAA;EAErE,IAAIoD,aAAa;EACjB,IAAI;GACA,MAAMpD,MAAMS,oBAAoB4C,YAAY,EAAE1C,MAAM3B,eAAe4B,WAAW,CAAA;EAClF,SAAS0C,GAAG;GACR,IAAI,CAACtD,MAAMC,UACP,MAAMqD;GAEVF,aAAa;EACjB;EAEA,IAAI,CAACA,YAED,OAAO,KAAK1D,WAAW6D,SAASL,QAAQ;GACpC1B,OAAO;IACHtB,SAASF,MAAMC,SAAUE,KAAKC;IAC9BC,WAAWL,MAAMC,SAAUK;GAC/B;GACA,GAAIX,QAAQa,UAAU,EAAEA,SAASb,QAAQa,QAAQ,IAAI,CAAC;EAC1D,CAAA;EASJ,MAAMgD,WAAW,MAAMxD,MAAMS,oBAAoBgD,QAAQ,EAAE9C,MAAM3B,eAAe4B,WAAW,CAAA;EAC3F,IAAI4C,SAASE,YAAY,QAAQ;GAC7B,MAAMC,YAAY3D,MAAMC,WACpBrB,IAAIC,GAAG,WAAWmB,MAAMC,SAASE,KAAKC,EAAE,GAAGvB,GAAG,aAAamB,MAAMC,SAASK,IAAI,CAAA,IAC9E;GAEJ,IAAIsD,SAASV;GACb,IAAIM,SAASE,YAAY,QACrBE,SAASvE,sBAAsB6D,QAAQS,aAAa7E,QAAQ,MAAM,CAAA,CAAE,CAAA;QACjE,IAAI0E,SAASE,YAAY,eAC5BE,SAASvE,sBACL6D,QACAS,YAAY5E,GAAG4E,WAAWH,SAASK,SAAS,IAAIL,SAASK,SAAS;GAI1E,OAAO,KAAKnE,WAAW6D,SAASK,QAAQ,EAAE,GAAIjE,QAAQa,UAAU,EAAEA,SAASb,QAAQa,QAAQ,IAAI,CAAC,EAAG,CAAA;EACvG;EAEA,MAAMsD,aAAa,MAAM,KAAK7C,sBAAsBjB,KAAAA;EACpD,MAAM,EAAEG,MAAM4D,UAAUC,SAAS,MAAM,KAAKtE,WAAW6D,SAASL,QAAQ;GACpE,GAAIvD,QAAQa,UAAU,EAAEA,SAASb,QAAQa,QAAQ,IAAI,CAAC;GACtD,GAAIsD,aAAa,EAAEA,WAAW,IAAI,CAAC;EACvC,CAAA;EAEA,MAAM3D,OAAgB,CAAA;EAEtB,KAAK,MAAMJ,UAAUgE,UAAU;GAC3B,IAAI,KAAKjE,UAAUC,QAAQC,KAAAA,GAAQ;IAC/BG,KAAKoB,KAAKxB,MAAAA;IACV;GACJ;GAEA,IAAI;IACA,MAAMC,MAAMS,oBAAoBC,SAAS;KACrCC,MAAM3B,eAAe4B;KACrBT,MAAMxB,iBAAiB;OAClBD,kBAAkBuF,aAAalE;MAChC,GAAG,KAAKmE,mBAAmBnE,MAAAA;KAC/B,CAAA;IACJ,CAAA;IACAI,KAAKoB,KAAKxB,MAAAA;GACd,QAAQ;IACJ;GACJ;EACJ;EAEA,OAAO;GACHI;GACA6D,MAAM;IACF,GAAGA;IACHG,OAAOH,KAAKG,SAASJ,SAASK,SAASjE,KAAKiE;GAChD;EACJ;CACJ;CAEA,MAAMC,OAAOjE,IAAYJ,OAAqBL,UAAmC,CAAC,GAAmB;EACjG,MAAMI,SAAS,MAAM,KAAKL,WAAW4E,YAAYlE,EAAAA;EACjD,IAAI,CAACL,UAAWJ,QAAQa,WAAWT,OAAOS,YAAYb,QAAQa,SAC1D,MAAM,IAAIvB,oBAAAA;EAGd,IAAI,CAAC,KAAKa,UAAUC,QAAQC,KAAAA,GAAQ;GAChC,MAAMA,MAAMS,oBAAoB4C,YAAY,EAAE1C,MAAM3B,eAAe4B,WAAW,CAAA;GAC9E,MAAMZ,MAAMS,oBAAoBC,SAAS;IACrCC,MAAM3B,eAAe4B;IACrBT,MAAMxB,iBAAiB;MAClBD,kBAAkBuF,aAAalE;KAChC,GAAG,KAAKmE,mBAAmBnE,MAAAA;IAC/B,CAAA;GACJ,CAAA;EACJ;EAEA,OAAOA;CACX;AACJ;AAEA,SAASoC,SAASoC,OAAkCC,WAAiB;CACjE,IAAI,OAAOD,UAAU,UACjB,OAAO;CAGX,IAAIA,MAAMH,UAAUI,WAChB,OAAOD;CAGX,OAAOA,MAAME,UAAU,GAAGD,SAAAA;AAC9B"}