@gatwech/auth 1.0.0-beta.23 → 1.0.0-beta.25

package/dist/plugins/organization/index.d.mts

@@ -1,9 +1,9 @@
 import "../../helper-BgOIGHsu.mjs";
-import "../../index-3lfPQHhX.mjs";
+import "../../index-CTjXncwM.mjs";
 import "../../types-DNQ9XQrB.mjs";
 import "../../index-BL_t8cRp-C4QYBsac.mjs";
 import "../../plugins-Dy_FrD4Y.mjs";
 import "../../index-CxlWnL9c.mjs";
 import { a as memberAc, i as defaultStatements, n as defaultAc, o as ownerAc, r as defaultRoles, t as adminAc } from "../../index-QmocqGM-.mjs";
-import { A as organizationRoleSchema, C as TeamInput, D as invitationSchema, E as defaultRolesSchema, F as OrganizationOptions, M as roleSchema, N as teamMemberSchema, O as invitationStatus, P as teamSchema, S as Team, T as TeamMemberInput, _ as MemberInput, a as organization, b as OrganizationRole, c as InferMember, d as InferOrganizationZodRolesFromOption, f as InferTeam, g as Member, h as InvitationStatus, i as TeamEndpoints, j as organizationSchema, k as memberSchema, l as InferOrganization, m as InvitationInput, n as OrganizationEndpoints, o as parseRoles, p as Invitation, r as OrganizationPlugin, s as InferInvitation, t as DynamicAccessControlEndpoints, u as InferOrganizationRolesFromOption, v as Organization, w as TeamMember, x as OrganizationSchema, y as OrganizationInput } from "../../index-CExSHSFz.mjs";
+import { A as organizationRoleSchema, C as TeamInput, D as invitationSchema, E as defaultRolesSchema, F as OrganizationOptions, M as roleSchema, N as teamMemberSchema, O as invitationStatus, P as teamSchema, S as Team, T as TeamMemberInput, _ as MemberInput, a as organization, b as OrganizationRole, c as InferMember, d as InferOrganizationZodRolesFromOption, f as InferTeam, g as Member, h as InvitationStatus, i as TeamEndpoints, j as organizationSchema, k as memberSchema, l as InferOrganization, m as InvitationInput, n as OrganizationEndpoints, o as parseRoles, p as Invitation, r as OrganizationPlugin, s as InferInvitation, t as DynamicAccessControlEndpoints, u as InferOrganizationRolesFromOption, v as Organization, w as TeamMember, x as OrganizationSchema, y as OrganizationInput } from "../../index-Bi-vEjDm.mjs";
 export { DynamicAccessControlEndpoints, InferInvitation, InferMember, InferOrganization, InferOrganizationRolesFromOption, InferOrganizationZodRolesFromOption, InferTeam, Invitation, InvitationInput, InvitationStatus, Member, MemberInput, Organization, OrganizationEndpoints, OrganizationInput, OrganizationOptions, OrganizationPlugin, OrganizationRole, OrganizationSchema, Team, TeamEndpoints, TeamInput, TeamMember, TeamMemberInput, adminAc, defaultAc, defaultRoles, defaultRolesSchema, defaultStatements, invitationSchema, invitationStatus, memberAc, memberSchema, organization, organizationRoleSchema, organizationSchema, ownerAc, parseRoles, roleSchema, teamMemberSchema, teamSchema };

package/dist/plugins/passkey/index.d.mts

@@ -1,7 +1,7 @@
 import "../../helper-BgOIGHsu.mjs";
-import "../../index-3lfPQHhX.mjs";
+import "../../index-CTjXncwM.mjs";
 import "../../types-DNQ9XQrB.mjs";
 import "../../index-BL_t8cRp-C4QYBsac.mjs";
 import "../../plugins-Dy_FrD4Y.mjs";
-import { n as Passkey, r as PasskeyOptions, t as passkey } from "../../index-COFPq-mg.mjs";
+import { n as Passkey, r as PasskeyOptions, t as passkey } from "../../index-DBtm_waB.mjs";
 export { Passkey, PasskeyOptions, passkey };

package/dist/plugins/phone-number/index.d.mts

@@ -1,7 +1,7 @@
 import "../../helper-BgOIGHsu.mjs";
-import "../../index-3lfPQHhX.mjs";
+import "../../index-CTjXncwM.mjs";
 import "../../types-DNQ9XQrB.mjs";
 import "../../index-BL_t8cRp-C4QYBsac.mjs";
 import "../../plugins-Dy_FrD4Y.mjs";
-import { n as UserWithPhoneNumber, r as phoneNumber, t as PhoneNumberOptions } from "../../index-Dgyj1fTk.mjs";
+import { n as UserWithPhoneNumber, r as phoneNumber, t as PhoneNumberOptions } from "../../index-CUUaJp3R.mjs";
 export { PhoneNumberOptions, UserWithPhoneNumber, phoneNumber };

package/dist/plugins/sentinel/client.d.mts

@@ -1,30 +1,30 @@
 import "../../helper-BgOIGHsu.mjs";
-import "../../index-3lfPQHhX.mjs";
+import "../../index-CTjXncwM.mjs";
 import "../../types-DNQ9XQrB.mjs";
 import "../../index-BL_t8cRp-C4QYBsac.mjs";
 import "../../plugins-Dy_FrD4Y.mjs";
 import "../../index-CxlWnL9c.mjs";
-import "../../index-Blq8KrTy.mjs";
-import "../../index-B4aWSJEd.mjs";
-import "../../index-B7iZf_Dl.mjs";
-import "../../index-CWxKeTtE.mjs";
-import "../../index-382PsmkK.mjs";
-import "../../index-D0SgItjY.mjs";
-import "../../index-DxRAXHrZ.mjs";
-import "../../index-C8F7PsET.mjs";
-import "../../index-DUu0ieh6.mjs";
-import "../../index-DCliG2n6.mjs";
-import "../../index-DPVukjga.mjs";
-import "../../index-DxIqV3rU.mjs";
-import "../../index-Dg6Ftb6f.mjs";
-import "../../index-C-z4TCHD.mjs";
-import "../../index-CIxFDcfQ.mjs";
-import "../../index-B5r4oL5q.mjs";
+import "../../index-DRoa3BGG.mjs";
+import "../../index-i1L-uguJ.mjs";
+import "../../index-DD_pxX-h.mjs";
+import "../../index-B4HTudhm.mjs";
+import "../../index-BX55rZO5.mjs";
+import "../../index-CNyQFga7.mjs";
+import "../../index-gRLqvVoc.mjs";
+import "../../index-BHiF_ZfZ.mjs";
+import "../../index-BfwCJQfM.mjs";
+import "../../index-CcJjgkwe.mjs";
+import "../../index-C5W_sTlp.mjs";
+import "../../index-M0IQ_DTL.mjs";
+import "../../index-Cdfh66xb.mjs";
+import "../../index-BifhxQ8O.mjs";
+import "../../index-BhbilPfs.mjs";
+import "../../index-mDmrBYrk.mjs";
 import "../../index-QmocqGM-.mjs";
-import "../../index-CExSHSFz.mjs";
-import "../../index-Dgyj1fTk.mjs";
-import "../../index-CWwQ1Q7t.mjs";
-import "../../index-COFPq-mg.mjs";
-import "../../index-De2a2OyC.mjs";
-import { t as sentinelClient } from "../../client-CDaFOX7A.mjs";
+import "../../index-Bi-vEjDm.mjs";
+import "../../index-CUUaJp3R.mjs";
+import "../../index-BiomZttP.mjs";
+import "../../index-DBtm_waB.mjs";
+import "../../index-BoHrBgTB.mjs";
+import { t as sentinelClient } from "../../client-zkWmSxqy.mjs";
 export { sentinelClient };

package/dist/plugins/sentinel/client.mjs

@@ -1,5 +1,5 @@
 import "../../random-32E3cU5o.mjs";
-import "../../pow-DvkUopsK.mjs";
-import { t as sentinelClient } from "../../client-CMsC6-rl.mjs";
+import "../../pow-Vna_j4hx.mjs";
+import { t as sentinelClient } from "../../client-BkpNva-h.mjs";
 
 export { sentinelClient };

package/dist/plugins/sentinel/index.d.mts

@@ -1,29 +1,29 @@
 import "../../helper-BgOIGHsu.mjs";
-import "../../index-3lfPQHhX.mjs";
+import "../../index-CTjXncwM.mjs";
 import "../../types-DNQ9XQrB.mjs";
 import "../../index-BL_t8cRp-C4QYBsac.mjs";
 import "../../plugins-Dy_FrD4Y.mjs";
 import "../../index-CxlWnL9c.mjs";
-import "../../index-Blq8KrTy.mjs";
-import "../../index-B4aWSJEd.mjs";
-import { S as SentinelOptions, _ as haversineDistanceKm, b as GeoLocation, c as sentinel, d as POW_SOLUTION_HEADER, f as createNonce, g as verifySolution, h as solveChallenge, l as POW_CHALLENGE_HEADER, m as parsePowHeader, p as hasLeadingZeroBits, u as POW_REASON_HEADER, v as normalizeEmail, x as SecurityAction, y as SENTINEL_ERROR_CODES } from "../../index-B7iZf_Dl.mjs";
-import "../../index-CWxKeTtE.mjs";
-import "../../index-382PsmkK.mjs";
-import "../../index-D0SgItjY.mjs";
-import "../../index-DxRAXHrZ.mjs";
-import "../../index-C8F7PsET.mjs";
-import "../../index-DUu0ieh6.mjs";
-import "../../index-DCliG2n6.mjs";
-import "../../index-DPVukjga.mjs";
-import "../../index-DxIqV3rU.mjs";
-import "../../index-Dg6Ftb6f.mjs";
-import "../../index-C-z4TCHD.mjs";
-import "../../index-CIxFDcfQ.mjs";
-import "../../index-B5r4oL5q.mjs";
+import "../../index-DRoa3BGG.mjs";
+import "../../index-i1L-uguJ.mjs";
+import { A as verifySolution, C as POW_CHALLENGE_HEADER, D as hasLeadingZeroBits, E as createNonce, F as SentinelOptions, M as normalizeEmail, N as GeoLocation, O as parsePowHeader, P as SecurityAction, S as SENTINEL_ERROR_CODES, T as POW_SOLUTION_HEADER, j as haversineDistanceKm, k as solveChallenge, w as POW_REASON_HEADER, x as sentinel } from "../../index-DD_pxX-h.mjs";
+import "../../index-B4HTudhm.mjs";
+import "../../index-BX55rZO5.mjs";
+import "../../index-CNyQFga7.mjs";
+import "../../index-gRLqvVoc.mjs";
+import "../../index-BHiF_ZfZ.mjs";
+import "../../index-BfwCJQfM.mjs";
+import "../../index-CcJjgkwe.mjs";
+import "../../index-C5W_sTlp.mjs";
+import "../../index-M0IQ_DTL.mjs";
+import "../../index-Cdfh66xb.mjs";
+import "../../index-BifhxQ8O.mjs";
+import "../../index-BhbilPfs.mjs";
+import "../../index-mDmrBYrk.mjs";
 import "../../index-QmocqGM-.mjs";
-import "../../index-CExSHSFz.mjs";
-import "../../index-Dgyj1fTk.mjs";
-import "../../index-CWwQ1Q7t.mjs";
-import "../../index-COFPq-mg.mjs";
-import "../../index-De2a2OyC.mjs";
+import "../../index-Bi-vEjDm.mjs";
+import "../../index-CUUaJp3R.mjs";
+import "../../index-BiomZttP.mjs";
+import "../../index-DBtm_waB.mjs";
+import "../../index-BoHrBgTB.mjs";
 export { GeoLocation, POW_CHALLENGE_HEADER, POW_REASON_HEADER, POW_SOLUTION_HEADER, SENTINEL_ERROR_CODES, SecurityAction, SentinelOptions, createNonce, hasLeadingZeroBits, haversineDistanceKm, normalizeEmail, parsePowHeader, sentinel, solveChallenge, verifySolution };

package/dist/plugins/sentinel/index.mjs

@@ -14,9 +14,9 @@ import "../../get-tables-CKvSyDST.mjs";
 import "../../types-DCPpFKUB.mjs";
 import "../../misc-fKH4d5XQ.mjs";
 import "../../session-BB3oqApE.mjs";
-import "../../registry-GztLf62p.mjs";
+import "../../registry-BjYhRF79.mjs";
 import "../../haveibeenpwned-_3a5amT-.mjs";
-import { a as hasLeadingZeroBits, c as verifySolution, i as createNonce, n as POW_REASON_HEADER, o as parsePowHeader, r as POW_SOLUTION_HEADER, s as solveChallenge, t as POW_CHALLENGE_HEADER } from "../../pow-DvkUopsK.mjs";
-import { i as SENTINEL_ERROR_CODES, n as haversineDistanceKm, r as normalizeEmail, t as sentinel } from "../../sentinel-CYtaI3eO.mjs";
+import { i as SENTINEL_ERROR_CODES, n as haversineDistanceKm, r as normalizeEmail, t as sentinel } from "../../sentinel-BttZLWPD.mjs";
+import { a as hasLeadingZeroBits, c as verifySolution, i as createNonce, n as POW_REASON_HEADER, o as parsePowHeader, r as POW_SOLUTION_HEADER, s as solveChallenge, t as POW_CHALLENGE_HEADER } from "../../pow-Vna_j4hx.mjs";
 
 export { POW_CHALLENGE_HEADER, POW_REASON_HEADER, POW_SOLUTION_HEADER, SENTINEL_ERROR_CODES, createNonce, hasLeadingZeroBits, haversineDistanceKm, normalizeEmail, parsePowHeader, sentinel, solveChallenge, verifySolution };

package/dist/plugins/two-factor/index.d.mts

@@ -1,7 +1,7 @@
 import "../../helper-BgOIGHsu.mjs";
-import "../../index-3lfPQHhX.mjs";
+import "../../index-CTjXncwM.mjs";
 import "../../types-DNQ9XQrB.mjs";
 import "../../index-BL_t8cRp-C4QYBsac.mjs";
 import "../../plugins-Dy_FrD4Y.mjs";
-import { a as TwoFactorProvider, i as TwoFactorOptions, n as twoFactorClient, o as TwoFactorTable, r as TWO_FACTOR_ERROR_CODES, s as UserWithTwoFactor, t as twoFactor } from "../../index-CWwQ1Q7t.mjs";
+import { a as TwoFactorProvider, i as TwoFactorOptions, n as twoFactorClient, o as TwoFactorTable, r as TWO_FACTOR_ERROR_CODES, s as UserWithTwoFactor, t as twoFactor } from "../../index-BiomZttP.mjs";
 export { TWO_FACTOR_ERROR_CODES, TwoFactorOptions, TwoFactorProvider, TwoFactorTable, UserWithTwoFactor, twoFactor, twoFactorClient };

package/dist/plugins/username/index.d.mts

@@ -1,4 +1,4 @@
 import "../../helper-BgOIGHsu.mjs";
 import "../../plugins-Dy_FrD4Y.mjs";
-import { n as username, r as USERNAME_ERROR_CODES, t as UsernameOptions } from "../../index-De2a2OyC.mjs";
+import { n as username, r as USERNAME_ERROR_CODES, t as UsernameOptions } from "../../index-BoHrBgTB.mjs";
 export { USERNAME_ERROR_CODES, UsernameOptions, username };

package/dist/{registry-GztLf62p.mjs → registry-BjYhRF79.mjs}

@@ -66,7 +66,9 @@ const AUDIT_EVENT_TYPES = {
 	TEAM_MEMBER_ADDED: "team_member_added",
 	TEAM_MEMBER_REMOVED: "team_member_removed",
 	USER_SIGN_IN_FAILED: "user_sign_in_failed",
-	VERIFICATION_FAILED: "verification_failed"
+	VERIFICATION_FAILED: "verification_failed",
+	AUDIT_READ: "audit_read",
+	AUDIT_EVENTS_DELETED: "audit_events_deleted"
 };
 /**
 * Security event types recorded by the sentinel plugin
@@ -89,6 +91,34 @@ const SECURITY_EVENT_TYPES = {
 	UNBLOCKED: "security_unblocked"
 };
 const ALL_EVENT_TYPES = [...Object.values(AUDIT_EVENT_TYPES), ...Object.values(SECURITY_EVENT_TYPES)];
+/**
+* The events that can't be excluded: who signed in or out and who failed to,
+* changes to credentials, roles, bans and sessions, impersonation, reads and
+* deletions of the audit log itself, and every security decision.
+*/
+const CORE_EVENT_TYPES = [
+	AUDIT_EVENT_TYPES.USER_SIGNED_UP,
+	AUDIT_EVENT_TYPES.USER_SIGNED_IN,
+	AUDIT_EVENT_TYPES.USER_SIGNED_OUT,
+	AUDIT_EVENT_TYPES.USER_SIGN_IN_FAILED,
+	AUDIT_EVENT_TYPES.VERIFICATION_FAILED,
+	AUDIT_EVENT_TYPES.SESSION_REVOKED,
+	AUDIT_EVENT_TYPES.SESSIONS_REVOKED_ALL,
+	AUDIT_EVENT_TYPES.USER_BANNED,
+	AUDIT_EVENT_TYPES.USER_UNBANNED,
+	AUDIT_EVENT_TYPES.USER_DELETED,
+	AUDIT_EVENT_TYPES.USER_ROLE_UPDATED,
+	AUDIT_EVENT_TYPES.USER_EMAIL_CHANGED,
+	AUDIT_EVENT_TYPES.PASSWORD_CHANGED,
+	AUDIT_EVENT_TYPES.PASSWORD_RESET_COMPLETED,
+	AUDIT_EVENT_TYPES.TWO_FACTOR_ENABLED,
+	AUDIT_EVENT_TYPES.TWO_FACTOR_DISABLED,
+	AUDIT_EVENT_TYPES.USER_IMPERSONATED,
+	AUDIT_EVENT_TYPES.USER_IMPERSONATION_STOPPED,
+	AUDIT_EVENT_TYPES.AUDIT_READ,
+	AUDIT_EVENT_TYPES.AUDIT_EVENTS_DELETED,
+	...Object.values(SECURITY_EVENT_TYPES)
+];
 /** Endpoints that complete a sign-in by creating a session */
 const SIGN_IN_PATHS = [
 	"/sign-in/email",
@@ -185,6 +215,43 @@ const PATH_EVENTS = {
 	"/organization/add-team-member": AUDIT_EVENT_TYPES.TEAM_MEMBER_ADDED,
 	"/organization/remove-team-member": AUDIT_EVENT_TYPES.TEAM_MEMBER_REMOVED
 };
+/**
+* The severity of each event type that isn't `info`. A failed, blocked or
+* challenged event is at least `warning`.
+*/
+const EVENT_SEVERITIES = {
+	[AUDIT_EVENT_TYPES.USER_BANNED]: "critical",
+	[AUDIT_EVENT_TYPES.USER_DELETED]: "critical",
+	[AUDIT_EVENT_TYPES.USER_ROLE_UPDATED]: "critical",
+	[AUDIT_EVENT_TYPES.USER_IMPERSONATED]: "critical",
+	[AUDIT_EVENT_TYPES.TWO_FACTOR_DISABLED]: "critical",
+	[AUDIT_EVENT_TYPES.USER_EMAIL_CHANGED]: "warning",
+	[AUDIT_EVENT_TYPES.PASSWORD_CHANGED]: "warning",
+	[AUDIT_EVENT_TYPES.PASSWORD_RESET_COMPLETED]: "warning",
+	[AUDIT_EVENT_TYPES.SESSIONS_REVOKED_ALL]: "warning",
+	[AUDIT_EVENT_TYPES.ACCOUNT_UNLINKED]: "warning",
+	[AUDIT_EVENT_TYPES.PASSKEY_REMOVED]: "warning",
+	[AUDIT_EVENT_TYPES.API_KEY_CREATED]: "warning",
+	[AUDIT_EVENT_TYPES.API_KEY_DELETED]: "warning",
+	[AUDIT_EVENT_TYPES.MEMBER_ROLE_UPDATED]: "warning",
+	[AUDIT_EVENT_TYPES.ORGANIZATION_DELETED]: "critical",
+	[AUDIT_EVENT_TYPES.USER_SIGN_IN_FAILED]: "warning",
+	[AUDIT_EVENT_TYPES.VERIFICATION_FAILED]: "warning",
+	[SECURITY_EVENT_TYPES.BLOCKED]: "warning",
+	[SECURITY_EVENT_TYPES.CREDENTIAL_STUFFING]: "warning",
+	[SECURITY_EVENT_TYPES.IMPOSSIBLE_TRAVEL]: "critical",
+	[SECURITY_EVENT_TYPES.GEO_BLOCKED]: "warning",
+	[SECURITY_EVENT_TYPES.BOT_BLOCKED]: "warning",
+	[SECURITY_EVENT_TYPES.SUSPICIOUS_IP]: "warning",
+	[SECURITY_EVENT_TYPES.VELOCITY_EXCEEDED]: "warning",
+	[SECURITY_EVENT_TYPES.FREE_TRIAL_ABUSE]: "warning",
+	[SECURITY_EVENT_TYPES.COMPROMISED_PASSWORD]: "critical",
+	[SECURITY_EVENT_TYPES.STALE_ACCOUNT]: "warning",
+	[SECURITY_EVENT_TYPES.INVALID_EMAIL]: "warning",
+	[SECURITY_EVENT_TYPES.UNBLOCKED]: "warning",
+	[AUDIT_EVENT_TYPES.AUDIT_READ]: "warning",
+	[AUDIT_EVENT_TYPES.AUDIT_EVENTS_DELETED]: "critical"
+};
 
 //#endregion
 //#region src/plugins/audit-log/registry.ts
@@ -203,4 +270,4 @@ function getAuditRecorder(context) {
 }
 
 //#endregion
-export { CREDENTIAL_SIGN_IN_PATHS as a, SIGN_IN_PATHS as c, AUDIT_EVENT_TYPES as i, VERIFICATION_PATHS as l, registerAuditRecorder as n, PATH_EVENTS as o, ALL_EVENT_TYPES as r, SECURITY_EVENT_TYPES as s, getAuditRecorder as t, hasRole as u };
+export { CORE_EVENT_TYPES as a, PATH_EVENTS as c, VERIFICATION_PATHS as d, hasRole as f, AUDIT_EVENT_TYPES as i, SECURITY_EVENT_TYPES as l, registerAuditRecorder as n, CREDENTIAL_SIGN_IN_PATHS as o, ALL_EVENT_TYPES as r, EVENT_SEVERITIES as s, getAuditRecorder as t, SIGN_IN_PATHS as u };

package/dist/{sentinel-CYtaI3eO.mjs → sentinel-BttZLWPD.mjs}

@@ -3,9 +3,9 @@ import { t as safeJSONParse } from "./json-D0TBLy4q.mjs";
 import { n as deleteSessionCookie } from "./cookies-BuvlgcA-.mjs";
 import { n as mergeSchema } from "./date-CMr04reD.mjs";
 import { u as sessionMiddleware } from "./session-BB3oqApE.mjs";
-import { a as CREDENTIAL_SIGN_IN_PATHS, c as SIGN_IN_PATHS, l as VERIFICATION_PATHS, s as SECURITY_EVENT_TYPES, t as getAuditRecorder, u as hasRole } from "./registry-GztLf62p.mjs";
+import { d as VERIFICATION_PATHS, f as hasRole, l as SECURITY_EVENT_TYPES, o as CREDENTIAL_SIGN_IN_PATHS, t as getAuditRecorder, u as SIGN_IN_PATHS } from "./registry-BjYhRF79.mjs";
 import { t as getPasswordBreachCount } from "./haveibeenpwned-_3a5amT-.mjs";
-import { c as verifySolution, i as createNonce, n as POW_REASON_HEADER, o as parsePowHeader, r as POW_SOLUTION_HEADER, t as POW_CHALLENGE_HEADER } from "./pow-DvkUopsK.mjs";
+import { c as verifySolution, i as createNonce, n as POW_REASON_HEADER, o as parsePowHeader, r as POW_SOLUTION_HEADER, t as POW_CHALLENGE_HEADER } from "./pow-Vna_j4hx.mjs";
 import { env } from "@gatwech/core/env";
 import { PayvoAuthError } from "@gatwech/core/error";
 import { defineErrorCodes } from "@gatwech/core/utils";
@@ -14,6 +14,15 @@ import { createAuthEndpoint, createAuthMiddleware } from "@gatwech/core/api";
 import * as z$1 from "zod";
 import { betterFetch } from "@better-fetch/fetch";
 
+//#region src/plugins/sentinel/error-codes.ts
+const SENTINEL_ERROR_CODES = defineErrorCodes({
+	POW_CHALLENGE_REQUIRED: "Challenge required",
+	SECURITY_BLOCKED: "Request blocked for security reasons",
+	SECURITY_ADMIN_REQUIRED: "Only an administrator can manage security blocks",
+	BLOCK_NOT_FOUND: "That block doesn't exist or has ended"
+});
+
+//#endregion
 //#region src/plugins/sentinel/actions.ts
 const CHALLENGE_TTL_MS = 6e4;
 /**
@@ -111,12 +120,6 @@ function challengeHeaders(decision) {
 		"access-control-expose-headers": `${POW_CHALLENGE_HEADER}, ${POW_REASON_HEADER}`
 	};
 }
-const SENTINEL_ERROR_CODES = defineErrorCodes({
-	POW_CHALLENGE_REQUIRED: "Challenge required",
-	SECURITY_BLOCKED: "Request blocked for security reasons",
-	SECURITY_ADMIN_REQUIRED: "Only an administrator can manage security blocks",
-	BLOCK_NOT_FOUND: "That block doesn't exist or has ended"
-});
 /** The error for a decision, or null when the request is allowed */
 function errorForDecision(decision) {
 	if (decision.outcome === "allow") return null;
@@ -1240,6 +1243,39 @@ const sentinel = (options) => {
 		}));
 		return Math.max(0, ...failures);
 	}
+	/**
+	* Blocks an attempt counter for the cooldown and clears its counts. The
+	* block is also recorded so an admin can list and lift it; it holds
+	* without the record.
+	*/
+	async function blockKey(auth, store, key, also = []) {
+		if (!credentialStuffing) return;
+		const { cooldownSeconds } = credentialStuffing;
+		await store.increment(`${key}:blocked`, cooldownSeconds);
+		await Promise.all([key, ...also].map((name) => store.reset(name)));
+		await store.recordBlock({
+			key,
+			feature: "credential_stuffing",
+			...describeAttemptKey(key),
+			blockedUntil: new Date(Date.now() + cooldownSeconds * 1e3)
+		}).catch((e) => {
+			auth.logger.error("[sentinel] Failed to record block", e);
+		});
+	}
+	/**
+	* Turns the counters that passed the block threshold into blocks that last
+	* the cooldown, so they end then and can be listed and lifted. `count`
+	* includes the attempt just made.
+	*/
+	async function blockOverThreshold(auth, store, keys) {
+		if (!credentialStuffing) return;
+		const { thresholds } = credentialStuffing;
+		for (const { scope, account } of keys) {
+			const [total, succeeded] = await Promise.all([store.get(scope), store.get(`${scope}:succeeded`)]);
+			if (total - succeeded - 1 >= thresholds.block) await blockKey(auth, store, scope, [`${scope}:succeeded`]);
+			if (account && await store.get(account) - 1 >= thresholds.block) await blockKey(auth, store, account);
+		}
+	}
 	/** What an attempt counter's key is for: `cs:ip:<ip>` or `cs:visitor:<id>`, plus `:account:<email>` */
 	function describeAttemptKey(key) {
 		const accountAt = key.indexOf(":account:");
@@ -1581,7 +1617,10 @@ const sentinel = (options) => {
 							failedAttempts: failures,
 							thresholds
 						};
-						if (blocked || failures >= thresholds.block) return act(ctx, store, details, credentialStuffing.action === "log" ? "log" : "block", SECURITY_EVENT_TYPES.CREDENTIAL_STUFFING, "credential_stuffing", metadata);
+						if (blocked || failures >= thresholds.block) {
+							if (!blocked && credentialStuffing.action !== "log") await blockOverThreshold(ctx.context, store, keys);
+							return act(ctx, store, details, credentialStuffing.action === "log" ? "log" : "block", SECURITY_EVENT_TYPES.CREDENTIAL_STUFFING, "credential_stuffing", metadata);
+						}
 						if (failures >= thresholds.challenge) return act(ctx, store, details, credentialStuffing.action === "log" ? "log" : "challenge", SECURITY_EVENT_TYPES.CREDENTIAL_STUFFING, "credential_stuffing", metadata);
 						return { outcome: "allow" };
 					}));
@@ -1635,7 +1674,7 @@ const sentinel = (options) => {
 					try {
 						const store = createSentinelStore(ctx.context);
 						const keys = attemptKeys(await requestDetails(ctx));
-						const { windowSeconds, cooldownSeconds, thresholds } = credentialStuffing;
+						const { windowSeconds, thresholds } = credentialStuffing;
 						if (status < 400) for (const { scope, account } of keys) {
 							const [total, succeeded, own] = await Promise.all([
 								store.get(scope),
@@ -1649,18 +1688,7 @@ const sentinel = (options) => {
 							} else await store.increment(`${scope}:succeeded`, windowSeconds);
 						}
 						else if (!SENTINEL_STATUSES.has(status) && status < 500) {
-							const block = async (key, also = []) => {
-								await store.increment(`${key}:blocked`, cooldownSeconds);
-								await Promise.all([key, ...also].map((name) => store.reset(name)));
-								await store.recordBlock({
-									key,
-									feature: "credential_stuffing",
-									...describeAttemptKey(key),
-									blockedUntil: new Date(Date.now() + cooldownSeconds * 1e3)
-								}).catch((e) => {
-									ctx.context.logger.error("[sentinel] Failed to record block", e);
-								});
-							};
+							const block = (key, also = []) => blockKey(ctx.context, store, key, also);
 							for (const { scope, account } of keys) {
 								const [total, succeeded] = await Promise.all([store.get(scope), store.get(`${scope}:succeeded`)]);
 								if (total - succeeded >= thresholds.block) await block(scope, [`${scope}:succeeded`]);
@@ -1805,17 +1833,62 @@ const sentinel = (options) => {
 			...normalizedEmailSchema
 		} : schema, opts.schema),
 		endpoints: {
-			listBlocks: createAuthEndpoint("/sentinel/blocks", {
+			listBlocks: createAuthEndpoint("/sentinel/list-blocks", {
 				method: "GET",
 				use: [sessionMiddleware],
 				query: z$1.object({
-					limit: z$1.string().or(z$1.number()).optional(),
-					offset: z$1.string().or(z$1.number()).optional()
+					limit: z$1.string().or(z$1.number()).meta({ description: "The number of blocks to return. Max 100, defaults to 50" }).optional(),
+					offset: z$1.string().or(z$1.number()).meta({ description: "The offset to start from" }).optional()
 				}).optional(),
 				metadata: { openapi: {
 					operationId: "listSentinelBlocks",
 					summary: "List active blocks",
-					description: "List the visitors and IP addresses sentinel is blocking, for admins"
+					description: "List the visitors and IP addresses sentinel is blocking, for admins",
+					responses: { 200: {
+						description: "Paginated blocks that haven't ended",
+						content: { "application/json": { schema: {
+							type: "object",
+							properties: {
+								blocks: {
+									type: "array",
+									items: {
+										type: "object",
+										properties: {
+											id: { type: "string" },
+											key: { type: "string" },
+											feature: { type: "string" },
+											kind: {
+												type: "string",
+												enum: ["visitor", "ip"]
+											},
+											identifier: { type: "string" },
+											account: {
+												type: "string",
+												nullable: true
+											},
+											blockedUntil: {
+												type: "string",
+												format: "date-time"
+											},
+											createdAt: {
+												type: "string",
+												format: "date-time"
+											}
+										}
+									}
+								},
+								total: { type: "number" },
+								limit: { type: "number" },
+								offset: { type: "number" }
+							},
+							required: [
+								"blocks",
+								"total",
+								"limit",
+								"offset"
+							]
+						} } }
+					} }
 				} }
 			}, async (ctx) => {
 				requireAdmin(ctx.context.session.user);
@@ -1835,11 +1908,19 @@ const sentinel = (options) => {
 			unblock: createAuthEndpoint("/sentinel/unblock", {
 				method: "POST",
 				use: [sessionMiddleware],
-				body: z$1.object({ id: z$1.string() }),
+				body: z$1.object({ id: z$1.string().meta({ description: "The id of the block to lift, from the list of blocks" }) }),
 				metadata: { openapi: {
 					operationId: "unblockSentinel",
 					summary: "Lift a block",
-					description: "Lift a block before its cooldown ends, for admins. Recorded in the audit log."
+					description: "Lift a block before its cooldown ends, for admins. Recorded in the audit log.",
+					responses: { 200: {
+						description: "The block was lifted",
+						content: { "application/json": { schema: {
+							type: "object",
+							properties: { success: { type: "boolean" } },
+							required: ["success"]
+						} } }
+					} }
 				} }
 			}, async (ctx) => {
 				const { user } = ctx.context.session;

package/dist/src/plugins/audit-log/error-codes.d.ts

@@ -0,0 +1,7 @@
+export declare const AUDIT_LOG_ERROR_CODES: {
+    readonly AUDIT_LOG_ACCESS_DENIED: "You don't have access to these audit logs";
+    readonly AUDIT_CANNOT_BE_DISABLED: "Core audit events and the local audit store can't be turned off";
+    readonly AUDIT_LOG_UNAVAILABLE: "Audit logs are temporarily unavailable";
+    readonly AUDIT_RETENTION_TOO_SHORT: "Audit events can't be deleted before the retention minimum has passed";
+    readonly AUDIT_SIGNING_SECRET_MISSING: "Audit events must be signed in production: set integrity.secret or PAYVO_AUDIT_SIGNING_SECRET";
+};

package/dist/src/plugins/audit-log/events.d.ts

@@ -55,6 +55,8 @@ export declare const AUDIT_EVENT_TYPES: {
     readonly TEAM_MEMBER_REMOVED: "team_member_removed";
     readonly USER_SIGN_IN_FAILED: "user_sign_in_failed";
     readonly VERIFICATION_FAILED: "verification_failed";
+    readonly AUDIT_READ: "audit_read";
+    readonly AUDIT_EVENTS_DELETED: "audit_events_deleted";
 };
 /**
  * Security event types recorded by the sentinel plugin
@@ -78,6 +80,12 @@ export declare const SECURITY_EVENT_TYPES: {
 };
 export type AuditEventType = (typeof AUDIT_EVENT_TYPES)[keyof typeof AUDIT_EVENT_TYPES] | (typeof SECURITY_EVENT_TYPES)[keyof typeof SECURITY_EVENT_TYPES];
 export declare const ALL_EVENT_TYPES: AuditEventType[];
+/**
+ * The events that can't be excluded: who signed in or out and who failed to,
+ * changes to credentials, roles, bans and sessions, impersonation, reads and
+ * deletions of the audit log itself, and every security decision.
+ */
+export declare const CORE_EVENT_TYPES: ("user_signed_up" | "user_banned" | "user_unbanned" | "user_deleted" | "user_role_updated" | "user_email_changed" | "user_signed_in" | "user_signed_out" | "session_revoked" | "sessions_revoked_all" | "user_impersonated" | "user_impersonation_stopped" | "password_changed" | "two_factor_enabled" | "two_factor_disabled" | "password_reset_completed" | "user_sign_in_failed" | "verification_failed" | "audit_read" | "audit_events_deleted" | "security_blocked" | "security_allowed" | "security_credential_stuffing" | "security_impossible_travel" | "security_geo_blocked" | "security_bot_blocked" | "security_suspicious_ip" | "security_velocity_exceeded" | "security_free_trial_abuse" | "security_compromised_password" | "security_stale_account" | "security_invalid_email" | "security_unblocked")[];
 /** Endpoints that complete a sign-in by creating a session */
 export declare const SIGN_IN_PATHS: string[];
 /** Sign-in endpoints that check credentials, so a failure is a failed attempt */
@@ -89,3 +97,8 @@ export declare const CREDENTIAL_SIGN_IN_PATHS: string[];
 export declare const VERIFICATION_PATHS: string[];
 /** Endpoints whose successful response maps to a single event */
 export declare const PATH_EVENTS: Record<string, AuditEventType>;
+/**
+ * The severity of each event type that isn't `info`. A failed, blocked or
+ * challenged event is at least `warning`.
+ */
+export declare const EVENT_SEVERITIES: Partial<Record<AuditEventType, "warning" | "critical">>;