@gatwech/auth 1.0.0-beta.18 → 1.0.0-beta.20

package/dist/audit-log-DKsUWR8O.mjs

@@ -0,0 +1,772 @@
+import { t as getIp } from "./get-request-ip-DSjrEpGo.mjs";
+import { t as generateRandomString } from "./random-32E3cU5o.mjs";
+import { n as mergeSchema } from "./date-CMr04reD.mjs";
+import { r as getSessionFromCtx, u as sessionMiddleware } from "./session-BB3oqApE.mjs";
+import { a as CREDENTIAL_SIGN_IN_PATHS, c as SIGN_IN_PATHS, i as AUDIT_EVENT_TYPES, l as VERIFICATION_PATHS, n as registerAuditRecorder, o as PATH_EVENTS, r as ALL_EVENT_TYPES } from "./registry-CqG_3Qnx.mjs";
+import { env } from "@gatwech/core/env";
+import { defineErrorCodes } from "@gatwech/core/utils";
+import { APIError } from "better-call";
+import { createAuthEndpoint, createAuthMiddleware } from "@gatwech/core/api";
+import * as z$1 from "zod";
+import { betterFetch } from "@better-fetch/fetch";
+
+//#region src/plugins/audit-log/remote.ts
+/**
+* Batches events and sends them to the hosted backend. Sending is never
+* awaited by the auth flow, and failures are logged and dropped.
+*/
+function createRemoteSink(options) {
+	if (options === false) return {
+		sink: null,
+		misconfigured: false
+	};
+	const apiKey = options?.apiKey ?? env.PAYVO_INFRA_API_KEY;
+	const apiUrl = options?.apiUrl ?? env.PAYVO_INFRA_API_URL;
+	if (!apiKey || !apiUrl) return {
+		sink: null,
+		misconfigured: Boolean(options)
+	};
+	const baseURL = apiUrl.replace(/\/+$/, "");
+	const timeout = options?.timeout ?? 3e3;
+	const maxSize = options?.batch?.maxSize ?? 25;
+	const flushIntervalMs = options?.batch?.flushIntervalMs ?? 2e3;
+	const headers = {
+		...options?.headers,
+		authorization: `Bearer ${apiKey}`
+	};
+	let buffer = [];
+	let timer = null;
+	async function send(events, logger$1) {
+		const { error } = await betterFetch(`${baseURL}/v1/events`, {
+			method: "POST",
+			headers,
+			body: { events },
+			timeout
+		}).catch((e) => ({ error: e }));
+		if (error) logger$1?.error("[audit-log] Failed to send audit events", error);
+	}
+	async function flush(logger$1) {
+		if (timer) {
+			clearTimeout(timer);
+			timer = null;
+		}
+		if (!buffer.length) return;
+		const events = buffer;
+		buffer = [];
+		await send(events, logger$1);
+	}
+	return {
+		sink: {
+			push(event, logger$1) {
+				buffer.push(event);
+				if (buffer.length >= maxSize) {
+					flush(logger$1);
+					return;
+				}
+				if (!timer) {
+					timer = setTimeout(() => void flush(logger$1), flushIntervalMs);
+					timer.unref?.();
+				}
+			},
+			flush,
+			async query({ userIds, organizationIds,...query }) {
+				const params = new URLSearchParams();
+				for (const [key, value] of Object.entries(query)) if (value !== void 0) params.set(key, String(value));
+				for (const id of userIds ?? []) params.append("userId", id);
+				for (const id of organizationIds ?? []) params.append("organizationId", id);
+				const { data, error } = await betterFetch(`${baseURL}/v1/events?${params.toString()}`, {
+					headers,
+					timeout
+				});
+				if (error || !data) throw new Error(`Failed to query audit events: ${error?.status ?? "no response"}`);
+				return {
+					...data,
+					events: data.events.map((event) => ({
+						...event,
+						createdAt: new Date(event.createdAt)
+					}))
+				};
+			}
+		},
+		misconfigured: false
+	};
+}
+
+//#endregion
+//#region src/plugins/audit-log/schema.ts
+const schema = { auditLog: { fields: {
+	eventType: {
+		type: "string",
+		required: true
+	},
+	userId: {
+		type: "string",
+		required: false
+	},
+	identifier: {
+		type: "string",
+		required: false
+	},
+	organizationId: {
+		type: "string",
+		required: false
+	},
+	status: {
+		type: "string",
+		required: true
+	},
+	path: {
+		type: "string",
+		required: false
+	},
+	ipAddress: {
+		type: "string",
+		required: false
+	},
+	userAgent: {
+		type: "string",
+		required: false
+	},
+	visitorId: {
+		type: "string",
+		required: false
+	},
+	eventData: {
+		type: "json",
+		required: false
+	},
+	createdAt: {
+		type: "date",
+		required: true
+	}
+} } };
+
+//#endregion
+//#region src/plugins/audit-log/index.ts
+const AUDIT_LOG_ERROR_CODES = defineErrorCodes({
+	AUDIT_LOG_ACCESS_DENIED: "You don't have access to these audit logs",
+	AUDIT_LOG_UNAVAILABLE: "Audit logs are temporarily unavailable"
+});
+/** User fields that change as a side effect and aren't profile edits */
+const INTERNAL_USER_FIELDS = new Set([
+	"updatedAt",
+	"emailVerified",
+	"image",
+	"banned",
+	"banReason",
+	"banExpires",
+	"lastLoginMethod",
+	"twoFactorEnabled",
+	"role"
+]);
+const isDate = (value) => !Number.isNaN(new Date(value).getTime());
+const auditLogQuery = {
+	limit: z$1.string().meta({ description: "The number of events to return. Max 100, defaults to 50" }).or(z$1.number()).optional(),
+	offset: z$1.string().meta({ description: "The offset to start from" }).or(z$1.number()).optional(),
+	eventType: z$1.string().meta({ description: "Filter by event type. Eg: \"user_signed_in\"" }).optional(),
+	identifier: z$1.string().meta({ description: "Filter by the actor's identifier. Eg: \"user@example.com\"" }).optional(),
+	organizationId: z$1.string().meta({ description: "Filter by organization" }).optional(),
+	userId: z$1.string().meta({ description: "Filter by user" }).optional(),
+	startDate: z$1.string().refine(isDate, "Invalid date").meta({ description: "Only return events created at or after this date. Eg: \"2026-01-01\"" }).optional(),
+	endDate: z$1.string().refine(isDate, "Invalid date").meta({ description: "Only return events created at or before this date. Eg: \"2026-01-31\"" }).optional()
+};
+function toPagination(query) {
+	const limit = Number(query.limit) || 50;
+	return {
+		limit: Math.min(Math.max(Math.trunc(limit), 1), 100),
+		offset: Math.max(Math.trunc(Number(query.offset) || 0), 0)
+	};
+}
+const auditLog = (options) => {
+	const opts = {
+		...options,
+		database: options?.database ?? true,
+		trackFailedSignIns: options?.trackFailedSignIns ?? true,
+		adminRoles: options?.adminRoles ?? ["admin"]
+	};
+	const excluded = new Set(opts.exclude ?? []);
+	const { sink: remote, misconfigured } = createRemoteSink(opts.remote);
+	const mergedSchema = mergeSchema(schema, opts.schema);
+	let authContext;
+	/** Pending update payloads, so `update.after` knows which fields changed */
+	const pendingUserUpdates = /* @__PURE__ */ new WeakMap();
+	const noContextKey = {};
+	/** Users created in a request, so their first account isn't a link */
+	const createdUsers = /* @__PURE__ */ new WeakMap();
+	/**
+	* The signed-in actor of an audited request, keyed by the request headers
+	* both hooks receive. Read before the endpoint runs because some endpoints
+	* delete the session, and sessions are deleted without database hooks.
+	*/
+	const actors = /* @__PURE__ */ new WeakMap();
+	/** The user an admin endpoint acted on, when the body doesn't name them */
+	const targets = /* @__PURE__ */ new WeakMap();
+	/** The organization an organization endpoint acted on */
+	async function resolveOrganizationId(auth, path, body, result, activeOrganizationId) {
+		const direct = body.organizationId ?? result.organizationId ?? result.member?.organizationId ?? result.invitation?.organizationId ?? (path === "/organization/create" || path === "/organization/update" ? result.id : void 0);
+		if (typeof direct === "string") return direct;
+		if (!path.startsWith("/organization/")) return null;
+		if (typeof body.teamId === "string") {
+			const team = await auth.adapter.findOne({
+				model: "team",
+				where: [{
+					field: "id",
+					value: body.teamId
+				}]
+			}).catch(() => null);
+			if (team) return team.organizationId;
+		}
+		return activeOrganizationId;
+	}
+	function requestMeta(ctx, auth) {
+		const headers = ctx?.headers ?? ctx?.request?.headers;
+		return {
+			path: ctx?.path ?? null,
+			ipAddress: headers ? getIp(headers, auth.options) : null,
+			userAgent: headers?.get("user-agent") ?? null,
+			visitorId: headers?.get("x-visitor-id") ?? null
+		};
+	}
+	/**
+	* The signed-in user making a request, and the admin impersonating them,
+	* when known
+	*/
+	function actorOf(ctx) {
+		const session = (ctx?.context)?.session;
+		if (session?.user?.id) return {
+			id: session.user.id,
+			impersonatedBy: session.session?.impersonatedBy ?? null
+		};
+		const headers = ctx?.headers ?? ctx?.request?.headers;
+		const actor = headers ? actors.get(headers) : void 0;
+		return {
+			id: actor?.id ?? null,
+			impersonatedBy: actor?.impersonatedBy ?? null
+		};
+	}
+	/**
+	* Records an event in every enabled sink. Never throws: audit logging must
+	* not break authentication.
+	*/
+	async function record(ctx, event) {
+		const auth = ctx?.context?.adapter ? ctx.context : authContext;
+		if (!auth || excluded.has(event.eventType)) return;
+		try {
+			const meta = requestMeta(ctx, auth);
+			const actor = actorOf(ctx);
+			const attribution = {
+				...actor.id && actor.id !== event.userId ? { actorId: actor.id } : {},
+				...actor.impersonatedBy ? { impersonatedBy: actor.impersonatedBy } : {}
+			};
+			const eventData = Object.keys(attribution).length ? {
+				...event.eventData,
+				...attribution
+			} : event.eventData ?? null;
+			const { id: _,...data } = {
+				id: "",
+				status: "success",
+				userId: null,
+				identifier: null,
+				organizationId: null,
+				...meta,
+				...event,
+				eventData,
+				createdAt: /* @__PURE__ */ new Date()
+			};
+			let id = auth.generateId({ model: "auditLog" }) || "";
+			if (opts.database) {
+				const row = id ? {
+					...data,
+					id
+				} : data;
+				id = (await auth.adapter.create({
+					model: "auditLog",
+					data: row,
+					forceAllowId: Boolean(id)
+				}).catch((e) => {
+					auth.logger.error("[audit-log] Failed to write audit log", e);
+					return null;
+				}))?.id ?? id;
+			}
+			const full = {
+				...data,
+				id: id || generateRandomString(32)
+			};
+			remote?.push(full, auth.logger);
+			const onEvent = opts.onEvent;
+			if (onEvent) await Promise.resolve().then(() => onEvent(full)).catch((e) => auth.logger.error("[audit-log] onEvent handler failed", e));
+		} catch (e) {
+			auth.logger.error("[audit-log] Failed to record audit event", e);
+		}
+	}
+	function userEventsFromUpdate(data) {
+		const events = [];
+		if (data.emailVerified === true) events.push({ eventType: AUDIT_EVENT_TYPES.USER_EMAIL_VERIFIED });
+		if (data.banned === true) events.push({ eventType: AUDIT_EVENT_TYPES.USER_BANNED });
+		if (data.banned === false) events.push({ eventType: AUDIT_EVENT_TYPES.USER_UNBANNED });
+		if (data.email !== void 0) events.push({ eventType: AUDIT_EVENT_TYPES.USER_EMAIL_CHANGED });
+		if (data.phoneNumber !== void 0) events.push({ eventType: AUDIT_EVENT_TYPES.USER_PHONE_NUMBER_CHANGED });
+		if (data.role !== void 0) events.push({
+			eventType: AUDIT_EVENT_TYPES.USER_ROLE_UPDATED,
+			eventData: { role: data.role }
+		});
+		if (data.twoFactorEnabled === true) events.push({ eventType: AUDIT_EVENT_TYPES.TWO_FACTOR_ENABLED });
+		if (data.twoFactorEnabled === false) events.push({ eventType: AUDIT_EVENT_TYPES.TWO_FACTOR_DISABLED });
+		if (data.image !== void 0) events.push({ eventType: AUDIT_EVENT_TYPES.USER_PROFILE_IMAGE_UPDATED });
+		if (Object.entries(data).some(([key, value]) => value !== void 0 && !INTERNAL_USER_FIELDS.has(key))) events.push({ eventType: AUDIT_EVENT_TYPES.USER_PROFILE_UPDATED });
+		return events;
+	}
+	async function queryEvents(auth, query) {
+		const { limit, offset } = query;
+		if (remote) return remote.query(query);
+		const where = [];
+		if (query.userIds) where.push({
+			field: "userId",
+			operator: "in",
+			value: query.userIds
+		});
+		if (query.organizationIds) where.push({
+			field: "organizationId",
+			operator: "in",
+			value: query.organizationIds
+		});
+		for (const field of [
+			"eventType",
+			"identifier",
+			"userId",
+			"organizationId"
+		]) {
+			const value = query[field];
+			if (value) where.push({
+				field,
+				value
+			});
+		}
+		if (query.startDate) where.push({
+			field: "createdAt",
+			operator: "gte",
+			value: new Date(query.startDate)
+		});
+		if (query.endDate) where.push({
+			field: "createdAt",
+			operator: "lte",
+			value: new Date(query.endDate)
+		});
+		const [events, total] = await Promise.all([auth.adapter.findMany({
+			model: "auditLog",
+			where,
+			limit,
+			offset,
+			sortBy: {
+				field: "createdAt",
+				direction: "desc"
+			}
+		}), auth.adapter.count({
+			model: "auditLog",
+			where
+		})]);
+		return {
+			events,
+			total,
+			limit,
+			offset
+		};
+	}
+	/** Organization memberships of a user, empty without the organization plugin */
+	async function findMemberships(auth, userId) {
+		try {
+			return await auth.adapter.findMany({
+				model: "member",
+				where: [{
+					field: "userId",
+					value: userId
+				}]
+			});
+		} catch {
+			return [];
+		}
+	}
+	function hasRole(roleField, roles) {
+		if (typeof roleField !== "string") return false;
+		return roleField.split(",").map((role) => role.trim()).some((role) => roles.includes(role));
+	}
+	async function runQuery(auth, query) {
+		try {
+			return await queryEvents(auth, query);
+		} catch (e) {
+			auth.logger.error("[audit-log] Failed to query audit logs", e);
+			throw new APIError("SERVICE_UNAVAILABLE", { message: AUDIT_LOG_ERROR_CODES.AUDIT_LOG_UNAVAILABLE });
+		}
+	}
+	return {
+		id: "audit-log",
+		init(ctx) {
+			authContext = ctx;
+			registerAuditRecorder(ctx, record);
+			if (misconfigured) ctx.logger.warn("[audit-log] Missing PAYVO_INFRA_API_URL or PAYVO_INFRA_API_KEY. Remote audit logging is disabled.");
+			return { options: { databaseHooks: {
+				user: {
+					create: { async after(user, context) {
+						if (context) {
+							const created = createdUsers.get(context) ?? /* @__PURE__ */ new Set();
+							created.add(user.id);
+							createdUsers.set(context, created);
+						}
+						await record(context ?? void 0, {
+							eventType: AUDIT_EVENT_TYPES.USER_SIGNED_UP,
+							userId: user.id,
+							identifier: user.email
+						});
+					} },
+					update: {
+						async before(data, context) {
+							const key = context ?? noContextKey;
+							const queue = pendingUserUpdates.get(key) ?? [];
+							queue.push(data);
+							pendingUserUpdates.set(key, queue);
+							return { data };
+						},
+						async after(user, context) {
+							const key = context ?? noContextKey;
+							const data = pendingUserUpdates.get(key)?.shift();
+							if (!user || !data) return;
+							for (const event of userEventsFromUpdate(data)) await record(context ?? void 0, {
+								...event,
+								userId: user.id,
+								identifier: user.email
+							});
+						}
+					},
+					delete: { async after(user, context) {
+						await record(context ?? void 0, {
+							eventType: AUDIT_EVENT_TYPES.USER_DELETED,
+							userId: user.id,
+							identifier: user.email
+						});
+					} }
+				},
+				session: { create: { async after(session, context) {
+					await record(context ?? void 0, {
+						eventType: AUDIT_EVENT_TYPES.SESSION_CREATED,
+						userId: session.userId
+					});
+					const impersonatedBy = session.impersonatedBy;
+					if (impersonatedBy) await record(context ?? void 0, {
+						eventType: AUDIT_EVENT_TYPES.USER_IMPERSONATED,
+						userId: session.userId,
+						eventData: { impersonatedBy }
+					});
+				} } },
+				account: { create: { async after(account, context) {
+					if (context && createdUsers.get(context)?.has(account.userId)) return;
+					await record(context ?? void 0, {
+						eventType: AUDIT_EVENT_TYPES.ACCOUNT_LINKED,
+						userId: account.userId,
+						eventData: { providerId: account.providerId }
+					});
+				} } }
+			} } };
+		},
+		hooks: {
+			before: [{
+				matcher(context) {
+					return context.path === "/sign-out" || context.path in PATH_EVENTS;
+				},
+				handler: createAuthMiddleware(async (ctx) => {
+					if (!ctx.headers) return;
+					const session = await getSessionFromCtx(ctx).catch(() => null);
+					if (session) actors.set(ctx.headers, {
+						id: session.user.id,
+						email: session.user.email,
+						activeOrganizationId: session.session.activeOrganizationId ?? null,
+						impersonatedBy: session.session.impersonatedBy ?? null
+					});
+					const sessionToken = ctx.body?.sessionToken;
+					if (ctx.path === "/admin/revoke-user-session" && typeof sessionToken === "string") {
+						const revoked = await ctx.context.internalAdapter.findSession(sessionToken).catch(() => null);
+						if (revoked) targets.set(ctx.headers, revoked.session.userId);
+					}
+				})
+			}],
+			after: [{
+				matcher(context) {
+					return context.path === "/sign-out" || SIGN_IN_PATHS.includes(context.path) || VERIFICATION_PATHS.includes(context.path) || context.path in PATH_EVENTS;
+				},
+				handler: createAuthMiddleware(async (ctx) => {
+					const returned = ctx.context.returned;
+					const failed = returned instanceof APIError && returned.statusCode >= 400;
+					const body = ctx.body ?? {};
+					const identifier = [
+						body.email,
+						body.username,
+						body.phoneNumber
+					].find((value) => typeof value === "string") ?? null;
+					if (ctx.path === "/sign-out") {
+						const actor$1 = ctx.headers && actors.get(ctx.headers);
+						if (!actor$1 || failed) return;
+						await record(ctx, {
+							eventType: AUDIT_EVENT_TYPES.USER_SIGNED_OUT,
+							userId: actor$1.id,
+							identifier: actor$1.email
+						});
+						return;
+					}
+					const isCredentialCheck = CREDENTIAL_SIGN_IN_PATHS.includes(ctx.path);
+					if (returned instanceof APIError && failed && opts.trackFailedSignIns && (isCredentialCheck || VERIFICATION_PATHS.includes(ctx.path))) {
+						await record(ctx, {
+							eventType: isCredentialCheck ? AUDIT_EVENT_TYPES.USER_SIGN_IN_FAILED : AUDIT_EVENT_TYPES.VERIFICATION_FAILED,
+							status: "failure",
+							identifier,
+							eventData: {
+								code: returned.body?.code,
+								status: returned.statusCode
+							}
+						});
+						return;
+					}
+					if (SIGN_IN_PATHS.includes(ctx.path)) {
+						const newSession = ctx.context.newSession;
+						if (!failed && newSession && !(returned && "twoFactorRedirect" in returned)) await record(ctx, {
+							eventType: AUDIT_EVENT_TYPES.USER_SIGNED_IN,
+							userId: newSession.user.id,
+							identifier: newSession.user.email
+						});
+						return;
+					}
+					const eventType = PATH_EVENTS[ctx.path];
+					if (!eventType || failed) return;
+					if (ctx.path === "/email-otp/send-verification-otp" && body.type !== "email-verification") return;
+					const result = returned ?? {};
+					const actor = ctx.headers ? actors.get(ctx.headers) : void 0;
+					const target = (ctx.headers && targets.get(ctx.headers)) ?? (ctx.path.startsWith("/admin/") && typeof body.userId === "string" ? body.userId : null);
+					const organizationId = await resolveOrganizationId(ctx.context, ctx.path, body, result, actor?.activeOrganizationId ?? null);
+					const eventData = {};
+					if (ctx.path === "/unlink-account") eventData.providerId = body.providerId;
+					if (ctx.path === "/organization/invite-member") {
+						eventData.email = body.email;
+						eventData.role = body.role;
+					}
+					if (ctx.path === "/organization/update-member-role") {
+						eventData.memberId = body.memberId;
+						eventData.role = body.role;
+					}
+					if (ctx.path.startsWith("/organization/") && ctx.path.endsWith("-role")) eventData.role = body.role ?? body.roleName ?? body.roleId;
+					let owner = null;
+					if (ctx.path.startsWith("/api-key/")) {
+						eventData.keyId = body.keyId ?? result.id;
+						owner = result.userId ?? null;
+					}
+					if (ctx.path.startsWith("/passkey/")) eventData.passkeyId = body.id ?? result.id;
+					await record(ctx, {
+						eventType,
+						userId: target ?? actor?.id ?? result.user?.id ?? owner,
+						identifier: actor?.email ?? identifier,
+						organizationId,
+						eventData: Object.keys(eventData).length ? eventData : null
+					});
+				})
+			}]
+		},
+		endpoints: {
+			getAuditLogs: createAuthEndpoint("/audit-log/get-audit-logs", {
+				method: "GET",
+				use: [sessionMiddleware],
+				query: z$1.object(auditLogQuery).optional(),
+				metadata: { openapi: {
+					operationId: "getAuditLogs",
+					summary: "Get audit logs",
+					description: "Get the current user's audit events, optionally restricted to an organization",
+					responses: { 200: {
+						description: "Paginated audit events",
+						content: { "application/json": { schema: {
+							type: "object",
+							properties: {
+								events: {
+									type: "array",
+									items: {
+										type: "object",
+										properties: {
+											id: { type: "string" },
+											eventType: { type: "string" },
+											status: { type: "string" },
+											userId: {
+												type: "string",
+												nullable: true
+											},
+											identifier: {
+												type: "string",
+												nullable: true
+											},
+											organizationId: {
+												type: "string",
+												nullable: true
+											},
+											path: {
+												type: "string",
+												nullable: true
+											},
+											ipAddress: {
+												type: "string",
+												nullable: true
+											},
+											userAgent: {
+												type: "string",
+												nullable: true
+											},
+											visitorId: {
+												type: "string",
+												nullable: true
+											},
+											eventData: {
+												type: "object",
+												nullable: true
+											},
+											createdAt: {
+												type: "string",
+												format: "date-time"
+											}
+										}
+									}
+								},
+								total: { type: "number" },
+								limit: { type: "number" },
+								offset: { type: "number" }
+							},
+							required: [
+								"events",
+								"total",
+								"limit",
+								"offset"
+							]
+						} } }
+					} }
+				} }
+			}, async (ctx) => {
+				const { user } = ctx.context.session;
+				const { limit: _limit, offset: _offset,...filters } = ctx.query ?? {};
+				const pagination = toPagination(ctx.query ?? {});
+				if (filters.userId && filters.userId !== user.id) throw new APIError("FORBIDDEN", { message: AUDIT_LOG_ERROR_CODES.AUDIT_LOG_ACCESS_DENIED });
+				return ctx.json(await runQuery(ctx.context, {
+					...filters,
+					...pagination,
+					userId: user.id
+				}));
+			}),
+			getAllAuditLogs: createAuthEndpoint("/audit-log/get-all-audit-logs", {
+				method: "GET",
+				use: [sessionMiddleware],
+				query: z$1.object(auditLogQuery).optional(),
+				metadata: { openapi: {
+					operationId: "getAllAuditLogs",
+					summary: "Get all audit logs",
+					description: "Get audit events across organizations the user owns or administers, or every event for admins",
+					responses: { 200: {
+						description: "Paginated audit events",
+						content: { "application/json": { schema: {
+							type: "object",
+							properties: {
+								events: {
+									type: "array",
+									items: {
+										type: "object",
+										properties: {
+											id: { type: "string" },
+											eventType: { type: "string" },
+											status: { type: "string" },
+											userId: {
+												type: "string",
+												nullable: true
+											},
+											identifier: {
+												type: "string",
+												nullable: true
+											},
+											organizationId: {
+												type: "string",
+												nullable: true
+											},
+											path: {
+												type: "string",
+												nullable: true
+											},
+											ipAddress: {
+												type: "string",
+												nullable: true
+											},
+											userAgent: {
+												type: "string",
+												nullable: true
+											},
+											visitorId: {
+												type: "string",
+												nullable: true
+											},
+											eventData: {
+												type: "object",
+												nullable: true
+											},
+											createdAt: {
+												type: "string",
+												format: "date-time"
+											}
+										}
+									}
+								},
+								total: { type: "number" },
+								limit: { type: "number" },
+								offset: { type: "number" }
+							},
+							required: [
+								"events",
+								"total",
+								"limit",
+								"offset"
+							]
+						} } }
+					} }
+				} }
+			}, async (ctx) => {
+				const { user } = ctx.context.session;
+				const { limit: _limit, offset: _offset,...filters } = ctx.query ?? {};
+				const pagination = toPagination(ctx.query ?? {});
+				if (hasRole(user.role, opts.adminRoles)) return ctx.json(await runQuery(ctx.context, {
+					...filters,
+					...pagination
+				}));
+				const administered = (await findMemberships(ctx.context, user.id)).filter((m) => hasRole(m.role, ["owner", "admin"])).map((m) => m.organizationId);
+				if (!administered.length || filters.organizationId && !administered.includes(filters.organizationId)) throw new APIError("FORBIDDEN", { message: AUDIT_LOG_ERROR_CODES.AUDIT_LOG_ACCESS_DENIED });
+				return ctx.json(await runQuery(ctx.context, {
+					...filters,
+					...pagination,
+					organizationIds: filters.organizationId ? void 0 : administered
+				}));
+			}),
+			getEventTypes: createAuthEndpoint("/audit-log/get-event-types", {
+				method: "GET",
+				use: [sessionMiddleware],
+				metadata: { openapi: {
+					operationId: "getAuditLogEventTypes",
+					summary: "Get audit log event types",
+					description: "Get the event types the audit log can record",
+					responses: { 200: {
+						description: "Event types",
+						content: { "application/json": { schema: {
+							type: "object",
+							properties: { types: {
+								type: "array",
+								items: { type: "string" }
+							} },
+							required: ["types"]
+						} } }
+					} }
+				} }
+			}, async (ctx) => ctx.json({ types: ALL_EVENT_TYPES }))
+		},
+		schema: mergedSchema,
+		$ERROR_CODES: AUDIT_LOG_ERROR_CODES,
+		options: opts
+	};
+};
+
+//#endregion
+export { auditLog as n, AUDIT_LOG_ERROR_CODES as t };