@aventara/access 0.0.0-stage → 1.0.0-rc.1

package/dist/audit/audit-event.d.ts

@@ -0,0 +1,135 @@
+import type { AccessAction, AccessOrigin } from "../policies-contract.js";
+/**
+ * One audit event.
+ *
+ * - `sign-in`: a session began (a sign-in, or a sign-up that signs the user in).
+ *   `origin` is `client` when it came through Access's routes, `application` when the
+ *   server called Better Auth's API itself. `impersonatedBy` is the admin's user id
+ *   when the session is an impersonation (Better Auth's `admin()` plugin).
+ * - `sign-in-failed`: a route that starts a session refused the caller, or the rate
+ *   limit refused a server call of `signIn`, `signUp` or `resetPassword`
+ *   (`access.client`, reason `rate-limited`). `route` is
+ *   the Better Auth endpoint (`/sign-in/email`), `reason` the code it refused with
+ *   (`INVALID_EMAIL_OR_PASSWORD`), `target` an HMAC-SHA-256 of the identifier the
+ *   request named (its email, username or phone number), keyed by Better Auth's
+ *   secret: the same for every attempt on one identifier, and no way back to it. The
+ *   identifier itself, and anything else the caller sent, is never recorded.
+ * - `sign-out`: a session was ended through `/sign-out`.
+ * - `token`: a JWT was issued for a session by `GET /token`, with `impersonatedBy` as
+ *   for `sign-in`.
+ * - `kiosk-switch` (the kiosk profile): a PIN switched the device to `userId`, ending
+ *   the session of `previousUserId` on it (`null` when the device was locked).
+ *   `deviceId` is the enrolled device's id. A failed PIN is a `sign-in-failed` on
+ *   `/kiosk/switch-user`, with its `deviceId`.
+ * - `kiosk-lock`: a session on a device ended without a switch: `lock` (asked),
+ *   `idle` (unused for the profile's `idleTimeout`), or `device-mismatch` (it was
+ *   brought by a request without its device's credential, so it is ended for both).
+ *   `userId` is the session's user.
+ * - `kiosk-device`: a device `enrolled` or `revoked` (by `userId`, `null` when the
+ *   app's server did it), or revoked for `token-reuse`: its replaced credential was
+ *   brought again, so a copy of it is in use somewhere (`userId` is `null`); or a
+ *   request refused `stale-in-grace` (409): it brought the credential the device's
+ *   last rotation retired, inside the grace, and nothing changed (`userId` is
+ *   `null`).
+ * - `kiosk-pin`: `userId`'s PIN was set.
+ * - `decision`: the engine answered a `can` question. A request's admission (may
+ *   this caller ever do `action` on `resource`?) is one event, allowed or refused,
+ *   however many rows the request then reads or writes; a row question (a row a
+ *   create inserts, or an update leaves) adds an event only when the rules refuse
+ *   that row. `scopeOf` and `fieldsOf` shape an answer and are not decisions.
+ *   `reason` names the rule that decided: `grant:<id>`, `deny:<id>`, or `no grant`.
+ *   `userId` is the `sub` of the token or session the principal came from (through
+ *   `access.state`); `null` for an anonymous caller or a principal Access did not derive.
+ *
+ * Anonymous refusals (a `decision` refused with `userId: null`, and every
+ * `sign-in-failed`) are logged once a minute for each origin and reason (a refused
+ * sign-in, for each route and target too): the first is logged, the repeats in the
+ * minute are counted, and when the minute closes the count is logged as a summary
+ * event, the first one's fields with `suppressed` (the count), `windowStart` and
+ * `windowEnd`. The summary is logged on the next event of any kind after the minute,
+ * or by a timer at its end; a sign-in on a target logs its target's count first. A
+ * flood of anonymous requests makes two events a minute, not one per request.
+ */
+export type AccessAuditEvent = {
+    readonly at: Date;
+    readonly kind: "sign-in";
+    readonly userId: string;
+    readonly origin: AccessOrigin;
+    readonly impersonatedBy?: string;
+} | {
+    readonly at: Date;
+    readonly kind: "sign-in-failed";
+    readonly userId: null;
+    readonly route: string;
+    readonly reason: string;
+    readonly target?: string;
+    /** The kiosk profile's device, for a failed PIN. */
+    readonly deviceId?: string;
+    readonly origin: AccessOrigin;
+    readonly suppressed?: number;
+    readonly windowStart?: Date;
+    readonly windowEnd?: Date;
+} | {
+    readonly at: Date;
+    readonly kind: "sign-out";
+    readonly userId: string;
+    readonly origin: AccessOrigin;
+    readonly impersonatedBy?: string;
+} | {
+    readonly at: Date;
+    readonly kind: "token";
+    readonly userId: string;
+    readonly origin: AccessOrigin;
+    readonly impersonatedBy?: string;
+} | {
+    readonly at: Date;
+    readonly kind: "kiosk-switch";
+    readonly userId: string;
+    readonly previousUserId: string | null;
+    readonly deviceId: string;
+    readonly origin: AccessOrigin;
+} | {
+    readonly at: Date;
+    readonly kind: "kiosk-lock";
+    readonly userId: string;
+    readonly deviceId: string;
+    readonly reason: "lock" | "idle" | "device-mismatch";
+    readonly origin: AccessOrigin;
+} | {
+    readonly at: Date;
+    readonly kind: "kiosk-device";
+    readonly userId: string | null;
+    readonly deviceId: string;
+    readonly reason: "enrolled" | "revoked" | "token-reuse" | "stale-in-grace";
+    readonly origin: AccessOrigin;
+} | {
+    readonly at: Date;
+    readonly kind: "kiosk-pin";
+    readonly userId: string;
+    readonly origin: AccessOrigin;
+} | {
+    readonly at: Date;
+    readonly kind: "decision";
+    readonly userId: string | null;
+    readonly resource: string;
+    readonly action: AccessAction;
+    readonly allowed: boolean;
+    readonly reason: string;
+    readonly origin: AccessOrigin;
+    readonly suppressed?: number;
+    readonly windowStart?: Date;
+    readonly windowEnd?: Date;
+};
+/**
+ * The `audit` block: `true` writes each event to the `accessAudit` table, through
+ * Better Auth's database adapter (Better Auth's own `generate`/`migrate` create it);
+ * `{ sink }` hands each event to the app instead, and the table is not declared.
+ * `false`, the default, logs nothing.
+ *
+ * The request waits for the write or the sink. A sink that throws (or a write that
+ * fails) does not fail the request: Better Auth's logger warns, and the request goes on.
+ */
+export type AccessAuditOptions = boolean | {
+    /** Receives each event; the request waits for it, so queue slow work. */
+    readonly sink: (event: AccessAuditEvent) => void | Promise<void>;
+};

package/dist/audit/audit-event.js

@@ -0,0 +1,8 @@
+// The audit log's event and the `audit` option. One shape for both destinations: a
+// row of the `accessAudit` table (`audit: true`) or the argument of the app's sink
+// (`audit: { sink }`).
+//
+// An event holds who, what and the answer, never a credential: no token, password,
+// cookie, key or header reaches it, because it is built field by field from the
+// session's user id and the engine's question, never copied from a request.
+export {};

package/dist/audit/audit.log.d.ts

@@ -0,0 +1,122 @@
+import type { DecisionObserver } from "../access.engine.js";
+import type { AccessAuditEvent } from "./audit-event.js";
+/** Where events go: Better Auth's adapter into the table, or the app's function. */
+type AuditDestination = {
+    readonly kind: "table";
+} | {
+    readonly kind: "sink";
+    readonly sink: (event: AccessAuditEvent) => void | Promise<void>;
+};
+/** The part of Better Auth's context the log uses: its adapter and its logger. */
+export type AuditContext = {
+    readonly adapter: {
+        create(input: {
+            model: string;
+            data: {
+                readonly [field: string]: unknown;
+            };
+        }): Promise<unknown>;
+    };
+    readonly logger: {
+        warn(message: string): void;
+    };
+};
+/** The `audit` option, checked: where events go, or `undefined` when the log is off. */
+export declare const auditDestinationOf: (audit: unknown) => AuditDestination | undefined;
+export type AuditLog = {
+    /** Delivers one event; never throws (a failure is logged as a warning). */
+    record(event: AccessAuditEvent): Promise<void>;
+    /**
+     * Closes the repeat windows of refused sign-ins for one sign-in target now,
+     * logging their counts: a success for that target follows its failures in the log.
+     */
+    flushTarget(target: string): Promise<void>;
+};
+/**
+ * How many repeat windows stay open at once. Past it, a refusal that would open
+ * another closes the oldest window early (its count logged, `windowEnd` now), and
+ * opens its own: every target keeps its own row.
+ */
+export declare const AUDIT_OPEN_WINDOWS_MAX = 10000;
+/**
+ * The log: each event goes to its destination; a failure warns through Better
+ * Auth's logger. An anonymous refusal is logged once per window; its repeats are
+ * counted, and when the window closes (at its end, or on the next event of any kind
+ * after it, or when its sign-in target signs in) the count is logged as a summary:
+ * the first event's fields with `suppressed`, `windowStart` and `windowEnd`.
+ *
+ * The windows are kept in the order they close (each opens a minute after the
+ * clock, never before the one opened last), so finding the expired ones stops at
+ * the first that is not; at most `AUDIT_OPEN_WINDOWS_MAX` stay open.
+ */
+export declare const createAuditLog: (destination: AuditDestination, context: () => Promise<AuditContext>) => AuditLog;
+/**
+ * The engine's decision observer: a request's admission is one event; a row
+ * question adds one only when the rules refuse that row.
+ */
+export declare const decisionObserver: (log: AuditLog, userIdOf: (principal: unknown) => string | null) => DecisionObserver;
+/** A session row, as Better Auth's database hooks hand it over. */
+type SessionRow = {
+    readonly userId?: unknown;
+    readonly impersonatedBy?: unknown;
+} | null | undefined;
+/** The endpoint context Better Auth's database hooks receive: the request, the endpoint's path and body, and the auth context. */
+type HookContext = {
+    readonly request?: unknown;
+    readonly path?: unknown;
+    readonly body?: unknown;
+    readonly context?: {
+        readonly secret?: unknown;
+    } | undefined;
+} | null | undefined;
+/**
+ * The identifier a sign-in request names its user by, as the route that takes it
+ * reads it (`email:<address>`, `username:<name>`), normalized as that route
+ * normalizes it; `undefined` for a route that names none this way.
+ */
+export type SignInIdentifier = (path: unknown, body: unknown) => string | undefined;
+/**
+ * A sign-in's target: an HMAC-SHA-256, keyed by Better Auth's secret, of the
+ * identifier the request named (`SignInIdentifier`), as 64 hex digits. It ties a
+ * refused sign-in to the later ones, and to the success, for the same identifier
+ * without storing the identifier: without the secret it cannot be reversed or
+ * checked against a guess. `undefined` when the request named none.
+ */
+export declare const signInTarget: (identifier: string | undefined, secret: unknown) => Promise<string | undefined>;
+/**
+ * Better Auth's database hooks that log sign-ins and sign-outs: a session row
+ * created (and committed) is a sign-in; one deleted by `/sign-out` is a sign-out.
+ * Through Access's routes it comes from a client; a call to Better Auth's API with
+ * no request is the application's own. A sign-in first logs the refused sign-ins
+ * counted for its target, so a guessed password shows after its failures.
+ */
+export declare const sessionAuditHooks: (log: AuditLog, identify: SignInIdentifier) => {
+    session: {
+        create: {
+            after: (session: SessionRow, context: HookContext) => Promise<void>;
+        };
+        delete: {
+            after: (session: SessionRow, context: HookContext) => Promise<void>;
+        };
+    };
+};
+/** What an endpoint hook reads of Better Auth's context, once the endpoint has answered. */
+type AuditEndpointContext = {
+    readonly path?: unknown;
+    readonly request?: unknown;
+    readonly body?: unknown;
+    readonly context: {
+        /** The endpoint's answer: its body, or the `APIError` it refused with. */
+        readonly returned?: unknown;
+        readonly session?: unknown;
+        readonly secret?: unknown;
+    };
+};
+/**
+ * Better Auth's endpoint hook (after the endpoint answers) that logs a refused
+ * sign-in on a route that starts a session (`startsSession`), with its target, and
+ * a token issued by `GET /token`. (`/get-session`'s `set-auth-jwt` header is not
+ * logged: a page asks for its session on every load.)
+ */
+export declare const endpointAudit: (log: AuditLog, startsSession: (path: unknown) => boolean, identify: SignInIdentifier) => (ctx: AuditEndpointContext) => Promise<void>;
+export {};

package/dist/audit/audit.log.js

@@ -0,0 +1,345 @@
+// The audit log: where events go (the `accessAudit` table or the app's sink), the
+// places they come from (Better Auth's session hooks for sign-ins and sign-outs, its
+// endpoint hooks for refused sign-ins and issued tokens, the engine's decision
+// observer for `can` answers), the window that keeps anonymous refusals from
+// flooding it, and the rule that a failing destination never fails the request.
+import { AccessError } from "../access/access.error.js";
+import { KIOSK_SWITCH_PATH } from "../kiosk/kiosk-verbs.schema.js";
+import { isRecord } from "../policies.compiler.js";
+import { AUDIT_MODEL } from "./audit.schema.js";
+/** The `audit` option, checked: where events go, or `undefined` when the log is off. */
+export const auditDestinationOf = (audit) => {
+    if (audit === undefined || audit === false) {
+        return undefined;
+    }
+    if (audit === true) {
+        return { kind: "table" };
+    }
+    if (isRecord(audit) &&
+        typeof audit.sink === "function" &&
+        Object.keys(audit).length === 1) {
+        return {
+            kind: "sink",
+            sink: audit.sink,
+        };
+    }
+    throw new AccessError("ACCESS_OPTIONS_INVALID", "`audit` is `true` (the accessAudit table), `{ sink: (event) => … }` (the app's own destination) or `false`, the default.");
+};
+/** The event as the table stores it: its fields, absent ones left out. */
+const rowOf = (event) => Object.fromEntries(Object.entries(event).filter(([, value]) => value !== undefined));
+/** How long an anonymous refusal is logged once for its origin and reason: a minute. */
+const AUDIT_REPEAT_WINDOW_MS = 60_000;
+/**
+ * The window an event shares with its repeats: an anonymous refused decision by
+ * origin and reason; a refused sign-in by origin, route, reason and target (the
+ * keyed hash of the identifier it named). Every other event is logged each time.
+ */
+const repeatKeyOf = (event) => event.kind === "decision" && event.userId === null && !event.allowed
+    ? `decision\u0000${event.origin}\u0000${event.reason}`
+    : event.kind === "sign-in-failed"
+        ? `sign-in-failed\u0000${event.origin}\u0000${event.route}\u0000${event.reason}\u0000${event.target ?? ""}`
+        : undefined;
+/**
+ * How many repeat windows stay open at once. Past it, a refusal that would open
+ * another closes the oldest window early (its count logged, `windowEnd` now), and
+ * opens its own: every target keeps its own row.
+ */
+export const AUDIT_OPEN_WINDOWS_MAX = 10_000;
+/** A sign-in target's windows, by key: what a sign-in on that target closes. */
+const targetOf = (event) => event.kind === "sign-in-failed" ? event.target : undefined;
+/**
+ * The log: each event goes to its destination; a failure warns through Better
+ * Auth's logger. An anonymous refusal is logged once per window; its repeats are
+ * counted, and when the window closes (at its end, or on the next event of any kind
+ * after it, or when its sign-in target signs in) the count is logged as a summary:
+ * the first event's fields with `suppressed`, `windowStart` and `windowEnd`.
+ *
+ * The windows are kept in the order they close (each opens a minute after the
+ * clock, never before the one opened last), so finding the expired ones stops at
+ * the first that is not; at most `AUDIT_OPEN_WINDOWS_MAX` stay open.
+ */
+export const createAuditLog = (destination, context) => {
+    const windows = new Map();
+    const byTarget = new Map();
+    let lastUntil = Number.NEGATIVE_INFINITY;
+    let timer;
+    /** Logs a closed window's count, when it has one. */
+    const summarize = async (window, end) => {
+        if (window.suppressed > 0) {
+            await deliver({
+                ...window.first,
+                at: new Date(),
+                suppressed: window.suppressed,
+                windowStart: new Date(window.start),
+                windowEnd: new Date(end),
+            });
+        }
+    };
+    /** Closes one window, logging its count when it has one. */
+    const close = async (key, window, end) => {
+        windows.delete(key);
+        const target = targetOf(window.first);
+        if (target !== undefined) {
+            const keys = byTarget.get(target) ?? [];
+            const left = keys.length - 1;
+            const at = keys.indexOf(key);
+            if (at >= 0) {
+                keys[at] = keys[left] ?? key;
+                keys.length = left;
+            }
+            if (keys.length === 0) {
+                byTarget.delete(target);
+            }
+        }
+        await summarize(window, end);
+    };
+    /** Closes every window whose minute is over: the oldest first, stopping at the first still open. */
+    const closeExpired = async (now) => {
+        for (const [key, window] of windows) {
+            if (window.until > now) {
+                break;
+            }
+            await close(key, window, window.until);
+        }
+    };
+    /** Logs the counts when their minute ends, even with no event after it: one timer, at the earliest end. */
+    const schedule = (now) => {
+        let next;
+        for (const window of windows.values()) {
+            next = window.until;
+            break;
+        }
+        if (timer !== undefined || next === undefined) {
+            return;
+        }
+        timer = setTimeout(() => {
+            timer = undefined;
+            void closeExpired(Date.now()).then(() => schedule(Date.now()));
+        }, Math.max(0, next - now));
+        timer.unref?.();
+    };
+    return {
+        record: async (event) => {
+            const now = Date.now();
+            await closeExpired(now);
+            const key = repeatKeyOf(event);
+            if (key !== undefined) {
+                const window = windows.get(key);
+                if (window !== undefined) {
+                    window.suppressed += 1;
+                    schedule(now);
+                    return;
+                }
+                lastUntil = Math.max(now + AUDIT_REPEAT_WINDOW_MS, lastUntil);
+                for (const [oldest, open] of windows) {
+                    if (windows.size < AUDIT_OPEN_WINDOWS_MAX) {
+                        break;
+                    }
+                    await close(oldest, open, now);
+                }
+                windows.set(key, {
+                    first: event,
+                    start: now,
+                    until: lastUntil,
+                    suppressed: 0,
+                });
+                const target = targetOf(event);
+                if (target !== undefined) {
+                    const keys = byTarget.get(target);
+                    if (keys === undefined) {
+                        byTarget.set(target, [key]);
+                    }
+                    else {
+                        keys.push(key);
+                    }
+                }
+            }
+            await deliver(event);
+        },
+        flushTarget: async (target) => {
+            const now = Date.now();
+            await closeExpired(now);
+            for (const key of (byTarget.get(target) ?? []).slice()) {
+                const window = windows.get(key);
+                if (window !== undefined) {
+                    await close(key, window, now);
+                }
+            }
+        },
+    };
+    async function deliver(event) {
+        const frozen = Object.freeze({ ...event });
+        try {
+            if (destination.kind === "sink") {
+                await destination.sink(frozen);
+            }
+            else {
+                await (await context()).adapter.create({
+                    model: AUDIT_MODEL,
+                    data: rowOf(frozen),
+                });
+            }
+        }
+        catch (error) {
+            const why = error instanceof Error ? error.message : String(error);
+            const what = destination.kind === "sink"
+                ? `the audit sink threw on a ${event.kind} event`
+                : `could not write a ${event.kind} event to the ${AUDIT_MODEL} table`;
+            try {
+                (await context()).logger.warn(`Aventara Access: ${what} (${why}); the request goes on.`);
+            }
+            catch {
+                // Better Auth itself is unavailable: nothing left to tell.
+            }
+        }
+    }
+};
+/**
+ * The engine's decision observer: a request's admission is one event; a row
+ * question adds one only when the rules refuse that row.
+ */
+export const decisionObserver = (log, userIdOf) => (question, allowed, rule) => {
+    if (question.row !== undefined && allowed) {
+        return;
+    }
+    return log.record({
+        at: new Date(),
+        kind: "decision",
+        userId: userIdOf(question.principal),
+        resource: question.resource,
+        action: question.action,
+        allowed,
+        reason: rule === null ? "no grant" : `${rule.kind}:${rule.id}`,
+        origin: question.origin,
+    });
+};
+const originOf = (context) => (context?.request ? "client" : "application");
+const impersonation = (by) => typeof by === "string" && by !== "" ? { impersonatedBy: by } : {};
+/** The HMAC keys, by Better Auth secret: imported once each. */
+const targetKeys = new Map();
+const encoder = new TextEncoder();
+/**
+ * A sign-in's target: an HMAC-SHA-256, keyed by Better Auth's secret, of the
+ * identifier the request named (`SignInIdentifier`), as 64 hex digits. It ties a
+ * refused sign-in to the later ones, and to the success, for the same identifier
+ * without storing the identifier: without the secret it cannot be reversed or
+ * checked against a guess. `undefined` when the request named none.
+ */
+export const signInTarget = async (identifier, secret) => {
+    const subtle = globalThis.crypto?.subtle;
+    if (identifier === undefined ||
+        typeof secret !== "string" ||
+        secret === "" ||
+        subtle === undefined) {
+        return undefined;
+    }
+    let key = targetKeys.get(secret);
+    if (key === undefined) {
+        key = subtle.importKey("raw", encoder.encode(secret), { name: "HMAC", hash: "SHA-256" }, false, ["sign"]);
+        targetKeys.set(secret, key);
+    }
+    const mac = await subtle.sign("HMAC", await key, encoder.encode(`aventara-access/sign-in-target:${identifier}`));
+    let hex = "";
+    for (const byte of new Uint8Array(mac)) {
+        hex += byte.toString(16).padStart(2, "0");
+    }
+    return hex;
+};
+/**
+ * Better Auth's database hooks that log sign-ins and sign-outs: a session row
+ * created (and committed) is a sign-in; one deleted by `/sign-out` is a sign-out.
+ * Through Access's routes it comes from a client; a call to Better Auth's API with
+ * no request is the application's own. A sign-in first logs the refused sign-ins
+ * counted for its target, so a guessed password shows after its failures.
+ */
+export const sessionAuditHooks = (log, identify) => ({
+    session: {
+        create: {
+            after: async (session, context) => {
+                // The kiosk's PIN switch logs its own event (`kiosk-switch`).
+                if (typeof session?.userId !== "string" ||
+                    context?.path === KIOSK_SWITCH_PATH) {
+                    return;
+                }
+                const target = await signInTarget(identify(context?.path, context?.body), context?.context?.secret);
+                if (target !== undefined) {
+                    await log.flushTarget(target);
+                }
+                await log.record({
+                    at: new Date(),
+                    kind: "sign-in",
+                    userId: session.userId,
+                    origin: originOf(context),
+                    ...impersonation(session.impersonatedBy),
+                });
+            },
+        },
+        delete: {
+            after: async (session, context) => {
+                if (typeof session?.userId !== "string" ||
+                    context?.path !== "/sign-out") {
+                    return;
+                }
+                await log.record({
+                    at: new Date(),
+                    kind: "sign-out",
+                    userId: session.userId,
+                    origin: originOf(context),
+                    ...impersonation(session.impersonatedBy),
+                });
+            },
+        },
+    },
+});
+/** The session a request ran as, as Better Auth's context holds it: its user and its impersonator. */
+const sessionOf = (value) => {
+    const { session, user } = (value ?? {});
+    return typeof user?.id === "string"
+        ? { userId: user.id, ...impersonation(session?.impersonatedBy) }
+        : undefined;
+};
+/** The refusal an endpoint answered with: Better Auth's `APIError`, a 4xx or 5xx. */
+const refusalOf = (returned) => {
+    if (!(returned instanceof Error)) {
+        return undefined;
+    }
+    const { statusCode, status, body } = returned;
+    if (typeof statusCode !== "number" || statusCode < 400) {
+        return undefined;
+    }
+    return typeof body?.code === "string" && body.code !== ""
+        ? body.code
+        : typeof status === "string"
+            ? status
+            : String(statusCode);
+};
+/**
+ * Better Auth's endpoint hook (after the endpoint answers) that logs a refused
+ * sign-in on a route that starts a session (`startsSession`), with its target, and
+ * a token issued by `GET /token`. (`/get-session`'s `set-auth-jwt` header is not
+ * logged: a page asks for its session on every load.)
+ */
+export const endpointAudit = (log, startsSession, identify) => async (ctx) => {
+    const { path, context } = ctx;
+    const origin = originOf(ctx);
+    const refused = refusalOf(context.returned);
+    if (refused !== undefined) {
+        if (startsSession(path) && typeof path === "string") {
+            const target = await signInTarget(identify(path, ctx.body), context.secret);
+            await log.record({
+                at: new Date(),
+                kind: "sign-in-failed",
+                userId: null,
+                route: path,
+                reason: refused,
+                origin,
+                ...(target === undefined ? {} : { target }),
+            });
+        }
+        return;
+    }
+    const session = sessionOf(context.session);
+    if (path === "/token" && session !== undefined) {
+        await log.record({ at: new Date(), kind: "token", origin, ...session });
+    }
+};