@gatwech/auth 1.0.0-beta.18 → 1.0.0-beta.20

package/dist/registry-CqG_3Qnx.mjs

@@ -0,0 +1,194 @@
+//#region src/plugins/audit-log/events.ts
+/**
+* Audit event types recorded by the audit log plugin
+*/
+const AUDIT_EVENT_TYPES = {
+	USER_SIGNED_UP: "user_signed_up",
+	USER_PROFILE_UPDATED: "user_profile_updated",
+	USER_PROFILE_IMAGE_UPDATED: "user_profile_image_updated",
+	USER_EMAIL_VERIFIED: "user_email_verified",
+	USER_BANNED: "user_banned",
+	USER_UNBANNED: "user_unbanned",
+	USER_DELETED: "user_deleted",
+	USER_ROLE_UPDATED: "user_role_updated",
+	USER_EMAIL_CHANGED: "user_email_changed",
+	USER_PHONE_NUMBER_CHANGED: "user_phone_number_changed",
+	USER_SIGNED_IN: "user_signed_in",
+	USER_SIGNED_OUT: "user_signed_out",
+	SESSION_CREATED: "session_created",
+	SESSION_REVOKED: "session_revoked",
+	SESSIONS_REVOKED_ALL: "sessions_revoked_all",
+	USER_IMPERSONATED: "user_impersonated",
+	USER_IMPERSONATION_STOPPED: "user_impersonation_stopped",
+	DEVICE_AUTHORIZATION_APPROVED: "device_authorization_approved",
+	DEVICE_AUTHORIZATION_DENIED: "device_authorization_denied",
+	ACCOUNT_LINKED: "account_linked",
+	ACCOUNT_UNLINKED: "account_unlinked",
+	PASSWORD_CHANGED: "password_changed",
+	TWO_FACTOR_ENABLED: "two_factor_enabled",
+	TWO_FACTOR_DISABLED: "two_factor_disabled",
+	BACKUP_CODES_GENERATED: "two_factor_backup_codes_generated",
+	PASSKEY_ADDED: "passkey_added",
+	PASSKEY_REMOVED: "passkey_removed",
+	API_KEY_CREATED: "api_key_created",
+	API_KEY_UPDATED: "api_key_updated",
+	API_KEY_DELETED: "api_key_deleted",
+	PASSWORD_RESET_REQUESTED: "password_reset_requested",
+	PASSWORD_RESET_COMPLETED: "password_reset_completed",
+	EMAIL_VERIFICATION_SENT: "email_verification_sent",
+	ORGANIZATION_CREATED: "organization_created",
+	ORGANIZATION_UPDATED: "organization_updated",
+	ORGANIZATION_DELETED: "organization_deleted",
+	ORGANIZATION_ROLE_CREATED: "organization_role_created",
+	ORGANIZATION_ROLE_UPDATED: "organization_role_updated",
+	ORGANIZATION_ROLE_DELETED: "organization_role_deleted",
+	MEMBER_ADDED: "member_added",
+	MEMBER_REMOVED: "member_removed",
+	MEMBER_ROLE_UPDATED: "member_role_updated",
+	MEMBER_INVITED: "member_invited",
+	INVITE_ACCEPTED: "invite_accepted",
+	INVITE_REJECTED: "invite_rejected",
+	INVITE_CANCELLED: "invite_cancelled",
+	TEAM_CREATED: "team_created",
+	TEAM_UPDATED: "team_updated",
+	TEAM_DELETED: "team_deleted",
+	TEAM_MEMBER_ADDED: "team_member_added",
+	TEAM_MEMBER_REMOVED: "team_member_removed",
+	USER_SIGN_IN_FAILED: "user_sign_in_failed",
+	VERIFICATION_FAILED: "verification_failed"
+};
+/**
+* Security event types recorded by the sentinel plugin
+*
+* Declared here so both plugins share the same event types
+*/
+const SECURITY_EVENT_TYPES = {
+	BLOCKED: "security_blocked",
+	ALLOWED_AFTER_CHALLENGE: "security_allowed",
+	CREDENTIAL_STUFFING: "security_credential_stuffing",
+	IMPOSSIBLE_TRAVEL: "security_impossible_travel",
+	GEO_BLOCKED: "security_geo_blocked",
+	BOT_BLOCKED: "security_bot_blocked",
+	SUSPICIOUS_IP: "security_suspicious_ip",
+	VELOCITY_EXCEEDED: "security_velocity_exceeded",
+	FREE_TRIAL_ABUSE: "security_free_trial_abuse",
+	COMPROMISED_PASSWORD: "security_compromised_password",
+	STALE_ACCOUNT: "security_stale_account",
+	INVALID_EMAIL: "security_invalid_email"
+};
+const ALL_EVENT_TYPES = [...Object.values(AUDIT_EVENT_TYPES), ...Object.values(SECURITY_EVENT_TYPES)];
+/** Endpoints that complete a sign-in by creating a session */
+const SIGN_IN_PATHS = [
+	"/sign-in/email",
+	"/sign-in/email-otp",
+	"/sign-in/phone-number",
+	"/sign-in/username",
+	"/magic-link/verify",
+	"/sign-in/anonymous",
+	"/sign-in/social",
+	"/sign-in/oauth2",
+	"/callback/:id",
+	"/oauth2/callback/:providerId",
+	"/one-tap/callback",
+	"/passkey/verify-authentication",
+	"/two-factor/verify-totp",
+	"/two-factor/verify-otp",
+	"/two-factor/verify-backup-code",
+	"/one-time-token/verify",
+	"/device/token",
+	"/verify-email",
+	"/email-otp/verify-email",
+	"/phone-number/verify"
+];
+/** Sign-in endpoints that check credentials, so a failure is a failed attempt */
+const CREDENTIAL_SIGN_IN_PATHS = [
+	"/sign-in/email",
+	"/sign-in/email-otp",
+	"/sign-in/phone-number",
+	"/sign-in/username",
+	"/passkey/verify-authentication",
+	"/two-factor/verify-totp",
+	"/two-factor/verify-otp",
+	"/two-factor/verify-backup-code"
+];
+/**
+* Endpoints that check a one-time code or token outside a sign-in, so a
+* failure is a failed attempt
+*/
+const VERIFICATION_PATHS = [
+	"/email-otp/check-verification-otp",
+	"/email-otp/verify-email",
+	"/email-otp/reset-password",
+	"/phone-number/verify",
+	"/phone-number/reset-password",
+	"/reset-password",
+	"/one-time-token/verify"
+];
+/** Endpoints whose successful response maps to a single event */
+const PATH_EVENTS = {
+	"/revoke-session": AUDIT_EVENT_TYPES.SESSION_REVOKED,
+	"/revoke-sessions": AUDIT_EVENT_TYPES.SESSIONS_REVOKED_ALL,
+	"/revoke-other-sessions": AUDIT_EVENT_TYPES.SESSIONS_REVOKED_ALL,
+	"/multi-session/revoke": AUDIT_EVENT_TYPES.SESSION_REVOKED,
+	"/admin/revoke-user-session": AUDIT_EVENT_TYPES.SESSION_REVOKED,
+	"/admin/revoke-user-sessions": AUDIT_EVENT_TYPES.SESSIONS_REVOKED_ALL,
+	"/change-password": AUDIT_EVENT_TYPES.PASSWORD_CHANGED,
+	"/set-password": AUDIT_EVENT_TYPES.PASSWORD_CHANGED,
+	"/admin/set-user-password": AUDIT_EVENT_TYPES.PASSWORD_CHANGED,
+	"/request-password-reset": AUDIT_EVENT_TYPES.PASSWORD_RESET_REQUESTED,
+	"/forget-password/email-otp": AUDIT_EVENT_TYPES.PASSWORD_RESET_REQUESTED,
+	"/phone-number/request-password-reset": AUDIT_EVENT_TYPES.PASSWORD_RESET_REQUESTED,
+	"/reset-password": AUDIT_EVENT_TYPES.PASSWORD_RESET_COMPLETED,
+	"/email-otp/reset-password": AUDIT_EVENT_TYPES.PASSWORD_RESET_COMPLETED,
+	"/phone-number/reset-password": AUDIT_EVENT_TYPES.PASSWORD_RESET_COMPLETED,
+	"/send-verification-email": AUDIT_EVENT_TYPES.EMAIL_VERIFICATION_SENT,
+	"/email-otp/send-verification-otp": AUDIT_EVENT_TYPES.EMAIL_VERIFICATION_SENT,
+	"/unlink-account": AUDIT_EVENT_TYPES.ACCOUNT_UNLINKED,
+	"/two-factor/generate-backup-codes": AUDIT_EVENT_TYPES.BACKUP_CODES_GENERATED,
+	"/passkey/verify-registration": AUDIT_EVENT_TYPES.PASSKEY_ADDED,
+	"/passkey/delete-passkey": AUDIT_EVENT_TYPES.PASSKEY_REMOVED,
+	"/api-key/create": AUDIT_EVENT_TYPES.API_KEY_CREATED,
+	"/api-key/update": AUDIT_EVENT_TYPES.API_KEY_UPDATED,
+	"/api-key/delete": AUDIT_EVENT_TYPES.API_KEY_DELETED,
+	"/admin/stop-impersonating": AUDIT_EVENT_TYPES.USER_IMPERSONATION_STOPPED,
+	"/device/approve": AUDIT_EVENT_TYPES.DEVICE_AUTHORIZATION_APPROVED,
+	"/device/deny": AUDIT_EVENT_TYPES.DEVICE_AUTHORIZATION_DENIED,
+	"/organization/create": AUDIT_EVENT_TYPES.ORGANIZATION_CREATED,
+	"/organization/update": AUDIT_EVENT_TYPES.ORGANIZATION_UPDATED,
+	"/organization/delete": AUDIT_EVENT_TYPES.ORGANIZATION_DELETED,
+	"/organization/create-role": AUDIT_EVENT_TYPES.ORGANIZATION_ROLE_CREATED,
+	"/organization/update-role": AUDIT_EVENT_TYPES.ORGANIZATION_ROLE_UPDATED,
+	"/organization/delete-role": AUDIT_EVENT_TYPES.ORGANIZATION_ROLE_DELETED,
+	"/organization/add-member": AUDIT_EVENT_TYPES.MEMBER_ADDED,
+	"/organization/remove-member": AUDIT_EVENT_TYPES.MEMBER_REMOVED,
+	"/organization/leave": AUDIT_EVENT_TYPES.MEMBER_REMOVED,
+	"/organization/update-member-role": AUDIT_EVENT_TYPES.MEMBER_ROLE_UPDATED,
+	"/organization/invite-member": AUDIT_EVENT_TYPES.MEMBER_INVITED,
+	"/organization/accept-invitation": AUDIT_EVENT_TYPES.INVITE_ACCEPTED,
+	"/organization/reject-invitation": AUDIT_EVENT_TYPES.INVITE_REJECTED,
+	"/organization/cancel-invitation": AUDIT_EVENT_TYPES.INVITE_CANCELLED,
+	"/organization/create-team": AUDIT_EVENT_TYPES.TEAM_CREATED,
+	"/organization/update-team": AUDIT_EVENT_TYPES.TEAM_UPDATED,
+	"/organization/remove-team": AUDIT_EVENT_TYPES.TEAM_DELETED,
+	"/organization/add-team-member": AUDIT_EVENT_TYPES.TEAM_MEMBER_ADDED,
+	"/organization/remove-team-member": AUDIT_EVENT_TYPES.TEAM_MEMBER_REMOVED
+};
+
+//#endregion
+//#region src/plugins/audit-log/registry.ts
+/**
+* Recorders registered by `auditLog()`, keyed by the database adapter of the
+* auth instance they belong to (it's the same object for the whole lifetime
+* of the instance, unlike the options), so other plugins record through the
+* same sinks
+*/
+const recorders = /* @__PURE__ */ new WeakMap();
+function registerAuditRecorder(context, record) {
+	recorders.set(context.adapter, record);
+}
+function getAuditRecorder(context) {
+	return recorders.get(context.adapter);
+}
+
+//#endregion
+export { CREDENTIAL_SIGN_IN_PATHS as a, SIGN_IN_PATHS as c, AUDIT_EVENT_TYPES as i, VERIFICATION_PATHS as l, registerAuditRecorder as n, PATH_EVENTS as o, ALL_EVENT_TYPES as r, SECURITY_EVENT_TYPES as s, getAuditRecorder as t };