@axium/server 0.20.6 → 0.21.0

package/build/server/manifest.js

@@ -10,12 +10,12 @@ return {
 	assets: new Set(["icons/brands.svg","icons/light.svg","icons/regular.svg","icons/solid.svg","styles.css"]),
 	mimeTypes: {".svg":"image/svg+xml",".css":"text/css"},
 	_: {
-		client: {start:"_app/immutable/entry/start.AjI7jPvA.js",app:"_app/immutable/entry/app.DN-14WEp.js",imports:["_app/immutable/entry/start.AjI7jPvA.js","_app/immutable/chunks/LvObEX8u.js","_app/immutable/chunks/BZOe2Jko.js","_app/immutable/chunks/uU8Mt6Mg.js","_app/immutable/chunks/BK1-xGGj.js","_app/immutable/chunks/sfKJ2mhH.js","_app/immutable/entry/app.DN-14WEp.js","_app/immutable/chunks/uU8Mt6Mg.js","_app/immutable/chunks/BK1-xGGj.js","_app/immutable/chunks/DsnmJJEf.js","_app/immutable/chunks/BZOe2Jko.js","_app/immutable/chunks/sfKJ2mhH.js","_app/immutable/chunks/DGhIdZ_j.js"],stylesheets:[],fonts:[],uses_env_dynamic_public:false},
+		client: {start:"_app/immutable/entry/start.BeJCp-7l.js",app:"_app/immutable/entry/app.ZFo0Iz7Y.js",imports:["_app/immutable/entry/start.BeJCp-7l.js","_app/immutable/chunks/BT6JVi7A.js","_app/immutable/chunks/BZOe2Jko.js","_app/immutable/chunks/uU8Mt6Mg.js","_app/immutable/chunks/BK1-xGGj.js","_app/immutable/chunks/sfKJ2mhH.js","_app/immutable/entry/app.ZFo0Iz7Y.js","_app/immutable/chunks/uU8Mt6Mg.js","_app/immutable/chunks/BK1-xGGj.js","_app/immutable/chunks/DsnmJJEf.js","_app/immutable/chunks/BZOe2Jko.js","_app/immutable/chunks/sfKJ2mhH.js","_app/immutable/chunks/DGhIdZ_j.js"],stylesheets:[],fonts:[],uses_env_dynamic_public:false},
 		nodes: [
 			__memo(() => import('./chunks/0-B8fDicB8.js')),
-			__memo(() => import('./chunks/1-ChHp-lcj.js')),
+			__memo(() => import('./chunks/1-IUsQDUky.js')),
 			__memo(() => import('./chunks/2-CVTt4PZM.js')),
-			__memo(() => import('./chunks/3-qz4gvEJj.js')),
+			__memo(() => import('./chunks/3-BfZcxicd.js')),
 			__memo(() => import('./chunks/4-3AO_VRm0.js')),
 			__memo(() => import('./chunks/5-sUeA0D7s.js')),
 			__memo(() => import('./chunks/6-BqCt3ZcB.js'))

package/build/server/manifest.js.map

@@ -1 +1 @@
-{"version":3,"file":"manifest.js","sources":["../../.svelte-kit/adapter-node/manifest.js"],"sourcesContent":["export const manifest = (() => {\nfunction __memo(fn) {\n\tlet value;\n\treturn () => value ??= (value = fn());\n}\n\nreturn {\n\tappDir: \"_app\",\n\tappPath: \"_app\",\n\tassets: new Set([\"icons/brands.svg\",\"icons/light.svg\",\"icons/regular.svg\",\"icons/solid.svg\",\"styles.css\"]),\n\tmimeTypes: {\".svg\":\"image/svg+xml\",\".css\":\"text/css\"},\n\t_: {\n\t\tclient: {start:\"_app/immutable/entry/start.AjI7jPvA.js\",app:\"_app/immutable/entry/app.DN-14WEp.js\",imports:[\"_app/immutable/entry/start.AjI7jPvA.js\",\"_app/immutable/chunks/LvObEX8u.js\",\"_app/immutable/chunks/BZOe2Jko.js\",\"_app/immutable/chunks/uU8Mt6Mg.js\",\"_app/immutable/chunks/BK1-xGGj.js\",\"_app/immutable/chunks/sfKJ2mhH.js\",\"_app/immutable/entry/app.DN-14WEp.js\",\"_app/immutable/chunks/uU8Mt6Mg.js\",\"_app/immutable/chunks/BK1-xGGj.js\",\"_app/immutable/chunks/DsnmJJEf.js\",\"_app/immutable/chunks/BZOe2Jko.js\",\"_app/immutable/chunks/sfKJ2mhH.js\",\"_app/immutable/chunks/DGhIdZ_j.js\"],stylesheets:[],fonts:[],uses_env_dynamic_public:false},\n\t\tnodes: [\n\t\t\t__memo(() => import('./nodes/0.js')),\n\t\t\t__memo(() => import('./nodes/1.js')),\n\t\t\t__memo(() => import('./nodes/2.js')),\n\t\t\t__memo(() => import('./nodes/3.js')),\n\t\t\t__memo(() => import('./nodes/4.js')),\n\t\t\t__memo(() => import('./nodes/5.js')),\n\t\t\t__memo(() => import('./nodes/6.js'))\n\t\t],\n\t\tremotes: {\n\t\t\t\n\t\t},\n\t\troutes: [\n\t\t\t{\n\t\t\t\tid: \"/_axium/default\",\n\t\t\t\tpattern: /^\\/_axium\\/default\\/?$/,\n\t\t\t\tparams: [],\n\t\t\t\tpage: { layouts: [0,], errors: [1,], leaf: 2 },\n\t\t\t\tendpoint: null\n\t\t\t},\n\t\t\t{\n\t\t\t\tid: \"/account\",\n\t\t\t\tpattern: /^\\/account\\/?$/,\n\t\t\t\tparams: [],\n\t\t\t\tpage: { layouts: [0,], errors: [1,], leaf: 3 },\n\t\t\t\tendpoint: null\n\t\t\t},\n\t\t\t{\n\t\t\t\tid: \"/login\",\n\t\t\t\tpattern: /^\\/login\\/?$/,\n\t\t\t\tparams: [],\n\t\t\t\tpage: { layouts: [0,], errors: [1,], leaf: 4 },\n\t\t\t\tendpoint: null\n\t\t\t},\n\t\t\t{\n\t\t\t\tid: \"/logout\",\n\t\t\t\tpattern: /^\\/logout\\/?$/,\n\t\t\t\tparams: [],\n\t\t\t\tpage: { layouts: [0,], errors: [1,], leaf: 5 },\n\t\t\t\tendpoint: null\n\t\t\t},\n\t\t\t{\n\t\t\t\tid: \"/register\",\n\t\t\t\tpattern: /^\\/register\\/?$/,\n\t\t\t\tparams: [],\n\t\t\t\tpage: { layouts: [0,], errors: [1,], leaf: 6 },\n\t\t\t\tendpoint: null\n\t\t\t}\n\t\t],\n\t\tprerendered_routes: new Set([]),\n\t\tmatchers: async () => {\n\t\t\t\n\t\t\treturn {  };\n\t\t},\n\t\tserver_assets: {}\n\t}\n}\n})();\n\nexport const prerendered = new Set([]);\n\nexport const base = \"\";"],"names":[],"mappings":"AAAY,MAAC,QAAQ,GAAG,CAAC,MAAM;AAC/B,SAAS,MAAM,CAAC,EAAE,EAAE;AACpB,CAAC,IAAI,KAAK;AACV,CAAC,OAAO,MAAM,KAAK,MAAM,KAAK,GAAG,EAAE,EAAE,CAAC;AACtC;;AAEA,OAAO;AACP,CAAC,MAAM,EAAE,MAAM;AACf,CAAC,OAAO,EAAE,MAAM;AAChB,CAAC,MAAM,EAAE,IAAI,GAAG,CAAC,CAAC,kBAAkB,CAAC,iBAAiB,CAAC,mBAAmB,CAAC,iBAAiB,CAAC,YAAY,CAAC,CAAC;AAC3G,CAAC,SAAS,EAAE,CAAC,MAAM,CAAC,eAAe,CAAC,MAAM,CAAC,UAAU,CAAC;AACtD,CAAC,CAAC,EAAE;AACJ,EAAE,MAAM,EAAE,CAAC,KAAK,CAAC,wCAAwC,CAAC,GAAG,CAAC,sCAAsC,CAAC,OAAO,CAAC,CAAC,wCAAwC,CAAC,mCAAmC,CAAC,mCAAmC,CAAC,mCAAmC,CAAC,mCAAmC,CAAC,mCAAmC,CAAC,sCAAsC,CAAC,mCAAmC,CAAC,mCAAmC,CAAC,mCAAmC,CAAC,mCAAmC,CAAC,mCAAmC,CAAC,mCAAmC,CAAC,CAAC,WAAW,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,uBAAuB,CAAC,KAAK,CAAC;AACjoB,EAAE,KAAK,EAAE;AACT,GAAG,MAAM,CAAC,MAAM,OAAO,wBAAc,CAAC,CAAC;AACvC,GAAG,MAAM,CAAC,MAAM,OAAO,wBAAc,CAAC,CAAC;AACvC,GAAG,MAAM,CAAC,MAAM,OAAO,wBAAc,CAAC,CAAC;AACvC,GAAG,MAAM,CAAC,MAAM,OAAO,wBAAc,CAAC,CAAC;AACvC,GAAG,MAAM,CAAC,MAAM,OAAO,wBAAc,CAAC,CAAC;AACvC,GAAG,MAAM,CAAC,MAAM,OAAO,wBAAc,CAAC,CAAC;AACvC,GAAG,MAAM,CAAC,MAAM,OAAO,wBAAc,CAAC;AACtC,GAAG;AACH,EAAE,OAAO,EAAE;AACX;AACA,GAAG;AACH,EAAE,MAAM,EAAE;AACV,GAAG;AACH,IAAI,EAAE,EAAE,iBAAiB;AACzB,IAAI,OAAO,EAAE,wBAAwB;AACrC,IAAI,MAAM,EAAE,EAAE;AACd,IAAI,IAAI,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE;AAClD,IAAI,QAAQ,EAAE;AACd,IAAI;AACJ,GAAG;AACH,IAAI,EAAE,EAAE,UAAU;AAClB,IAAI,OAAO,EAAE,gBAAgB;AAC7B,IAAI,MAAM,EAAE,EAAE;AACd,IAAI,IAAI,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE;AAClD,IAAI,QAAQ,EAAE;AACd,IAAI;AACJ,GAAG;AACH,IAAI,EAAE,EAAE,QAAQ;AAChB,IAAI,OAAO,EAAE,cAAc;AAC3B,IAAI,MAAM,EAAE,EAAE;AACd,IAAI,IAAI,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE;AAClD,IAAI,QAAQ,EAAE;AACd,IAAI;AACJ,GAAG;AACH,IAAI,EAAE,EAAE,SAAS;AACjB,IAAI,OAAO,EAAE,eAAe;AAC5B,IAAI,MAAM,EAAE,EAAE;AACd,IAAI,IAAI,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE;AAClD,IAAI,QAAQ,EAAE;AACd,IAAI;AACJ,GAAG;AACH,IAAI,EAAE,EAAE,WAAW;AACnB,IAAI,OAAO,EAAE,iBAAiB;AAC9B,IAAI,MAAM,EAAE,EAAE;AACd,IAAI,IAAI,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE;AAClD,IAAI,QAAQ,EAAE;AACd;AACA,GAAG;AACH,EAAE,kBAAkB,EAAE,IAAI,GAAG,CAAC,EAAE,CAAC;AACjC,EAAE,QAAQ,EAAE,YAAY;AACxB;AACA,GAAG,OAAO,IAAI;AACd,EAAE,CAAC;AACH,EAAE,aAAa,EAAE;AACjB;AACA;AACA,CAAC;;AAEW,MAAC,WAAW,GAAG,IAAI,GAAG,CAAC,EAAE;;AAEzB,MAAC,IAAI,GAAG;;;;"}
+{"version":3,"file":"manifest.js","sources":["../../.svelte-kit/adapter-node/manifest.js"],"sourcesContent":["export const manifest = (() => {\nfunction __memo(fn) {\n\tlet value;\n\treturn () => value ??= (value = fn());\n}\n\nreturn {\n\tappDir: \"_app\",\n\tappPath: \"_app\",\n\tassets: new Set([\"icons/brands.svg\",\"icons/light.svg\",\"icons/regular.svg\",\"icons/solid.svg\",\"styles.css\"]),\n\tmimeTypes: {\".svg\":\"image/svg+xml\",\".css\":\"text/css\"},\n\t_: {\n\t\tclient: {start:\"_app/immutable/entry/start.BeJCp-7l.js\",app:\"_app/immutable/entry/app.ZFo0Iz7Y.js\",imports:[\"_app/immutable/entry/start.BeJCp-7l.js\",\"_app/immutable/chunks/BT6JVi7A.js\",\"_app/immutable/chunks/BZOe2Jko.js\",\"_app/immutable/chunks/uU8Mt6Mg.js\",\"_app/immutable/chunks/BK1-xGGj.js\",\"_app/immutable/chunks/sfKJ2mhH.js\",\"_app/immutable/entry/app.ZFo0Iz7Y.js\",\"_app/immutable/chunks/uU8Mt6Mg.js\",\"_app/immutable/chunks/BK1-xGGj.js\",\"_app/immutable/chunks/DsnmJJEf.js\",\"_app/immutable/chunks/BZOe2Jko.js\",\"_app/immutable/chunks/sfKJ2mhH.js\",\"_app/immutable/chunks/DGhIdZ_j.js\"],stylesheets:[],fonts:[],uses_env_dynamic_public:false},\n\t\tnodes: [\n\t\t\t__memo(() => import('./nodes/0.js')),\n\t\t\t__memo(() => import('./nodes/1.js')),\n\t\t\t__memo(() => import('./nodes/2.js')),\n\t\t\t__memo(() => import('./nodes/3.js')),\n\t\t\t__memo(() => import('./nodes/4.js')),\n\t\t\t__memo(() => import('./nodes/5.js')),\n\t\t\t__memo(() => import('./nodes/6.js'))\n\t\t],\n\t\tremotes: {\n\t\t\t\n\t\t},\n\t\troutes: [\n\t\t\t{\n\t\t\t\tid: \"/_axium/default\",\n\t\t\t\tpattern: /^\\/_axium\\/default\\/?$/,\n\t\t\t\tparams: [],\n\t\t\t\tpage: { layouts: [0,], errors: [1,], leaf: 2 },\n\t\t\t\tendpoint: null\n\t\t\t},\n\t\t\t{\n\t\t\t\tid: \"/account\",\n\t\t\t\tpattern: /^\\/account\\/?$/,\n\t\t\t\tparams: [],\n\t\t\t\tpage: { layouts: [0,], errors: [1,], leaf: 3 },\n\t\t\t\tendpoint: null\n\t\t\t},\n\t\t\t{\n\t\t\t\tid: \"/login\",\n\t\t\t\tpattern: /^\\/login\\/?$/,\n\t\t\t\tparams: [],\n\t\t\t\tpage: { layouts: [0,], errors: [1,], leaf: 4 },\n\t\t\t\tendpoint: null\n\t\t\t},\n\t\t\t{\n\t\t\t\tid: \"/logout\",\n\t\t\t\tpattern: /^\\/logout\\/?$/,\n\t\t\t\tparams: [],\n\t\t\t\tpage: { layouts: [0,], errors: [1,], leaf: 5 },\n\t\t\t\tendpoint: null\n\t\t\t},\n\t\t\t{\n\t\t\t\tid: \"/register\",\n\t\t\t\tpattern: /^\\/register\\/?$/,\n\t\t\t\tparams: [],\n\t\t\t\tpage: { layouts: [0,], errors: [1,], leaf: 6 },\n\t\t\t\tendpoint: null\n\t\t\t}\n\t\t],\n\t\tprerendered_routes: new Set([]),\n\t\tmatchers: async () => {\n\t\t\t\n\t\t\treturn {  };\n\t\t},\n\t\tserver_assets: {}\n\t}\n}\n})();\n\nexport const prerendered = new Set([]);\n\nexport const base = \"\";"],"names":[],"mappings":"AAAY,MAAC,QAAQ,GAAG,CAAC,MAAM;AAC/B,SAAS,MAAM,CAAC,EAAE,EAAE;AACpB,CAAC,IAAI,KAAK;AACV,CAAC,OAAO,MAAM,KAAK,MAAM,KAAK,GAAG,EAAE,EAAE,CAAC;AACtC;;AAEA,OAAO;AACP,CAAC,MAAM,EAAE,MAAM;AACf,CAAC,OAAO,EAAE,MAAM;AAChB,CAAC,MAAM,EAAE,IAAI,GAAG,CAAC,CAAC,kBAAkB,CAAC,iBAAiB,CAAC,mBAAmB,CAAC,iBAAiB,CAAC,YAAY,CAAC,CAAC;AAC3G,CAAC,SAAS,EAAE,CAAC,MAAM,CAAC,eAAe,CAAC,MAAM,CAAC,UAAU,CAAC;AACtD,CAAC,CAAC,EAAE;AACJ,EAAE,MAAM,EAAE,CAAC,KAAK,CAAC,wCAAwC,CAAC,GAAG,CAAC,sCAAsC,CAAC,OAAO,CAAC,CAAC,wCAAwC,CAAC,mCAAmC,CAAC,mCAAmC,CAAC,mCAAmC,CAAC,mCAAmC,CAAC,mCAAmC,CAAC,sCAAsC,CAAC,mCAAmC,CAAC,mCAAmC,CAAC,mCAAmC,CAAC,mCAAmC,CAAC,mCAAmC,CAAC,mCAAmC,CAAC,CAAC,WAAW,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,uBAAuB,CAAC,KAAK,CAAC;AACjoB,EAAE,KAAK,EAAE;AACT,GAAG,MAAM,CAAC,MAAM,OAAO,wBAAc,CAAC,CAAC;AACvC,GAAG,MAAM,CAAC,MAAM,OAAO,wBAAc,CAAC,CAAC;AACvC,GAAG,MAAM,CAAC,MAAM,OAAO,wBAAc,CAAC,CAAC;AACvC,GAAG,MAAM,CAAC,MAAM,OAAO,wBAAc,CAAC,CAAC;AACvC,GAAG,MAAM,CAAC,MAAM,OAAO,wBAAc,CAAC,CAAC;AACvC,GAAG,MAAM,CAAC,MAAM,OAAO,wBAAc,CAAC,CAAC;AACvC,GAAG,MAAM,CAAC,MAAM,OAAO,wBAAc,CAAC;AACtC,GAAG;AACH,EAAE,OAAO,EAAE;AACX;AACA,GAAG;AACH,EAAE,MAAM,EAAE;AACV,GAAG;AACH,IAAI,EAAE,EAAE,iBAAiB;AACzB,IAAI,OAAO,EAAE,wBAAwB;AACrC,IAAI,MAAM,EAAE,EAAE;AACd,IAAI,IAAI,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE;AAClD,IAAI,QAAQ,EAAE;AACd,IAAI;AACJ,GAAG;AACH,IAAI,EAAE,EAAE,UAAU;AAClB,IAAI,OAAO,EAAE,gBAAgB;AAC7B,IAAI,MAAM,EAAE,EAAE;AACd,IAAI,IAAI,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE;AAClD,IAAI,QAAQ,EAAE;AACd,IAAI;AACJ,GAAG;AACH,IAAI,EAAE,EAAE,QAAQ;AAChB,IAAI,OAAO,EAAE,cAAc;AAC3B,IAAI,MAAM,EAAE,EAAE;AACd,IAAI,IAAI,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE;AAClD,IAAI,QAAQ,EAAE;AACd,IAAI;AACJ,GAAG;AACH,IAAI,EAAE,EAAE,SAAS;AACjB,IAAI,OAAO,EAAE,eAAe;AAC5B,IAAI,MAAM,EAAE,EAAE;AACd,IAAI,IAAI,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE;AAClD,IAAI,QAAQ,EAAE;AACd,IAAI;AACJ,GAAG;AACH,IAAI,EAAE,EAAE,WAAW;AACnB,IAAI,OAAO,EAAE,iBAAiB;AAC9B,IAAI,MAAM,EAAE,EAAE;AACd,IAAI,IAAI,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE;AAClD,IAAI,QAAQ,EAAE;AACd;AACA,GAAG;AACH,EAAE,kBAAkB,EAAE,IAAI,GAAG,CAAC,EAAE,CAAC;AACjC,EAAE,QAAQ,EAAE,YAAY;AACxB;AACA,GAAG,OAAO,IAAI;AACd,EAAE,CAAC;AACH,EAAE,aAAa,EAAE;AACjB;AACA;AACA,CAAC;;AAEW,MAAC,WAAW,GAAG,IAAI,GAAG,CAAC,EAAE;;AAEzB,MAAC,IAAI,GAAG;;;;"}

package/dist/api/metadata.js

@@ -2,13 +2,24 @@ import { requestMethods } from '@axium/core/requests';
 import pkg from '../../package.json' with { type: 'json' };
 import { config } from '../config.js';
 import { plugins } from '../plugins.js';
-import { error } from '../requests.js';
+import { error, getToken } from '../requests.js';
 import { addRoute, routes } from '../routes.js';
+import { getSessionAndUser } from '../auth.js';
 addRoute({
     path: '/api/metadata',
-    async GET() {
-        if (config.api.disable_metadata)
-            error(401, 'API metadata is disabled');
+    async GET(event) {
+        if (!config.debug) {
+            const token = getToken(event);
+            if (!token)
+                error(401, 'Missing session token');
+            const session = await getSessionAndUser(token);
+            if (!session)
+                error(401, 'Invalid session');
+            if (!session.user.isAdmin)
+                error(403, 'User is not an administrator');
+            if (session.user.isSuspended)
+                error(403, 'User is suspended');
+        }
         return {
             version: pkg.version,
             routes: Object.fromEntries(routes

package/dist/api/register.js

@@ -7,6 +7,7 @@ import config from '../config.js';
 import { database as db } from '../database.js';
 import { createSessionData, error, parseBody, withError } from '../requests.js';
 import { addRoute } from '../routes.js';
+import { audit } from '../audit.js';
 // Map of user ID => challenge
 const registrations = new Map();
 async function OPTIONS(event) {
@@ -56,6 +57,7 @@ async function POST(event) {
         .values({ id: userId, name, email: email.toLowerCase() })
         .executeTakeFirstOrThrow()
         .catch(withError('Failed to create user'));
+    await audit('user_created', userId);
     await createPasskey({
         transports: [],
         ...registrationInfo.credential,

package/dist/api/session.js

@@ -3,6 +3,7 @@ import { getSessionAndUser } from '../auth.js';
 import { database as db } from '../database.js';
 import { error, getToken, stripUser, withError } from '../requests.js';
 import { addRoute } from '../routes.js';
+import { audit } from '../audit.js';
 addRoute({
     path: '/api/session',
     async GET(event) {
@@ -25,6 +26,7 @@ addRoute({
             .returningAll()
             .executeTakeFirstOrThrow()
             .catch((e) => (e.message == 'no result' ? error(404, 'Session does not exist') : error(400, 'Invalid session')));
+        await audit('logout', result.userId, { sessions: [result.id] });
         return omit(result, 'token');
     },
 });

package/dist/api/users.js

@@ -8,6 +8,7 @@ import { config } from '../config.js';
 import { database as db } from '../database.js';
 import { createSessionData, error, parseBody, stripUser, withError } from '../requests.js';
 import { addRoute } from '../routes.js';
+import { audit } from '../audit.js';
 const challenges = new Map();
 const params = { id: z.uuid() };
 /**
@@ -59,6 +60,7 @@ addRoute({
             .returningAll()
             .executeTakeFirstOrThrow()
             .catch(withError('Failed to delete user'));
+        await audit('user_deleted', userId);
         return result;
     },
 });
@@ -81,7 +83,9 @@ addRoute({
     async OPTIONS(event) {
         const userId = event.params.id;
         const { type } = await parseBody(event, UserAuthOptions);
-        await getUser(userId).catch(withError('User does not exist', 404));
+        const user = await getUser(userId).catch(withError('User does not exist', 404));
+        if (user.isSuspended)
+            error(403, 'User is suspended');
         const passkeys = await getPasskeysByUserId(userId);
         if (!passkeys)
             error(409, 'No passkeys exists for this user');
@@ -211,6 +215,7 @@ addRoute({
             .returningAll()
             .execute()
             .catch(withError('Failed to delete one or more sessions'));
+        await audit('logout', userId, { sessions: result.map(s => s.id) });
         return result.map(s => omit(s, 'token'));
     },
 });

package/dist/audit.d.ts

@@ -0,0 +1,84 @@
+import type { Insertable } from 'kysely';
+import * as z from 'zod';
+import { type Schema } from './database.js';
+export declare enum Severity {
+    Emergency = 0,
+    Alert = 1,
+    Critical = 2,
+    Error = 3,
+    Warning = 4,
+    Notice = 5,
+    Info = 6,
+    Debug = 7
+}
+export declare function styleSeverity(sev: Severity, align?: boolean): string;
+export interface AuditEvent<T extends Record<string, unknown> = Record<string, unknown>> {
+    /** UUID of the event */
+    id: string;
+    /** UUID of the user that triggered the event. `null` for events triggered via the server CLI */
+    userID?: string | null;
+    /** When the event happened */
+    timestamp: Date;
+    /** How severe the event is */
+    severity: Severity;
+    /** Snake case name for the event */
+    name: string;
+    /** The source of the event. This should be a package name */
+    source: string;
+    /** Tags for the event. For example, `auth` for authentication events */
+    tags: string[];
+    /** Additional event specific data. */
+    extra: T;
+}
+export interface AuditEventInit extends Insertable<Schema['audit_log']> {
+}
+export declare function audit_raw(event: AuditEventInit): Promise<void>;
+export interface $EventTypes {
+    user_created: never;
+    user_deleted: never;
+    new_session: {
+        id: string;
+    };
+    logout: {
+        sessions: string[];
+    };
+    acl_id_mismatch: {
+        item: string;
+    };
+    admin_change: {
+        user: string;
+    };
+}
+export type EventName = keyof $EventTypes;
+export type EventExtra<T extends EventName> = $EventTypes[T];
+export interface AuditEventConfigInit {
+    name: EventName;
+    source: string;
+    severity: Severity;
+    tags: string[];
+    /** Schema for the extra data */
+    extra?: z.core.$ZodShape;
+    noAutoSuspend?: boolean;
+}
+export interface AuditEventConfig {
+    name: EventName;
+    source: string;
+    severity: Severity;
+    tags: string[];
+    /** Schema for the extra data */
+    extra?: z.ZodObject;
+    noAutoSuspend?: boolean;
+}
+export declare function addEvent(init: AuditEventConfigInit): void;
+export declare function audit<T extends EventName>(eventName: T, userId?: string, extra?: EventExtra<T>): Promise<void>;
+export interface AuditFilter {
+    since?: Date;
+    until?: Date;
+    user?: string;
+    severity?: Severity;
+    source?: string;
+    tags?: string[];
+    event?: string;
+    cli?: boolean;
+}
+export declare function getEvents(filter: AuditFilter): Promise<AuditEvent[]>;

package/dist/audit.js

@@ -0,0 +1,125 @@
+import { styleText } from 'node:util';
+import { capitalize, omit } from 'utilium';
+import * as z from 'zod';
+import config from './config.js';
+import { database } from './database.js';
+import * as io from './io.js';
+export var Severity;
+(function (Severity) {
+    Severity[Severity["Emergency"] = 0] = "Emergency";
+    Severity[Severity["Alert"] = 1] = "Alert";
+    Severity[Severity["Critical"] = 2] = "Critical";
+    Severity[Severity["Error"] = 3] = "Error";
+    Severity[Severity["Warning"] = 4] = "Warning";
+    Severity[Severity["Notice"] = 5] = "Notice";
+    Severity[Severity["Info"] = 6] = "Info";
+    Severity[Severity["Debug"] = 7] = "Debug";
+})(Severity || (Severity = {}));
+const severityFormat = {
+    [Severity.Emergency]: ['bgRedBright', 'white', 'underline'],
+    [Severity.Alert]: ['bgRedBright', 'white'],
+    [Severity.Critical]: ['bold', 'redBright'],
+    [Severity.Error]: 'redBright',
+    [Severity.Warning]: 'yellowBright',
+    [Severity.Notice]: 'cyanBright',
+    [Severity.Info]: [],
+    [Severity.Debug]: ['dim'],
+};
+export function styleSeverity(sev, align = false) {
+    const text = align ? Severity[sev].padEnd(9) : Severity[sev];
+    return styleText(severityFormat[sev], text.toUpperCase());
+}
+function output(event) {
+    if (event.severity > Severity[capitalize(config.audit.min_severity)])
+        return;
+    console.error('[audit]', styleText('dim', io.prettyDate(event.timestamp)), styleSeverity(event.severity), event.name);
+}
+export async function audit_raw(event) {
+    if (!config.audit.allow_raw) {
+        io.warn('[audit] Ignoring raw event (disabled)');
+        return;
+    }
+    const result = await database.insertInto('audit_log').values(event).returningAll().executeTakeFirstOrThrow();
+    output(result);
+}
+const events = new Map();
+export function addEvent(init) {
+    if (events.has(init.name))
+        throw io.error(`Can not register multiple events with the same name ("${init.name}")`);
+    const config = {
+        ...init,
+        extra: init.extra ? z.object(init.extra) : undefined,
+    };
+    events.set(init.name, config);
+}
+export async function audit(eventName, userId, extra) {
+    const cfg = events.get(eventName);
+    if (!cfg) {
+        io.warn('Ignoring audit event with unknown event name: ' + eventName);
+        return;
+    }
+    try {
+        if (cfg.extra)
+            extra = cfg.extra.parse(extra);
+    }
+    catch (e) {
+        io.error('Audit event has invalid extra data: ' + eventName);
+        return;
+    }
+    const event = await database
+        .insertInto('audit_log')
+        .values({ ...omit(cfg, 'extra'), extra, userId })
+        .returningAll()
+        .executeTakeFirstOrThrow();
+    output(event);
+    if (userId && !cfg.noAutoSuspend && event.severity < Severity[capitalize(config.audit.auto_suspend)]) {
+        await database
+            .updateTable('users')
+            .set({ isSuspended: true })
+            .where('id', '=', userId)
+            .returningAll()
+            .executeTakeFirstOrThrow()
+            .then(user => console.error('[audit] Auto-suspended user:', user.id, `<${user.email}>`))
+            .catch(() => null);
+    }
+}
+export async function getEvents(filter) {
+    let query = database.selectFrom('audit_log').selectAll();
+    if (filter.cli)
+        query = query.where('userId', 'is', null);
+    else if (filter.user)
+        query = query.where('userId', '=', filter.user);
+    if (filter.source)
+        query = query.where('source', '=', filter.source);
+    if (filter.event)
+        query = query.where('name', '=', filter.event);
+    if (filter.tags)
+        query = query.where('tags', '@>', filter.tags);
+    if (filter.severity)
+        query = query.where('severity', '<=', filter.severity);
+    if (filter.since)
+        query = query.where('timestamp', '>=', filter.since);
+    if (filter.until)
+        query = query.where('timestamp', '<=', filter.until);
+    return await query.execute();
+}
+// Register built-ins
+addEvent({ source: '@axium/server', name: 'user_created', severity: Severity.Info, tags: ['user'] });
+addEvent({ source: '@axium/server', name: 'user_deleted', severity: Severity.Info, tags: ['user'] });
+addEvent({ source: '@axium/server', name: 'new_session', severity: Severity.Info, tags: ['user'], extra: { id: z.string() } });
+addEvent({ source: '@axium/server', name: 'logout', severity: Severity.Info, tags: ['user'], extra: { sessions: z.array(z.string()) } });
+addEvent({
+    source: '@axium/server',
+    name: 'admin_change',
+    severity: Severity.Notice,
+    tags: ['cli'],
+    extra: { user: z.string() },
+});
+addEvent({
+    source: '@axium/server',
+    name: 'acl_id_mismatch',
+    severity: Severity.Critical,
+    tags: ['acl', 'auth'],
+    extra: { item: z.string() },
+    noAutoSuspend: true,
+});

package/dist/auth.d.ts

@@ -7,6 +7,7 @@ import { type Schema } from './database.js';
 import type { RequestEvent } from './requests.js';
 export interface UserInternal extends User {
     isAdmin: boolean;
+    isSuspended: boolean;
     /** Tags are internal, roles are public */
     tags: string[];
 }

package/dist/auth.js

@@ -3,6 +3,7 @@ import { omit } from 'utilium';
 import * as acl from './acl.js';
 import { database as db, userFromId } from './database.js';
 import { error, getToken, withError } from './requests.js';
+import { audit } from './audit.js';
 export async function getUser(id) {
     return await db.selectFrom('users').selectAll().where('id', '=', id).executeTakeFirstOrThrow();
 }
@@ -22,6 +23,7 @@ export async function createSession(userId, elevated = false) {
         created: new Date(),
     };
     await db.insertInto('sessions').values(session).execute();
+    await audit('new_session', userId, { id: session.id });
     return session;
 }
 export async function getSessionAndUser(token) {
@@ -90,6 +92,8 @@ export async function checkAuthForUser(event, userId, sensitive = false) {
     if (!token)
         throw error(401, 'Missing token');
     const session = await getSessionAndUser(token).catch(withError('Invalid or expired session', 401));
+    if (session.user.isSuspended)
+        error(403, 'User is suspended');
     if (session.userId !== userId) {
         if (!session.user?.isAdmin)
             error(403, 'User ID mismatch');
@@ -125,14 +129,18 @@ export async function checkAuthForItem(event, itemType, itemId, permission) {
         return result;
     if (!session)
         error(403, 'Access denied');
+    if (session.user.isSuspended)
+        error(403, 'User is suspended');
     if (session.userId == item.userId)
         return result;
     result.fromACL = true;
     if (!item.acl || !item.acl.length)
         error(403, 'Access denied');
     const [control] = item.acl;
-    if (control.userId !== session.userId)
-        error(500, 'Access control entry does not match session user'); // @todo: audit log
+    if (control.userId !== session.userId) {
+        await audit('acl_id_mismatch', session.userId, { item: itemId });
+        error(500, 'Access control entry does not match session user');
+    }
     if (control.permission >= permission)
         return result;
     error(403, 'Access denied');