@authup/server-core 1.0.0-beta.58 → 1.0.0-beta.60

package/dist/core/entities/client-scope/schema.mjs

@@ -11,6 +11,14 @@ const schemaMapping = {
 };
 const clientScopeSchema = defineSchema({
 	name: EntityType.CLIENT_SCOPE,
+	indexes: [
+		["id"],
+		["clientId", "scopeId"],
+		["scopeId"],
+		["default"],
+		["clientRealmId"],
+		["scopeRealmId"]
+	],
 	fields: { default: [
 		"id",
 		"default",
@@ -21,11 +29,17 @@ const clientScopeSchema = defineSchema({
 		"createdAt",
 		"updatedAt"
 	] },
-	filters: { allowed: [
-		"clientId",
-		"scopeId",
-		"default"
-	] },
+	filters: {
+		allowed: [
+			"clientId",
+			"scopeId",
+			"default",
+			"id",
+			"clientRealmId",
+			"scopeRealmId"
+		],
+		indexed: true
+	},
 	relations: {
 		allowed: ["client", "scope"],
 		validate: createRelationsReadGate(schemaMapping)

package/dist/core/entities/client-scope/schema.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"schema.mjs","names":["defineSchema","EntityType","createRelationsReadGate","schemaMapping","client","CLIENT","scope","SCOPE","clientScopeSchema","name","CLIENT_SCOPE","fields","default","filters","allowed","relations","validate","pagination","maxLimit"],"sources":["../../../../src/core/entities/client-scope/schema.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { defineSchema } from '@rapiq/core';\nimport type { ClientScope } from '@authup/core-kit';\nimport { EntityType } from '@authup/core-kit';\nimport { createRelationsReadGate } from '../../query/relations.ts';\n\nconst schemaMapping = { client: EntityType.CLIENT, scope: EntityType.SCOPE };\n\nexport const clientScopeSchema = defineSchema<ClientScope>({\n    name: EntityType.CLIENT_SCOPE,\n    // see user-role schema — explicit root projection for include= decodes\n    fields: {\n        default: [\n            'id',\n            'default',\n            'clientId',\n            'clientRealmId',\n            'scopeId',\n            'scopeRealmId',\n            'createdAt',\n            'updatedAt',\n        ],\n    },\n    filters: { allowed: ['clientId', 'scopeId', 'default'] },\n    relations: { allowed: ['client', 'scope'], validate: createRelationsReadGate(schemaMapping) },\n    pagination: { maxLimit: 50 },\n    schemaMapping,\n});\n"],"mappings":";;;;;;;AAYA,MAAMG,gBAAgB;CAAEC,QAAQH,WAAWI;CAAQC,OAAOL,WAAWM;AAAM;AAE3E,MAAaC,oBAAoBR,aAA0B;CACvDS,MAAMR,WAAWS;CAEjBC,QAAQ,EACJC,SAAS;EACL;EACA;EACA;EACA;EACA;EACA;EACA;EACA;CACH,EACL;CACAC,SAAS,EAAEC,SAAS;EAAC;EAAY;EAAW;CAAU,EAAC;CACvDC,WAAW;EAAED,SAAS,CAAC,UAAU,OAAQ;EAAEE,UAAUd,wBAAwBC,aAAAA;CAAe;CAC5Fc,YAAY,EAAEC,UAAU,GAAG;CAC3Bf;AACJ,CAAA"}
+{"version":3,"file":"schema.mjs","names":["defineSchema","EntityType","createRelationsReadGate","schemaMapping","client","CLIENT","scope","SCOPE","clientScopeSchema","name","CLIENT_SCOPE","indexes","fields","default","filters","allowed","indexed","relations","validate","pagination","maxLimit"],"sources":["../../../../src/core/entities/client-scope/schema.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { defineSchema } from '@rapiq/core';\nimport type { ClientScope } from '@authup/core-kit';\nimport { EntityType } from '@authup/core-kit';\nimport { createRelationsReadGate } from '../../query/relations.ts';\n\nconst schemaMapping = { client: EntityType.CLIENT, scope: EntityType.SCOPE };\n\nexport const clientScopeSchema = defineSchema<ClientScope>({\n    name: EntityType.CLIENT_SCOPE,\n    indexes: [\n        ['id'],\n        ['clientId', 'scopeId'],\n        ['scopeId'],\n        ['default'],\n        ['clientRealmId'],\n        ['scopeRealmId'],\n    ],\n    // see user-role schema — explicit root projection for include= decodes\n    fields: {\n        default: [\n            'id',\n            'default',\n            'clientId',\n            'clientRealmId',\n            'scopeId',\n            'scopeRealmId',\n            'createdAt',\n            'updatedAt',\n        ],\n    },\n    filters: { allowed: ['clientId', 'scopeId', 'default', 'id', 'clientRealmId', 'scopeRealmId'], indexed: true },\n    relations: { allowed: ['client', 'scope'], validate: createRelationsReadGate(schemaMapping) },\n    pagination: { maxLimit: 50 },\n    schemaMapping,\n});\n"],"mappings":";;;;;;;AAYA,MAAMG,gBAAgB;CAAEC,QAAQH,WAAWI;CAAQC,OAAOL,WAAWM;AAAM;AAE3E,MAAaC,oBAAoBR,aAA0B;CACvDS,MAAMR,WAAWS;CACjBC,SAAS;EACL,CAAC,IAAK;EACN,CAAC,YAAY,SAAU;EACvB,CAAC,SAAU;EACX,CAAC,SAAU;EACX,CAAC,eAAgB;EACjB,CAAC,cAAe;CACnB;CAEDC,QAAQ,EACJC,SAAS;EACL;EACA;EACA;EACA;EACA;EACA;EACA;EACA;CACH,EACL;CACAC,SAAS;EAAEC,SAAS;GAAC;GAAY;GAAW;GAAW;GAAM;GAAiB;EAAe;EAAEC,SAAS;CAAK;CAC7GC,WAAW;EAAEF,SAAS,CAAC,UAAU,OAAQ;EAAEG,UAAUhB,wBAAwBC,aAAAA;CAAe;CAC5FgB,YAAY,EAAEC,UAAU,GAAG;CAC3BjB;AACJ,CAAA"}

package/dist/core/entities/consent/schema.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/consent/schema.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAOhD,eAAO,MAAM,aAAa,4CA2BxB,CAAC"}
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/consent/schema.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAOhD,eAAO,MAAM,aAAa,4CAsCxB,CAAC"}

package/dist/core/entities/consent/schema.mjs

@@ -9,6 +9,22 @@ import { defineSchema } from "@rapiq/core";
 const schemaMapping = { realm: EntityType.REALM };
 const consentSchema = defineSchema({
 	name: EntityType.CONSENT,
+	indexes: [
+		["id"],
+		[
+			"clientId",
+			"sub",
+			"subKind",
+			"scope"
+		],
+		["sub"],
+		["subKind"],
+		["scope"],
+		["realmId"],
+		["userId"],
+		["createdAt"],
+		["updatedAt"]
+	],
 	fields: { default: [
 		"id",
 		"clientId",
@@ -21,16 +37,22 @@ const consentSchema = defineSchema({
 		"createdAt",
 		"updatedAt"
 	] },
-	filters: { allowed: [...CONSENT_FILTER_KEYS] },
+	filters: {
+		allowed: [...CONSENT_FILTER_KEYS, "userId"],
+		indexed: true
+	},
 	relations: {
 		allowed: ["realm"],
 		validate: createRelationsReadGate(schemaMapping)
 	},
-	sort: { allowed: [
-		"createdAt",
-		"updatedAt",
-		"scope"
-	] },
+	sorts: {
+		allowed: [
+			"createdAt",
+			"updatedAt",
+			"scope"
+		],
+		indexed: true
+	},
 	pagination: { maxLimit: 50 },
 	schemaMapping
 });

package/dist/core/entities/consent/schema.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"schema.mjs","names":["defineSchema","EntityType","CONSENT_FILTER_KEYS","createRelationsReadGate","schemaMapping","realm","REALM","consentSchema","name","CONSENT","fields","default","filters","allowed","relations","validate","sort","pagination","maxLimit"],"sources":["../../../../src/core/entities/consent/schema.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { defineSchema } from '@rapiq/core';\nimport type { Consent } from '@authup/core-kit';\nimport { EntityType } from '@authup/core-kit';\nimport { CONSENT_FILTER_KEYS } from './types.ts';\nimport { createRelationsReadGate } from '../../query/relations.ts';\n\nconst schemaMapping = { realm: EntityType.REALM };\n\nexport const consentSchema = defineSchema<Consent>({\n    name: EntityType.CONSENT,\n    fields: {\n        // `default` (not just `allowed`) so the adapter adds an explicit\n        // per-column SELECT: it populates expressionMap.selects, which\n        // applyRealmScopeSelect dedupes against. Without it the default\n        // \"select all\" is implicit (empty selects) and the force-select\n        // re-adds consent.sub — a duplicate `consent_sub` alias that\n        // mysql rejects under the client join (see helpers.ts).\n        default: [\n            'id',\n            'clientId',\n            'realmId',\n            'userId',\n            'sub',\n            'subKind',\n            'scope',\n            'expiresAt',\n            'createdAt',\n            'updatedAt',\n        ],\n    },\n    filters: { allowed: [...CONSENT_FILTER_KEYS] },\n    relations: { allowed: ['realm'], validate: createRelationsReadGate(schemaMapping) },\n    sort: { allowed: ['createdAt', 'updatedAt', 'scope'] },\n    pagination: { maxLimit: 50 },\n    schemaMapping,\n});\n"],"mappings":";;;;;;;;AAaA,MAAMI,gBAAgB,EAAEC,OAAOJ,WAAWK,MAAM;AAEhD,MAAaC,gBAAgBP,aAAsB;CAC/CQ,MAAMP,WAAWQ;CACjBC,QAAQ,EAOJC,SAAS;EACL;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;CACH,EACL;CACAC,SAAS,EAAEC,SAAS,CAAIX,GAAAA,mBAAoB,EAAC;CAC7CY,WAAW;EAAED,SAAS,CAAC,OAAQ;EAAEE,UAAUZ,wBAAwBC,aAAAA;CAAe;CAClFY,MAAM,EAAEH,SAAS;EAAC;EAAa;EAAa;CAAQ,EAAC;CACrDI,YAAY,EAAEC,UAAU,GAAG;CAC3Bd;AACJ,CAAA"}
+{"version":3,"file":"schema.mjs","names":["defineSchema","EntityType","CONSENT_FILTER_KEYS","createRelationsReadGate","schemaMapping","realm","REALM","consentSchema","name","CONSENT","indexes","fields","default","filters","allowed","indexed","relations","validate","sorts","pagination","maxLimit"],"sources":["../../../../src/core/entities/consent/schema.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { defineSchema } from '@rapiq/core';\nimport type { Consent } from '@authup/core-kit';\nimport { EntityType } from '@authup/core-kit';\nimport { CONSENT_FILTER_KEYS } from './types.ts';\nimport { createRelationsReadGate } from '../../query/relations.ts';\n\nconst schemaMapping = { realm: EntityType.REALM };\n\nexport const consentSchema = defineSchema<Consent>({\n    name: EntityType.CONSENT,\n    indexes: [\n        ['id'],\n        ['clientId', 'sub', 'subKind', 'scope'],\n        ['sub'],\n        ['subKind'],\n        ['scope'],\n        ['realmId'],\n        ['userId'],\n        ['createdAt'],\n        ['updatedAt'],\n    ],\n    fields: {\n        // `default` (not just `allowed`) so the adapter adds an explicit\n        // per-column SELECT: it populates expressionMap.selects, which\n        // applyRealmScopeSelect dedupes against. Without it the default\n        // \"select all\" is implicit (empty selects) and the force-select\n        // re-adds consent.sub — a duplicate `consent_sub` alias that\n        // mysql rejects under the client join (see helpers.ts).\n        default: [\n            'id',\n            'clientId',\n            'realmId',\n            'userId',\n            'sub',\n            'subKind',\n            'scope',\n            'expiresAt',\n            'createdAt',\n            'updatedAt',\n        ],\n    },\n    filters: { allowed: [...CONSENT_FILTER_KEYS, 'userId'], indexed: true },\n    relations: { allowed: ['realm'], validate: createRelationsReadGate(schemaMapping) },\n    sorts: { allowed: ['createdAt', 'updatedAt', 'scope'], indexed: true },\n    pagination: { maxLimit: 50 },\n    schemaMapping,\n});\n"],"mappings":";;;;;;;;AAaA,MAAMI,gBAAgB,EAAEC,OAAOJ,WAAWK,MAAM;AAEhD,MAAaC,gBAAgBP,aAAsB;CAC/CQ,MAAMP,WAAWQ;CACjBC,SAAS;EACL,CAAC,IAAK;EACN;GAAC;GAAY;GAAO;GAAW;EAAQ;EACvC,CAAC,KAAM;EACP,CAAC,SAAU;EACX,CAAC,OAAQ;EACT,CAAC,SAAU;EACX,CAAC,QAAS;EACV,CAAC,WAAY;EACb,CAAC,WAAY;CAChB;CACDC,QAAQ,EAOJC,SAAS;EACL;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;CACH,EACL;CACAC,SAAS;EAAEC,SAAS,CAAIZ,GAAAA,qBAAqB,QAAS;EAAEa,SAAS;CAAK;CACtEC,WAAW;EAAEF,SAAS,CAAC,OAAQ;EAAEG,UAAUd,wBAAwBC,aAAAA;CAAe;CAClFc,OAAO;EAAEJ,SAAS;GAAC;GAAa;GAAa;EAAQ;EAAEC,SAAS;CAAK;CACrEI,YAAY,EAAEC,UAAU,GAAG;CAC3BhB;AACJ,CAAA"}

package/dist/core/entities/event/entity-event-handler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"entity-event-handler.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/event/entity-event-handler.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,yBAAyB,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAEzF,OAAO,KAAK,EACR,yBAAyB,EACzB,mBAAmB,EACnB,aAAa,EAChB,MAAM,YAAY,CAAC;AAEpB,MAAM,MAAM,yBAAyB,GAAG;IACpC,YAAY,EAAE,aAAa,CAAC;IAC5B,cAAc,CAAC,EAAE,MAAM,mBAAmB,GAAG,SAAS,CAAC;IACvD,OAAO,CAAC,EAAE,yBAAyB,CAAC;CACvC,CAAC;AAwCF;;;GAGG;AACH,qBAAa,kBAAmB,YAAW,mBAAmB;IAC1D,SAAS,CAAC,YAAY,EAAG,aAAa,CAAC;IAEvC,SAAS,CAAC,cAAc,CAAC,EAAG,MAAM,mBAAmB,GAAG,SAAS,CAAC;IAElE,SAAS,CAAC,OAAO,EAAG,yBAAyB,CAAC;gBAElC,GAAG,EAAE,yBAAyB;IAMpC,MAAM,CAAC,GAAG,EAAE,yBAAyB,GAAG,OAAO,CAAC,IAAI,CAAC;CAqD9D"}
+{"version":3,"file":"entity-event-handler.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/event/entity-event-handler.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,yBAAyB,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAEzF,OAAO,KAAK,EACR,yBAAyB,EACzB,mBAAmB,EACnB,aAAa,EAChB,MAAM,YAAY,CAAC;AAEpB,MAAM,MAAM,yBAAyB,GAAG;IACpC,YAAY,EAAE,aAAa,CAAC;IAC5B,cAAc,CAAC,EAAE,MAAM,mBAAmB,GAAG,SAAS,CAAC;IACvD,OAAO,CAAC,EAAE,yBAAyB,CAAC;CACvC,CAAC;AA4CF;;;GAGG;AACH,qBAAa,kBAAmB,YAAW,mBAAmB;IAC1D,SAAS,CAAC,YAAY,EAAG,aAAa,CAAC;IAEvC,SAAS,CAAC,cAAc,CAAC,EAAG,MAAM,mBAAmB,GAAG,SAAS,CAAC;IAElE,SAAS,CAAC,OAAO,EAAG,yBAAyB,CAAC;gBAElC,GAAG,EAAE,yBAAyB;IAMpC,MAAM,CAAC,GAAG,EAAE,yBAAyB,GAAG,OAAO,CAAC,IAAI,CAAC;CAsD9D"}

package/dist/core/entities/event/entity-event-handler.mjs

@@ -16,6 +16,7 @@ const ENTITY_REALM_KEY_MAP = {
 	[EntityType.CLIENT_ROLE]: "clientRealmId",
 	[EntityType.CLIENT_SCOPE]: "clientRealmId",
 	[EntityType.CONSENT]: "realmId",
+	[EntityType.SESSION_TOKEN]: "sessionId",
 	[EntityType.EVENT]: "realmId",
 	[EntityType.IDENTITY_PROVIDER]: "realmId",
 	[EntityType.IDENTITY_PROVIDER_ACCOUNT]: "userRealmId",
@@ -76,6 +77,7 @@ const ENTITY_REALM_KEY_MAP = {
 				actorType: requestContext?.actorType ?? null,
 				actorId: requestContext?.actorId ?? null,
 				actorName: requestContext?.actorName ?? null,
+				sessionId: requestContext?.sessionId ?? null,
 				requestPath: requestContext?.requestPath ?? null,
 				requestMethod: requestContext?.requestMethod ?? null,
 				requestIpAddress: requestContext?.requestIpAddress ?? null,

package/dist/core/entities/event/entity-event-handler.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"entity-event-handler.mjs","names":["EntityDefaultEventName","EntityType","EventName","EventScope","hasOwnProperty","isObject","buildEntityDiff","ENTITY_EVENT_NAME_MAP","CREATED","UPDATED","DELETED","ENTITY_REALM_KEY_MAP","CLIENT","CLIENT_PERMISSION","CLIENT_ROLE","CLIENT_SCOPE","CONSENT","EVENT","IDENTITY_PROVIDER","IDENTITY_PROVIDER_ACCOUNT","IDENTITY_PROVIDER_ATTRIBUTE","IDENTITY_PROVIDER_ATTRIBUTE_MAPPING","IDENTITY_PROVIDER_PERMISSION_MAPPING","IDENTITY_PROVIDER_ROLE_MAPPING","KEY","POLICY","POLICY_ATTRIBUTE","PERMISSION","PERMISSION_POLICY","REALM","ROLE","ROLE_ATTRIBUTE","ROLE_PERMISSION","SCOPE","SESSION","TRUST_ANCHOR","USER","USER_ATTRIBUTE","USER_AUTHENTICATOR","USER_PERMISSION","USER_ROLE","EntityEventHandler","eventService","requestContext","options","ctx","handle","content","type","name","event","refId","data","id","realmIdCurrent","resolveEntityRealmId","realmId","dataPrevious","undefined","diff","Object","keys","length","record","scope","ENTITY","refType","actorType","actorId","actorName","requestPath","requestMethod","requestIpAddress","requestUserAgent","retentionDays","key"],"sources":["../../../../src/core/entities/event/entity-event-handler.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport {\n    EntityDefaultEventName,\n    EntityType,\n    EventName,\n    EventScope,\n} from '@authup/core-kit';\nimport { hasOwnProperty, isObject } from '@authup/kit';\nimport type { DomainEventPublishContext, IDomainEventHandler } from '@authup/server-kit';\nimport { buildEntityDiff } from './diff.ts';\nimport type {\n    EntityEventHandlerOptions,\n    EventRequestContext,\n    IEventService,\n} from './types.ts';\n\nexport type EntityEventHandlerContext = {\n    eventService: IEventService,\n    requestContext?: () => EventRequestContext | undefined,\n    options?: EntityEventHandlerOptions,\n};\n\nconst ENTITY_EVENT_NAME_MAP : Record<string, `${EventName}`> = {\n    [EntityDefaultEventName.CREATED]: EventName.CREATED,\n    [EntityDefaultEventName.UPDATED]: EventName.UPDATED,\n    [EntityDefaultEventName.DELETED]: EventName.DELETED,\n};\n\nconst ENTITY_REALM_KEY_MAP : Record<`${EntityType}`, string> = {\n    [EntityType.CLIENT]: 'realmId',\n    [EntityType.CLIENT_PERMISSION]: 'clientRealmId',\n    [EntityType.CLIENT_ROLE]: 'clientRealmId',\n    [EntityType.CLIENT_SCOPE]: 'clientRealmId',\n    [EntityType.CONSENT]: 'realmId',\n    [EntityType.EVENT]: 'realmId',\n    [EntityType.IDENTITY_PROVIDER]: 'realmId',\n    [EntityType.IDENTITY_PROVIDER_ACCOUNT]: 'userRealmId',\n    [EntityType.IDENTITY_PROVIDER_ATTRIBUTE]: 'realmId',\n    [EntityType.IDENTITY_PROVIDER_ATTRIBUTE_MAPPING]: 'providerRealmId',\n    [EntityType.IDENTITY_PROVIDER_PERMISSION_MAPPING]: 'providerRealmId',\n    [EntityType.IDENTITY_PROVIDER_ROLE_MAPPING]: 'providerRealmId',\n    [EntityType.KEY]: 'realmId',\n    [EntityType.POLICY]: 'realmId',\n    [EntityType.POLICY_ATTRIBUTE]: 'realmId',\n    [EntityType.PERMISSION]: 'realmId',\n    [EntityType.PERMISSION_POLICY]: 'permissionRealmId',\n    [EntityType.REALM]: 'id',\n    [EntityType.ROLE]: 'realmId',\n    [EntityType.ROLE_ATTRIBUTE]: 'realmId',\n    [EntityType.ROLE_PERMISSION]: 'roleRealmId',\n    [EntityType.SCOPE]: 'realmId',\n    [EntityType.SESSION]: 'realmId',\n    [EntityType.TRUST_ANCHOR]: 'realmId',\n    [EntityType.USER]: 'realmId',\n    [EntityType.USER_ATTRIBUTE]: 'realmId',\n    [EntityType.USER_AUTHENTICATOR]: 'realmId',\n    [EntityType.USER_PERMISSION]: 'userRealmId',\n    [EntityType.USER_ROLE]: 'userRealmId',\n};\n\n/**\n * Bridges every entity create/update/delete published on the\n * DomainEventPublisher bus into the auth_events audit table (scope `entity`).\n */\nexport class EntityEventHandler implements IDomainEventHandler {\n    protected eventService : IEventService;\n\n    protected requestContext? : () => EventRequestContext | undefined;\n\n    protected options : EntityEventHandlerOptions;\n\n    constructor(ctx: EntityEventHandlerContext) {\n        this.eventService = ctx.eventService;\n        this.requestContext = ctx.requestContext;\n        this.options = ctx.options ?? {};\n    }\n\n    async handle(ctx: DomainEventPublishContext): Promise<void> {\n        try {\n            // recursion guard — no event subscriber exists today (the\n            // auth_events entity is deliberately subscriber-less), so this is\n            // defense in depth against an audit-write feedback loop.\n            if (ctx.content.type === 'event') {\n                return;\n            }\n\n            const name = ENTITY_EVENT_NAME_MAP[ctx.content.event];\n            if (!name) {\n                return;\n            }\n\n            const refId = ctx.content.data?.id ?? null;\n            const realmIdCurrent = resolveEntityRealmId(ctx.content.type, ctx.content.data);\n            const realmId = typeof realmIdCurrent === 'undefined' ?\n                (resolveEntityRealmId(ctx.content.type, ctx.dataPrevious) ?? null) :\n                realmIdCurrent;\n\n            const requestContext = this.requestContext ?\n                this.requestContext() :\n                undefined;\n\n            let data : Record<string, any> | null = null;\n            if (name === EventName.UPDATED && isObject(ctx.content.data) && isObject(ctx.dataPrevious)) {\n                const diff = buildEntityDiff(ctx.content.data, ctx.dataPrevious);\n                if (Object.keys(diff).length > 0) {\n                    data = { diff };\n                }\n            }\n\n            await this.eventService.record({\n                scope: EventScope.ENTITY,\n                name,\n                refType: ctx.content.type,\n                refId,\n                realmId,\n                actorType: requestContext?.actorType ?? null,\n                actorId: requestContext?.actorId ?? null,\n                actorName: requestContext?.actorName ?? null,\n                requestPath: requestContext?.requestPath ?? null,\n                requestMethod: requestContext?.requestMethod ?? null,\n                requestIpAddress: requestContext?.requestIpAddress ?? null,\n                requestUserAgent: requestContext?.requestUserAgent ?? null,\n                data,\n                retentionDays: this.options.retentionDays,\n            });\n        } catch {\n            // record() never throws, but the bridge itself must also never\n            // fail the originating publish.\n        }\n    }\n}\n\nfunction resolveEntityRealmId(\n    type: string,\n    data: unknown,\n): string | null | undefined {\n    if (!isObject(data)) {\n        return undefined;\n    }\n\n    const key = ENTITY_REALM_KEY_MAP[type as `${EntityType}`] ?? 'realmId';\n    if (!hasOwnProperty(data, key)) {\n        return undefined;\n    }\n\n    return typeof data[key] === 'string' ? data[key] : null;\n}\n"],"mappings":";;;;;;;AA4BA,MAAMO,wBAAyD;EAC1DP,uBAAuBQ,UAAUN,UAAUM;EAC3CR,uBAAuBS,UAAUP,UAAUO;EAC3CT,uBAAuBU,UAAUR,UAAUQ;AAChD;AAEA,MAAMC,uBAAyD;EAC1DV,WAAWW,SAAS;EACpBX,WAAWY,oBAAoB;EAC/BZ,WAAWa,cAAc;EACzBb,WAAWc,eAAe;EAC1Bd,WAAWe,UAAU;EACrBf,WAAWgB,QAAQ;EACnBhB,WAAWiB,oBAAoB;EAC/BjB,WAAWkB,4BAA4B;EACvClB,WAAWmB,8BAA8B;EACzCnB,WAAWoB,sCAAsC;EACjDpB,WAAWqB,uCAAuC;EAClDrB,WAAWsB,iCAAiC;EAC5CtB,WAAWuB,MAAM;EACjBvB,WAAWwB,SAAS;EACpBxB,WAAWyB,mBAAmB;EAC9BzB,WAAW0B,aAAa;EACxB1B,WAAW2B,oBAAoB;EAC/B3B,WAAW4B,QAAQ;EACnB5B,WAAW6B,OAAO;EAClB7B,WAAW8B,iBAAiB;EAC5B9B,WAAW+B,kBAAkB;EAC7B/B,WAAWgC,QAAQ;EACnBhC,WAAWiC,UAAU;EACrBjC,WAAWkC,eAAe;EAC1BlC,WAAWmC,OAAO;EAClBnC,WAAWoC,iBAAiB;EAC5BpC,WAAWqC,qBAAqB;EAChCrC,WAAWsC,kBAAkB;EAC7BtC,WAAWuC,YAAY;AAC5B;;;;GAMA,IAAaC,qBAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEV,YAAYC,KAAgC;EACxC,KAAKH,eAAeG,IAAIH;EACxB,KAAKC,iBAAiBE,IAAIF;EAC1B,KAAKC,UAAUC,IAAID,WAAW,CAAC;CACnC;CAEA,MAAME,OAAOD,KAA+C;EACxD,IAAI;GAIA,IAAIA,IAAIE,QAAQC,SAAS,SACrB;GAGJ,MAAMC,OAAO1C,sBAAsBsC,IAAIE,QAAQG;GAC/C,IAAI,CAACD,MACD;GAGJ,MAAME,QAAQN,IAAIE,QAAQK,MAAMC,MAAM;GACtC,MAAMC,iBAAiBC,qBAAqBV,IAAIE,QAAQC,MAAMH,IAAIE,QAAQK,IAAI;GAC9E,MAAMI,UAAU,OAAOF,mBAAmB,cACrCC,qBAAqBV,IAAIE,QAAQC,MAAMH,IAAIY,YAAY,KAAK,OAC7DH;GAEJ,MAAMX,iBAAiB,KAAKA,iBACxB,KAAKA,eAAc,IACnBe,KAAAA;GAEJ,IAAIN,OAAoC;GACxC,IAAIH,SAAS/C,UAAUO,WAAWJ,SAASwC,IAAIE,QAAQK,IAAI,KAAK/C,SAASwC,IAAIY,YAAY,GAAG;IACxF,MAAME,OAAOrD,gBAAgBuC,IAAIE,QAAQK,MAAMP,IAAIY,YAAY;IAC/D,IAAIG,OAAOC,KAAKF,IAAAA,CAAAA,CAAMG,SAAS,GAC3BV,OAAO,EAAEO,KAAK;GAEtB;GAEA,MAAM,KAAKjB,aAAaqB,OAAO;IAC3BC,OAAO7D,WAAW8D;IAClBhB;IACAiB,SAASrB,IAAIE,QAAQC;IACrBG;IACAK;IACAW,WAAWxB,gBAAgBwB,aAAa;IACxCC,SAASzB,gBAAgByB,WAAW;IACpCC,WAAW1B,gBAAgB0B,aAAa;IACxCC,aAAa3B,gBAAgB2B,eAAe;IAC5CC,eAAe5B,gBAAgB4B,iBAAiB;IAChDC,kBAAkB7B,gBAAgB6B,oBAAoB;IACtDC,kBAAkB9B,gBAAgB8B,oBAAoB;IACtDrB;IACAsB,eAAe,KAAK9B,QAAQ8B;GAChC,CAAA;EACJ,QAAQ,CAGR;CACJ;AACJ;AAEA,SAASnB,qBACLP,MACAI,MAAa;CAEb,IAAI,CAAC/C,SAAS+C,IAAAA,GACV;CAGJ,MAAMuB,MAAMhE,qBAAqBqC,SAA4B;CAC7D,IAAI,CAAC5C,eAAegD,MAAMuB,GAAAA,GACtB;CAGJ,OAAO,OAAOvB,KAAKuB,SAAS,WAAWvB,KAAKuB,OAAO;AACvD"}
+{"version":3,"file":"entity-event-handler.mjs","names":["EntityDefaultEventName","EntityType","EventName","EventScope","hasOwnProperty","isObject","buildEntityDiff","ENTITY_EVENT_NAME_MAP","CREATED","UPDATED","DELETED","ENTITY_REALM_KEY_MAP","CLIENT","CLIENT_PERMISSION","CLIENT_ROLE","CLIENT_SCOPE","CONSENT","SESSION_TOKEN","EVENT","IDENTITY_PROVIDER","IDENTITY_PROVIDER_ACCOUNT","IDENTITY_PROVIDER_ATTRIBUTE","IDENTITY_PROVIDER_ATTRIBUTE_MAPPING","IDENTITY_PROVIDER_PERMISSION_MAPPING","IDENTITY_PROVIDER_ROLE_MAPPING","KEY","POLICY","POLICY_ATTRIBUTE","PERMISSION","PERMISSION_POLICY","REALM","ROLE","ROLE_ATTRIBUTE","ROLE_PERMISSION","SCOPE","SESSION","TRUST_ANCHOR","USER","USER_ATTRIBUTE","USER_AUTHENTICATOR","USER_PERMISSION","USER_ROLE","EntityEventHandler","eventService","requestContext","options","ctx","handle","content","type","name","event","refId","data","id","realmIdCurrent","resolveEntityRealmId","realmId","dataPrevious","undefined","diff","Object","keys","length","record","scope","ENTITY","refType","actorType","actorId","actorName","sessionId","requestPath","requestMethod","requestIpAddress","requestUserAgent","retentionDays","key"],"sources":["../../../../src/core/entities/event/entity-event-handler.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport {\n    EntityDefaultEventName,\n    EntityType,\n    EventName,\n    EventScope,\n} from '@authup/core-kit';\nimport { hasOwnProperty, isObject } from '@authup/kit';\nimport type { DomainEventPublishContext, IDomainEventHandler } from '@authup/server-kit';\nimport { buildEntityDiff } from './diff.ts';\nimport type {\n    EntityEventHandlerOptions,\n    EventRequestContext,\n    IEventService,\n} from './types.ts';\n\nexport type EntityEventHandlerContext = {\n    eventService: IEventService,\n    requestContext?: () => EventRequestContext | undefined,\n    options?: EntityEventHandlerOptions,\n};\n\nconst ENTITY_EVENT_NAME_MAP : Record<string, `${EventName}`> = {\n    [EntityDefaultEventName.CREATED]: EventName.CREATED,\n    [EntityDefaultEventName.UPDATED]: EventName.UPDATED,\n    [EntityDefaultEventName.DELETED]: EventName.DELETED,\n};\n\nconst ENTITY_REALM_KEY_MAP : Record<`${EntityType}`, string> = {\n    [EntityType.CLIENT]: 'realmId',\n    [EntityType.CLIENT_PERMISSION]: 'clientRealmId',\n    [EntityType.CLIENT_ROLE]: 'clientRealmId',\n    [EntityType.CLIENT_SCOPE]: 'clientRealmId',\n    [EntityType.CONSENT]: 'realmId',\n    // Unreachable in practice: auth_session_tokens has no entity subscriber,\n    // so no domain event is ever published for it. Present for exhaustiveness,\n    // and the key is the one it would resolve through if that changed.\n    [EntityType.SESSION_TOKEN]: 'sessionId',\n    [EntityType.EVENT]: 'realmId',\n    [EntityType.IDENTITY_PROVIDER]: 'realmId',\n    [EntityType.IDENTITY_PROVIDER_ACCOUNT]: 'userRealmId',\n    [EntityType.IDENTITY_PROVIDER_ATTRIBUTE]: 'realmId',\n    [EntityType.IDENTITY_PROVIDER_ATTRIBUTE_MAPPING]: 'providerRealmId',\n    [EntityType.IDENTITY_PROVIDER_PERMISSION_MAPPING]: 'providerRealmId',\n    [EntityType.IDENTITY_PROVIDER_ROLE_MAPPING]: 'providerRealmId',\n    [EntityType.KEY]: 'realmId',\n    [EntityType.POLICY]: 'realmId',\n    [EntityType.POLICY_ATTRIBUTE]: 'realmId',\n    [EntityType.PERMISSION]: 'realmId',\n    [EntityType.PERMISSION_POLICY]: 'permissionRealmId',\n    [EntityType.REALM]: 'id',\n    [EntityType.ROLE]: 'realmId',\n    [EntityType.ROLE_ATTRIBUTE]: 'realmId',\n    [EntityType.ROLE_PERMISSION]: 'roleRealmId',\n    [EntityType.SCOPE]: 'realmId',\n    [EntityType.SESSION]: 'realmId',\n    [EntityType.TRUST_ANCHOR]: 'realmId',\n    [EntityType.USER]: 'realmId',\n    [EntityType.USER_ATTRIBUTE]: 'realmId',\n    [EntityType.USER_AUTHENTICATOR]: 'realmId',\n    [EntityType.USER_PERMISSION]: 'userRealmId',\n    [EntityType.USER_ROLE]: 'userRealmId',\n};\n\n/**\n * Bridges every entity create/update/delete published on the\n * DomainEventPublisher bus into the auth_events audit table (scope `entity`).\n */\nexport class EntityEventHandler implements IDomainEventHandler {\n    protected eventService : IEventService;\n\n    protected requestContext? : () => EventRequestContext | undefined;\n\n    protected options : EntityEventHandlerOptions;\n\n    constructor(ctx: EntityEventHandlerContext) {\n        this.eventService = ctx.eventService;\n        this.requestContext = ctx.requestContext;\n        this.options = ctx.options ?? {};\n    }\n\n    async handle(ctx: DomainEventPublishContext): Promise<void> {\n        try {\n            // recursion guard — no event subscriber exists today (the\n            // auth_events entity is deliberately subscriber-less), so this is\n            // defense in depth against an audit-write feedback loop.\n            if (ctx.content.type === 'event') {\n                return;\n            }\n\n            const name = ENTITY_EVENT_NAME_MAP[ctx.content.event];\n            if (!name) {\n                return;\n            }\n\n            const refId = ctx.content.data?.id ?? null;\n            const realmIdCurrent = resolveEntityRealmId(ctx.content.type, ctx.content.data);\n            const realmId = typeof realmIdCurrent === 'undefined' ?\n                (resolveEntityRealmId(ctx.content.type, ctx.dataPrevious) ?? null) :\n                realmIdCurrent;\n\n            const requestContext = this.requestContext ?\n                this.requestContext() :\n                undefined;\n\n            let data : Record<string, any> | null = null;\n            if (name === EventName.UPDATED && isObject(ctx.content.data) && isObject(ctx.dataPrevious)) {\n                const diff = buildEntityDiff(ctx.content.data, ctx.dataPrevious);\n                if (Object.keys(diff).length > 0) {\n                    data = { diff };\n                }\n            }\n\n            await this.eventService.record({\n                scope: EventScope.ENTITY,\n                name,\n                refType: ctx.content.type,\n                refId,\n                realmId,\n                actorType: requestContext?.actorType ?? null,\n                actorId: requestContext?.actorId ?? null,\n                actorName: requestContext?.actorName ?? null,\n                sessionId: requestContext?.sessionId ?? null,\n                requestPath: requestContext?.requestPath ?? null,\n                requestMethod: requestContext?.requestMethod ?? null,\n                requestIpAddress: requestContext?.requestIpAddress ?? null,\n                requestUserAgent: requestContext?.requestUserAgent ?? null,\n                data,\n                retentionDays: this.options.retentionDays,\n            });\n        } catch {\n            // record() never throws, but the bridge itself must also never\n            // fail the originating publish.\n        }\n    }\n}\n\nfunction resolveEntityRealmId(\n    type: string,\n    data: unknown,\n): string | null | undefined {\n    if (!isObject(data)) {\n        return undefined;\n    }\n\n    const key = ENTITY_REALM_KEY_MAP[type as `${EntityType}`] ?? 'realmId';\n    if (!hasOwnProperty(data, key)) {\n        return undefined;\n    }\n\n    return typeof data[key] === 'string' ? data[key] : null;\n}\n"],"mappings":";;;;;;;AA4BA,MAAMO,wBAAyD;EAC1DP,uBAAuBQ,UAAUN,UAAUM;EAC3CR,uBAAuBS,UAAUP,UAAUO;EAC3CT,uBAAuBU,UAAUR,UAAUQ;AAChD;AAEA,MAAMC,uBAAyD;EAC1DV,WAAWW,SAAS;EACpBX,WAAWY,oBAAoB;EAC/BZ,WAAWa,cAAc;EACzBb,WAAWc,eAAe;EAC1Bd,WAAWe,UAAU;EAIrBf,WAAWgB,gBAAgB;EAC3BhB,WAAWiB,QAAQ;EACnBjB,WAAWkB,oBAAoB;EAC/BlB,WAAWmB,4BAA4B;EACvCnB,WAAWoB,8BAA8B;EACzCpB,WAAWqB,sCAAsC;EACjDrB,WAAWsB,uCAAuC;EAClDtB,WAAWuB,iCAAiC;EAC5CvB,WAAWwB,MAAM;EACjBxB,WAAWyB,SAAS;EACpBzB,WAAW0B,mBAAmB;EAC9B1B,WAAW2B,aAAa;EACxB3B,WAAW4B,oBAAoB;EAC/B5B,WAAW6B,QAAQ;EACnB7B,WAAW8B,OAAO;EAClB9B,WAAW+B,iBAAiB;EAC5B/B,WAAWgC,kBAAkB;EAC7BhC,WAAWiC,QAAQ;EACnBjC,WAAWkC,UAAU;EACrBlC,WAAWmC,eAAe;EAC1BnC,WAAWoC,OAAO;EAClBpC,WAAWqC,iBAAiB;EAC5BrC,WAAWsC,qBAAqB;EAChCtC,WAAWuC,kBAAkB;EAC7BvC,WAAWwC,YAAY;AAC5B;;;;GAMA,IAAaC,qBAAb,MAAaA;CACCC;CAEAC;CAEAC;CAEV,YAAYC,KAAgC;EACxC,KAAKH,eAAeG,IAAIH;EACxB,KAAKC,iBAAiBE,IAAIF;EAC1B,KAAKC,UAAUC,IAAID,WAAW,CAAC;CACnC;CAEA,MAAME,OAAOD,KAA+C;EACxD,IAAI;GAIA,IAAIA,IAAIE,QAAQC,SAAS,SACrB;GAGJ,MAAMC,OAAO3C,sBAAsBuC,IAAIE,QAAQG;GAC/C,IAAI,CAACD,MACD;GAGJ,MAAME,QAAQN,IAAIE,QAAQK,MAAMC,MAAM;GACtC,MAAMC,iBAAiBC,qBAAqBV,IAAIE,QAAQC,MAAMH,IAAIE,QAAQK,IAAI;GAC9E,MAAMI,UAAU,OAAOF,mBAAmB,cACrCC,qBAAqBV,IAAIE,QAAQC,MAAMH,IAAIY,YAAY,KAAK,OAC7DH;GAEJ,MAAMX,iBAAiB,KAAKA,iBACxB,KAAKA,eAAc,IACnBe,KAAAA;GAEJ,IAAIN,OAAoC;GACxC,IAAIH,SAAShD,UAAUO,WAAWJ,SAASyC,IAAIE,QAAQK,IAAI,KAAKhD,SAASyC,IAAIY,YAAY,GAAG;IACxF,MAAME,OAAOtD,gBAAgBwC,IAAIE,QAAQK,MAAMP,IAAIY,YAAY;IAC/D,IAAIG,OAAOC,KAAKF,IAAAA,CAAAA,CAAMG,SAAS,GAC3BV,OAAO,EAAEO,KAAK;GAEtB;GAEA,MAAM,KAAKjB,aAAaqB,OAAO;IAC3BC,OAAO9D,WAAW+D;IAClBhB;IACAiB,SAASrB,IAAIE,QAAQC;IACrBG;IACAK;IACAW,WAAWxB,gBAAgBwB,aAAa;IACxCC,SAASzB,gBAAgByB,WAAW;IACpCC,WAAW1B,gBAAgB0B,aAAa;IACxCC,WAAW3B,gBAAgB2B,aAAa;IACxCC,aAAa5B,gBAAgB4B,eAAe;IAC5CC,eAAe7B,gBAAgB6B,iBAAiB;IAChDC,kBAAkB9B,gBAAgB8B,oBAAoB;IACtDC,kBAAkB/B,gBAAgB+B,oBAAoB;IACtDtB;IACAuB,eAAe,KAAK/B,QAAQ+B;GAChC,CAAA;EACJ,QAAQ,CAGR;CACJ;AACJ;AAEA,SAASpB,qBACLP,MACAI,MAAa;CAEb,IAAI,CAAChD,SAASgD,IAAAA,GACV;CAGJ,MAAMwB,MAAMlE,qBAAqBsC,SAA4B;CAC7D,IAAI,CAAC7C,eAAeiD,MAAMwB,GAAAA,GACtB;CAGJ,OAAO,OAAOxB,KAAKwB,SAAS,WAAWxB,KAAKwB,OAAO;AACvD"}

package/dist/core/entities/event/sanitize.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sanitize.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/event/sanitize.ts"],"names":[],"mappings":"AAqGA,wBAAgB,iBAAiB,CAC7B,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,IAAI,GACnC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,IAAI,CA6B5B"}
+{"version":3,"file":"sanitize.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/event/sanitize.ts"],"names":[],"mappings":"AAwGA,wBAAgB,iBAAiB,CAC7B,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,IAAI,GACnC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,IAAI,CA6B5B"}

package/dist/core/entities/event/sanitize.mjs

@@ -11,10 +11,13 @@ import { isObject } from "@authup/kit";
 * objects and arrays are dropped outright, so a nested structure can never
 * smuggle a secret past the boundary (this subsumes a denylist: password,
 * client_secret, code, code_verifier, *token* etc. are simply never listed).
-* sessionId / jti / revokedSessionId are opaque correlation ids, not PII.
+* jti is an opaque correlation id, not PII (a session id is not listed here:
+* it rides the dedicated `sessionId` column, never the data bag).
 * name / use / status / enabled / force describe key & trust-anchor lifecycle
 * operations (issue #3269) — canonical identifiers and enum/flag metadata,
 * never material. kind is the MFA authenticator kind (totp/email/...).
+* providerId / providerName identify the identity provider on account link &
+* unlink events (plan 091): metadata only, never external tokens.
 *
 * The single structured exception is `diff` (entity-CRUD bridge): it survives
 * only as a one-level object of `{ next, previous }` scalar pairs, keys
@@ -30,15 +33,15 @@ import { isObject } from "@authup/kit";
 	"reason",
 	"clientName",
 	"realmName",
-	"sessionId",
 	"jti",
-	"revokedSessionId",
 	"name",
 	"use",
 	"status",
 	"enabled",
 	"force",
-	"kind"
+	"kind",
+	"providerId",
+	"providerName"
 ];
 const DATA_VALUE_MAX_LENGTH = 512;
 function isDiffScalar(value) {

package/dist/core/entities/event/sanitize.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"sanitize.mjs","names":["isObject","EVENT_DIFF_SECRET_KEY_REGEX","DATA_KEY_ALLOW_LIST","DATA_VALUE_MAX_LENGTH","isDiffScalar","value","truncateDiffScalar","length","substring","sanitizeDiff","input","output","key","entry","Object","entries","test","next","previous","keys","sanitizeEventData","diff"],"sources":["../../../../src/core/entities/event/sanitize.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { isObject } from '@authup/kit';\nimport { EVENT_DIFF_SECRET_KEY_REGEX } from './diff.ts';\n\n/**\n * The central PII/credential write boundary for event context data.\n *\n * Allowlist-first: only these keys survive, and only with scalar values —\n * objects and arrays are dropped outright, so a nested structure can never\n * smuggle a secret past the boundary (this subsumes a denylist: password,\n * client_secret, code, code_verifier, *token* etc. are simply never listed).\n * sessionId / jti / revokedSessionId are opaque correlation ids, not PII.\n * name / use / status / enabled / force describe key & trust-anchor lifecycle\n * operations (issue #3269) — canonical identifiers and enum/flag metadata,\n * never material. kind is the MFA authenticator kind (totp/email/...).\n *\n * The single structured exception is `diff` (entity-CRUD bridge): it survives\n * only as a one-level object of `{ next, previous }` scalar pairs, keys\n * re-checked against the diff secret denylist — the write boundary stays the\n * choke point even though buildEntityDiff pre-sanitizes.\n */\nconst DATA_KEY_ALLOW_LIST = [\n    'grantType',\n    'scope',\n    'responseType',\n    'prompt',\n    'error',\n    'errorCode',\n    'reason',\n    'clientName',\n    'realmName',\n    'sessionId',\n    'jti',\n    'revokedSessionId',\n    'name',\n    'use',\n    'status',\n    'enabled',\n    'force',\n    'kind',\n] as const;\n\nconst DATA_VALUE_MAX_LENGTH = 512;\n\nfunction isDiffScalar(value: unknown): value is string | number | boolean | null {\n    return value === null ||\n        typeof value === 'string' ||\n        typeof value === 'number' ||\n        typeof value === 'boolean';\n}\n\nfunction truncateDiffScalar(\n    value: string | number | boolean | null,\n): string | number | boolean | null {\n    if (typeof value === 'string' && value.length > DATA_VALUE_MAX_LENGTH) {\n        return value.substring(0, DATA_VALUE_MAX_LENGTH);\n    }\n\n    return value;\n}\n\nfunction sanitizeDiff(input: unknown): Record<string, any> | null {\n    if (!isObject(input)) {\n        return null;\n    }\n\n    const output: Record<string, any> = {};\n\n    for (const [key, entry] of Object.entries(input)) {\n        if (EVENT_DIFF_SECRET_KEY_REGEX.test(key)) {\n            continue;\n        }\n\n        if (!isObject(entry)) {\n            continue;\n        }\n\n        const { next, previous } = entry;\n        if (!isDiffScalar(next) || !isDiffScalar(previous)) {\n            continue;\n        }\n\n        output[key] = {\n            next: truncateDiffScalar(next),\n            previous: truncateDiffScalar(previous),\n        };\n    }\n\n    if (Object.keys(output).length === 0) {\n        return null;\n    }\n\n    return output;\n}\n\nexport function sanitizeEventData(\n    input?: Record<string, any> | null,\n): Record<string, any> | null {\n    if (!input) {\n        return null;\n    }\n\n    const output: Record<string, any> = {};\n\n    for (const key of DATA_KEY_ALLOW_LIST) {\n        const value = input[key];\n\n        if (typeof value === 'string') {\n            output[key] = value.length > DATA_VALUE_MAX_LENGTH ?\n                value.substring(0, DATA_VALUE_MAX_LENGTH) :\n                value;\n        } else if (typeof value === 'number' || typeof value === 'boolean') {\n            output[key] = value;\n        }\n    }\n\n    const diff = sanitizeDiff(input.diff);\n    if (diff) {\n        output.diff = diff;\n    }\n\n    if (Object.keys(output).length === 0) {\n        return null;\n    }\n\n    return output;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;GA2BA,MAAME,sBAAsB;CACxB;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACH;AAED,MAAMC,wBAAwB;AAE9B,SAASC,aAAaC,OAAc;CAChC,OAAOA,UAAU,QACb,OAAOA,UAAU,YACjB,OAAOA,UAAU,YACjB,OAAOA,UAAU;AACzB;AAEA,SAASC,mBACLD,OAAuC;CAEvC,IAAI,OAAOA,UAAU,YAAYA,MAAME,SAASJ,uBAC5C,OAAOE,MAAMG,UAAU,GAAGL,qBAAAA;CAG9B,OAAOE;AACX;AAEA,SAASI,aAAaC,OAAc;CAChC,IAAI,CAACV,SAASU,KAAAA,GACV,OAAO;CAGX,MAAMC,SAA8B,CAAC;CAErC,KAAK,MAAM,CAACC,KAAKC,UAAUC,OAAOC,QAAQL,KAAAA,GAAQ;EAC9C,IAAIT,4BAA4Be,KAAKJ,GAAAA,GACjC;EAGJ,IAAI,CAACZ,SAASa,KAAAA,GACV;EAGJ,MAAM,EAAEI,MAAMC,aAAaL;EAC3B,IAAI,CAACT,aAAaa,IAAAA,KAAS,CAACb,aAAac,QAAAA,GACrC;EAGJP,OAAOC,OAAO;GACVK,MAAMX,mBAAmBW,IAAAA;GACzBC,UAAUZ,mBAAmBY,QAAAA;EACjC;CACJ;CAEA,IAAIJ,OAAOK,KAAKR,MAAAA,CAAAA,CAAQJ,WAAW,GAC/B,OAAO;CAGX,OAAOI;AACX;AAEA,SAAgBS,kBACZV,OAAkC;CAElC,IAAI,CAACA,OACD,OAAO;CAGX,MAAMC,SAA8B,CAAC;CAErC,KAAK,MAAMC,OAAOV,qBAAqB;EACnC,MAAMG,QAAQK,MAAME;EAEpB,IAAI,OAAOP,UAAU,UACjBM,OAAOC,OAAOP,MAAME,SAASJ,wBACzBE,MAAMG,UAAU,GAAGL,qBAAAA,IACnBE;OACD,IAAI,OAAOA,UAAU,YAAY,OAAOA,UAAU,WACrDM,OAAOC,OAAOP;CAEtB;CAEA,MAAMgB,OAAOZ,aAAaC,MAAMW,IAAI;CACpC,IAAIA,MACAV,OAAOU,OAAOA;CAGlB,IAAIP,OAAOK,KAAKR,MAAAA,CAAAA,CAAQJ,WAAW,GAC/B,OAAO;CAGX,OAAOI;AACX"}
+{"version":3,"file":"sanitize.mjs","names":["isObject","EVENT_DIFF_SECRET_KEY_REGEX","DATA_KEY_ALLOW_LIST","DATA_VALUE_MAX_LENGTH","isDiffScalar","value","truncateDiffScalar","length","substring","sanitizeDiff","input","output","key","entry","Object","entries","test","next","previous","keys","sanitizeEventData","diff"],"sources":["../../../../src/core/entities/event/sanitize.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { isObject } from '@authup/kit';\nimport { EVENT_DIFF_SECRET_KEY_REGEX } from './diff.ts';\n\n/**\n * The central PII/credential write boundary for event context data.\n *\n * Allowlist-first: only these keys survive, and only with scalar values —\n * objects and arrays are dropped outright, so a nested structure can never\n * smuggle a secret past the boundary (this subsumes a denylist: password,\n * client_secret, code, code_verifier, *token* etc. are simply never listed).\n * jti is an opaque correlation id, not PII (a session id is not listed here:\n * it rides the dedicated `sessionId` column, never the data bag).\n * name / use / status / enabled / force describe key & trust-anchor lifecycle\n * operations (issue #3269) — canonical identifiers and enum/flag metadata,\n * never material. kind is the MFA authenticator kind (totp/email/...).\n * providerId / providerName identify the identity provider on account link &\n * unlink events (plan 091): metadata only, never external tokens.\n *\n * The single structured exception is `diff` (entity-CRUD bridge): it survives\n * only as a one-level object of `{ next, previous }` scalar pairs, keys\n * re-checked against the diff secret denylist — the write boundary stays the\n * choke point even though buildEntityDiff pre-sanitizes.\n */\nconst DATA_KEY_ALLOW_LIST = [\n    'grantType',\n    'scope',\n    'responseType',\n    'prompt',\n    'error',\n    'errorCode',\n    'reason',\n    'clientName',\n    'realmName',\n    'jti',\n    'name',\n    'use',\n    'status',\n    'enabled',\n    'force',\n    'kind',\n    'providerId',\n    'providerName',\n] as const;\n\nconst DATA_VALUE_MAX_LENGTH = 512;\n\nfunction isDiffScalar(value: unknown): value is string | number | boolean | null {\n    return value === null ||\n        typeof value === 'string' ||\n        typeof value === 'number' ||\n        typeof value === 'boolean';\n}\n\nfunction truncateDiffScalar(\n    value: string | number | boolean | null,\n): string | number | boolean | null {\n    if (typeof value === 'string' && value.length > DATA_VALUE_MAX_LENGTH) {\n        return value.substring(0, DATA_VALUE_MAX_LENGTH);\n    }\n\n    return value;\n}\n\nfunction sanitizeDiff(input: unknown): Record<string, any> | null {\n    if (!isObject(input)) {\n        return null;\n    }\n\n    const output: Record<string, any> = {};\n\n    for (const [key, entry] of Object.entries(input)) {\n        if (EVENT_DIFF_SECRET_KEY_REGEX.test(key)) {\n            continue;\n        }\n\n        if (!isObject(entry)) {\n            continue;\n        }\n\n        const { next, previous } = entry;\n        if (!isDiffScalar(next) || !isDiffScalar(previous)) {\n            continue;\n        }\n\n        output[key] = {\n            next: truncateDiffScalar(next),\n            previous: truncateDiffScalar(previous),\n        };\n    }\n\n    if (Object.keys(output).length === 0) {\n        return null;\n    }\n\n    return output;\n}\n\nexport function sanitizeEventData(\n    input?: Record<string, any> | null,\n): Record<string, any> | null {\n    if (!input) {\n        return null;\n    }\n\n    const output: Record<string, any> = {};\n\n    for (const key of DATA_KEY_ALLOW_LIST) {\n        const value = input[key];\n\n        if (typeof value === 'string') {\n            output[key] = value.length > DATA_VALUE_MAX_LENGTH ?\n                value.substring(0, DATA_VALUE_MAX_LENGTH) :\n                value;\n        } else if (typeof value === 'number' || typeof value === 'boolean') {\n            output[key] = value;\n        }\n    }\n\n    const diff = sanitizeDiff(input.diff);\n    if (diff) {\n        output.diff = diff;\n    }\n\n    if (Object.keys(output).length === 0) {\n        return null;\n    }\n\n    return output;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;GA8BA,MAAME,sBAAsB;CACxB;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACH;AAED,MAAMC,wBAAwB;AAE9B,SAASC,aAAaC,OAAc;CAChC,OAAOA,UAAU,QACb,OAAOA,UAAU,YACjB,OAAOA,UAAU,YACjB,OAAOA,UAAU;AACzB;AAEA,SAASC,mBACLD,OAAuC;CAEvC,IAAI,OAAOA,UAAU,YAAYA,MAAME,SAASJ,uBAC5C,OAAOE,MAAMG,UAAU,GAAGL,qBAAAA;CAG9B,OAAOE;AACX;AAEA,SAASI,aAAaC,OAAc;CAChC,IAAI,CAACV,SAASU,KAAAA,GACV,OAAO;CAGX,MAAMC,SAA8B,CAAC;CAErC,KAAK,MAAM,CAACC,KAAKC,UAAUC,OAAOC,QAAQL,KAAAA,GAAQ;EAC9C,IAAIT,4BAA4Be,KAAKJ,GAAAA,GACjC;EAGJ,IAAI,CAACZ,SAASa,KAAAA,GACV;EAGJ,MAAM,EAAEI,MAAMC,aAAaL;EAC3B,IAAI,CAACT,aAAaa,IAAAA,KAAS,CAACb,aAAac,QAAAA,GACrC;EAGJP,OAAOC,OAAO;GACVK,MAAMX,mBAAmBW,IAAAA;GACzBC,UAAUZ,mBAAmBY,QAAAA;EACjC;CACJ;CAEA,IAAIJ,OAAOK,KAAKR,MAAAA,CAAAA,CAAQJ,WAAW,GAC/B,OAAO;CAGX,OAAOI;AACX;AAEA,SAAgBS,kBACZV,OAAkC;CAElC,IAAI,CAACA,OACD,OAAO;CAGX,MAAMC,SAA8B,CAAC;CAErC,KAAK,MAAMC,OAAOV,qBAAqB;EACnC,MAAMG,QAAQK,MAAME;EAEpB,IAAI,OAAOP,UAAU,UACjBM,OAAOC,OAAOP,MAAME,SAASJ,wBACzBE,MAAMG,UAAU,GAAGL,qBAAAA,IACnBE;OACD,IAAI,OAAOA,UAAU,YAAY,OAAOA,UAAU,WACrDM,OAAOC,OAAOP;CAEtB;CAEA,MAAMgB,OAAOZ,aAAaC,MAAMW,IAAI;CACpC,IAAIA,MACAV,OAAOU,OAAOA;CAGlB,IAAIP,OAAOK,KAAKR,MAAAA,CAAAA,CAAQJ,WAAW,GAC/B,OAAO;CAGX,OAAOI;AACX"}

package/dist/core/entities/event/schema.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/event/schema.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAG9C,eAAO,MAAM,WAAW,0CA4CtB,CAAC"}
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/event/schema.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAG9C,eAAO,MAAM,WAAW,0CAgEtB,CAAC"}

package/dist/core/entities/event/schema.mjs

@@ -6,6 +6,27 @@ import { defineSchema } from "@rapiq/core";
 //#region src/core/entities/event/schema.ts
 const eventSchema = defineSchema({
 	name: EntityType.EVENT,
+	indexes: [
+		["id"],
+		["name", "scope"],
+		["scope"],
+		["refType", "refId"],
+		["refId"],
+		["clientId"],
+		["sessionId"],
+		["actorType"],
+		["actorId"],
+		[
+			"actorName",
+			"requestIpAddress",
+			"createdAt"
+		],
+		["requestIpAddress"],
+		["realmId"],
+		["expiring"],
+		["realmId", "createdAt"],
+		["createdAt"]
+	],
 	fields: { allowed: [
 		"id",
 		"scope",
@@ -13,6 +34,7 @@ const eventSchema = defineSchema({
 		"refType",
 		"refId",
 		"clientId",
+		"sessionId",
 		"actorType",
 		"actorId",
 		"actorName",
@@ -26,23 +48,30 @@ const eventSchema = defineSchema({
 		"expiresAt",
 		"createdAt"
 	] },
-	filters: { allowed: [
-		"id",
-		"scope",
-		"name",
-		"refType",
-		"refId",
-		"clientId",
-		"actorType",
-		"actorId",
-		"actorName",
-		"requestIpAddress",
-		"realmId",
-		"expiring",
-		"createdAt"
-	] },
+	filters: {
+		allowed: [
+			"id",
+			"scope",
+			"name",
+			"refType",
+			"refId",
+			"clientId",
+			"sessionId",
+			"actorType",
+			"actorId",
+			"actorName",
+			"requestIpAddress",
+			"realmId",
+			"expiring",
+			"createdAt"
+		],
+		indexed: true
+	},
 	relations: { allowed: [] },
-	sort: { allowed: ["createdAt"] },
+	sorts: {
+		allowed: ["createdAt"],
+		indexed: true
+	},
 	pagination: { maxLimit: 50 }
 });
 //#endregion

package/dist/core/entities/event/schema.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"schema.mjs","names":["defineSchema","EntityType","eventSchema","name","EVENT","fields","allowed","filters","relations","sort","pagination","maxLimit"],"sources":["../../../../src/core/entities/event/schema.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { defineSchema } from '@rapiq/core';\nimport type { Event } from '@authup/core-kit';\nimport { EntityType } from '@authup/core-kit';\n\nexport const eventSchema = defineSchema<Event>({\n    name: EntityType.EVENT,\n    fields: {\n        allowed: [\n            'id',\n            'scope',\n            'name',\n            'refType',\n            'refId',\n            'clientId',\n            'actorType',\n            'actorId',\n            'actorName',\n            'requestPath',\n            'requestMethod',\n            'requestIpAddress',\n            'requestUserAgent',\n            'realmId',\n            'data',\n            'expiring',\n            'expiresAt',\n            'createdAt',\n        ],\n    },\n    filters: {\n        allowed: [\n            'id',\n            'scope',\n            'name',\n            'refType',\n            'refId',\n            'clientId',\n            'actorType',\n            'actorId',\n            'actorName',\n            'requestIpAddress',\n            'realmId',\n            'expiring',\n            'createdAt',\n        ], \n    },\n    relations: { allowed: [] },\n    sort: { allowed: ['createdAt'] },\n    pagination: { maxLimit: 50 },\n});\n"],"mappings":";;;;;;AAWA,MAAaE,cAAcF,aAAoB;CAC3CG,MAAMF,WAAWG;CACjBC,QAAQ,EACJC,SAAS;EACL;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;CACH,EACL;CACAC,SAAS,EACLD,SAAS;EACL;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;CACH,EACL;CACAE,WAAW,EAAEF,SAAS,CAAA,EAAG;CACzBG,MAAM,EAAEH,SAAS,CAAC,WAAY,EAAC;CAC/BI,YAAY,EAAEC,UAAU,GAAG;AAC/B,CAAA"}
+{"version":3,"file":"schema.mjs","names":["defineSchema","EntityType","eventSchema","name","EVENT","indexes","fields","allowed","filters","indexed","relations","sorts","pagination","maxLimit"],"sources":["../../../../src/core/entities/event/schema.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { defineSchema } from '@rapiq/core';\nimport type { Event } from '@authup/core-kit';\nimport { EntityType } from '@authup/core-kit';\n\nexport const eventSchema = defineSchema<Event>({\n    name: EntityType.EVENT,\n    indexes: [\n        ['id'],\n        ['name', 'scope'],\n        ['scope'],\n        ['refType', 'refId'],\n        ['refId'],\n        ['clientId'],\n        ['sessionId'],\n        ['actorType'],\n        ['actorId'],\n        ['actorName', 'requestIpAddress', 'createdAt'],\n        ['requestIpAddress'],\n        ['realmId'],\n        ['expiring'],\n        ['realmId', 'createdAt'],\n        ['createdAt'],\n    ],\n    fields: {\n        allowed: [\n            'id',\n            'scope',\n            'name',\n            'refType',\n            'refId',\n            'clientId',\n            'sessionId',\n            'actorType',\n            'actorId',\n            'actorName',\n            'requestPath',\n            'requestMethod',\n            'requestIpAddress',\n            'requestUserAgent',\n            'realmId',\n            'data',\n            'expiring',\n            'expiresAt',\n            'createdAt',\n        ],\n    },\n    filters: {\n        allowed: [\n            'id',\n            'scope',\n            'name',\n            'refType',\n            'refId',\n            'clientId',\n            'sessionId',\n            'actorType',\n            'actorId',\n            'actorName',\n            'requestIpAddress',\n            'realmId',\n            'expiring',\n            'createdAt',\n        ],\n        indexed: true,\n    },\n    relations: { allowed: [] },\n    sorts: { allowed: ['createdAt'], indexed: true },\n    pagination: { maxLimit: 50 },\n});\n"],"mappings":";;;;;;AAWA,MAAaE,cAAcF,aAAoB;CAC3CG,MAAMF,WAAWG;CACjBC,SAAS;EACL,CAAC,IAAK;EACN,CAAC,QAAQ,OAAQ;EACjB,CAAC,OAAQ;EACT,CAAC,WAAW,OAAQ;EACpB,CAAC,OAAQ;EACT,CAAC,UAAW;EACZ,CAAC,WAAY;EACb,CAAC,WAAY;EACb,CAAC,SAAU;EACX;GAAC;GAAa;GAAoB;EAAY;EAC9C,CAAC,kBAAmB;EACpB,CAAC,SAAU;EACX,CAAC,UAAW;EACZ,CAAC,WAAW,WAAY;EACxB,CAAC,WAAY;CAChB;CACDC,QAAQ,EACJC,SAAS;EACL;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;CACH,EACL;CACAC,SAAS;EACLD,SAAS;GACL;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;EACH;EACDE,SAAS;CACb;CACAC,WAAW,EAAEH,SAAS,CAAA,EAAG;CACzBI,OAAO;EAAEJ,SAAS,CAAC,WAAY;EAAEE,SAAS;CAAK;CAC/CG,YAAY,EAAEC,UAAU,GAAG;AAC/B,CAAA"}

package/dist/core/entities/event/service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/event/service.ts"],"names":[],"mappings":"AAgBA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAE9C,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAC3D,OAAO,KAAK,EAAE,YAAY,EAAE,8BAA8B,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAG/F,OAAO,KAAK,EACR,mBAAmB,EACnB,gBAAgB,EAChB,mBAAmB,EACnB,uBAAuB,EACvB,gBAAgB,EAChB,aAAa,EAChB,MAAM,YAAY,CAAC;AAIpB,MAAM,MAAM,mBAAmB,GAAG;IAC9B,UAAU,EAAE,gBAAgB,CAAC;IAC7B,OAAO,CAAC,EAAE,mBAAmB,CAAC;IAC9B,MAAM,CAAC,EAAE,MAAM,CAAC;CACnB,CAAC;AAIF,qBAAa,YAAa,SAAQ,qBAAsB,YAAW,aAAa;IAC5E,SAAS,CAAC,UAAU,EAAE,gBAAgB,CAAC;IAEvC,SAAS,CAAC,OAAO,EAAE,mBAAmB,CAAC;IAEvC,SAAS,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;gBAEd,GAAG,EAAE,mBAAmB;IAQpC,SAAS,CAAC,SAAS,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO;cAOhD,YAAY,CAAC,KAAK,EAAE,YAAY,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC;cAmB3E,qBAAqB,CAAC,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,mBAAmB,GAAG,SAAS,CAAC;IA8B9F,MAAM,CAAC,KAAK,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC;IAqD9C,OAAO,CACT,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC1B,KAAK,EAAE,YAAY,EACnB,OAAO,GAAE,uBAA4B,GACtC,OAAO,CAAC,8BAA8B,CAAC,KAAK,CAAC,CAAC;IAsF3C,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,OAAO,GAAE,uBAA4B,GAAG,OAAO,CAAC,KAAK,CAAC;CAmBvG"}
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/event/service.ts"],"names":[],"mappings":"AAgBA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAE9C,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAC3D,OAAO,KAAK,EAAE,YAAY,EAAE,8BAA8B,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAG/F,OAAO,KAAK,EACR,mBAAmB,EACnB,gBAAgB,EAChB,mBAAmB,EACnB,uBAAuB,EACvB,gBAAgB,EAChB,aAAa,EAChB,MAAM,YAAY,CAAC;AAIpB,MAAM,MAAM,mBAAmB,GAAG;IAC9B,UAAU,EAAE,gBAAgB,CAAC;IAC7B,OAAO,CAAC,EAAE,mBAAmB,CAAC;IAC9B,MAAM,CAAC,EAAE,MAAM,CAAC;CACnB,CAAC;AAIF,qBAAa,YAAa,SAAQ,qBAAsB,YAAW,aAAa;IAC5E,SAAS,CAAC,UAAU,EAAE,gBAAgB,CAAC;IAEvC,SAAS,CAAC,OAAO,EAAE,mBAAmB,CAAC;IAEvC,SAAS,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;gBAEd,GAAG,EAAE,mBAAmB;IAQpC,SAAS,CAAC,SAAS,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO;cAOhD,YAAY,CAAC,KAAK,EAAE,YAAY,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC;cAmB3E,qBAAqB,CAAC,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,mBAAmB,GAAG,SAAS,CAAC;IA8B9F,MAAM,CAAC,KAAK,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC;IAuD9C,OAAO,CACT,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC1B,KAAK,EAAE,YAAY,EACnB,OAAO,GAAE,uBAA4B,GACtC,OAAO,CAAC,8BAA8B,CAAC,KAAK,CAAC,CAAC;IAsF3C,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,OAAO,GAAE,uBAA4B,GAAG,OAAO,CAAC,KAAK,CAAC;CAmBvG"}

package/dist/core/entities/event/service.mjs

@@ -67,6 +67,7 @@ var EventService = class extends AbstractEntityService {
 			refType: input.refType ?? null,
 			refId: input.refId ?? null,
 			clientId: input.clientId ?? null,
+			sessionId: input.sessionId ?? null,
 			actorType: input.actorType ?? null,
 			actorId: input.actorId ?? null,
 			realmId: input.realmId ?? null,
@@ -82,6 +83,7 @@ var EventService = class extends AbstractEntityService {
 				refType: truncate(input.refType, 64),
 				refId: truncate(input.refId, 64),
 				clientId: input.clientId ?? null,
+				sessionId: input.sessionId ?? null,
 				actorType: input.actorType ?? null,
 				actorId: input.actorId ?? null,
 				actorName: truncate(input.actorName, 128),

package/dist/core/entities/event/service.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"service.mjs","names":["randomUUID","BuiltInPolicyType","definePolicyData","and","eq","inArray","or","PermissionName","EntityNotFoundError","AbstractEntityService","EVENT_ACTOR_NAME_MAX_LENGTH","EVENT_LOG_RETENTION_DAYS_DEFAULT","sanitizeEventData","appendQueryConditions","decodeQuery","eventSchema","DAY_IN_MS","EventService","repository","options","logger","ctx","isOwnedBy","entity","actor","identity","actorId","data","id","actorType","type","canReadRealm","realmId","permissionEvaluator","evaluate","name","EVENT_READ","REALM_MATCH","policiesIncluded","COMPOSITE","PERMISSION_BINDING","resolveReadVisibility","actorRealmId","getActorRealmId","foreignRealmId","undefined","realmIds","push","owner","record","input","info","scope","refType","refId","clientId","enabled","retentionDays","create","truncate","actorName","requestPath","requestMethod","requestIpAddress","requestUserAgent","expiring","expiresAt","Date","now","toISOString","save","warn","getMany","query","parsed","schema","canReadAll","preEvaluate","e","findMany","compiled","compile","verdict","ownership","scoped","condition","visibility","entities","meta","ATTRIBUTES","resourceRealmMatch","total","length","getOne","findOneById","value","maxLength","substring"],"sources":["../../../../src/core/entities/event/service.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { randomUUID } from 'node:crypto';\nimport { BuiltInPolicyType, definePolicyData } from '@authup/access';\nimport {\n    and, \n    eq, \n    inArray, \n    or,\n} from '@rapiq/core';\nimport { PermissionName } from '@authup/core-kit';\nimport type { Event } from '@authup/core-kit';\nimport { EntityNotFoundError } from '@authup/errors';\nimport { AbstractEntityService } from '@authup/server-kit';\nimport type { ActorContext, EntityRepositoryFindManyResult, Logger } from '@authup/server-kit';\nimport { EVENT_ACTOR_NAME_MAX_LENGTH, EVENT_LOG_RETENTION_DAYS_DEFAULT } from './constants.ts';\nimport { sanitizeEventData } from './sanitize.ts';\nimport type {\n    EventReadVisibility,\n    EventRecordInput,\n    EventServiceOptions,\n    EventServiceReadOptions,\n    IEventRepository,\n    IEventService,\n} from './types.ts';\nimport { appendQueryConditions, decodeQuery } from '../../query/index.ts';\nimport { eventSchema } from './schema.ts';\n\nexport type EventServiceContext = {\n    repository: IEventRepository,\n    options?: EventServiceOptions,\n    logger?: Logger,\n};\n\nconst DAY_IN_MS = 86_400_000;\n\nexport class EventService extends AbstractEntityService implements IEventService {\n    protected repository: IEventRepository;\n\n    protected options: EventServiceOptions;\n\n    protected logger?: Logger;\n\n    constructor(ctx: EventServiceContext) {\n        super();\n\n        this.repository = ctx.repository;\n        this.options = ctx.options ?? {};\n        this.logger = ctx.logger;\n    }\n\n    protected isOwnedBy(entity: Event, actor: ActorContext): boolean {\n        return !!actor.identity &&\n            !!entity.actorId &&\n            entity.actorId === actor.identity.data.id &&\n            entity.actorType === actor.identity.type;\n    }\n\n    protected async canReadRealm(actor: ActorContext, realmId: string | null): Promise<boolean> {\n        try {\n            await actor.permissionEvaluator.evaluate({\n                name: PermissionName.EVENT_READ,\n                data: definePolicyData({ [BuiltInPolicyType.REALM_MATCH]: realmId }),\n                options: {\n                    policiesIncluded: [\n                        BuiltInPolicyType.COMPOSITE,\n                        BuiltInPolicyType.PERMISSION_BINDING,\n                        BuiltInPolicyType.REALM_MATCH,\n                    ],\n                },\n            });\n            return true;\n        } catch {\n            return false;\n        }\n    }\n\n    protected async resolveReadVisibility(actor: ActorContext): Promise<EventReadVisibility | undefined> {\n        const actorRealmId = this.getActorRealmId(actor);\n        let foreignRealmId = randomUUID();\n        while (foreignRealmId === actorRealmId) {\n            foreignRealmId = randomUUID();\n        }\n\n        if (await this.canReadRealm(actor, foreignRealmId)) {\n            return undefined;\n        }\n\n        const realmIds: Array<string | null> = [];\n        if (actorRealmId && await this.canReadRealm(actor, actorRealmId)) {\n            realmIds.push(actorRealmId);\n        }\n        if (await this.canReadRealm(actor, null)) {\n            realmIds.push(null);\n        }\n\n        return {\n            realmIds,\n            ...(actor.identity ? {\n                owner: {\n                    actorId: actor.identity.data.id,\n                    actorType: actor.identity.type,\n                },\n            } : {}),\n        };\n    }\n\n    async record(input: EventRecordInput): Promise<void> {\n        const data = sanitizeEventData(input.data);\n\n        // complementary structured log line — fires even when persistence is\n        // disabled, so a SIEM/Loki pipeline can pick the events up for free.\n        this.logger?.info(`audit: ${input.scope}.${input.name}`, {\n            scope: input.scope,\n            name: input.name,\n            refType: input.refType ?? null,\n            refId: input.refId ?? null,\n            clientId: input.clientId ?? null,\n            actorType: input.actorType ?? null,\n            actorId: input.actorId ?? null,\n            realmId: input.realmId ?? null,\n            ...(data ? { data } : {}),\n        });\n\n        if (this.options.enabled === false) {\n            return;\n        }\n\n        try {\n            const retentionDays = input.retentionDays ?? this.options.retentionDays ?? EVENT_LOG_RETENTION_DAYS_DEFAULT;\n\n            const entity = this.repository.create({\n                id: randomUUID(),\n                scope: input.scope,\n                name: input.name,\n                refType: truncate(input.refType, 64),\n                refId: truncate(input.refId, 64),\n                clientId: input.clientId ?? null,\n                actorType: input.actorType ?? null,\n                actorId: input.actorId ?? null,\n                actorName: truncate(input.actorName, EVENT_ACTOR_NAME_MAX_LENGTH),\n                requestPath: truncate(input.requestPath, 256),\n                requestMethod: truncate(input.requestMethod, 10),\n                requestIpAddress: truncate(input.requestIpAddress, 45),\n                requestUserAgent: truncate(input.requestUserAgent, 512),\n                realmId: input.realmId ?? null,\n                data,\n                expiring: retentionDays > 0,\n                expiresAt: retentionDays > 0 ?\n                    new Date(Date.now() + (retentionDays * DAY_IN_MS)).toISOString() :\n                    null,\n            });\n\n            await this.repository.save(entity);\n        } catch {\n            // an audit write failure must never fail the originating operation\n            this.logger?.warn(`Recording the audit event ${input.scope}.${input.name} failed.`);\n        }\n    }\n\n    async getMany(\n        query: Record<string, any>,\n        actor: ActorContext,\n        options: EventServiceReadOptions = {},\n    ): Promise<EntityRepositoryFindManyResult<Event>> {\n        const parsed = await decodeQuery(query, { schema: eventSchema, actor });\n\n        let canReadAll = true;\n        try {\n            await actor.permissionEvaluator.preEvaluate({ name: PermissionName.EVENT_READ });\n        } catch (e) {\n            if (!actor.identity) {\n                throw e;\n            }\n            canReadAll = false;\n        }\n\n        if (!canReadAll) {\n            // self-service: only the actor's own rows (\"my sign-in history\")\n            return this.repository.findMany(parsed, {\n                owner: {\n                    actorId: actor.identity!.data.id,\n                    actorType: actor.identity!.type,\n                },\n                ...(options.realmId ? { realmId: options.realmId } : {}),\n            });\n        }\n\n        // Compile EVENT_READ into a row condition (#3286 phase 3). Own rows are\n        // always readable, so ownership composes as an OR-alternative — the whole\n        // gate runs as WHERE (replacing the probe-based visibility derivation, and\n        // additionally covering junction ATTRIBUTES policies the probe excluded)\n        // and pagination/totals stay exact. A non-expressible policy falls back to\n        // the probe + per-row loop below.\n        const compiled = await actor.permissionEvaluator.compile({ name: PermissionName.EVENT_READ });\n        if (compiled.verdict !== 'post') {\n            const ownership = actor.identity ?\n                and(eq('actorId', actor.identity.data.id), eq('actorType', actor.identity.type)) :\n                null;\n\n            let scoped = parsed;\n            if (compiled.verdict === 'deny') {\n                scoped = appendQueryConditions(parsed, ownership ?? inArray('id', []));\n            } else if (compiled.verdict === 'conditional') {\n                scoped = appendQueryConditions(\n                    parsed,\n                    ownership ? or(ownership, compiled.condition) : compiled.condition,\n                );\n            }\n\n            return this.repository.findMany(scoped, { ...(options.realmId ? { realmId: options.realmId } : {}) });\n        }\n\n        const visibility = await this.resolveReadVisibility(actor);\n        const { data: entities, meta } = await this.repository.findMany(parsed, {\n            ...(options.realmId ? { realmId: options.realmId } : {}),\n            ...(visibility ? { visibility } : {}),\n        });\n\n        const data: Event[] = [];\n\n        for (const entity of entities) {\n            if (this.isOwnedBy(entity, actor)) {\n                data.push(entity);\n                continue;\n            }\n\n            try {\n                await actor.permissionEvaluator.evaluate({\n                    name: PermissionName.EVENT_READ,\n                    data: definePolicyData({\n                        [BuiltInPolicyType.ATTRIBUTES]: entity,\n                        ...this.resourceRealmMatch(entity),\n                    }),\n                });\n                data.push(entity);\n            } catch {\n                continue;\n            }\n        }\n\n        return {\n            data,\n            meta: {\n                ...meta,\n                total: meta.total - (entities.length - data.length),\n            },\n        };\n    }\n\n    async getOne(id: string, actor: ActorContext, options: EventServiceReadOptions = {}): Promise<Event> {\n        const entity = await this.repository.findOneById(id);\n        if (!entity || (options.realmId && entity.realmId !== options.realmId)) {\n            throw new EntityNotFoundError();\n        }\n\n        if (!this.isOwnedBy(entity, actor)) {\n            await actor.permissionEvaluator.preEvaluate({ name: PermissionName.EVENT_READ });\n            await actor.permissionEvaluator.evaluate({\n                name: PermissionName.EVENT_READ,\n                data: definePolicyData({\n                    [BuiltInPolicyType.ATTRIBUTES]: entity,\n                    ...this.resourceRealmMatch(entity),\n                }),\n            });\n        }\n\n        return entity;\n    }\n}\n\nfunction truncate(value: string | null | undefined, maxLength: number): string | null {\n    if (typeof value !== 'string') {\n        return null;\n    }\n\n    if (value.length <= maxLength) {\n        return value;\n    }\n\n    return value.substring(0, maxLength);\n}\n"],"mappings":";;;;;;;;;;;;;;;AAuCA,MAAMgB,YAAY;AAElB,IAAaC,eAAb,cAAkCR,sBAAAA;CACpBS;CAEAC;CAEAC;CAEV,YAAYC,KAA0B;EAClC,MAAK;EAEL,KAAKH,aAAaG,IAAIH;EACtB,KAAKC,UAAUE,IAAIF,WAAW,CAAC;EAC/B,KAAKC,SAASC,IAAID;CACtB;CAEUE,UAAUC,QAAeC,OAA8B;EAC7D,OAAO,CAAC,CAACA,MAAMC,YACX,CAAC,CAACF,OAAOG,WACTH,OAAOG,YAAYF,MAAMC,SAASE,KAAKC,MACvCL,OAAOM,cAAcL,MAAMC,SAASK;CAC5C;CAEA,MAAgBC,aAAaP,OAAqBQ,SAA0C;EACxF,IAAI;GACA,MAAMR,MAAMS,oBAAoBC,SAAS;IACrCC,MAAM5B,eAAe6B;IACrBT,MAAMzB,iBAAiB,GAAGD,kBAAkBoC,cAAcL,QAAQ,CAAA;IAClEb,SAAS,EACLmB,kBAAkB;KACdrC,kBAAkBsC;KAClBtC,kBAAkBuC;KAClBvC,kBAAkBoC;IACrB,EACL;GACJ,CAAA;GACA,OAAO;EACX,QAAQ;GACJ,OAAO;EACX;CACJ;CAEA,MAAgBI,sBAAsBjB,OAA+D;EACjG,MAAMkB,eAAe,KAAKC,gBAAgBnB,KAAAA;EAC1C,IAAIoB,iBAAiB5C,WAAAA;EACrB,OAAO4C,mBAAmBF,cACtBE,iBAAiB5C,WAAAA;EAGrB,IAAI,MAAM,KAAK+B,aAAaP,OAAOoB,cAAAA,GAC/B;EAGJ,MAAME,WAAiC,CAAA;EACvC,IAAIJ,gBAAgB,MAAM,KAAKX,aAAaP,OAAOkB,YAAAA,GAC/CI,SAASC,KAAKL,YAAAA;EAElB,IAAI,MAAM,KAAKX,aAAaP,OAAO,IAAA,GAC/BsB,SAASC,KAAK,IAAA;EAGlB,OAAO;GACHD;GACA,GAAItB,MAAMC,WAAW,EACjBuB,OAAO;IACHtB,SAASF,MAAMC,SAASE,KAAKC;IAC7BC,WAAWL,MAAMC,SAASK;GAC9B,EACJ,IAAI,CAAC;EACT;CACJ;CAEA,MAAMmB,OAAOC,OAAwC;EACjD,MAAMvB,OAAOf,kBAAkBsC,MAAMvB,IAAI;EAIzC,KAAKP,QAAQ+B,KAAK,UAAUD,MAAME,MAAM,GAAGF,MAAMf,QAAQ;GACrDiB,OAAOF,MAAME;GACbjB,MAAMe,MAAMf;GACZkB,SAASH,MAAMG,WAAW;GAC1BC,OAAOJ,MAAMI,SAAS;GACtBC,UAAUL,MAAMK,YAAY;GAC5B1B,WAAWqB,MAAMrB,aAAa;GAC9BH,SAASwB,MAAMxB,WAAW;GAC1BM,SAASkB,MAAMlB,WAAW;GAC1B,GAAIL,OAAO,EAAEA,KAAK,IAAI,CAAC;EAC3B,CAAA;EAEA,IAAI,KAAKR,QAAQqC,YAAY,OACzB;EAGJ,IAAI;GACA,MAAMC,gBAAgBP,MAAMO,iBAAiB,KAAKtC,QAAQsC,iBAAAA;GAE1D,MAAMlC,SAAS,KAAKL,WAAWwC,OAAO;IAClC9B,IAAI5B,WAAAA;IACJoD,OAAOF,MAAME;IACbjB,MAAMe,MAAMf;IACZkB,SAASM,SAAST,MAAMG,SAAS,EAAA;IACjCC,OAAOK,SAAST,MAAMI,OAAO,EAAA;IAC7BC,UAAUL,MAAMK,YAAY;IAC5B1B,WAAWqB,MAAMrB,aAAa;IAC9BH,SAASwB,MAAMxB,WAAW;IAC1BkC,WAAWD,SAAST,MAAMU,WAAAA,GAAWlD;IACrCmD,aAAaF,SAAST,MAAMW,aAAa,GAAA;IACzCC,eAAeH,SAAST,MAAMY,eAAe,EAAA;IAC7CC,kBAAkBJ,SAAST,MAAMa,kBAAkB,EAAA;IACnDC,kBAAkBL,SAAST,MAAMc,kBAAkB,GAAA;IACnDhC,SAASkB,MAAMlB,WAAW;IAC1BL;IACAsC,UAAUR,gBAAgB;IAC1BS,WAAWT,gBAAgB,IACvB,IAAIU,KAAKA,KAAKC,IAAG,IAAMX,gBAAgBzC,SAAAA,CAAAA,CAAYqD,YAAW,IAC9D;GACR,CAAA;GAEA,MAAM,KAAKnD,WAAWoD,KAAK/C,MAAAA;EAC/B,QAAQ;GAEJ,KAAKH,QAAQmD,KAAK,6BAA6BrB,MAAME,MAAM,GAAGF,MAAMf,KAAK,SAAS;EACtF;CACJ;CAEA,MAAMqC,QACFC,OACAjD,OACAL,UAAmC,CAAC,GACU;EAC9C,MAAMuD,SAAS,MAAM5D,YAAY2D,OAAO;GAAEE,QAAQ5D;GAAaS;EAAM,CAAA;EAErE,IAAIoD,aAAa;EACjB,IAAI;GACA,MAAMpD,MAAMS,oBAAoB4C,YAAY,EAAE1C,MAAM5B,eAAe6B,WAAW,CAAA;EAClF,SAAS0C,GAAG;GACR,IAAI,CAACtD,MAAMC,UACP,MAAMqD;GAEVF,aAAa;EACjB;EAEA,IAAI,CAACA,YAED,OAAO,KAAK1D,WAAW6D,SAASL,QAAQ;GACpC1B,OAAO;IACHtB,SAASF,MAAMC,SAAUE,KAAKC;IAC9BC,WAAWL,MAAMC,SAAUK;GAC/B;GACA,GAAIX,QAAQa,UAAU,EAAEA,SAASb,QAAQa,QAAQ,IAAI,CAAC;EAC1D,CAAA;EASJ,MAAMgD,WAAW,MAAMxD,MAAMS,oBAAoBgD,QAAQ,EAAE9C,MAAM5B,eAAe6B,WAAW,CAAA;EAC3F,IAAI4C,SAASE,YAAY,QAAQ;GAC7B,MAAMC,YAAY3D,MAAMC,WACpBtB,IAAIC,GAAG,WAAWoB,MAAMC,SAASE,KAAKC,EAAE,GAAGxB,GAAG,aAAaoB,MAAMC,SAASK,IAAI,CAAA,IAC9E;GAEJ,IAAIsD,SAASV;GACb,IAAIM,SAASE,YAAY,QACrBE,SAASvE,sBAAsB6D,QAAQS,aAAa9E,QAAQ,MAAM,CAAA,CAAE,CAAA;QACjE,IAAI2E,SAASE,YAAY,eAC5BE,SAASvE,sBACL6D,QACAS,YAAY7E,GAAG6E,WAAWH,SAASK,SAAS,IAAIL,SAASK,SAAS;GAI1E,OAAO,KAAKnE,WAAW6D,SAASK,QAAQ,EAAE,GAAIjE,QAAQa,UAAU,EAAEA,SAASb,QAAQa,QAAQ,IAAI,CAAC,EAAG,CAAA;EACvG;EAEA,MAAMsD,aAAa,MAAM,KAAK7C,sBAAsBjB,KAAAA;EACpD,MAAM,EAAEG,MAAM4D,UAAUC,SAAS,MAAM,KAAKtE,WAAW6D,SAASL,QAAQ;GACpE,GAAIvD,QAAQa,UAAU,EAAEA,SAASb,QAAQa,QAAQ,IAAI,CAAC;GACtD,GAAIsD,aAAa,EAAEA,WAAW,IAAI,CAAC;EACvC,CAAA;EAEA,MAAM3D,OAAgB,CAAA;EAEtB,KAAK,MAAMJ,UAAUgE,UAAU;GAC3B,IAAI,KAAKjE,UAAUC,QAAQC,KAAAA,GAAQ;IAC/BG,KAAKoB,KAAKxB,MAAAA;IACV;GACJ;GAEA,IAAI;IACA,MAAMC,MAAMS,oBAAoBC,SAAS;KACrCC,MAAM5B,eAAe6B;KACrBT,MAAMzB,iBAAiB;OAClBD,kBAAkBwF,aAAalE;MAChC,GAAG,KAAKmE,mBAAmBnE,MAAAA;KAC/B,CAAA;IACJ,CAAA;IACAI,KAAKoB,KAAKxB,MAAAA;GACd,QAAQ;IACJ;GACJ;EACJ;EAEA,OAAO;GACHI;GACA6D,MAAM;IACF,GAAGA;IACHG,OAAOH,KAAKG,SAASJ,SAASK,SAASjE,KAAKiE;GAChD;EACJ;CACJ;CAEA,MAAMC,OAAOjE,IAAYJ,OAAqBL,UAAmC,CAAC,GAAmB;EACjG,MAAMI,SAAS,MAAM,KAAKL,WAAW4E,YAAYlE,EAAAA;EACjD,IAAI,CAACL,UAAWJ,QAAQa,WAAWT,OAAOS,YAAYb,QAAQa,SAC1D,MAAM,IAAIxB,oBAAAA;EAGd,IAAI,CAAC,KAAKc,UAAUC,QAAQC,KAAAA,GAAQ;GAChC,MAAMA,MAAMS,oBAAoB4C,YAAY,EAAE1C,MAAM5B,eAAe6B,WAAW,CAAA;GAC9E,MAAMZ,MAAMS,oBAAoBC,SAAS;IACrCC,MAAM5B,eAAe6B;IACrBT,MAAMzB,iBAAiB;MAClBD,kBAAkBwF,aAAalE;KAChC,GAAG,KAAKmE,mBAAmBnE,MAAAA;IAC/B,CAAA;GACJ,CAAA;EACJ;EAEA,OAAOA;CACX;AACJ;AAEA,SAASoC,SAASoC,OAAkCC,WAAiB;CACjE,IAAI,OAAOD,UAAU,UACjB,OAAO;CAGX,IAAIA,MAAMH,UAAUI,WAChB,OAAOD;CAGX,OAAOA,MAAME,UAAU,GAAGD,SAAAA;AAC9B"}
+{"version":3,"file":"service.mjs","names":["randomUUID","BuiltInPolicyType","definePolicyData","and","eq","inArray","or","PermissionName","EntityNotFoundError","AbstractEntityService","EVENT_ACTOR_NAME_MAX_LENGTH","EVENT_LOG_RETENTION_DAYS_DEFAULT","sanitizeEventData","appendQueryConditions","decodeQuery","eventSchema","DAY_IN_MS","EventService","repository","options","logger","ctx","isOwnedBy","entity","actor","identity","actorId","data","id","actorType","type","canReadRealm","realmId","permissionEvaluator","evaluate","name","EVENT_READ","REALM_MATCH","policiesIncluded","COMPOSITE","PERMISSION_BINDING","resolveReadVisibility","actorRealmId","getActorRealmId","foreignRealmId","undefined","realmIds","push","owner","record","input","info","scope","refType","refId","clientId","sessionId","enabled","retentionDays","create","truncate","actorName","requestPath","requestMethod","requestIpAddress","requestUserAgent","expiring","expiresAt","Date","now","toISOString","save","warn","getMany","query","parsed","schema","canReadAll","preEvaluate","e","findMany","compiled","compile","verdict","ownership","scoped","condition","visibility","entities","meta","ATTRIBUTES","resourceRealmMatch","total","length","getOne","findOneById","value","maxLength","substring"],"sources":["../../../../src/core/entities/event/service.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { randomUUID } from 'node:crypto';\nimport { BuiltInPolicyType, definePolicyData } from '@authup/access';\nimport {\n    and, \n    eq, \n    inArray, \n    or,\n} from '@rapiq/core';\nimport { PermissionName } from '@authup/core-kit';\nimport type { Event } from '@authup/core-kit';\nimport { EntityNotFoundError } from '@authup/errors';\nimport { AbstractEntityService } from '@authup/server-kit';\nimport type { ActorContext, EntityRepositoryFindManyResult, Logger } from '@authup/server-kit';\nimport { EVENT_ACTOR_NAME_MAX_LENGTH, EVENT_LOG_RETENTION_DAYS_DEFAULT } from './constants.ts';\nimport { sanitizeEventData } from './sanitize.ts';\nimport type {\n    EventReadVisibility,\n    EventRecordInput,\n    EventServiceOptions,\n    EventServiceReadOptions,\n    IEventRepository,\n    IEventService,\n} from './types.ts';\nimport { appendQueryConditions, decodeQuery } from '../../query/index.ts';\nimport { eventSchema } from './schema.ts';\n\nexport type EventServiceContext = {\n    repository: IEventRepository,\n    options?: EventServiceOptions,\n    logger?: Logger,\n};\n\nconst DAY_IN_MS = 86_400_000;\n\nexport class EventService extends AbstractEntityService implements IEventService {\n    protected repository: IEventRepository;\n\n    protected options: EventServiceOptions;\n\n    protected logger?: Logger;\n\n    constructor(ctx: EventServiceContext) {\n        super();\n\n        this.repository = ctx.repository;\n        this.options = ctx.options ?? {};\n        this.logger = ctx.logger;\n    }\n\n    protected isOwnedBy(entity: Event, actor: ActorContext): boolean {\n        return !!actor.identity &&\n            !!entity.actorId &&\n            entity.actorId === actor.identity.data.id &&\n            entity.actorType === actor.identity.type;\n    }\n\n    protected async canReadRealm(actor: ActorContext, realmId: string | null): Promise<boolean> {\n        try {\n            await actor.permissionEvaluator.evaluate({\n                name: PermissionName.EVENT_READ,\n                data: definePolicyData({ [BuiltInPolicyType.REALM_MATCH]: realmId }),\n                options: {\n                    policiesIncluded: [\n                        BuiltInPolicyType.COMPOSITE,\n                        BuiltInPolicyType.PERMISSION_BINDING,\n                        BuiltInPolicyType.REALM_MATCH,\n                    ],\n                },\n            });\n            return true;\n        } catch {\n            return false;\n        }\n    }\n\n    protected async resolveReadVisibility(actor: ActorContext): Promise<EventReadVisibility | undefined> {\n        const actorRealmId = this.getActorRealmId(actor);\n        let foreignRealmId = randomUUID();\n        while (foreignRealmId === actorRealmId) {\n            foreignRealmId = randomUUID();\n        }\n\n        if (await this.canReadRealm(actor, foreignRealmId)) {\n            return undefined;\n        }\n\n        const realmIds: Array<string | null> = [];\n        if (actorRealmId && await this.canReadRealm(actor, actorRealmId)) {\n            realmIds.push(actorRealmId);\n        }\n        if (await this.canReadRealm(actor, null)) {\n            realmIds.push(null);\n        }\n\n        return {\n            realmIds,\n            ...(actor.identity ? {\n                owner: {\n                    actorId: actor.identity.data.id,\n                    actorType: actor.identity.type,\n                },\n            } : {}),\n        };\n    }\n\n    async record(input: EventRecordInput): Promise<void> {\n        const data = sanitizeEventData(input.data);\n\n        // complementary structured log line — fires even when persistence is\n        // disabled, so a SIEM/Loki pipeline can pick the events up for free.\n        this.logger?.info(`audit: ${input.scope}.${input.name}`, {\n            scope: input.scope,\n            name: input.name,\n            refType: input.refType ?? null,\n            refId: input.refId ?? null,\n            clientId: input.clientId ?? null,\n            sessionId: input.sessionId ?? null,\n            actorType: input.actorType ?? null,\n            actorId: input.actorId ?? null,\n            realmId: input.realmId ?? null,\n            ...(data ? { data } : {}),\n        });\n\n        if (this.options.enabled === false) {\n            return;\n        }\n\n        try {\n            const retentionDays = input.retentionDays ?? this.options.retentionDays ?? EVENT_LOG_RETENTION_DAYS_DEFAULT;\n\n            const entity = this.repository.create({\n                id: randomUUID(),\n                scope: input.scope,\n                name: input.name,\n                refType: truncate(input.refType, 64),\n                refId: truncate(input.refId, 64),\n                clientId: input.clientId ?? null,\n                sessionId: input.sessionId ?? null,\n                actorType: input.actorType ?? null,\n                actorId: input.actorId ?? null,\n                actorName: truncate(input.actorName, EVENT_ACTOR_NAME_MAX_LENGTH),\n                requestPath: truncate(input.requestPath, 256),\n                requestMethod: truncate(input.requestMethod, 10),\n                requestIpAddress: truncate(input.requestIpAddress, 45),\n                requestUserAgent: truncate(input.requestUserAgent, 512),\n                realmId: input.realmId ?? null,\n                data,\n                expiring: retentionDays > 0,\n                expiresAt: retentionDays > 0 ?\n                    new Date(Date.now() + (retentionDays * DAY_IN_MS)).toISOString() :\n                    null,\n            });\n\n            await this.repository.save(entity);\n        } catch {\n            // an audit write failure must never fail the originating operation\n            this.logger?.warn(`Recording the audit event ${input.scope}.${input.name} failed.`);\n        }\n    }\n\n    async getMany(\n        query: Record<string, any>,\n        actor: ActorContext,\n        options: EventServiceReadOptions = {},\n    ): Promise<EntityRepositoryFindManyResult<Event>> {\n        const parsed = await decodeQuery(query, { schema: eventSchema, actor });\n\n        let canReadAll = true;\n        try {\n            await actor.permissionEvaluator.preEvaluate({ name: PermissionName.EVENT_READ });\n        } catch (e) {\n            if (!actor.identity) {\n                throw e;\n            }\n            canReadAll = false;\n        }\n\n        if (!canReadAll) {\n            // self-service: only the actor's own rows (\"my sign-in history\")\n            return this.repository.findMany(parsed, {\n                owner: {\n                    actorId: actor.identity!.data.id,\n                    actorType: actor.identity!.type,\n                },\n                ...(options.realmId ? { realmId: options.realmId } : {}),\n            });\n        }\n\n        // Compile EVENT_READ into a row condition (#3286 phase 3). Own rows are\n        // always readable, so ownership composes as an OR-alternative — the whole\n        // gate runs as WHERE (replacing the probe-based visibility derivation, and\n        // additionally covering junction ATTRIBUTES policies the probe excluded)\n        // and pagination/totals stay exact. A non-expressible policy falls back to\n        // the probe + per-row loop below.\n        const compiled = await actor.permissionEvaluator.compile({ name: PermissionName.EVENT_READ });\n        if (compiled.verdict !== 'post') {\n            const ownership = actor.identity ?\n                and(eq('actorId', actor.identity.data.id), eq('actorType', actor.identity.type)) :\n                null;\n\n            let scoped = parsed;\n            if (compiled.verdict === 'deny') {\n                scoped = appendQueryConditions(parsed, ownership ?? inArray('id', []));\n            } else if (compiled.verdict === 'conditional') {\n                scoped = appendQueryConditions(\n                    parsed,\n                    ownership ? or(ownership, compiled.condition) : compiled.condition,\n                );\n            }\n\n            return this.repository.findMany(scoped, { ...(options.realmId ? { realmId: options.realmId } : {}) });\n        }\n\n        const visibility = await this.resolveReadVisibility(actor);\n        const { data: entities, meta } = await this.repository.findMany(parsed, {\n            ...(options.realmId ? { realmId: options.realmId } : {}),\n            ...(visibility ? { visibility } : {}),\n        });\n\n        const data: Event[] = [];\n\n        for (const entity of entities) {\n            if (this.isOwnedBy(entity, actor)) {\n                data.push(entity);\n                continue;\n            }\n\n            try {\n                await actor.permissionEvaluator.evaluate({\n                    name: PermissionName.EVENT_READ,\n                    data: definePolicyData({\n                        [BuiltInPolicyType.ATTRIBUTES]: entity,\n                        ...this.resourceRealmMatch(entity),\n                    }),\n                });\n                data.push(entity);\n            } catch {\n                continue;\n            }\n        }\n\n        return {\n            data,\n            meta: {\n                ...meta,\n                total: meta.total - (entities.length - data.length),\n            },\n        };\n    }\n\n    async getOne(id: string, actor: ActorContext, options: EventServiceReadOptions = {}): Promise<Event> {\n        const entity = await this.repository.findOneById(id);\n        if (!entity || (options.realmId && entity.realmId !== options.realmId)) {\n            throw new EntityNotFoundError();\n        }\n\n        if (!this.isOwnedBy(entity, actor)) {\n            await actor.permissionEvaluator.preEvaluate({ name: PermissionName.EVENT_READ });\n            await actor.permissionEvaluator.evaluate({\n                name: PermissionName.EVENT_READ,\n                data: definePolicyData({\n                    [BuiltInPolicyType.ATTRIBUTES]: entity,\n                    ...this.resourceRealmMatch(entity),\n                }),\n            });\n        }\n\n        return entity;\n    }\n}\n\nfunction truncate(value: string | null | undefined, maxLength: number): string | null {\n    if (typeof value !== 'string') {\n        return null;\n    }\n\n    if (value.length <= maxLength) {\n        return value;\n    }\n\n    return value.substring(0, maxLength);\n}\n"],"mappings":";;;;;;;;;;;;;;;AAuCA,MAAMgB,YAAY;AAElB,IAAaC,eAAb,cAAkCR,sBAAAA;CACpBS;CAEAC;CAEAC;CAEV,YAAYC,KAA0B;EAClC,MAAK;EAEL,KAAKH,aAAaG,IAAIH;EACtB,KAAKC,UAAUE,IAAIF,WAAW,CAAC;EAC/B,KAAKC,SAASC,IAAID;CACtB;CAEUE,UAAUC,QAAeC,OAA8B;EAC7D,OAAO,CAAC,CAACA,MAAMC,YACX,CAAC,CAACF,OAAOG,WACTH,OAAOG,YAAYF,MAAMC,SAASE,KAAKC,MACvCL,OAAOM,cAAcL,MAAMC,SAASK;CAC5C;CAEA,MAAgBC,aAAaP,OAAqBQ,SAA0C;EACxF,IAAI;GACA,MAAMR,MAAMS,oBAAoBC,SAAS;IACrCC,MAAM5B,eAAe6B;IACrBT,MAAMzB,iBAAiB,GAAGD,kBAAkBoC,cAAcL,QAAQ,CAAA;IAClEb,SAAS,EACLmB,kBAAkB;KACdrC,kBAAkBsC;KAClBtC,kBAAkBuC;KAClBvC,kBAAkBoC;IACrB,EACL;GACJ,CAAA;GACA,OAAO;EACX,QAAQ;GACJ,OAAO;EACX;CACJ;CAEA,MAAgBI,sBAAsBjB,OAA+D;EACjG,MAAMkB,eAAe,KAAKC,gBAAgBnB,KAAAA;EAC1C,IAAIoB,iBAAiB5C,WAAAA;EACrB,OAAO4C,mBAAmBF,cACtBE,iBAAiB5C,WAAAA;EAGrB,IAAI,MAAM,KAAK+B,aAAaP,OAAOoB,cAAAA,GAC/B;EAGJ,MAAME,WAAiC,CAAA;EACvC,IAAIJ,gBAAgB,MAAM,KAAKX,aAAaP,OAAOkB,YAAAA,GAC/CI,SAASC,KAAKL,YAAAA;EAElB,IAAI,MAAM,KAAKX,aAAaP,OAAO,IAAA,GAC/BsB,SAASC,KAAK,IAAA;EAGlB,OAAO;GACHD;GACA,GAAItB,MAAMC,WAAW,EACjBuB,OAAO;IACHtB,SAASF,MAAMC,SAASE,KAAKC;IAC7BC,WAAWL,MAAMC,SAASK;GAC9B,EACJ,IAAI,CAAC;EACT;CACJ;CAEA,MAAMmB,OAAOC,OAAwC;EACjD,MAAMvB,OAAOf,kBAAkBsC,MAAMvB,IAAI;EAIzC,KAAKP,QAAQ+B,KAAK,UAAUD,MAAME,MAAM,GAAGF,MAAMf,QAAQ;GACrDiB,OAAOF,MAAME;GACbjB,MAAMe,MAAMf;GACZkB,SAASH,MAAMG,WAAW;GAC1BC,OAAOJ,MAAMI,SAAS;GACtBC,UAAUL,MAAMK,YAAY;GAC5BC,WAAWN,MAAMM,aAAa;GAC9B3B,WAAWqB,MAAMrB,aAAa;GAC9BH,SAASwB,MAAMxB,WAAW;GAC1BM,SAASkB,MAAMlB,WAAW;GAC1B,GAAIL,OAAO,EAAEA,KAAK,IAAI,CAAC;EAC3B,CAAA;EAEA,IAAI,KAAKR,QAAQsC,YAAY,OACzB;EAGJ,IAAI;GACA,MAAMC,gBAAgBR,MAAMQ,iBAAiB,KAAKvC,QAAQuC,iBAAAA;GAE1D,MAAMnC,SAAS,KAAKL,WAAWyC,OAAO;IAClC/B,IAAI5B,WAAAA;IACJoD,OAAOF,MAAME;IACbjB,MAAMe,MAAMf;IACZkB,SAASO,SAASV,MAAMG,SAAS,EAAA;IACjCC,OAAOM,SAASV,MAAMI,OAAO,EAAA;IAC7BC,UAAUL,MAAMK,YAAY;IAC5BC,WAAWN,MAAMM,aAAa;IAC9B3B,WAAWqB,MAAMrB,aAAa;IAC9BH,SAASwB,MAAMxB,WAAW;IAC1BmC,WAAWD,SAASV,MAAMW,WAAAA,GAAWnD;IACrCoD,aAAaF,SAASV,MAAMY,aAAa,GAAA;IACzCC,eAAeH,SAASV,MAAMa,eAAe,EAAA;IAC7CC,kBAAkBJ,SAASV,MAAMc,kBAAkB,EAAA;IACnDC,kBAAkBL,SAASV,MAAMe,kBAAkB,GAAA;IACnDjC,SAASkB,MAAMlB,WAAW;IAC1BL;IACAuC,UAAUR,gBAAgB;IAC1BS,WAAWT,gBAAgB,IACvB,IAAIU,KAAKA,KAAKC,IAAG,IAAMX,gBAAgB1C,SAAAA,CAAAA,CAAYsD,YAAW,IAC9D;GACR,CAAA;GAEA,MAAM,KAAKpD,WAAWqD,KAAKhD,MAAAA;EAC/B,QAAQ;GAEJ,KAAKH,QAAQoD,KAAK,6BAA6BtB,MAAME,MAAM,GAAGF,MAAMf,KAAK,SAAS;EACtF;CACJ;CAEA,MAAMsC,QACFC,OACAlD,OACAL,UAAmC,CAAC,GACU;EAC9C,MAAMwD,SAAS,MAAM7D,YAAY4D,OAAO;GAAEE,QAAQ7D;GAAaS;EAAM,CAAA;EAErE,IAAIqD,aAAa;EACjB,IAAI;GACA,MAAMrD,MAAMS,oBAAoB6C,YAAY,EAAE3C,MAAM5B,eAAe6B,WAAW,CAAA;EAClF,SAAS2C,GAAG;GACR,IAAI,CAACvD,MAAMC,UACP,MAAMsD;GAEVF,aAAa;EACjB;EAEA,IAAI,CAACA,YAED,OAAO,KAAK3D,WAAW8D,SAASL,QAAQ;GACpC3B,OAAO;IACHtB,SAASF,MAAMC,SAAUE,KAAKC;IAC9BC,WAAWL,MAAMC,SAAUK;GAC/B;GACA,GAAIX,QAAQa,UAAU,EAAEA,SAASb,QAAQa,QAAQ,IAAI,CAAC;EAC1D,CAAA;EASJ,MAAMiD,WAAW,MAAMzD,MAAMS,oBAAoBiD,QAAQ,EAAE/C,MAAM5B,eAAe6B,WAAW,CAAA;EAC3F,IAAI6C,SAASE,YAAY,QAAQ;GAC7B,MAAMC,YAAY5D,MAAMC,WACpBtB,IAAIC,GAAG,WAAWoB,MAAMC,SAASE,KAAKC,EAAE,GAAGxB,GAAG,aAAaoB,MAAMC,SAASK,IAAI,CAAA,IAC9E;GAEJ,IAAIuD,SAASV;GACb,IAAIM,SAASE,YAAY,QACrBE,SAASxE,sBAAsB8D,QAAQS,aAAa/E,QAAQ,MAAM,CAAA,CAAE,CAAA;QACjE,IAAI4E,SAASE,YAAY,eAC5BE,SAASxE,sBACL8D,QACAS,YAAY9E,GAAG8E,WAAWH,SAASK,SAAS,IAAIL,SAASK,SAAS;GAI1E,OAAO,KAAKpE,WAAW8D,SAASK,QAAQ,EAAE,GAAIlE,QAAQa,UAAU,EAAEA,SAASb,QAAQa,QAAQ,IAAI,CAAC,EAAG,CAAA;EACvG;EAEA,MAAMuD,aAAa,MAAM,KAAK9C,sBAAsBjB,KAAAA;EACpD,MAAM,EAAEG,MAAM6D,UAAUC,SAAS,MAAM,KAAKvE,WAAW8D,SAASL,QAAQ;GACpE,GAAIxD,QAAQa,UAAU,EAAEA,SAASb,QAAQa,QAAQ,IAAI,CAAC;GACtD,GAAIuD,aAAa,EAAEA,WAAW,IAAI,CAAC;EACvC,CAAA;EAEA,MAAM5D,OAAgB,CAAA;EAEtB,KAAK,MAAMJ,UAAUiE,UAAU;GAC3B,IAAI,KAAKlE,UAAUC,QAAQC,KAAAA,GAAQ;IAC/BG,KAAKoB,KAAKxB,MAAAA;IACV;GACJ;GAEA,IAAI;IACA,MAAMC,MAAMS,oBAAoBC,SAAS;KACrCC,MAAM5B,eAAe6B;KACrBT,MAAMzB,iBAAiB;OAClBD,kBAAkByF,aAAanE;MAChC,GAAG,KAAKoE,mBAAmBpE,MAAAA;KAC/B,CAAA;IACJ,CAAA;IACAI,KAAKoB,KAAKxB,MAAAA;GACd,QAAQ;IACJ;GACJ;EACJ;EAEA,OAAO;GACHI;GACA8D,MAAM;IACF,GAAGA;IACHG,OAAOH,KAAKG,SAASJ,SAASK,SAASlE,KAAKkE;GAChD;EACJ;CACJ;CAEA,MAAMC,OAAOlE,IAAYJ,OAAqBL,UAAmC,CAAC,GAAmB;EACjG,MAAMI,SAAS,MAAM,KAAKL,WAAW6E,YAAYnE,EAAAA;EACjD,IAAI,CAACL,UAAWJ,QAAQa,WAAWT,OAAOS,YAAYb,QAAQa,SAC1D,MAAM,IAAIxB,oBAAAA;EAGd,IAAI,CAAC,KAAKc,UAAUC,QAAQC,KAAAA,GAAQ;GAChC,MAAMA,MAAMS,oBAAoB6C,YAAY,EAAE3C,MAAM5B,eAAe6B,WAAW,CAAA;GAC9E,MAAMZ,MAAMS,oBAAoBC,SAAS;IACrCC,MAAM5B,eAAe6B;IACrBT,MAAMzB,iBAAiB;MAClBD,kBAAkByF,aAAanE;KAChC,GAAG,KAAKoE,mBAAmBpE,MAAAA;IAC/B,CAAA;GACJ,CAAA;EACJ;EAEA,OAAOA;CACX;AACJ;AAEA,SAASqC,SAASoC,OAAkCC,WAAiB;CACjE,IAAI,OAAOD,UAAU,UACjB,OAAO;CAGX,IAAIA,MAAMH,UAAUI,WAChB,OAAOD;CAGX,OAAOA,MAAME,UAAU,GAAGD,SAAAA;AAC9B"}

package/dist/core/entities/event/types.d.ts

@@ -52,6 +52,7 @@ export type EventRecordInput = {
     refType?: string | null;
     refId?: string | null;
     clientId?: string | null;
+    sessionId?: string | null;
     actorType?: `${IdentityType}` | null;
     actorId?: string | null;
     actorName?: string | null;
@@ -93,6 +94,7 @@ export type EventRequestContext = {
     actorType: `${IdentityType}` | null;
     actorId: string | null;
     actorName: string | null;
+    sessionId: string | null;
     requestPath: string | null;
     requestMethod: string | null;
     requestIpAddress: string | null;

package/dist/core/entities/event/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/event/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EACR,KAAK,EACL,SAAS,EACT,UAAU,EACV,YAAY,EACf,MAAM,kBAAkB,CAAC;AAC1B,OAAO,KAAK,EAAE,YAAY,EAAE,8BAA8B,EAAE,MAAM,oBAAoB,CAAC;AACvF,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAE1C,MAAM,MAAM,UAAU,GAAG;IACrB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;CACrB,CAAC;AAEF,MAAM,MAAM,mBAAmB,GAAG;IAC9B,KAAK,CAAC,EAAE,UAAU,CAAC;IACnB,QAAQ,EAAE,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;CAClC,CAAC;AAEF,MAAM,MAAM,oBAAoB,GAAG;IAC/B;;;OAGG;IACH,KAAK,CAAC,EAAE,UAAU,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;OAIG;IACH,UAAU,CAAC,EAAE,mBAAmB,CAAC;CACpC,CAAC;AAEF,MAAM,MAAM,sBAAsB,GAAG;IACjC,IAAI,EAAE,GAAG,SAAS,EAAE,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB;;OAEG;IACH,KAAK,EAAE,MAAM,CAAC;CACjB,CAAC;AAEF,MAAM,WAAW,gBAAgB;IAC7B,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,KAAK,CAAC,GAAG,KAAK,CAAC;IAEpC,IAAI,CAAC,MAAM,EAAE,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;IAEpC,QAAQ,CACJ,KAAK,EAAE,MAAM,EACb,OAAO,CAAC,EAAE,oBAAoB,GAC/B,OAAO,CAAC,8BAA8B,CAAC,KAAK,CAAC,CAAC,CAAC;IAElD,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC;IAE/C,WAAW,CAAC,MAAM,EAAE,sBAAsB,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAE7D;;;;OAIG;IACH,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CAC/C;AAED,MAAM,MAAM,gBAAgB,GAAG;IAC3B,KAAK,EAAE,GAAG,UAAU,EAAE,CAAC;IACvB,IAAI,EAAE,GAAG,SAAS,EAAE,CAAC;IACrB,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,SAAS,CAAC,EAAE,GAAG,YAAY,EAAE,GAAG,IAAI,CAAC;IACrC,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,IAAI,CAAC;IAClC;;;;OAIG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;CAC1B,CAAC;AAEF,MAAM,MAAM,mBAAmB,GAAG;IAC9B;;;OAGG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;;OAGG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;CAC1B,CAAC;AAEF,MAAM,MAAM,uBAAuB,GAAG;IAClC,OAAO,CAAC,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF;;;;;GAKG;AACH,MAAM,MAAM,mBAAmB,GAAG;IAC9B,SAAS,EAAE,GAAG,YAAY,EAAE,GAAG,IAAI,CAAC;IACpC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;CACnC,CAAC;AAEF,MAAM,MAAM,yBAAyB,GAAG;IACpC;;;OAGG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;CAC1B,CAAC;AAEF,MAAM,WAAW,aAAa;IAC1B;;;OAGG;IACH,MAAM,CAAC,KAAK,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE/C;;;;OAIG;IACH,OAAO,CACH,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC1B,KAAK,EAAE,YAAY,EACnB,OAAO,CAAC,EAAE,uBAAuB,GAClC,OAAO,CAAC,8BAA8B,CAAC,KAAK,CAAC,CAAC,CAAC;IAElD;;OAEG;IACH,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,OAAO,CAAC,EAAE,uBAAuB,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;CAC9F"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/event/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EACR,KAAK,EACL,SAAS,EACT,UAAU,EACV,YAAY,EACf,MAAM,kBAAkB,CAAC;AAC1B,OAAO,KAAK,EAAE,YAAY,EAAE,8BAA8B,EAAE,MAAM,oBAAoB,CAAC;AACvF,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAE1C,MAAM,MAAM,UAAU,GAAG;IACrB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;CACrB,CAAC;AAEF,MAAM,MAAM,mBAAmB,GAAG;IAC9B,KAAK,CAAC,EAAE,UAAU,CAAC;IACnB,QAAQ,EAAE,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;CAClC,CAAC;AAEF,MAAM,MAAM,oBAAoB,GAAG;IAC/B;;;OAGG;IACH,KAAK,CAAC,EAAE,UAAU,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;OAIG;IACH,UAAU,CAAC,EAAE,mBAAmB,CAAC;CACpC,CAAC;AAEF,MAAM,MAAM,sBAAsB,GAAG;IACjC,IAAI,EAAE,GAAG,SAAS,EAAE,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB;;OAEG;IACH,KAAK,EAAE,MAAM,CAAC;CACjB,CAAC;AAEF,MAAM,WAAW,gBAAgB;IAC7B,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,KAAK,CAAC,GAAG,KAAK,CAAC;IAEpC,IAAI,CAAC,MAAM,EAAE,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;IAEpC,QAAQ,CACJ,KAAK,EAAE,MAAM,EACb,OAAO,CAAC,EAAE,oBAAoB,GAC/B,OAAO,CAAC,8BAA8B,CAAC,KAAK,CAAC,CAAC,CAAC;IAElD,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC;IAE/C,WAAW,CAAC,MAAM,EAAE,sBAAsB,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAE7D;;;;OAIG;IACH,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CAC/C;AAED,MAAM,MAAM,gBAAgB,GAAG;IAC3B,KAAK,EAAE,GAAG,UAAU,EAAE,CAAC;IACvB,IAAI,EAAE,GAAG,SAAS,EAAE,CAAC;IACrB,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,SAAS,CAAC,EAAE,GAAG,YAAY,EAAE,GAAG,IAAI,CAAC;IACrC,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,IAAI,CAAC;IAClC;;;;OAIG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;CAC1B,CAAC;AAEF,MAAM,MAAM,mBAAmB,GAAG;IAC9B;;;OAGG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;;OAGG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;CAC1B,CAAC;AAEF,MAAM,MAAM,uBAAuB,GAAG;IAClC,OAAO,CAAC,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF;;;;;GAKG;AACH,MAAM,MAAM,mBAAmB,GAAG;IAC9B,SAAS,EAAE,GAAG,YAAY,EAAE,GAAG,IAAI,CAAC;IACpC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;CACnC,CAAC;AAEF,MAAM,MAAM,yBAAyB,GAAG;IACpC;;;OAGG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;CAC1B,CAAC;AAEF,MAAM,WAAW,aAAa;IAC1B;;;OAGG;IACH,MAAM,CAAC,KAAK,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE/C;;;;OAIG;IACH,OAAO,CACH,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC1B,KAAK,EAAE,YAAY,EACnB,OAAO,CAAC,EAAE,uBAAuB,GAClC,OAAO,CAAC,8BAA8B,CAAC,KAAK,CAAC,CAAC,CAAC;IAElD;;OAEG;IACH,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,OAAO,CAAC,EAAE,uBAAuB,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;CAC9F"}

package/dist/core/entities/identity-provider/schema.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/identity-provider/schema.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAMzD,eAAO,MAAM,sBAAsB,qDAoBjC,CAAC"}
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/identity-provider/schema.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAMzD,eAAO,MAAM,sBAAsB,qDA8BjC,CAAC"}

package/dist/core/entities/identity-provider/schema.mjs

@@ -8,6 +8,16 @@ import { defineSchema } from "@rapiq/core";
 const schemaMapping = { realm: EntityType.REALM };
 const identityProviderSchema = defineSchema({
 	name: EntityType.IDENTITY_PROVIDER,
+	indexes: [
+		["id"],
+		["name", "realmId"],
+		["displayName"],
+		["protocol"],
+		["enabled"],
+		["realmId"],
+		["createdAt"],
+		["updatedAt"]
+	],
 	fields: { default: [
 		"id",
 		"name",
@@ -19,21 +29,29 @@ const identityProviderSchema = defineSchema({
 		"createdAt",
 		"updatedAt"
 	] },
-	filters: { allowed: [
-		"name",
-		"protocol",
-		"enabled",
-		"realmId"
-	] },
+	filters: {
+		allowed: [
+			"name",
+			"displayName",
+			"protocol",
+			"enabled",
+			"realmId",
+			"id"
+		],
+		indexed: true
+	},
 	relations: {
 		allowed: ["realm"],
 		validate: createRelationsReadGate(schemaMapping)
 	},
-	sort: { allowed: [
-		"id",
-		"createdAt",
-		"updatedAt"
-	] },
+	sorts: {
+		allowed: [
+			"id",
+			"createdAt",
+			"updatedAt"
+		],
+		indexed: true
+	},
 	pagination: { maxLimit: 50 },
 	schemaMapping
 });

package/dist/core/entities/identity-provider/schema.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"schema.mjs","names":["defineSchema","EntityType","createRelationsReadGate","schemaMapping","realm","REALM","identityProviderSchema","name","IDENTITY_PROVIDER","fields","default","filters","allowed","relations","validate","sort","pagination","maxLimit"],"sources":["../../../../src/core/entities/identity-provider/schema.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { defineSchema } from '@rapiq/core';\nimport type { IdentityProvider } from '@authup/core-kit';\nimport { EntityType } from '@authup/core-kit';\nimport { createRelationsReadGate } from '../../query/relations.ts';\n\nconst schemaMapping = { realm: EntityType.REALM };\n\nexport const identityProviderSchema = defineSchema<IdentityProvider>({\n    name: EntityType.IDENTITY_PROVIDER,\n    fields: {\n        default: [\n            'id',\n            'name',\n            'displayName',\n            'protocol',\n            'preset',\n            'enabled',\n            'realmId',\n            'createdAt',\n            'updatedAt',\n        ],\n    },\n    filters: { allowed: ['name', 'protocol', 'enabled', 'realmId'] },\n    relations: { allowed: ['realm'], validate: createRelationsReadGate(schemaMapping) },\n    sort: { allowed: ['id', 'createdAt', 'updatedAt'] },\n    pagination: { maxLimit: 50 },\n    schemaMapping,\n});\n"],"mappings":";;;;;;;AAYA,MAAMG,gBAAgB,EAAEC,OAAOH,WAAWI,MAAM;AAEhD,MAAaC,yBAAyBN,aAA+B;CACjEO,MAAMN,WAAWO;CACjBC,QAAQ,EACJC,SAAS;EACL;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;CACH,EACL;CACAC,SAAS,EAAEC,SAAS;EAAC;EAAQ;EAAY;EAAW;CAAU,EAAC;CAC/DC,WAAW;EAAED,SAAS,CAAC,OAAQ;EAAEE,UAAUZ,wBAAwBC,aAAAA;CAAe;CAClFY,MAAM,EAAEH,SAAS;EAAC;EAAM;EAAa;CAAY,EAAC;CAClDI,YAAY,EAAEC,UAAU,GAAG;CAC3Bd;AACJ,CAAA"}
+{"version":3,"file":"schema.mjs","names":["defineSchema","EntityType","createRelationsReadGate","schemaMapping","realm","REALM","identityProviderSchema","name","IDENTITY_PROVIDER","indexes","fields","default","filters","allowed","indexed","relations","validate","sorts","pagination","maxLimit"],"sources":["../../../../src/core/entities/identity-provider/schema.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { defineSchema } from '@rapiq/core';\nimport type { IdentityProvider } from '@authup/core-kit';\nimport { EntityType } from '@authup/core-kit';\nimport { createRelationsReadGate } from '../../query/relations.ts';\n\nconst schemaMapping = { realm: EntityType.REALM };\n\nexport const identityProviderSchema = defineSchema<IdentityProvider>({\n    name: EntityType.IDENTITY_PROVIDER,\n    indexes: [\n        ['id'],\n        ['name', 'realmId'],\n        ['displayName'],\n        ['protocol'],\n        ['enabled'],\n        ['realmId'],\n        ['createdAt'],\n        ['updatedAt'],\n    ],\n    fields: {\n        default: [\n            'id',\n            'name',\n            'displayName',\n            'protocol',\n            'preset',\n            'enabled',\n            'realmId',\n            'createdAt',\n            'updatedAt',\n        ],\n    },\n    filters: { allowed: ['name', 'displayName', 'protocol', 'enabled', 'realmId', 'id'], indexed: true },\n    relations: { allowed: ['realm'], validate: createRelationsReadGate(schemaMapping) },\n    sorts: { allowed: ['id', 'createdAt', 'updatedAt'], indexed: true },\n    pagination: { maxLimit: 50 },\n    schemaMapping,\n});\n"],"mappings":";;;;;;;AAYA,MAAMG,gBAAgB,EAAEC,OAAOH,WAAWI,MAAM;AAEhD,MAAaC,yBAAyBN,aAA+B;CACjEO,MAAMN,WAAWO;CACjBC,SAAS;EACL,CAAC,IAAK;EACN,CAAC,QAAQ,SAAU;EACnB,CAAC,aAAc;EACf,CAAC,UAAW;EACZ,CAAC,SAAU;EACX,CAAC,SAAU;EACX,CAAC,WAAY;EACb,CAAC,WAAY;CAChB;CACDC,QAAQ,EACJC,SAAS;EACL;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;CACH,EACL;CACAC,SAAS;EAAEC,SAAS;GAAC;GAAQ;GAAe;GAAY;GAAW;GAAW;EAAK;EAAEC,SAAS;CAAK;CACnGC,WAAW;EAAEF,SAAS,CAAC,OAAQ;EAAEG,UAAUd,wBAAwBC,aAAAA;CAAe;CAClFc,OAAO;EAAEJ,SAAS;GAAC;GAAM;GAAa;EAAY;EAAEC,SAAS;CAAK;CAClEI,YAAY,EAAEC,UAAU,GAAG;CAC3BhB;AACJ,CAAA"}