@connextar/house 0.18.0 → 0.19.1

package/dist/admin/access.d.ts

@@ -0,0 +1,134 @@
+import { type AuthWithProofs } from "./proof.js";
+/**
+ * Whether this request may use administration — one decision for every app with platform administrators.
+ *
+ * Six apps wrote it, and they agreed on the rule while disagreeing on its words, its order and what they checked:
+ *
+ * 1. **An administrator** — read from the database on every request, never from the session payload, which a
+ *    cookie cache can serve minutes after a demotion (AltEd).
+ * 2. **Two-factor is on** for the account.
+ * 3. **The session is still live** — read from the session store, always. Better Auth serves a session from its
+ *    cookie cache for minutes after it was revoked, and the proof below outlives a revoked session; AltEd and Quickie
+ *    checked this, PharmaLine and PM Tool did not.
+ * 4. **This sign-in used the second factor** — the authenticator code, a backup code or a passkey, recorded per
+ *    session by `adminSecondFactorSessions()` at the moment the session is made.
+ * 5. **Not while viewing as somebody.** For as long as a view lasts the administrator is not one: that is what stops
+ *    the admin panel being reached from inside a view that promised to be read-only (Quickie).
+ *
+ * Fail-closed throughout: only `true` counts for any fact, so a lookup that answers `undefined` refuses, and a lookup
+ * that throws fails the request rather than letting it through.
+ */
+export type AdminRefusalReason = "signed-out" | "not-admin" | "two-factor-off" | "sign-in-without-second-factor" | "session-ended" | "viewing-as";
+export declare const ADMIN_REFUSAL_REASONS: readonly AdminRefusalReason[];
+export interface AdminRefusal {
+    ok: false;
+    reason: AdminRefusalReason;
+    /** The sentence for the page and the 403 alike, so the reason is the same wherever it is met. */
+    message: string;
+    /** Where to put it right, or null where there is nothing to go to. */
+    fixHref: string | null;
+    /** 401 when nobody usable is signed in; 403 otherwise. */
+    status: 401 | 403;
+}
+export type AdminAccessDecision = {
+    ok: true;
+} | AdminRefusal;
+/** What is known about the request. `null` for nobody signed in. */
+export interface AdminAccessFacts {
+    isAdmin: boolean;
+    twoFactorEnabled: boolean;
+    /** The session's sign-in used the second factor (the plugin's record). */
+    sessionProven: boolean;
+    /** The session still exists in the session store. */
+    sessionLive: boolean;
+    /** The request is a "view as". */
+    viewingAs: boolean;
+}
+export interface AdminRefusalWording {
+    message?: string;
+    fixHref?: string | null;
+}
+/** Per reason, the words and the link an app wants instead of the house's. */
+export type AdminRefusalWords = Partial<Record<AdminRefusalReason, AdminRefusalWording>>;
+export declare const DEFAULT_ADMIN_REFUSAL_WORDS: Record<AdminRefusalReason, Required<AdminRefusalWording>>;
+/** The refusal for a reason, in the app's words where it has them. */
+export declare function adminRefusal(reason: AdminRefusalReason, words?: AdminRefusalWords): AdminRefusal;
+/**
+ * The decision, from what is known. Pure, so every refusal is testable without a database.
+ *
+ * The order is the order the person can act on: who they are, then whether this sign-in still exists, then the
+ * account's setup, then this sign-in's, then what the request is doing.
+ */
+export declare function decideAdminAccess(facts: AdminAccessFacts | null | undefined, words?: AdminRefusalWords): AdminRefusal | {
+    readonly ok: true;
+};
+type Answer = boolean | null | undefined;
+/** The app's reads. Each is asked only when the answer can still change the decision. */
+export interface AdminAccessLookups {
+    /** From the database, every request — never the session payload. */
+    isAdmin(userId: string): Answer | Promise<Answer>;
+    twoFactorEnabled(userId: string): Answer | Promise<Answer>;
+    /** From the session store, every request — the session row exists for this user and has not expired. */
+    sessionLive(sessionId: string, userId: string): Answer | Promise<Answer>;
+    /** Default: the plugin's record, read through `options.auth`. */
+    sessionProven?(sessionId: string, userId: string): Answer | Promise<Answer>;
+}
+export interface AdminAccessOptions {
+    /** The Better Auth instance, to read the plugin's record when `sessionProven` is not given. */
+    auth?: AuthWithProofs;
+    /** The plugin's `recordPrefix`, when it is not the default. */
+    recordPrefix?: string;
+    words?: AdminRefusalWords;
+}
+/** Who is asking: the app's user with its `sessionId`, `{ userId, sessionId }`, or Better Auth's `getSession` answer. */
+export type SignedIn = {
+    id: string;
+    sessionId: string;
+} | {
+    userId: string;
+    sessionId: string;
+} | {
+    user: {
+        id: string;
+    };
+    session: {
+        id: string;
+    };
+} | null | undefined;
+export interface AdminAccess {
+    /** The decision for this request. `viewingAs` is whether the request is a "view as". */
+    check(signedIn: SignedIn, context?: {
+        viewingAs?: boolean;
+    }): Promise<AdminAccessDecision>;
+    /** The facts the decision was made from, or null for nobody signed in. */
+    facts(signedIn: SignedIn, context?: {
+        viewingAs?: boolean;
+    }): Promise<AdminAccessFacts | null>;
+    /** The app's own `isAdmin`, for the view-as rule that an administrator is never a target. */
+    isAdmin(userId: string): Promise<boolean>;
+    /** The refusal for a reason in this app's words — for a page that reads `?admin=`. */
+    refusal(reason: AdminRefusalReason): AdminRefusal;
+    readonly words: AdminRefusalWords;
+}
+export declare function adminAccess(lookups: AdminAccessLookups, options?: AdminAccessOptions): AdminAccess;
+/**
+ * The refusal named by a page's `?admin=` parameter, for the settings page an administrator is sent to — so it says
+ * why in the same words the admin routes refuse with. Anything that is not a reason (`toString`, an array) is null.
+ */
+export declare function adminRefusalFromParam(param: string | string[] | null | undefined, words?: AdminRefusalWords): AdminRefusal | null;
+/**
+ * A refusal as an error, for code that answers by throwing. Each app's error handler maps it to its own envelope
+ * with `status` and `message`; or pass `makeError` where the house functions take one, to throw the app's own class.
+ */
+export declare class AdminRefusalError extends Error {
+    readonly refusal: AdminRefusal;
+    readonly status: 401 | 403;
+    readonly reason: AdminRefusalReason;
+    constructor(refusal: AdminRefusal, options?: {
+        cause?: unknown;
+    });
+}
+/** The decision's user, or a thrown refusal: `assertAdminAccess(await access.check(session))`. */
+export declare function assertAdminAccess(decision: AdminAccessDecision, makeError?: (refusal: AdminRefusal) => Error): void;
+export {};
+//# sourceMappingURL=access.d.ts.map

package/dist/admin/access.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"access.d.ts","sourceRoot":"","sources":["../../src/admin/access.ts"],"names":[],"mappings":"AAAA,OAAO,EAAkD,KAAK,cAAc,EAAE,MAAM,YAAY,CAAC;AAEjG;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,MAAM,kBAAkB,GAC5B,YAAY,GAAG,WAAW,GAAG,gBAAgB,GAAG,+BAA+B,GAAG,eAAe,GAAG,YAAY,CAAC;AAEnH,eAAO,MAAM,qBAAqB,EAAE,SAAS,kBAAkB,EAO9D,CAAC;AAEF,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,KAAK,CAAC;IACV,MAAM,EAAE,kBAAkB,CAAC;IAC3B,iGAAiG;IACjG,OAAO,EAAE,MAAM,CAAC;IAChB,sEAAsE;IACtE,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,0DAA0D;IAC1D,MAAM,EAAE,GAAG,GAAG,GAAG,CAAC;CACnB;AAED,MAAM,MAAM,mBAAmB,GAAG;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG,YAAY,CAAC;AAE9D,oEAAoE;AACpE,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,OAAO,CAAC;IACjB,gBAAgB,EAAE,OAAO,CAAC;IAC1B,0EAA0E;IAC1E,aAAa,EAAE,OAAO,CAAC;IACvB,qDAAqD;IACrD,WAAW,EAAE,OAAO,CAAC;IACrB,kCAAkC;IAClC,SAAS,EAAE,OAAO,CAAC;CACpB;AAED,MAAM,WAAW,mBAAmB;IAClC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB;AAED,8EAA8E;AAC9E,MAAM,MAAM,iBAAiB,GAAG,OAAO,CAAC,MAAM,CAAC,kBAAkB,EAAE,mBAAmB,CAAC,CAAC,CAAC;AAEzF,eAAO,MAAM,2BAA2B,EAAE,MAAM,CAAC,kBAAkB,EAAE,QAAQ,CAAC,mBAAmB,CAAC,CAqBjG,CAAC;AAWF,sEAAsE;AACtE,wBAAgB,YAAY,CAAC,MAAM,EAAE,kBAAkB,EAAE,KAAK,GAAE,iBAAsB,GAAG,YAAY,CAUpG;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,gBAAgB,GAAG,IAAI,GAAG,SAAS,EAAE,KAAK,CAAC,EAAE,iBAAiB;;EAYtG;AAED,KAAK,MAAM,GAAG,OAAO,GAAG,IAAI,GAAG,SAAS,CAAC;AAEzC,yFAAyF;AACzF,MAAM,WAAW,kBAAkB;IACjC,oEAAoE;IACpE,OAAO,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAClD,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC3D,wGAAwG;IACxG,WAAW,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACzE,iEAAiE;IACjE,aAAa,CAAC,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CAC7E;AAED,MAAM,WAAW,kBAAkB;IACjC,+FAA+F;IAC/F,IAAI,CAAC,EAAE,cAAc,CAAC;IACtB,+DAA+D;IAC/D,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,KAAK,CAAC,EAAE,iBAAiB,CAAC;CAC3B;AAED,yHAAyH;AACzH,MAAM,MAAM,QAAQ,GAChB;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GACjC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GACrC;IAAE,IAAI,EAAE;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC;IAAC,OAAO,EAAE;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,GACjD,IAAI,GACJ,SAAS,CAAC;AAad,MAAM,WAAW,WAAW;IAC1B,wFAAwF;IACxF,KAAK,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,CAAC,EAAE;QAAE,SAAS,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAAC;IAC3F,0EAA0E;IAC1E,KAAK,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,CAAC,EAAE;QAAE,SAAS,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAC;IAC/F,6FAA6F;IAC7F,OAAO,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC1C,sFAAsF;IACtF,OAAO,CAAC,MAAM,EAAE,kBAAkB,GAAG,YAAY,CAAC;IAClD,QAAQ,CAAC,KAAK,EAAE,iBAAiB,CAAC;CACnC;AAED,wBAAgB,WAAW,CAAC,OAAO,EAAE,kBAAkB,EAAE,OAAO,GAAE,kBAAuB,GAAG,WAAW,CA6CtG;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,CACnC,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,IAAI,GAAG,SAAS,EAC3C,KAAK,CAAC,EAAE,iBAAiB,GACxB,YAAY,GAAG,IAAI,CAGrB;AAED;;;GAGG;AACH,qBAAa,iBAAkB,SAAQ,KAAK;IAC1C,QAAQ,CAAC,OAAO,EAAE,YAAY,CAAC;IAC/B,QAAQ,CAAC,MAAM,EAAE,GAAG,GAAG,GAAG,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,kBAAkB,CAAC;gBAExB,OAAO,EAAE,YAAY,EAAE,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE;CAOjE;AAED,kGAAkG;AAClG,wBAAgB,iBAAiB,CAC/B,QAAQ,EAAE,mBAAmB,EAC7B,SAAS,GAAE,CAAC,OAAO,EAAE,YAAY,KAAK,KAAmD,GACxF,IAAI,CAEN"}

package/dist/admin/access.js

@@ -0,0 +1,157 @@
+import { DEFAULT_ADMIN_PROOF_PREFIX, sessionProofReader } from "./proof.js";
+export const ADMIN_REFUSAL_REASONS = [
+    "signed-out",
+    "not-admin",
+    "two-factor-off",
+    "sign-in-without-second-factor",
+    "session-ended",
+    "viewing-as",
+];
+export const DEFAULT_ADMIN_REFUSAL_WORDS = {
+    "signed-out": { message: "Sign in to use administration.", fixHref: "/sign-in" },
+    "session-ended": {
+        message: "This sign-in has ended. Sign in again to use administration.",
+        fixHref: "/sign-in",
+    },
+    "not-admin": { message: "Only an administrator can do that.", fixHref: null },
+    "two-factor-off": {
+        message: "Administration needs two-factor authentication on your account. Turn it on in Settings › Account & security, then come back.",
+        fixHref: "/settings?admin=two-factor-off#two-factor",
+    },
+    "sign-in-without-second-factor": {
+        message: "Administration needs a sign-in that used your authenticator code or a passkey, and this one didn’t. Sign out, then sign in with your email, password and code — or with a passkey.",
+        fixHref: "/settings?admin=sign-in-without-second-factor#two-factor",
+    },
+    "viewing-as": {
+        message: "You’re viewing as somebody else. Stop viewing as them to use administration.",
+        fixHref: null,
+    },
+};
+const STATUS = {
+    "signed-out": 401,
+    "session-ended": 401,
+    "not-admin": 403,
+    "two-factor-off": 403,
+    "sign-in-without-second-factor": 403,
+    "viewing-as": 403,
+};
+/** The refusal for a reason, in the app's words where it has them. */
+export function adminRefusal(reason, words = {}) {
+    const own = words[reason];
+    const fallback = DEFAULT_ADMIN_REFUSAL_WORDS[reason];
+    return {
+        ok: false,
+        reason,
+        message: own?.message ?? fallback.message,
+        fixHref: own && "fixHref" in own && own.fixHref !== undefined ? own.fixHref : fallback.fixHref,
+        status: STATUS[reason],
+    };
+}
+/**
+ * The decision, from what is known. Pure, so every refusal is testable without a database.
+ *
+ * The order is the order the person can act on: who they are, then whether this sign-in still exists, then the
+ * account's setup, then this sign-in's, then what the request is doing.
+ */
+export function decideAdminAccess(facts, words) {
+    const decide = () => {
+        if (!facts)
+            return "signed-out";
+        if (facts.isAdmin !== true)
+            return "not-admin";
+        if (facts.sessionLive !== true)
+            return "session-ended";
+        if (facts.twoFactorEnabled !== true)
+            return "two-factor-off";
+        if (facts.sessionProven !== true)
+            return "sign-in-without-second-factor";
+        if (facts.viewingAs !== false)
+            return "viewing-as";
+        return null;
+    };
+    const reason = decide();
+    return reason ? adminRefusal(reason, words) : { ok: true };
+}
+function normalise(signedIn) {
+    if (!signedIn)
+        return null;
+    if ("user" in signedIn) {
+        const userId = signedIn.user?.id;
+        const sessionId = signedIn.session?.id;
+        return userId && sessionId ? { userId, sessionId } : null;
+    }
+    const userId = "userId" in signedIn ? signedIn.userId : signedIn.id;
+    return userId && signedIn.sessionId ? { userId, sessionId: signedIn.sessionId } : null;
+}
+export function adminAccess(lookups, options = {}) {
+    const words = options.words ?? {};
+    const proven = lookups.sessionProven?.bind(lookups) ??
+        (options.auth ? sessionProofReader(options.auth, options.recordPrefix ?? DEFAULT_ADMIN_PROOF_PREFIX) : null);
+    if (!proven) {
+        throw new Error("[admin] adminAccess needs either `sessionProven` or `auth` (the Better Auth instance, to read the record " +
+            "adminSecondFactorSessions() writes).");
+    }
+    const isAdmin = async (userId) => (await lookups.isAdmin(userId)) === true;
+    async function facts(signedIn, context = {}) {
+        const who = normalise(signedIn);
+        if (!who)
+            return null;
+        const viewingAs = context.viewingAs === true;
+        if (!(await isAdmin(who.userId))) {
+            return { isAdmin: false, twoFactorEnabled: false, sessionLive: false, sessionProven: false, viewingAs };
+        }
+        // One round trip: the three reads run together.
+        const [twoFactorEnabled, sessionLive, sessionProven] = await Promise.all([
+            lookups.twoFactorEnabled(who.userId),
+            lookups.sessionLive(who.sessionId, who.userId),
+            proven(who.sessionId, who.userId),
+        ]);
+        return {
+            isAdmin: true,
+            twoFactorEnabled: twoFactorEnabled === true,
+            sessionLive: sessionLive === true,
+            sessionProven: sessionProven === true,
+            viewingAs,
+        };
+    }
+    return {
+        facts,
+        async check(signedIn, context) {
+            return decideAdminAccess(await facts(signedIn, context), words);
+        },
+        isAdmin,
+        refusal: (reason) => adminRefusal(reason, words),
+        words,
+    };
+}
+/**
+ * The refusal named by a page's `?admin=` parameter, for the settings page an administrator is sent to — so it says
+ * why in the same words the admin routes refuse with. Anything that is not a reason (`toString`, an array) is null.
+ */
+export function adminRefusalFromParam(param, words) {
+    if (typeof param !== "string" || !ADMIN_REFUSAL_REASONS.includes(param))
+        return null;
+    return adminRefusal(param, words);
+}
+/**
+ * A refusal as an error, for code that answers by throwing. Each app's error handler maps it to its own envelope
+ * with `status` and `message`; or pass `makeError` where the house functions take one, to throw the app's own class.
+ */
+export class AdminRefusalError extends Error {
+    refusal;
+    status;
+    reason;
+    constructor(refusal, options) {
+        super(refusal.message, options);
+        this.name = "AdminRefusalError";
+        this.refusal = refusal;
+        this.status = refusal.status;
+        this.reason = refusal.reason;
+    }
+}
+/** The decision's user, or a thrown refusal: `assertAdminAccess(await access.check(session))`. */
+export function assertAdminAccess(decision, makeError = (refusal) => new AdminRefusalError(refusal)) {
+    if (!decision.ok)
+        throw makeError(decision);
+}
+//# sourceMappingURL=access.js.map

package/dist/admin/access.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"access.js","sourceRoot":"","sources":["../../src/admin/access.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,0BAA0B,EAAE,kBAAkB,EAAuB,MAAM,YAAY,CAAC;AAwBjG,MAAM,CAAC,MAAM,qBAAqB,GAAkC;IAClE,YAAY;IACZ,WAAW;IACX,gBAAgB;IAChB,+BAA+B;IAC/B,eAAe;IACf,YAAY;CACb,CAAC;AAmCF,MAAM,CAAC,MAAM,2BAA2B,GAA8D;IACpG,YAAY,EAAE,EAAE,OAAO,EAAE,gCAAgC,EAAE,OAAO,EAAE,UAAU,EAAE;IAChF,eAAe,EAAE;QACf,OAAO,EAAE,8DAA8D;QACvE,OAAO,EAAE,UAAU;KACpB;IACD,WAAW,EAAE,EAAE,OAAO,EAAE,oCAAoC,EAAE,OAAO,EAAE,IAAI,EAAE;IAC7E,gBAAgB,EAAE;QAChB,OAAO,EACL,8HAA8H;QAChI,OAAO,EAAE,2CAA2C;KACrD;IACD,+BAA+B,EAAE;QAC/B,OAAO,EACL,oLAAoL;QACtL,OAAO,EAAE,0DAA0D;KACpE;IACD,YAAY,EAAE;QACZ,OAAO,EAAE,8EAA8E;QACvF,OAAO,EAAE,IAAI;KACd;CACF,CAAC;AAEF,MAAM,MAAM,GAA0C;IACpD,YAAY,EAAE,GAAG;IACjB,eAAe,EAAE,GAAG;IACpB,WAAW,EAAE,GAAG;IAChB,gBAAgB,EAAE,GAAG;IACrB,+BAA+B,EAAE,GAAG;IACpC,YAAY,EAAE,GAAG;CAClB,CAAC;AAEF,sEAAsE;AACtE,MAAM,UAAU,YAAY,CAAC,MAA0B,EAAE,QAA2B,EAAE;IACpF,MAAM,GAAG,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC;IAC1B,MAAM,QAAQ,GAAG,2BAA2B,CAAC,MAAM,CAAC,CAAC;IACrD,OAAO;QACL,EAAE,EAAE,KAAK;QACT,MAAM;QACN,OAAO,EAAE,GAAG,EAAE,OAAO,IAAI,QAAQ,CAAC,OAAO;QACzC,OAAO,EAAE,GAAG,IAAI,SAAS,IAAI,GAAG,IAAI,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO;QAC9F,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC;KACvB,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAAC,KAA0C,EAAE,KAAyB;IACrG,MAAM,MAAM,GAAG,GAA8B,EAAE;QAC7C,IAAI,CAAC,KAAK;YAAE,OAAO,YAAY,CAAC;QAChC,IAAI,KAAK,CAAC,OAAO,KAAK,IAAI;YAAE,OAAO,WAAW,CAAC;QAC/C,IAAI,KAAK,CAAC,WAAW,KAAK,IAAI;YAAE,OAAO,eAAe,CAAC;QACvD,IAAI,KAAK,CAAC,gBAAgB,KAAK,IAAI;YAAE,OAAO,gBAAgB,CAAC;QAC7D,IAAI,KAAK,CAAC,aAAa,KAAK,IAAI;YAAE,OAAO,+BAA+B,CAAC;QACzE,IAAI,KAAK,CAAC,SAAS,KAAK,KAAK;YAAE,OAAO,YAAY,CAAC;QACnD,OAAO,IAAI,CAAC;IACd,CAAC,CAAC;IACF,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC;IACxB,OAAO,MAAM,CAAC,CAAC,CAAC,YAAY,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,CAAE,EAAE,EAAE,EAAE,IAAI,EAAY,CAAC;AACxE,CAAC;AA+BD,SAAS,SAAS,CAAC,QAAkB;IACnC,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC3B,IAAI,MAAM,IAAI,QAAQ,EAAE,CAAC;QACvB,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC;QACjC,MAAM,SAAS,GAAG,QAAQ,CAAC,OAAO,EAAE,EAAE,CAAC;QACvC,OAAO,MAAM,IAAI,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IAC5D,CAAC;IACD,MAAM,MAAM,GAAG,QAAQ,IAAI,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC;IACpE,OAAO,MAAM,IAAI,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACzF,CAAC;AAcD,MAAM,UAAU,WAAW,CAAC,OAA2B,EAAE,UAA8B,EAAE;IACvF,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC;IAClC,MAAM,MAAM,GACV,OAAO,CAAC,aAAa,EAAE,IAAI,CAAC,OAAO,CAAC;QACpC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,kBAAkB,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,YAAY,IAAI,0BAA0B,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IAC/G,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CACb,2GAA2G;YACzG,sCAAsC,CACzC,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,KAAK,EAAE,MAAc,EAAE,EAAE,CAAC,CAAC,MAAM,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,IAAI,CAAC;IAEnF,KAAK,UAAU,KAAK,CAAC,QAAkB,EAAE,UAAmC,EAAE;QAC5E,MAAM,GAAG,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;QAChC,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,CAAC;QACtB,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,KAAK,IAAI,CAAC;QAC7C,IAAI,CAAC,CAAC,MAAM,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;YACjC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,gBAAgB,EAAE,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,aAAa,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;QAC1G,CAAC;QACD,gDAAgD;QAChD,MAAM,CAAC,gBAAgB,EAAE,WAAW,EAAE,aAAa,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YACvE,OAAO,CAAC,gBAAgB,CAAC,GAAG,CAAC,MAAM,CAAC;YACpC,OAAO,CAAC,WAAW,CAAC,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,MAAM,CAAC;YAC9C,MAAO,CAAC,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,MAAM,CAAC;SACnC,CAAC,CAAC;QACH,OAAO;YACL,OAAO,EAAE,IAAI;YACb,gBAAgB,EAAE,gBAAgB,KAAK,IAAI;YAC3C,WAAW,EAAE,WAAW,KAAK,IAAI;YACjC,aAAa,EAAE,aAAa,KAAK,IAAI;YACrC,SAAS;SACV,CAAC;IACJ,CAAC;IAED,OAAO;QACL,KAAK;QACL,KAAK,CAAC,KAAK,CAAC,QAAQ,EAAE,OAAO;YAC3B,OAAO,iBAAiB,CAAC,MAAM,KAAK,CAAC,QAAQ,EAAE,OAAO,CAAC,EAAE,KAAK,CAAC,CAAC;QAClE,CAAC;QACD,OAAO;QACP,OAAO,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,YAAY,CAAC,MAAM,EAAE,KAAK,CAAC;QAChD,KAAK;KACN,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CACnC,KAA2C,EAC3C,KAAyB;IAEzB,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAE,qBAA2C,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5G,OAAO,YAAY,CAAC,KAA2B,EAAE,KAAK,CAAC,CAAC;AAC1D,CAAC;AAED;;;GAGG;AACH,MAAM,OAAO,iBAAkB,SAAQ,KAAK;IACjC,OAAO,CAAe;IACtB,MAAM,CAAY;IAClB,MAAM,CAAqB;IAEpC,YAAY,OAAqB,EAAE,OAA6B;QAC9D,KAAK,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAChC,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;QAChC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAC7B,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAC/B,CAAC;CACF;AAED,kGAAkG;AAClG,MAAM,UAAU,iBAAiB,CAC/B,QAA6B,EAC7B,YAA8C,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,iBAAiB,CAAC,OAAO,CAAC;IAEzF,IAAI,CAAC,QAAQ,CAAC,EAAE;QAAE,MAAM,SAAS,CAAC,QAAQ,CAAC,CAAC;AAC9C,CAAC"}

package/dist/admin/audit.d.ts

@@ -0,0 +1,130 @@
+/**
+ * What an administrator did, in one shape every app maps to its own `AuditLog`.
+ *
+ * The apps' trails agree on the columns — actor id, name and role, a dotted action, the entity, a summary under 300
+ * characters, a sanitised `changes` — and disagree on scope: AltEd has no tenants, Quickie and PM Tool record
+ * platform actions with a null `organizationId`, and nobody recorded an administrator signing in, starting a view,
+ * or being granted the role by script. So the event says its scope outright (`platform`, or one tenant), the actor
+ * carries their standing at the time, and a "view as" names both people — the administrator stays the actor, so an
+ * entry never reads as though the person being viewed did it.
+ *
+ * The house writes no table. An app passes an `AdminAuditSink` that maps the event to its own row.
+ */
+export interface AdminAuditActor {
+    id: string;
+    name: string;
+    /** The actor's standing when they acted: `"platform-admin"`, `"ADMIN"`, an org role — the app's own word. */
+    standing: string;
+}
+export type AdminAuditScope = {
+    kind: "platform";
+} | {
+    kind: "tenant";
+    tenantId: string;
+};
+export interface AdminAuditEvent {
+    /** Dotted, e.g. `admin.signed_in`, `user.role_changed`, `admin.view_as_started`. */
+    action: string;
+    /** Null for a script or the system: the bootstrap script has nobody to name. */
+    actor: AdminAuditActor | null;
+    /** Set while the actor is viewing as somebody: who. */
+    viewingAs?: {
+        id: string;
+        name: string;
+    } | null;
+    scope: AdminAuditScope;
+    entity: {
+        type: string;
+        id: string | null;
+    };
+    /** At most 300 characters — the apps' column. The builders trim it. */
+    summary: string;
+    changes?: Record<string, unknown>;
+    at: Date;
+    ip?: string | null;
+    userAgent?: string | null;
+}
+export type AdminAuditSink = (event: AdminAuditEvent) => void | Promise<void>;
+export declare const PLATFORM_SCOPE: AdminAuditScope;
+export declare const SUMMARY_MAX = 300;
+/** Where the request came from: the first `x-forwarded-for` hop, and the user agent. */
+export interface RequestMeta {
+    ip?: string | null;
+    userAgent?: string | null;
+}
+/** `{ ip, userAgent }` from a `Request` or its `Headers`. */
+export declare function requestMeta(source: Request | Headers | null | undefined): RequestMeta;
+interface Common extends RequestMeta {
+    at?: Date;
+}
+/**
+ * How a sign-in was made. The first four prove the second factor; the rest do not, and an administrator signed in
+ * that way is refused administration until they sign in again.
+ */
+export type AdminSignInMethod = "code" | "backup-code" | "passkey" | "trusted-device" | "password" | "email-link" | "social" | "other";
+export declare function adminSignedIn(input: {
+    actor: AdminAuditActor;
+    sessionId: string;
+    method: AdminSignInMethod;
+    /** Whether the session counts for administration — its sign-in used the second factor. */
+    proven: boolean;
+    scope?: AdminAuditScope;
+} & Common): AdminAuditEvent;
+export declare function roleChanged(input: {
+    /** Null for a script. */
+    actor: AdminAuditActor | null;
+    target: {
+        id: string;
+        name?: string | null;
+        email?: string | null;
+    };
+    /** The standing before and after: `"user"` → `"platform-admin"`, `"MEMBER"` → `"ADMIN"`. Null for none. */
+    from: string | null;
+    to: string | null;
+    scope?: AdminAuditScope;
+    /** What made the change when it was not a screen: `"bootstrap-admin"`. */
+    via?: string;
+    changes?: Record<string, unknown>;
+} & Common): AdminAuditEvent;
+export declare function viewAsStarted(input: {
+    actor: AdminAuditActor;
+    target: {
+        id: string;
+        name: string;
+    };
+    expiresAt: Date;
+    scope?: AdminAuditScope;
+} & Common): AdminAuditEvent;
+export declare function viewAsStopped(input: {
+    actor: AdminAuditActor;
+    target: {
+        id: string;
+        name: string;
+    };
+    scope?: AdminAuditScope;
+} & Common): AdminAuditEvent;
+/** An operator's action across the platform — comps, AI rates, re-pricing — with no tenant of its own. */
+export declare function platformAction(input: {
+    actor: AdminAuditActor;
+    action: string;
+    entity: {
+        type: string;
+        id?: string | null;
+    };
+    summary: string;
+    changes?: Record<string, unknown>;
+    viewingAs?: {
+        id: string;
+        name: string;
+    } | null;
+} & Common): AdminAuditEvent;
+export interface AuditLogger {
+    error(message: string, ...args: unknown[]): void;
+}
+/**
+ * Recording an event must never break the thing being recorded: an error from the sink is logged and swallowed.
+ * Used wherever the house emits an event beside an action that already happened (a sign-in, a view starting).
+ */
+export declare function emitSafely(sink: AdminAuditSink | undefined, auditEvent: AdminAuditEvent, logger?: AuditLogger): Promise<void>;
+export {};
+//# sourceMappingURL=audit.d.ts.map

package/dist/admin/audit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit.d.ts","sourceRoot":"","sources":["../../src/admin/audit.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,6GAA6G;IAC7G,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,MAAM,eAAe,GAAG;IAAE,IAAI,EAAE,UAAU,CAAA;CAAE,GAAG;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC;AAE1F,MAAM,WAAW,eAAe;IAC9B,oFAAoF;IACpF,MAAM,EAAE,MAAM,CAAC;IACf,gFAAgF;IAChF,KAAK,EAAE,eAAe,GAAG,IAAI,CAAC;IAC9B,uDAAuD;IACvD,SAAS,CAAC,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IAChD,KAAK,EAAE,eAAe,CAAC;IACvB,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;IAC5C,uEAAuE;IACvE,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC,EAAE,EAAE,IAAI,CAAC;IACT,EAAE,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAED,MAAM,MAAM,cAAc,GAAG,CAAC,KAAK,EAAE,eAAe,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;AAE9E,eAAO,MAAM,cAAc,EAAE,eAAsC,CAAC;AAEpE,eAAO,MAAM,WAAW,MAAM,CAAC;AAE/B,wFAAwF;AACxF,MAAM,WAAW,WAAW;IAC1B,EAAE,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAED,6DAA6D;AAC7D,wBAAgB,WAAW,CAAC,MAAM,EAAE,OAAO,GAAG,OAAO,GAAG,IAAI,GAAG,SAAS,GAAG,WAAW,CAMrF;AAID,UAAU,MAAO,SAAQ,WAAW;IAClC,EAAE,CAAC,EAAE,IAAI,CAAC;CACX;AAaD;;;GAGG;AACH,MAAM,MAAM,iBAAiB,GAC3B,MAAM,GAAG,aAAa,GAAG,SAAS,GAAG,gBAAgB,GAAG,UAAU,GAAG,YAAY,GAAG,QAAQ,GAAG,OAAO,CAAC;AAazG,wBAAgB,aAAa,CAC3B,KAAK,EAAE;IACL,KAAK,EAAE,eAAe,CAAC;IACvB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,iBAAiB,CAAC;IAC1B,0FAA0F;IAC1F,MAAM,EAAE,OAAO,CAAC;IAChB,KAAK,CAAC,EAAE,eAAe,CAAC;CACzB,GAAG,MAAM,GACT,eAAe,CAYjB;AAED,wBAAgB,WAAW,CACzB,KAAK,EAAE;IACL,yBAAyB;IACzB,KAAK,EAAE,eAAe,GAAG,IAAI,CAAC;IAC9B,MAAM,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;IACpE,2GAA2G;IAC3G,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,EAAE,EAAE,MAAM,GAAG,IAAI,CAAC;IAClB,KAAK,CAAC,EAAE,eAAe,CAAC;IACxB,0EAA0E;IAC1E,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACnC,GAAG,MAAM,GACT,eAAe,CAkBjB;AAED,wBAAgB,aAAa,CAC3B,KAAK,EAAE;IACL,KAAK,EAAE,eAAe,CAAC;IACvB,MAAM,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IACrC,SAAS,EAAE,IAAI,CAAC;IAChB,KAAK,CAAC,EAAE,eAAe,CAAC;CACzB,GAAG,MAAM,GACT,eAAe,CAajB;AAED,wBAAgB,aAAa,CAC3B,KAAK,EAAE;IACL,KAAK,EAAE,eAAe,CAAC;IACvB,MAAM,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IACrC,KAAK,CAAC,EAAE,eAAe,CAAC;CACzB,GAAG,MAAM,GACT,eAAe,CAYjB;AAED,0GAA0G;AAC1G,wBAAgB,cAAc,CAC5B,KAAK,EAAE;IACL,KAAK,EAAE,eAAe,CAAC;IACvB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,EAAE,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;IAC7C,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC,SAAS,CAAC,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;CACjD,GAAG,MAAM,GACT,eAAe,CAajB;AAED,MAAM,WAAW,WAAW;IAC1B,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC;CAClD;AAED;;;GAGG;AACH,wBAAsB,UAAU,CAC9B,IAAI,EAAE,cAAc,GAAG,SAAS,EAChC,UAAU,EAAE,eAAe,EAC3B,MAAM,GAAE,WAAqB,GAC5B,OAAO,CAAC,IAAI,CAAC,CAOf"}

package/dist/admin/audit.js

@@ -0,0 +1,132 @@
+/**
+ * What an administrator did, in one shape every app maps to its own `AuditLog`.
+ *
+ * The apps' trails agree on the columns — actor id, name and role, a dotted action, the entity, a summary under 300
+ * characters, a sanitised `changes` — and disagree on scope: AltEd has no tenants, Quickie and PM Tool record
+ * platform actions with a null `organizationId`, and nobody recorded an administrator signing in, starting a view,
+ * or being granted the role by script. So the event says its scope outright (`platform`, or one tenant), the actor
+ * carries their standing at the time, and a "view as" names both people — the administrator stays the actor, so an
+ * entry never reads as though the person being viewed did it.
+ *
+ * The house writes no table. An app passes an `AdminAuditSink` that maps the event to its own row.
+ */
+export const PLATFORM_SCOPE = { kind: "platform" };
+export const SUMMARY_MAX = 300;
+/** `{ ip, userAgent }` from a `Request` or its `Headers`. */
+export function requestMeta(source) {
+    const headers = source instanceof Headers ? source : source?.headers;
+    if (!headers)
+        return {};
+    const forwarded = headers.get("x-forwarded-for")?.split(",")[0]?.trim();
+    const ip = forwarded || headers.get("x-real-ip") || null;
+    return { ip, userAgent: headers.get("user-agent") };
+}
+const trim = (summary) => (summary.length > SUMMARY_MAX ? `${summary.slice(0, SUMMARY_MAX - 1)}…` : summary);
+function event(base) {
+    const { at, ip, userAgent, ...rest } = base;
+    return {
+        ...rest,
+        summary: trim(rest.summary),
+        at: at ?? new Date(),
+        ...(ip !== undefined ? { ip } : {}),
+        ...(userAgent !== undefined ? { userAgent } : {}),
+    };
+}
+const METHOD_WORDS = {
+    code: "their authenticator code",
+    "backup-code": "a backup code",
+    passkey: "a passkey",
+    "trusted-device": "a password on a trusted device",
+    password: "a password, without a second factor",
+    "email-link": "an email link, without a second factor",
+    social: "a social sign-in, without a second factor",
+    other: "a sign-in that did not use a second factor",
+};
+export function adminSignedIn(input) {
+    return event({
+        action: "admin.signed_in",
+        actor: input.actor,
+        scope: input.scope ?? PLATFORM_SCOPE,
+        entity: { type: "session", id: input.sessionId },
+        summary: `${input.actor.name} signed in with ${METHOD_WORDS[input.method]}`,
+        changes: { method: input.method, proven: input.proven },
+        at: input.at,
+        ip: input.ip,
+        userAgent: input.userAgent,
+    });
+}
+export function roleChanged(input) {
+    const who = input.target.name || input.target.email || input.target.id;
+    const by = input.via ? ` (${input.via})` : "";
+    const summary = input.to === null
+        ? `Removed ${who}'s ${input.from ?? "role"} standing${by}`
+        : `Changed ${who} from ${input.from ?? "no role"} to ${input.to}${by}`;
+    return event({
+        action: "user.role_changed",
+        actor: input.actor,
+        scope: input.scope ?? PLATFORM_SCOPE,
+        entity: { type: "user", id: input.target.id },
+        summary,
+        changes: { from: input.from, to: input.to, ...(input.via ? { via: input.via } : {}), ...input.changes },
+        at: input.at,
+        ip: input.ip,
+        userAgent: input.userAgent,
+    });
+}
+export function viewAsStarted(input) {
+    return event({
+        action: "admin.view_as_started",
+        actor: input.actor,
+        viewingAs: input.target,
+        scope: input.scope ?? PLATFORM_SCOPE,
+        entity: { type: "user", id: input.target.id },
+        summary: `${input.actor.name} started viewing as ${input.target.name}`,
+        changes: { until: input.expiresAt.toISOString() },
+        at: input.at,
+        ip: input.ip,
+        userAgent: input.userAgent,
+    });
+}
+export function viewAsStopped(input) {
+    return event({
+        action: "admin.view_as_stopped",
+        actor: input.actor,
+        viewingAs: input.target,
+        scope: input.scope ?? PLATFORM_SCOPE,
+        entity: { type: "user", id: input.target.id },
+        summary: `${input.actor.name} stopped viewing as ${input.target.name}`,
+        at: input.at,
+        ip: input.ip,
+        userAgent: input.userAgent,
+    });
+}
+/** An operator's action across the platform — comps, AI rates, re-pricing — with no tenant of its own. */
+export function platformAction(input) {
+    return event({
+        action: input.action,
+        actor: input.actor,
+        ...(input.viewingAs ? { viewingAs: input.viewingAs } : {}),
+        scope: PLATFORM_SCOPE,
+        entity: { type: input.entity.type, id: input.entity.id ?? null },
+        summary: input.summary,
+        ...(input.changes ? { changes: input.changes } : {}),
+        at: input.at,
+        ip: input.ip,
+        userAgent: input.userAgent,
+    });
+}
+/**
+ * Recording an event must never break the thing being recorded: an error from the sink is logged and swallowed.
+ * Used wherever the house emits an event beside an action that already happened (a sign-in, a view starting).
+ */
+export async function emitSafely(sink, auditEvent, logger = console) {
+    if (!sink)
+        return;
+    try {
+        await sink(auditEvent);
+    }
+    catch (error) {
+        logger.error(`[admin] could not record ${auditEvent.action}`, error);
+    }
+}
+//# sourceMappingURL=audit.js.map

package/dist/admin/audit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit.js","sourceRoot":"","sources":["../../src/admin/audit.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AA8BH,MAAM,CAAC,MAAM,cAAc,GAAoB,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;AAEpE,MAAM,CAAC,MAAM,WAAW,GAAG,GAAG,CAAC;AAQ/B,6DAA6D;AAC7D,MAAM,UAAU,WAAW,CAAC,MAA4C;IACtE,MAAM,OAAO,GAAG,MAAM,YAAY,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,OAAO,CAAC;IACrE,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,CAAC;IACxB,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;IACxE,MAAM,EAAE,GAAG,SAAS,IAAI,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,IAAI,CAAC;IACzD,OAAO,EAAE,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC;AACtD,CAAC;AAED,MAAM,IAAI,GAAG,CAAC,OAAe,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,GAAG,WAAW,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,WAAW,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;AAMrH,SAAS,KAAK,CAAC,IAA4E;IACzF,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,SAAS,EAAE,GAAG,IAAI,EAAE,GAAG,IAAI,CAAC;IAC5C,OAAO;QACL,GAAG,IAAI;QACP,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC;QAC3B,EAAE,EAAE,EAAE,IAAI,IAAI,IAAI,EAAE;QACpB,GAAG,CAAC,EAAE,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnC,GAAG,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAClD,CAAC;AACJ,CAAC;AASD,MAAM,YAAY,GAAsC;IACtD,IAAI,EAAE,0BAA0B;IAChC,aAAa,EAAE,eAAe;IAC9B,OAAO,EAAE,WAAW;IACpB,gBAAgB,EAAE,gCAAgC;IAClD,QAAQ,EAAE,qCAAqC;IAC/C,YAAY,EAAE,wCAAwC;IACtD,MAAM,EAAE,2CAA2C;IACnD,KAAK,EAAE,4CAA4C;CACpD,CAAC;AAEF,MAAM,UAAU,aAAa,CAC3B,KAOU;IAEV,OAAO,KAAK,CAAC;QACX,MAAM,EAAE,iBAAiB;QACzB,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,KAAK,EAAE,KAAK,CAAC,KAAK,IAAI,cAAc;QACpC,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,KAAK,CAAC,SAAS,EAAE;QAChD,OAAO,EAAE,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,mBAAmB,YAAY,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE;QAC3E,OAAO,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE;QACvD,EAAE,EAAE,KAAK,CAAC,EAAE;QACZ,EAAE,EAAE,KAAK,CAAC,EAAE;QACZ,SAAS,EAAE,KAAK,CAAC,SAAS;KAC3B,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,WAAW,CACzB,KAWU;IAEV,MAAM,GAAG,GAAG,KAAK,CAAC,MAAM,CAAC,IAAI,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;IACvE,MAAM,EAAE,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IAC9C,MAAM,OAAO,GACX,KAAK,CAAC,EAAE,KAAK,IAAI;QACf,CAAC,CAAC,WAAW,GAAG,MAAM,KAAK,CAAC,IAAI,IAAI,MAAM,YAAY,EAAE,EAAE;QAC1D,CAAC,CAAC,WAAW,GAAG,SAAS,KAAK,CAAC,IAAI,IAAI,SAAS,OAAO,KAAK,CAAC,EAAE,GAAG,EAAE,EAAE,CAAC;IAC3E,OAAO,KAAK,CAAC;QACX,MAAM,EAAE,mBAAmB;QAC3B,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,KAAK,EAAE,KAAK,CAAC,KAAK,IAAI,cAAc;QACpC,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,EAAE;QAC7C,OAAO;QACP,OAAO,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,KAAK,CAAC,OAAO,EAAE;QACvG,EAAE,EAAE,KAAK,CAAC,EAAE;QACZ,EAAE,EAAE,KAAK,CAAC,EAAE;QACZ,SAAS,EAAE,KAAK,CAAC,SAAS;KAC3B,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,aAAa,CAC3B,KAKU;IAEV,OAAO,KAAK,CAAC;QACX,MAAM,EAAE,uBAAuB;QAC/B,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,SAAS,EAAE,KAAK,CAAC,MAAM;QACvB,KAAK,EAAE,KAAK,CAAC,KAAK,IAAI,cAAc;QACpC,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,EAAE;QAC7C,OAAO,EAAE,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,uBAAuB,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE;QACtE,OAAO,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,SAAS,CAAC,WAAW,EAAE,EAAE;QACjD,EAAE,EAAE,KAAK,CAAC,EAAE;QACZ,EAAE,EAAE,KAAK,CAAC,EAAE;QACZ,SAAS,EAAE,KAAK,CAAC,SAAS;KAC3B,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,aAAa,CAC3B,KAIU;IAEV,OAAO,KAAK,CAAC;QACX,MAAM,EAAE,uBAAuB;QAC/B,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,SAAS,EAAE,KAAK,CAAC,MAAM;QACvB,KAAK,EAAE,KAAK,CAAC,KAAK,IAAI,cAAc;QACpC,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,EAAE;QAC7C,OAAO,EAAE,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,uBAAuB,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE;QACtE,EAAE,EAAE,KAAK,CAAC,EAAE;QACZ,EAAE,EAAE,KAAK,CAAC,EAAE;QACZ,SAAS,EAAE,KAAK,CAAC,SAAS;KAC3B,CAAC,CAAC;AACL,CAAC;AAED,0GAA0G;AAC1G,MAAM,UAAU,cAAc,CAC5B,KAOU;IAEV,OAAO,KAAK,CAAC;QACX,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1D,KAAK,EAAE,cAAc;QACrB,MAAM,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,IAAI,IAAI,EAAE;QAChE,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACpD,EAAE,EAAE,KAAK,CAAC,EAAE;QACZ,EAAE,EAAE,KAAK,CAAC,EAAE;QACZ,SAAS,EAAE,KAAK,CAAC,SAAS;KAC3B,CAAC,CAAC;AACL,CAAC;AAMD;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,IAAgC,EAChC,UAA2B,EAC3B,SAAsB,OAAO;IAE7B,IAAI,CAAC,IAAI;QAAE,OAAO;IAClB,IAAI,CAAC;QACH,MAAM,IAAI,CAAC,UAAU,CAAC,CAAC;IACzB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,KAAK,CAAC,4BAA4B,UAAU,CAAC,MAAM,EAAE,EAAE,KAAK,CAAC,CAAC;IACvE,CAAC;AACH,CAAC"}