@de-otio/trellis 0.4.0

package/dist/lib/age-tier-transition.js

@@ -0,0 +1,190 @@
+"use strict";
+/**
+ * Age Tier Transition
+ *
+ * Checks users' date of birth and transitions their age tier when appropriate.
+ * Applies new privacy defaults and notifies users and guardians.
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.computeAgeTier = computeAgeTier;
+exports.checkAgeTierTransitions = checkAgeTierTransitions;
+const logger_1 = require("./logger");
+const privacy_defaults_1 = require("./privacy-defaults");
+/**
+ * Compute the age tier from a date of birth.
+ */
+function computeAgeTier(dateOfBirth, now = new Date()) {
+    const age = getAge(dateOfBirth, now);
+    if (age < 13)
+        return "CHILD";
+    if (age < 18)
+        return "TEEN";
+    return "ADULT";
+}
+function getAge(dateOfBirth, now) {
+    let age = now.getFullYear() - dateOfBirth.getFullYear();
+    const monthDiff = now.getMonth() - dateOfBirth.getMonth();
+    if (monthDiff < 0 || (monthDiff === 0 && now.getDate() < dateOfBirth.getDate())) {
+        age--;
+    }
+    return age;
+}
+/**
+ * Determine if a user setting is MORE restrictive than the new default.
+ * If so, keep the user's setting; otherwise apply the new default.
+ */
+function mergeMoreRestrictive(currentSettings, newDefaults) {
+    const visibilityOrder = { PRIVATE: 0, CONNECTIONS: 1, PUBLIC: 2 };
+    const dmOrder = { NOBODY: 0, CONNECTIONS: 1, ANYONE: 2 };
+    return {
+        // Boolean fields: false is more restrictive for "show" fields; true is more restrictive for stealth/optOut
+        stealthMode: currentSettings.stealthMode || newDefaults.stealthMode,
+        showOnlineStatus: currentSettings.showOnlineStatus && newDefaults.showOnlineStatus,
+        showTypingIndicator: currentSettings.showTypingIndicator && newDefaults.showTypingIndicator,
+        showLastSeen: currentSettings.showLastSeen && newDefaults.showLastSeen,
+        locationTrackingEnabled: currentSettings.locationTrackingEnabled && newDefaults.locationTrackingEnabled,
+        // Higher anonymization is more restrictive
+        locationAnonymizationLevel: Math.max(currentSettings.locationAnonymizationLevel, newDefaults.locationAnonymizationLevel),
+        analyticsOptOut: currentSettings.analyticsOptOut || newDefaults.analyticsOptOut,
+        // Lower visibility order = more restrictive
+        profileVisibility: visibilityOrder[currentSettings.profileVisibility] <= visibilityOrder[newDefaults.profileVisibility]
+            ? currentSettings.profileVisibility
+            : newDefaults.profileVisibility,
+        // Lower dm order = more restrictive
+        dmAccess: dmOrder[currentSettings.dmAccess] <= dmOrder[newDefaults.dmAccess]
+            ? currentSettings.dmAccess
+            : newDefaults.dmAccess,
+    };
+}
+/**
+ * Check all users with a date of birth and transition their age tier if needed.
+ * Returns the count of transitioned users and errors.
+ */
+async function checkAgeTierTransitions(env) {
+    const { createPrisma } = await Promise.resolve().then(() => __importStar(require("../db")));
+    const db = createPrisma(env);
+    const logger = logger_1.Logger.getInstance(env);
+    const now = new Date();
+    let transitioned = 0;
+    let errors = 0;
+    try {
+        const users = await db.user.findMany({
+            where: { dateOfBirth: { not: null } },
+            select: {
+                id: true,
+                dateOfBirth: true,
+                ageTier: true,
+                stealthMode: true,
+                showOnlineStatus: true,
+                showTypingIndicator: true,
+                showLastSeen: true,
+                locationTrackingEnabled: true,
+                locationAnonymizationLevel: true,
+                analyticsOptOut: true,
+                profileVisibility: true,
+                dmAccess: true,
+            },
+        });
+        for (const user of users) {
+            try {
+                if (!user.dateOfBirth)
+                    continue;
+                const computedTier = computeAgeTier(user.dateOfBirth, now);
+                if (computedTier === user.ageTier)
+                    continue;
+                const oldTier = user.ageTier;
+                const newDefaults = (0, privacy_defaults_1.getPrivacyDefaults)(computedTier);
+                const currentSettings = {
+                    stealthMode: user.stealthMode,
+                    showOnlineStatus: user.showOnlineStatus,
+                    showTypingIndicator: user.showTypingIndicator,
+                    showLastSeen: user.showLastSeen,
+                    locationTrackingEnabled: user.locationTrackingEnabled,
+                    locationAnonymizationLevel: user.locationAnonymizationLevel,
+                    analyticsOptOut: user.analyticsOptOut,
+                    profileVisibility: user.profileVisibility,
+                    dmAccess: user.dmAccess,
+                };
+                // Keep user settings that are MORE restrictive than the new defaults
+                const merged = mergeMoreRestrictive(currentSettings, newDefaults);
+                await db.user.update({
+                    where: { id: user.id },
+                    data: {
+                        ageTier: computedTier,
+                        ...merged,
+                    },
+                });
+                // Notify user of tier transition
+                await db.notification.create({
+                    data: {
+                        userId: user.id,
+                        type: "SYSTEM",
+                        title: "Age tier updated",
+                        body: `Your account has transitioned from ${oldTier} to ${computedTier}. Privacy settings have been updated.`,
+                        data: { oldTier, newTier: computedTier },
+                    },
+                });
+                // Notify guardian(s) if any active link exists
+                const guardianLinks = await db.parentalLink.findMany({
+                    where: { childId: user.id, status: "ACTIVE" },
+                });
+                for (const link of guardianLinks) {
+                    await db.notification.create({
+                        data: {
+                            userId: link.guardianId,
+                            type: "SYSTEM",
+                            title: "Child age tier updated",
+                            body: `Your linked child account has transitioned from ${oldTier} to ${computedTier}.`,
+                            data: { childId: user.id, oldTier, newTier: computedTier },
+                        },
+                    });
+                }
+                transitioned++;
+                logger.info(`User ${user.id} transitioned from ${oldTier} to ${computedTier}`);
+            }
+            catch (error) {
+                errors++;
+                logger.error(`Error transitioning user ${user.id}:`, error);
+            }
+        }
+    }
+    catch (error) {
+        logger.error("Error in checkAgeTierTransitions:", error);
+        errors++;
+    }
+    return { transitioned, errors };
+}
+//# sourceMappingURL=age-tier-transition.js.map

package/dist/lib/age-tier-transition.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"age-tier-transition.js","sourceRoot":"","sources":["../../src/lib/age-tier-transition.ts"],"names":[],"mappings":";AAAA;;;;;GAKG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAUH,wCAKC;AAiDD,0DAyGC;AArKD,qCAAkC;AAClC,yDAA8E;AAE9E;;GAEG;AACH,SAAgB,cAAc,CAAC,WAAiB,EAAE,MAAY,IAAI,IAAI,EAAE;IACtE,MAAM,GAAG,GAAG,MAAM,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;IACrC,IAAI,GAAG,GAAG,EAAE;QAAE,OAAO,OAAO,CAAC;IAC7B,IAAI,GAAG,GAAG,EAAE;QAAE,OAAO,MAAM,CAAC;IAC5B,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,MAAM,CAAC,WAAiB,EAAE,GAAS;IAC1C,IAAI,GAAG,GAAG,GAAG,CAAC,WAAW,EAAE,GAAG,WAAW,CAAC,WAAW,EAAE,CAAC;IACxD,MAAM,SAAS,GAAG,GAAG,CAAC,QAAQ,EAAE,GAAG,WAAW,CAAC,QAAQ,EAAE,CAAC;IAC1D,IAAI,SAAS,GAAG,CAAC,IAAI,CAAC,SAAS,KAAK,CAAC,IAAI,GAAG,CAAC,OAAO,EAAE,GAAG,WAAW,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC;QAChF,GAAG,EAAE,CAAC;IACR,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;GAGG;AACH,SAAS,oBAAoB,CAC3B,eAAgC,EAChC,WAA4B;IAE5B,MAAM,eAAe,GAAG,EAAE,OAAO,EAAE,CAAC,EAAE,WAAW,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC;IAClE,MAAM,OAAO,GAAG,EAAE,MAAM,EAAE,CAAC,EAAE,WAAW,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC;IAEzD,OAAO;QACL,2GAA2G;QAC3G,WAAW,EAAE,eAAe,CAAC,WAAW,IAAI,WAAW,CAAC,WAAW;QACnE,gBAAgB,EAAE,eAAe,CAAC,gBAAgB,IAAI,WAAW,CAAC,gBAAgB;QAClF,mBAAmB,EAAE,eAAe,CAAC,mBAAmB,IAAI,WAAW,CAAC,mBAAmB;QAC3F,YAAY,EAAE,eAAe,CAAC,YAAY,IAAI,WAAW,CAAC,YAAY;QACtE,uBAAuB,EAAE,eAAe,CAAC,uBAAuB,IAAI,WAAW,CAAC,uBAAuB;QACvG,2CAA2C;QAC3C,0BAA0B,EAAE,IAAI,CAAC,GAAG,CAAC,eAAe,CAAC,0BAA0B,EAAE,WAAW,CAAC,0BAA0B,CAAC;QACxH,eAAe,EAAE,eAAe,CAAC,eAAe,IAAI,WAAW,CAAC,eAAe;QAC/E,4CAA4C;QAC5C,iBAAiB,EACf,eAAe,CAAC,eAAe,CAAC,iBAAiB,CAAC,IAAI,eAAe,CAAC,WAAW,CAAC,iBAAiB,CAAC;YAClG,CAAC,CAAC,eAAe,CAAC,iBAAiB;YACnC,CAAC,CAAC,WAAW,CAAC,iBAAiB;QACnC,oCAAoC;QACpC,QAAQ,EACN,OAAO,CAAC,eAAe,CAAC,QAAQ,CAAC,IAAI,OAAO,CAAC,WAAW,CAAC,QAAQ,CAAC;YAChE,CAAC,CAAC,eAAe,CAAC,QAAQ;YAC1B,CAAC,CAAC,WAAW,CAAC,QAAQ;KAC3B,CAAC;AACJ,CAAC;AAED;;;GAGG;AACI,KAAK,UAAU,uBAAuB,CAAC,GAAQ;IAIpD,MAAM,EAAE,YAAY,EAAE,GAAG,wDAAa,OAAO,GAAC,CAAC;IAC/C,MAAM,EAAE,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;IAC7B,MAAM,MAAM,GAAG,eAAM,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IACvC,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;IAEvB,IAAI,YAAY,GAAG,CAAC,CAAC;IACrB,IAAI,MAAM,GAAG,CAAC,CAAC;IAEf,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC;YACnC,KAAK,EAAE,EAAE,WAAW,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;YACrC,MAAM,EAAE;gBACN,EAAE,EAAE,IAAI;gBACR,WAAW,EAAE,IAAI;gBACjB,OAAO,EAAE,IAAI;gBACb,WAAW,EAAE,IAAI;gBACjB,gBAAgB,EAAE,IAAI;gBACtB,mBAAmB,EAAE,IAAI;gBACzB,YAAY,EAAE,IAAI;gBAClB,uBAAuB,EAAE,IAAI;gBAC7B,0BAA0B,EAAE,IAAI;gBAChC,eAAe,EAAE,IAAI;gBACrB,iBAAiB,EAAE,IAAI;gBACvB,QAAQ,EAAE,IAAI;aACf;SACF,CAAC,CAAC;QAEH,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,IAAI,CAAC;gBACH,IAAI,CAAC,IAAI,CAAC,WAAW;oBAAE,SAAS;gBAEhC,MAAM,YAAY,GAAG,cAAc,CAAC,IAAI,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;gBAC3D,IAAI,YAAY,KAAK,IAAI,CAAC,OAAO;oBAAE,SAAS;gBAE5C,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;gBAC7B,MAAM,WAAW,GAAG,IAAA,qCAAkB,EAAC,YAAY,CAAC,CAAC;gBAErD,MAAM,eAAe,GAAoB;oBACvC,WAAW,EAAE,IAAI,CAAC,WAAW;oBAC7B,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;oBACvC,mBAAmB,EAAE,IAAI,CAAC,mBAAmB;oBAC7C,YAAY,EAAE,IAAI,CAAC,YAAY;oBAC/B,uBAAuB,EAAE,IAAI,CAAC,uBAAuB;oBACrD,0BAA0B,EAAE,IAAI,CAAC,0BAA0B;oBAC3D,eAAe,EAAE,IAAI,CAAC,eAAe;oBACrC,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;oBACzC,QAAQ,EAAE,IAAI,CAAC,QAAQ;iBACxB,CAAC;gBAEF,qEAAqE;gBACrE,MAAM,MAAM,GAAG,oBAAoB,CAAC,eAAe,EAAE,WAAW,CAAC,CAAC;gBAElE,MAAM,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC;oBACnB,KAAK,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE;oBACtB,IAAI,EAAE;wBACJ,OAAO,EAAE,YAAY;wBACrB,GAAG,MAAM;qBACV;iBACF,CAAC,CAAC;gBAEH,iCAAiC;gBACjC,MAAM,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC;oBAC3B,IAAI,EAAE;wBACJ,MAAM,EAAE,IAAI,CAAC,EAAE;wBACf,IAAI,EAAE,QAAQ;wBACd,KAAK,EAAE,kBAAkB;wBACzB,IAAI,EAAE,sCAAsC,OAAO,OAAO,YAAY,uCAAuC;wBAC7G,IAAI,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE;qBACzC;iBACF,CAAC,CAAC;gBAEH,+CAA+C;gBAC/C,MAAM,aAAa,GAAG,MAAM,EAAE,CAAC,YAAY,CAAC,QAAQ,CAAC;oBACnD,KAAK,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE;iBAC9C,CAAC,CAAC;gBAEH,KAAK,MAAM,IAAI,IAAI,aAAa,EAAE,CAAC;oBACjC,MAAM,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC;wBAC3B,IAAI,EAAE;4BACJ,MAAM,EAAE,IAAI,CAAC,UAAU;4BACvB,IAAI,EAAE,QAAQ;4BACd,KAAK,EAAE,wBAAwB;4BAC/B,IAAI,EAAE,mDAAmD,OAAO,OAAO,YAAY,GAAG;4BACtF,IAAI,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE;yBAC3D;qBACF,CAAC,CAAC;gBACL,CAAC;gBAED,YAAY,EAAE,CAAC;gBACf,MAAM,CAAC,IAAI,CAAC,QAAQ,IAAI,CAAC,EAAE,sBAAsB,OAAO,OAAO,YAAY,EAAE,CAAC,CAAC;YACjF,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,EAAE,CAAC;gBACT,MAAM,CAAC,KAAK,CAAC,4BAA4B,IAAI,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;YAC9D,CAAC;QACH,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,KAAK,CAAC,mCAAmC,EAAE,KAAK,CAAC,CAAC;QACzD,MAAM,EAAE,CAAC;IACX,CAAC;IAED,OAAO,EAAE,YAAY,EAAE,MAAM,EAAE,CAAC;AAClC,CAAC"}

package/dist/lib/audit-logger.d.ts

@@ -0,0 +1,142 @@
+/**
+ * Audit Logger Module
+ *
+ * Provides audit logging for data access and user actions with region tracking.
+ *
+ * Security: All audit events are stored in database with region/dataRegion tracking
+ * for compliance and data residency verification.
+ *
+ * Uses existing Logger for application logging and SecurityEvent table for persistence.
+ */
+import { type LoggerEnv } from "./logger";
+import { type EnvWithDb } from "../db";
+import { type Region } from "./region-detection";
+/**
+ * Environment interface for audit logger
+ */
+export interface AuditLoggerEnv extends EnvWithDb, LoggerEnv {
+    DEFAULT_REGION?: string;
+}
+/**
+ * Audit event types
+ */
+export type AuditEventType = "data_access" | "data_create" | "data_update" | "data_delete" | "user_action" | "authentication" | "authorization" | "region_change";
+/**
+ * Audit event severity
+ */
+export type AuditEventSeverity = "low" | "medium" | "high" | "critical";
+/**
+ * Audit event interface
+ */
+export interface AuditEvent {
+    type: AuditEventType;
+    action: string;
+    resource: string;
+    resourceId?: string;
+    userId?: string;
+    region: Region;
+    dataRegion?: string;
+    ipAddress?: string;
+    userAgent?: string;
+    metadata?: Record<string, unknown>;
+    severity?: AuditEventSeverity;
+    success: boolean;
+}
+/**
+ * Audit Logger class
+ *
+ * Provides audit logging with region tracking for compliance.
+ */
+export declare class AuditLogger {
+    private logger;
+    private requestId?;
+    constructor(env?: LoggerEnv, requestId?: string);
+    /**
+     * Create audit logger with request ID for correlation
+     */
+    withRequestId(requestId: string): AuditLogger;
+    /**
+     * Log data access event
+     *
+     * Use this for read operations (GET, SELECT).
+     *
+     * @param event - Audit event details
+     * @param env - Environment variables
+     */
+    logDataAccess(event: Omit<AuditEvent, "type" | "severity"> & {
+        type?: AuditEventType;
+        severity?: AuditEventSeverity;
+    }, env: AuditLoggerEnv): Promise<void>;
+    /**
+     * Log user action event
+     *
+     * Use this for user-initiated actions (create, update, delete).
+     *
+     * @param event - Audit event details
+     * @param env - Environment variables
+     */
+    logUserAction(event: Omit<AuditEvent, "type" | "severity"> & {
+        type?: AuditEventType;
+        severity?: AuditEventSeverity;
+    }, env: AuditLoggerEnv): Promise<void>;
+    /**
+     * Log authentication event
+     *
+     * @param event - Audit event details
+     * @param env - Environment variables
+     */
+    logAuthentication(event: Omit<AuditEvent, "type" | "severity"> & {
+        type?: AuditEventType;
+        severity?: AuditEventSeverity;
+    }, env: AuditLoggerEnv): Promise<void>;
+    /**
+     * Log authorization event
+     *
+     * @param event - Audit event details
+     * @param env - Environment variables
+     */
+    logAuthorization(event: Omit<AuditEvent, "type" | "severity"> & {
+        type?: AuditEventType;
+        severity?: AuditEventSeverity;
+    }, env: AuditLoggerEnv): Promise<void>;
+    /**
+     * Generic log method that routes to the appropriate specific log method
+     *
+     * @param event - Audit event details
+     * @param env - Environment variables
+     */
+    log(event: Omit<AuditEvent, "severity"> & {
+        severity?: AuditEventSeverity;
+    }, env: AuditLoggerEnv): Promise<void>;
+    /**
+     * Log audit event to database and application logs
+     *
+     * Security: All audit events are stored in database with region/dataRegion tracking.
+     *
+     * @param event - Audit event to log
+     * @param env - Environment variables
+     */
+    private logAuditEvent;
+    /**
+     * Calculate retention date based on severity
+     *
+     * Retention periods:
+     * - critical: 365 days (1 year)
+     * - high: 90 days
+     * - medium: 30 days
+     * - low: 7 days
+     *
+     * @param severity - Event severity level
+     * @returns Date when the event should be deleted, or null if retention is disabled
+     */
+    private calculateRetentionUntil;
+}
+/**
+ * Create an audit logger instance
+ *
+ * @param env - Environment variables
+ * @param requestId - Optional request ID for correlation
+ * @returns AuditLogger instance
+ */
+export declare function createAuditLogger(env?: LoggerEnv, requestId?: string): AuditLogger;
+//# sourceMappingURL=audit-logger.d.ts.map

package/dist/lib/audit-logger.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-logger.d.ts","sourceRoot":"","sources":["../../src/lib/audit-logger.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAA6B,KAAK,SAAS,EAAE,MAAM,UAAU,CAAC;AACrE,OAAO,EAAyB,KAAK,SAAS,EAAE,MAAM,OAAO,CAAC;AAC9D,OAAO,EAAiB,KAAK,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAEhE;;GAEG;AACH,MAAM,WAAW,cAAe,SAAQ,SAAS,EAAE,SAAS;IAE1D,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED;;GAEG;AACH,MAAM,MAAM,cAAc,GACtB,aAAa,GACb,aAAa,GACb,aAAa,GACb,aAAa,GACb,aAAa,GACb,gBAAgB,GAChB,eAAe,GACf,eAAe,CAAC;AAEpB;;GAEG;AACH,MAAM,MAAM,kBAAkB,GAAG,KAAK,GAAG,QAAQ,GAAG,MAAM,GAAG,UAAU,CAAC;AAExE;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,cAAc,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC,QAAQ,CAAC,EAAE,kBAAkB,CAAC;IAC9B,OAAO,EAAE,OAAO,CAAC;CAClB;AAED;;;;GAIG;AACH,qBAAa,WAAW;IACtB,OAAO,CAAC,MAAM,CAAS;IACvB,OAAO,CAAC,SAAS,CAAC,CAAS;gBAEf,GAAG,CAAC,EAAE,SAAS,EAAE,SAAS,CAAC,EAAE,MAAM;IAK/C;;OAEG;IACH,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,WAAW;IAO7C;;;;;;;OAOG;IACG,aAAa,CACjB,KAAK,EAAE,IAAI,CAAC,UAAU,EAAE,MAAM,GAAG,UAAU,CAAC,GAAG;QAC7C,IAAI,CAAC,EAAE,cAAc,CAAC;QACtB,QAAQ,CAAC,EAAE,kBAAkB,CAAC;KAC/B,EACD,GAAG,EAAE,cAAc,GAClB,OAAO,CAAC,IAAI,CAAC;IAmBhB;;;;;;;OAOG;IACG,aAAa,CACjB,KAAK,EAAE,IAAI,CAAC,UAAU,EAAE,MAAM,GAAG,UAAU,CAAC,GAAG;QAC7C,IAAI,CAAC,EAAE,cAAc,CAAC;QACtB,QAAQ,CAAC,EAAE,kBAAkB,CAAC;KAC/B,EACD,GAAG,EAAE,cAAc,GAClB,OAAO,CAAC,IAAI,CAAC;IAmBhB;;;;;OAKG;IACG,iBAAiB,CACrB,KAAK,EAAE,IAAI,CAAC,UAAU,EAAE,MAAM,GAAG,UAAU,CAAC,GAAG;QAC7C,IAAI,CAAC,EAAE,cAAc,CAAC;QACtB,QAAQ,CAAC,EAAE,kBAAkB,CAAC;KAC/B,EACD,GAAG,EAAE,cAAc,GAClB,OAAO,CAAC,IAAI,CAAC;IAmBhB;;;;;OAKG;IACG,gBAAgB,CACpB,KAAK,EAAE,IAAI,CAAC,UAAU,EAAE,MAAM,GAAG,UAAU,CAAC,GAAG;QAC7C,IAAI,CAAC,EAAE,cAAc,CAAC;QACtB,QAAQ,CAAC,EAAE,kBAAkB,CAAC;KAC/B,EACD,GAAG,EAAE,cAAc,GAClB,OAAO,CAAC,IAAI,CAAC;IAmBhB;;;;;OAKG;IACG,GAAG,CACP,KAAK,EAAE,IAAI,CAAC,UAAU,EAAE,UAAU,CAAC,GAAG;QAAE,QAAQ,CAAC,EAAE,kBAAkB,CAAA;KAAE,EACvE,GAAG,EAAE,cAAc,GAClB,OAAO,CAAC,IAAI,CAAC;IAsBhB;;;;;;;OAOG;YACW,aAAa;IAkH3B;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,uBAAuB;CAahC;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAC/B,GAAG,CAAC,EAAE,SAAS,EACf,SAAS,CAAC,EAAE,MAAM,GACjB,WAAW,CAEb"}

package/dist/lib/audit-logger.js

@@ -0,0 +1,326 @@
+"use strict";
+/**
+ * Audit Logger Module
+ *
+ * Provides audit logging for data access and user actions with region tracking.
+ *
+ * Security: All audit events are stored in database with region/dataRegion tracking
+ * for compliance and data residency verification.
+ *
+ * Uses existing Logger for application logging and SecurityEvent table for persistence.
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AuditLogger = void 0;
+exports.createAuditLogger = createAuditLogger;
+const logger_1 = require("./logger");
+const region_detection_1 = require("./region-detection");
+/**
+ * Audit Logger class
+ *
+ * Provides audit logging with region tracking for compliance.
+ */
+class AuditLogger {
+    logger;
+    requestId;
+    constructor(env, requestId) {
+        this.logger = logger_1.Logger.getInstance(env);
+        this.requestId = requestId;
+    }
+    /**
+     * Create audit logger with request ID for correlation
+     */
+    withRequestId(requestId) {
+        return new AuditLogger({ LOG_LEVEL: this.logger.getLogLevel() }, requestId);
+    }
+    /**
+     * Log data access event
+     *
+     * Use this for read operations (GET, SELECT).
+     *
+     * @param event - Audit event details
+     * @param env - Environment variables
+     */
+    async logDataAccess(event, env) {
+        const auditEvent = {
+            type: event.type || "data_access",
+            action: event.action,
+            resource: event.resource,
+            resourceId: event.resourceId,
+            userId: event.userId,
+            region: event.region,
+            dataRegion: event.dataRegion,
+            ipAddress: event.ipAddress,
+            userAgent: event.userAgent,
+            metadata: event.metadata,
+            severity: event.severity || "low",
+            success: event.success,
+        };
+        await this.logAuditEvent(auditEvent, env);
+    }
+    /**
+     * Log user action event
+     *
+     * Use this for user-initiated actions (create, update, delete).
+     *
+     * @param event - Audit event details
+     * @param env - Environment variables
+     */
+    async logUserAction(event, env) {
+        const auditEvent = {
+            type: event.type || "user_action",
+            action: event.action,
+            resource: event.resource,
+            resourceId: event.resourceId,
+            userId: event.userId,
+            region: event.region,
+            dataRegion: event.dataRegion,
+            ipAddress: event.ipAddress,
+            userAgent: event.userAgent,
+            metadata: event.metadata,
+            severity: event.severity || "medium", // User actions are typically medium severity
+            success: event.success,
+        };
+        await this.logAuditEvent(auditEvent, env);
+    }
+    /**
+     * Log authentication event
+     *
+     * @param event - Audit event details
+     * @param env - Environment variables
+     */
+    async logAuthentication(event, env) {
+        const auditEvent = {
+            type: event.type || "authentication",
+            action: event.action,
+            resource: event.resource || "user",
+            resourceId: event.resourceId,
+            userId: event.userId,
+            region: event.region,
+            dataRegion: event.dataRegion,
+            ipAddress: event.ipAddress,
+            userAgent: event.userAgent,
+            metadata: event.metadata,
+            severity: event.severity || (event.success ? "low" : "high"), // Failed auth is high severity
+            success: event.success,
+        };
+        await this.logAuditEvent(auditEvent, env);
+    }
+    /**
+     * Log authorization event
+     *
+     * @param event - Audit event details
+     * @param env - Environment variables
+     */
+    async logAuthorization(event, env) {
+        const auditEvent = {
+            type: event.type || "authorization",
+            action: event.action,
+            resource: event.resource,
+            resourceId: event.resourceId,
+            userId: event.userId,
+            region: event.region,
+            dataRegion: event.dataRegion,
+            ipAddress: event.ipAddress,
+            userAgent: event.userAgent,
+            metadata: event.metadata,
+            severity: event.severity || (event.success ? "low" : "high"), // Failed authz is high severity
+            success: event.success,
+        };
+        await this.logAuditEvent(auditEvent, env);
+    }
+    /**
+     * Generic log method that routes to the appropriate specific log method
+     *
+     * @param event - Audit event details
+     * @param env - Environment variables
+     */
+    async log(event, env) {
+        const eventType = event.type || "user_action";
+        switch (eventType) {
+            case "data_access":
+                await this.logDataAccess(event, env);
+                break;
+            case "user_action":
+                await this.logUserAction(event, env);
+                break;
+            case "authentication":
+                await this.logAuthentication(event, env);
+                break;
+            case "authorization":
+                await this.logAuthorization(event, env);
+                break;
+            default:
+                // Default to user_action for unknown types
+                await this.logUserAction(event, env);
+        }
+    }
+    /**
+     * Log audit event to database and application logs
+     *
+     * Security: All audit events are stored in database with region/dataRegion tracking.
+     *
+     * @param event - Audit event to log
+     * @param env - Environment variables
+     */
+    async logAuditEvent(event, env) {
+        try {
+            // CRITICAL: Validate region before logging
+            if (!(0, region_detection_1.isValidRegion)(event.region)) {
+                this.logger.error("[AuditLogger] Invalid region in audit event", {
+                    region: event.region,
+                    action: event.action,
+                });
+                return; // Don't log invalid events
+            }
+            // Calculate retention date based on severity
+            const retentionUntil = this.calculateRetentionUntil(event.severity || "low");
+            // Prepare audit event details (JSON string)
+            const details = JSON.stringify({
+                action: event.action,
+                resource: event.resource,
+                resourceId: event.resourceId,
+                region: event.region,
+                dataRegion: event.dataRegion,
+                ...event.metadata,
+            });
+            // Store in SecurityEvent table (using Prisma create for compatibility with driver adapters)
+            // Note: Using SecurityEvent table since AuditLog table doesn't exist yet
+            // The type field distinguishes audit events from security events
+            // Using retry logic with exponential backoff for connection resilience
+            const severity = event.severity || "low";
+            try {
+                const { sharedDatabaseConnectionManager } = await Promise.resolve().then(() => __importStar(require("./database-connection-manager")));
+                const { withQueryTimeoutAndRetry, QueryTimeoutPresets } = await Promise.resolve().then(() => __importStar(require("./db-query-helper")));
+                await withQueryTimeoutAndRetry(sharedDatabaseConnectionManager, event.region, env, async (db) => {
+                    return await db.securityEvent.create({
+                        data: {
+                            type: `audit_${event.type}`, // Prefix with 'audit_' to distinguish from security events
+                            severity: severity,
+                            userId: event.userId || null,
+                            partnerId: null, // partnerId (not used for audit events)
+                            ipAddress: event.ipAddress || null,
+                            userAgent: event.userAgent || null,
+                            details: details,
+                            retentionUntil: retentionUntil,
+                        },
+                    });
+                }, {
+                    ...QueryTimeoutPresets.BACKGROUND, // Audit logging is background operation
+                    maxRetries: 3,
+                    baseDelayMs: 100,
+                    context: {
+                        operation: "audit_log",
+                        userId: event.userId,
+                        action: event.action,
+                    },
+                });
+            }
+            catch (dbError) {
+                // Table might not exist yet - log to console for now
+                // This is expected until migration is run
+                this.logger.warn("[AuditLogger] Database logging failed (table may not exist, migration needed)", { error: dbError, action: event.action });
+            }
+            // Also log to application logs (using existing Logger)
+            const logMessage = `[Audit] ${event.action} on ${event.resource}${event.resourceId ? ` (${event.resourceId})` : ""} in region ${event.region}${event.dataRegion ? ` (dataRegion: ${event.dataRegion})` : ""}`;
+            if (event.success) {
+                this.logger.info(logMessage, {
+                    type: event.type,
+                    action: event.action,
+                    resource: event.resource,
+                    region: event.region,
+                    dataRegion: event.dataRegion,
+                    userId: event.userId,
+                });
+            }
+            else {
+                this.logger.warn(logMessage, {
+                    type: event.type,
+                    action: event.action,
+                    resource: event.resource,
+                    region: event.region,
+                    dataRegion: event.dataRegion,
+                    userId: event.userId,
+                    error: event.metadata?.error,
+                });
+            }
+        }
+        catch (error) {
+            // Don't fail the request if audit logging fails
+            // But log the error for monitoring
+            this.logger.error("[AuditLogger] Failed to log audit event", {
+                error,
+                action: event.action,
+                resource: event.resource,
+            });
+        }
+    }
+    /**
+     * Calculate retention date based on severity
+     *
+     * Retention periods:
+     * - critical: 365 days (1 year)
+     * - high: 90 days
+     * - medium: 30 days
+     * - low: 7 days
+     *
+     * @param severity - Event severity level
+     * @returns Date when the event should be deleted, or null if retention is disabled
+     */
+    calculateRetentionUntil(severity) {
+        const retentionDays = {
+            critical: 365, // Keep critical events for 1 year
+            high: 90, // Keep high severity for 90 days
+            medium: 30, // Keep medium for 30 days
+            low: 7, // Keep low for 7 days
+        };
+        const days = retentionDays[severity] || 30;
+        const date = new Date();
+        date.setDate(date.getDate() + days);
+        return date;
+    }
+}
+exports.AuditLogger = AuditLogger;
+/**
+ * Create an audit logger instance
+ *
+ * @param env - Environment variables
+ * @param requestId - Optional request ID for correlation
+ * @returns AuditLogger instance
+ */
+function createAuditLogger(env, requestId) {
+    return new AuditLogger(env, requestId);
+}
+//# sourceMappingURL=audit-logger.js.map