@gatwech/auth 1.0.0-beta.24 → 1.0.0-beta.25

package/dist/{audit-log-DhRRCMrv.mjs → audit-log-CQnf8nrN.mjs}

@@ -2,14 +2,131 @@ import { t as getIp } from "./get-request-ip-DSjrEpGo.mjs";
 import { t as generateRandomString } from "./random-32E3cU5o.mjs";
 import { n as mergeSchema } from "./date-CMr04reD.mjs";
 import { r as getSessionFromCtx, u as sessionMiddleware } from "./session-BB3oqApE.mjs";
-import { a as CREDENTIAL_SIGN_IN_PATHS, c as SIGN_IN_PATHS, i as AUDIT_EVENT_TYPES, l as VERIFICATION_PATHS, n as registerAuditRecorder, o as PATH_EVENTS, r as ALL_EVENT_TYPES, s as SECURITY_EVENT_TYPES, u as hasRole } from "./registry-GztLf62p.mjs";
-import { env } from "@gatwech/core/env";
+import { a as CORE_EVENT_TYPES, c as PATH_EVENTS, d as VERIFICATION_PATHS, f as hasRole, i as AUDIT_EVENT_TYPES, l as SECURITY_EVENT_TYPES, n as registerAuditRecorder, o as CREDENTIAL_SIGN_IN_PATHS, r as ALL_EVENT_TYPES, s as EVENT_SEVERITIES, u as SIGN_IN_PATHS } from "./registry-BjYhRF79.mjs";
+import { env, isProduction } from "@gatwech/core/env";
+import { PayvoAuthError } from "@gatwech/core/error";
 import { defineErrorCodes } from "@gatwech/core/utils";
 import { APIError } from "better-call";
 import { createAuthEndpoint, createAuthMiddleware } from "@gatwech/core/api";
 import * as z$1 from "zod";
+import { createHMAC } from "@gatwech/utils/hmac";
 import { betterFetch } from "@better-fetch/fetch";
 
+//#region src/plugins/audit-log/error-codes.ts
+const AUDIT_LOG_ERROR_CODES = defineErrorCodes({
+	AUDIT_LOG_ACCESS_DENIED: "You don't have access to these audit logs",
+	AUDIT_CANNOT_BE_DISABLED: "Core audit events and the local audit store can't be turned off",
+	AUDIT_LOG_UNAVAILABLE: "Audit logs are temporarily unavailable",
+	AUDIT_RETENTION_TOO_SHORT: "Audit events can't be deleted before the retention minimum has passed",
+	AUDIT_SIGNING_SECRET_MISSING: "Audit events must be signed in production: set integrity.secret or PAYVO_AUDIT_SIGNING_SECRET"
+});
+
+//#endregion
+//#region src/plugins/audit-log/integrity.ts
+const hmac = createHMAC("SHA-256", "base64url");
+/** The version a signature is made with, and what `secret` is for */
+const CURRENT_VERSION = "v1";
+/**
+* The value as it is stored: the same as `JSON.stringify` makes of it, with
+* sorted keys at every depth, dates as ISO strings and bigints as strings.
+* A property that is `undefined`, a function or a symbol is left out, and
+* such an array element, a number that isn't finite and an invalid date are
+* `null`, so a signed event verifies once the database has stored it.
+*/
+function sorted(value) {
+	if (value instanceof Date) return Number.isNaN(value.getTime()) ? null : value.toISOString();
+	switch (typeof value) {
+		case "string":
+		case "boolean": return value;
+		case "number": return Number.isFinite(value) ? value : null;
+		case "bigint": return value.toString();
+		case "object":
+			if (value === null) return null;
+			if (Array.isArray(value)) return value.map(sorted);
+			return Object.fromEntries(Object.entries(value).filter(([, entry]) => !omittedFromJson(entry)).sort(([first], [second]) => first < second ? -1 : 1).map(([key, entry]) => [key, sorted(entry)]));
+		default: return null;
+	}
+}
+/** A property `JSON.stringify` leaves out */
+const omittedFromJson = (value) => value === void 0 || typeof value === "function" || typeof value === "symbol";
+/**
+* A value as the JSON that is signed: sorted keys at every depth, dates as ISO
+* strings, bigints as strings and no whitespace.
+*
+* It is the encoding payvo-core signs its own audit entries with.
+*/
+function canonicalize(value) {
+	return JSON.stringify(sorted(value));
+}
+/**
+* Signs a string with HMAC-SHA256 and returns `v1:<signature>`, where the
+* signature is base64url encoded.
+*/
+async function signAuditPayload(payload, secret) {
+	return `${CURRENT_VERSION}:${await hmac.sign(secret, payload)}`;
+}
+/**
+* The string that is signed for an event: its fields as canonical JSON, with
+* sorted keys at every depth, dates as ISO strings, bigints as strings and
+* no whitespace. `signature` isn't part of it, and a field an event doesn't
+* have is `null`.
+*/
+function canonicalPayload(event) {
+	return canonicalize({
+		id: event.id,
+		eventType: event.eventType,
+		status: event.status,
+		userId: event.userId ?? null,
+		identifier: event.identifier ?? null,
+		organizationId: event.organizationId ?? null,
+		path: event.path ?? null,
+		ipAddress: event.ipAddress ?? null,
+		userAgent: event.userAgent ?? null,
+		visitorId: event.visitorId ?? null,
+		eventData: event.eventData ?? null,
+		traceId: event.traceId ?? null,
+		requestId: event.requestId ?? null,
+		actorType: event.actorType,
+		severity: event.severity,
+		createdAt: event.createdAt
+	});
+}
+/** Signs an event's fields, as `signAuditPayload` does the string */
+function signAuditEvent(event, secret) {
+	return signAuditPayload(canonicalPayload(event), secret);
+}
+/**
+* Whether an event's signature matches its fields, so a row that was changed
+* after it was recorded doesn't verify.
+*
+* `integrity.secret` verifies signatures made with the current key, and
+* `integrity.secrets` maps an older version to its key, so keys can be
+* rotated without signing old rows again. An event without a signature, or
+* with a version that has no key, doesn't verify.
+*
+* @example
+* ```ts
+* const events = await auth.api.getAllAuditLogs({ headers });
+* events.events.every((event) => event.verified);
+* await verifyAuditEvent(event, { secret: process.env.PAYVO_AUDIT_SIGNING_SECRET });
+* ```
+*/
+async function verifyAuditEvent(event, integrity) {
+	if (!event.signature) return false;
+	const separator = event.signature.indexOf(":");
+	if (separator < 1) return false;
+	const version = event.signature.slice(0, separator);
+	const secret = integrity.secrets?.[version] ?? (version === CURRENT_VERSION ? integrity.secret : void 0);
+	if (!secret) return false;
+	const { signature: _,...fields } = event;
+	try {
+		return await hmac.verify(secret, canonicalPayload(fields), event.signature.slice(separator + 1));
+	} catch {
+		return false;
+	}
+}
+
+//#endregion
 //#region src/plugins/audit-log/remote.ts
 /** Sends to the backend: the first attempt and up to 2 retries */
 const SEND_ATTEMPTS = 3;
@@ -83,6 +200,67 @@ function createRemoteSink(options) {
 	};
 }
 
+//#endregion
+//#region src/plugins/audit-log/redact.ts
+/**
+* Keys that are always redacted, compared as in `redactAuditData`: in lower
+* case, without `-` or `_`.
+*/
+const ALWAYS_REDACTED_KEYS = new Set([
+	"password",
+	"newpassword",
+	"currentpassword",
+	"token",
+	"accesstoken",
+	"refreshtoken",
+	"idtoken",
+	"secret",
+	"clientsecret",
+	"otp",
+	"otpcode",
+	"verificationcode",
+	"backupcodes",
+	"authorization",
+	"cookie",
+	"cardnumber",
+	"cvv",
+	"pin"
+]);
+const REDACTED = "[REDACTED]";
+/** A key as compared: lower case, without `-` or `_` */
+const normalizeKey = (key) => key.toLowerCase().replace(/[-_]/g, "");
+/**
+* Replaces the value of every sensitive key with `"[REDACTED]"`, at any depth
+* and through arrays. The key stays, so the shape of the data is still
+* visible.
+*
+* A key is sensitive when its name, in lower case and without `-` or `_`,
+* is in the built-in list (passwords, tokens, OTPs, secrets, authorization
+* and cookie headers, card data) or in `sensitiveKeys`. The input isn't
+* changed. Only plain objects and arrays are walked; other values are
+* returned as they are.
+*
+* @example
+* ```ts
+* redactAuditData({ user: { id: "1", Access_Token: "abc" } }, [])
+* // { user: { id: "1", Access_Token: "[REDACTED]" } }
+* ```
+*/
+function redactAuditData(value, sensitiveKeys = []) {
+	const sensitive = new Set([...ALWAYS_REDACTED_KEYS, ...sensitiveKeys.map(normalizeKey)]);
+	const redact = (current) => {
+		if (Array.isArray(current)) return current.map(redact);
+		if (!isPlainObject(current)) return current;
+		return Object.fromEntries(Object.entries(current).map(([key, entry]) => [key, sensitive.has(normalizeKey(key)) ? REDACTED : redact(entry)]));
+	};
+	return redact(value);
+}
+function isPlainObject(value) {
+	if (typeof value !== "object" || value === null) return false;
+	const prototype = Object.getPrototypeOf(value);
+	return prototype === Object.prototype || prototype === null;
+}
+
 //#endregion
 //#region src/plugins/audit-log/schema.ts
 const schema = { auditLog: { fields: {
@@ -126,6 +304,26 @@ const schema = { auditLog: { fields: {
 		type: "json",
 		required: false
 	},
+	traceId: {
+		type: "string",
+		required: false
+	},
+	requestId: {
+		type: "string",
+		required: false
+	},
+	actorType: {
+		type: "string",
+		required: false
+	},
+	severity: {
+		type: "string",
+		required: false
+	},
+	signature: {
+		type: "string",
+		required: false
+	},
 	createdAt: {
 		type: "date",
 		required: true
@@ -134,10 +332,6 @@ const schema = { auditLog: { fields: {
 
 //#endregion
 //#region src/plugins/audit-log/index.ts
-const AUDIT_LOG_ERROR_CODES = defineErrorCodes({
-	AUDIT_LOG_ACCESS_DENIED: "You don't have access to these audit logs",
-	AUDIT_LOG_UNAVAILABLE: "Audit logs are temporarily unavailable"
-});
 /** User fields that change as a side effect and aren't profile edits */
 const INTERNAL_USER_FIELDS = new Set([
 	"updatedAt",
@@ -156,11 +350,23 @@ const auditLogQuery = {
 	offset: z$1.string().meta({ description: "The offset to start from" }).or(z$1.number()).optional(),
 	eventType: z$1.string().meta({ description: "Filter by event type. Eg: \"user_signed_in\"" }).optional(),
 	identifier: z$1.string().meta({ description: "Filter by the actor's identifier. Eg: \"user@example.com\"" }).optional(),
+	traceId: z$1.string().meta({ description: "Filter by the request chain the events belong to" }).optional(),
 	organizationId: z$1.string().meta({ description: "Filter by organization" }).optional(),
 	userId: z$1.string().meta({ description: "Filter by user" }).optional(),
 	startDate: z$1.string().refine(isDate, "Invalid date").meta({ description: "Only return events created at or after this date. Eg: \"2026-01-01\"" }).optional(),
 	endDate: z$1.string().refine(isDate, "Invalid date").meta({ description: "Only return events created at or before this date. Eg: \"2026-01-31\"" }).optional()
 };
+/** `00-<trace id>-<parent id>-<flags>` */
+const TRACEPARENT = /^[\da-f]{2}-([\da-f]{32})-[\da-f]{16}-[\da-f]{2}$/i;
+function newId() {
+	return crypto.randomUUID().replaceAll("-", "");
+}
+/** The catalog's severity, raised to `warning` for a failed or refused event */
+function severityOf(eventType, status) {
+	const severity = EVENT_SEVERITIES[eventType];
+	if (severity) return severity;
+	return status === "success" ? "info" : "warning";
+}
 function toPagination(query) {
 	const limit = Number(query.limit) || 50;
 	return {
@@ -184,13 +390,19 @@ const ACCOUNT_ATTEMPT_LIMIT = 50;
 const auditLog = (options) => {
 	const opts = {
 		...options,
-		database: options?.database ?? true,
-		trackFailedSignIns: options?.trackFailedSignIns ?? true,
 		adminRoles: options?.adminRoles ?? ["admin"],
 		organizationAdminRoles: options?.organizationAdminRoles ?? ["owner", "admin"],
 		showAttemptsOnOwnAccount: options?.showAttemptsOnOwnAccount ?? true
 	};
+	const minimumRetentionDays = options?.retention?.minimumDays ?? 365;
+	if (!Number.isInteger(minimumRetentionDays) || minimumRetentionDays < 1) throw new PayvoAuthError("audit-log: retention.minimumDays must be a whole number of at least 1");
+	const integrity = {
+		secret: options?.integrity?.secret ?? env.PAYVO_AUDIT_SIGNING_SECRET,
+		secrets: options?.integrity?.secrets
+	};
 	const excluded = new Set(opts.exclude ?? []);
+	const excludedCoreEvent = CORE_EVENT_TYPES.find((eventType) => excluded.has(eventType));
+	const disabledOption = ["database", "trackFailedSignIns"].find((name) => options?.[name] === false);
 	const { sink: remote, misconfigured } = createRemoteSink(opts.remote);
 	const mergedSchema = mergeSchema(schema, opts.schema);
 	let authContext;
@@ -205,8 +417,8 @@ const auditLog = (options) => {
 	/** The user an admin endpoint acted on, when the body doesn't name them */
 	const targets = /* @__PURE__ */ new WeakMap();
 	/** The organization an organization endpoint acted on */
-	async function resolveOrganizationId(auth, path, body, result, activeOrganizationId) {
-		const direct = body.organizationId ?? result.organizationId ?? result.member?.organizationId ?? result.invitation?.organizationId ?? (path === "/organization/create" || path === "/organization/update" ? result.id : void 0);
+	async function resolveOrganizationId(auth, path, body, returnedBody, activeOrganizationId) {
+		const direct = body.organizationId ?? returnedBody.organizationId ?? returnedBody.member?.organizationId ?? returnedBody.invitation?.organizationId ?? (path === "/organization/create" || path === "/organization/update" ? returnedBody.id : void 0);
 		if (typeof direct === "string") return direct;
 		if (!path.startsWith("/organization/")) return null;
 		if (typeof body.teamId === "string") {
@@ -230,6 +442,29 @@ const auditLog = (options) => {
 			visitorId: headers?.get("x-visitor-id") ?? null
 		};
 	}
+	/** Each request's trace and request ids, so all its events share them */
+	const correlations = /* @__PURE__ */ new WeakMap();
+	/**
+	* The request's trace id, from `Trace-Id` or a W3C `traceparent`, and its
+	* request id, from `Request-Id`. Either is minted when the request has
+	* none. Null outside a request.
+	*/
+	function correlationOf(ctx) {
+		const headers = ctx?.headers ?? ctx?.request?.headers;
+		if (!headers) return {
+			traceId: null,
+			requestId: null
+		};
+		const known = correlations.get(headers);
+		if (known) return known;
+		const traceparent = TRACEPARENT.exec(headers.get("traceparent") ?? "");
+		const correlation = {
+			traceId: headers.get("trace-id") || headers.get("x-trace-id") || traceparent?.[1] || newId(),
+			requestId: headers.get("request-id") || headers.get("x-request-id") || newId()
+		};
+		correlations.set(headers, correlation);
+		return correlation;
+	}
 	/**
 	* The signed-in user making a request, and the admin impersonating them,
 	* when known
@@ -261,39 +496,78 @@ const auditLog = (options) => {
 				...actor.id && actor.id !== event.userId ? { actorId: actor.id } : {},
 				...actor.impersonatedBy ? { impersonatedBy: actor.impersonatedBy } : {}
 			};
-			const eventData = Object.keys(attribution).length ? {
+			const eventData = redactAuditData(Object.keys(attribution).length ? {
 				...event.eventData,
 				...attribution
-			} : event.eventData ?? null;
+			} : event.eventData ?? null, opts.sensitiveKeys);
+			const status = event.status ?? "success";
+			const inRequest = Boolean(ctx?.headers ?? ctx?.request?.headers);
+			const actorType = event.actorType ?? (!inRequest ? "system" : actor.impersonatedBy || attribution.actorId ? "admin" : "user");
 			const { id: _,...data } = {
 				id: "",
-				status: "success",
 				userId: null,
 				identifier: null,
 				organizationId: null,
 				...meta,
+				...correlationOf(ctx),
 				...event,
+				status,
+				actorType,
+				severity: event.severity ?? severityOf(event.eventType, status),
 				eventData,
 				createdAt: /* @__PURE__ */ new Date()
 			};
 			let id = auth.generateId({ model: "auditLog" }) || "";
-			if (opts.database) {
-				const row = id ? {
-					...data,
+			const unsigned = {
+				...data,
+				signature: null
+			};
+			let signature = integrity.secret && id ? await signAuditEvent({
+				...unsigned,
+				id
+			}, integrity.secret) : null;
+			const row = id ? {
+				...unsigned,
+				signature,
+				id
+			} : {
+				...unsigned,
+				signature
+			};
+			const created = await auth.adapter.create({
+				model: "auditLog",
+				data: row,
+				forceAllowId: Boolean(id)
+			}).catch((e) => {
+				auth.logger.error("[audit-log] Failed to write audit log", e);
+				return null;
+			});
+			id = created?.id ?? id;
+			if (integrity.secret && !signature && created) {
+				signature = await signAuditEvent({
+					...unsigned,
 					id
-				} : data;
-				id = (await auth.adapter.create({
+				}, integrity.secret);
+				await auth.adapter.update({
 					model: "auditLog",
-					data: row,
-					forceAllowId: Boolean(id)
+					where: [{
+						field: "id",
+						value: id
+					}],
+					update: { signature }
 				}).catch((e) => {
-					auth.logger.error("[audit-log] Failed to write audit log", e);
-					return null;
-				}))?.id ?? id;
+					auth.logger.error("[audit-log] Failed to sign audit log", e);
+				});
 			}
+			id ||= generateRandomString(32);
+			if (integrity.secret && !signature) signature = await signAuditEvent({
+				...unsigned,
+				id
+			}, integrity.secret);
 			const full = {
-				...data,
-				id: id || generateRandomString(32)
+				...unsigned,
+				signature,
+				id
 			};
 			remote?.push(full, auth);
 			const onEvent = opts.onEvent;
@@ -336,6 +610,7 @@ const auditLog = (options) => {
 		for (const field of [
 			"eventType",
 			"identifier",
+			"traceId",
 			"userId",
 			"organizationId"
 		]) {
@@ -436,7 +711,8 @@ const auditLog = (options) => {
 			ipAddress: null,
 			userAgent: null,
 			visitorId: null,
-			eventData: null
+			eventData: null,
+			signature: null
 		}));
 	}
 	/** Organization memberships of a user, empty without the organization plugin */
@@ -455,7 +731,15 @@ const auditLog = (options) => {
 	}
 	async function runQuery(auth, query) {
 		try {
-			return await queryEvents(auth, query);
+			const page = await queryEvents(auth, query);
+			if (!integrity.secret) return page;
+			return {
+				...page,
+				events: await Promise.all(page.events.map(async (event) => ({
+					...event,
+					verified: await verifyAuditEvent(event, integrity)
+				})))
+			};
 		} catch (e) {
 			auth.logger.error("[audit-log] Failed to query audit logs", e);
 			throw new APIError("SERVICE_UNAVAILABLE", { message: AUDIT_LOG_ERROR_CODES.AUDIT_LOG_UNAVAILABLE });
@@ -464,6 +748,8 @@ const auditLog = (options) => {
 	return {
 		id: "audit-log",
 		init(ctx) {
+			if (excludedCoreEvent || disabledOption) throw new PayvoAuthError(`${AUDIT_LOG_ERROR_CODES.AUDIT_CANNOT_BE_DISABLED}: ${excludedCoreEvent ?? disabledOption}`);
+			if (isProduction && !integrity.secret) throw new PayvoAuthError(AUDIT_LOG_ERROR_CODES.AUDIT_SIGNING_SECRET_MISSING);
 			authContext = ctx;
 			registerAuditRecorder(ctx, record);
 			if (misconfigured) ctx.logger.warn("[audit-log] Missing PAYVO_INFRA_API_URL or PAYVO_INFRA_API_KEY. Remote audit logging is disabled.");
@@ -564,7 +850,7 @@ const auditLog = (options) => {
 						return;
 					}
 					const isCredentialCheck = CREDENTIAL_SIGN_IN_PATHS.includes(ctx.path);
-					if (returned instanceof APIError && failed && opts.trackFailedSignIns && (isCredentialCheck || VERIFICATION_PATHS.includes(ctx.path))) {
+					if (returned instanceof APIError && failed && (isCredentialCheck || VERIFICATION_PATHS.includes(ctx.path))) {
 						await record(ctx, {
 							eventType: isCredentialCheck ? AUDIT_EVENT_TYPES.USER_SIGN_IN_FAILED : AUDIT_EVENT_TYPES.VERIFICATION_FAILED,
 							status: "failure",
@@ -588,10 +874,10 @@ const auditLog = (options) => {
 					const eventType = PATH_EVENTS[ctx.path];
 					if (!eventType || failed) return;
 					if (ctx.path === "/email-otp/send-verification-otp" && body.type !== "email-verification") return;
-					const result = returned ?? {};
+					const returnedBody = returned ?? {};
 					const actor = ctx.headers ? actors.get(ctx.headers) : void 0;
 					const target = (ctx.headers && targets.get(ctx.headers)) ?? (ctx.path.startsWith("/admin/") && typeof body.userId === "string" ? body.userId : null);
-					const organizationId = await resolveOrganizationId(ctx.context, ctx.path, body, result, actor?.activeOrganizationId ?? null);
+					const organizationId = await resolveOrganizationId(ctx.context, ctx.path, body, returnedBody, actor?.activeOrganizationId ?? null);
 					const eventData = {};
 					if (ctx.path === "/unlink-account") eventData.providerId = body.providerId;
 					if (ctx.path === "/organization/invite-member") {
@@ -605,13 +891,13 @@ const auditLog = (options) => {
 					if (ctx.path.startsWith("/organization/") && ctx.path.endsWith("-role")) eventData.role = body.role ?? body.roleName ?? body.roleId;
 					let owner = null;
 					if (ctx.path.startsWith("/api-key/")) {
-						eventData.keyId = body.keyId ?? result.id;
-						owner = result.userId ?? null;
+						eventData.keyId = body.keyId ?? returnedBody.id;
+						owner = returnedBody.userId ?? null;
 					}
-					if (ctx.path.startsWith("/passkey/")) eventData.passkeyId = body.id ?? result.id;
+					if (ctx.path.startsWith("/passkey/")) eventData.passkeyId = body.id ?? returnedBody.id;
 					await record(ctx, {
 						eventType,
-						userId: target ?? actor?.id ?? result.user?.id ?? owner,
+						userId: target ?? actor?.id ?? returnedBody.user?.id ?? owner,
 						identifier: actor?.email ?? identifier,
 						organizationId,
 						eventData: Object.keys(eventData).length ? eventData : null
@@ -673,6 +959,38 @@ const auditLog = (options) => {
 												type: "object",
 												nullable: true
 											},
+											traceId: {
+												type: "string",
+												nullable: true
+											},
+											requestId: {
+												type: "string",
+												nullable: true
+											},
+											actorType: {
+												type: "string",
+												enum: [
+													"user",
+													"admin",
+													"system"
+												]
+											},
+											severity: {
+												type: "string",
+												enum: [
+													"info",
+													"warning",
+													"critical"
+												]
+											},
+											signature: {
+												type: "string",
+												nullable: true
+											},
+											verified: {
+												type: "boolean",
+												description: "Whether the signature matches the event. Only present when signing is configured."
+											},
 											createdAt: {
 												type: "string",
 												format: "date-time"
@@ -724,7 +1042,7 @@ const auditLog = (options) => {
 				metadata: { openapi: {
 					operationId: "getAllAuditLogs",
 					summary: "Get all audit logs",
-					description: "Get audit events across organizations the user owns or administers, or every event for admins",
+					description: "Get audit events across organizations the user owns or administers, or every event for admins. Each read is recorded as an audit_read event, which is not part of the page it returns.",
 					responses: { 200: {
 						description: "Paginated audit events",
 						content: { "application/json": { schema: {
@@ -770,6 +1088,38 @@ const auditLog = (options) => {
 												type: "object",
 												nullable: true
 											},
+											traceId: {
+												type: "string",
+												nullable: true
+											},
+											requestId: {
+												type: "string",
+												nullable: true
+											},
+											actorType: {
+												type: "string",
+												enum: [
+													"user",
+													"admin",
+													"system"
+												]
+											},
+											severity: {
+												type: "string",
+												enum: [
+													"info",
+													"warning",
+													"critical"
+												]
+											},
+											signature: {
+												type: "string",
+												nullable: true
+											},
+											verified: {
+												type: "boolean",
+												description: "Whether the signature matches the event. Only present when signing is configured."
+											},
 											createdAt: {
 												type: "string",
 												format: "date-time"
@@ -794,17 +1144,36 @@ const auditLog = (options) => {
 				const { user } = ctx.context.session;
 				const { limit: _limit, offset: _offset,...filters } = ctx.query ?? {};
 				const pagination = toPagination(ctx.query ?? {});
-				if (hasRole(user.role, opts.adminRoles)) return ctx.json(await runQuery(ctx.context, {
-					...filters,
-					...pagination
-				}));
+				/** Records the read once the page is built, so it isn't in the page */
+				const recordRead = (page$1, organizationId) => record(ctx, {
+					eventType: AUDIT_EVENT_TYPES.AUDIT_READ,
+					userId: user.id,
+					identifier: user.email,
+					organizationId,
+					actorType: "admin",
+					eventData: {
+						filters,
+						returned: page$1.events.length,
+						total: page$1.total
+					}
+				});
+				if (hasRole(user.role, opts.adminRoles)) {
+					const page$1 = await runQuery(ctx.context, {
+						...filters,
+						...pagination
+					});
+					await recordRead(page$1, filters.organizationId ?? null);
+					return ctx.json(page$1);
+				}
 				const administered = (await findMemberships(ctx.context, user.id)).filter((m) => hasRole(m.role, opts.organizationAdminRoles)).map((m) => m.organizationId);
 				if (!administered.length || filters.organizationId && !administered.includes(filters.organizationId)) throw new APIError("FORBIDDEN", { message: AUDIT_LOG_ERROR_CODES.AUDIT_LOG_ACCESS_DENIED });
-				return ctx.json(await runQuery(ctx.context, {
+				const page = await runQuery(ctx.context, {
 					...filters,
 					...pagination,
 					organizationIds: filters.organizationId ? void 0 : administered
-				}));
+				});
+				await recordRead(page, filters.organizationId ?? (administered.length === 1 ? administered[0] : null));
+				return ctx.json(page);
 			}),
 			getEventTypes: createAuthEndpoint("/audit-log/get-event-types", {
 				method: "GET",
@@ -828,21 +1197,48 @@ const auditLog = (options) => {
 			}, async (ctx) => ctx.json({ types: ALL_EVENT_TYPES })),
 			deleteOldEvents: createAuthEndpoint("/audit-log/delete-old-events", {
 				method: "POST",
-				body: z$1.object({ olderThanDays: z$1.number().int().min(1).meta({ description: "Delete events recorded more than this many days ago. There is no default: set it to your retention period." }) }),
+				body: z$1.object({ olderThanDays: z$1.number().int().min(1).meta({ description: "Delete events recorded more than this many days ago. There is no default, and a period shorter than retention.minimumDays is refused." }) }),
 				metadata: {
 					SERVER_ONLY: true,
-					client: false
+					client: false,
+					openapi: {
+						operationId: "deleteOldAuditEvents",
+						summary: "Delete old audit events",
+						description: "Delete audit events recorded more than olderThanDays ago. A period shorter than retention.minimumDays is refused, and every deletion is recorded as an audit_events_deleted event.",
+						responses: { 200: {
+							description: "How many events were deleted",
+							content: { "application/json": { schema: {
+								type: "object",
+								properties: { deleted: { type: "number" } },
+								required: ["deleted"]
+							} } }
+						} }
+					}
 				}
 			}, async (ctx) => {
-				if (!opts.database) return ctx.json({ deleted: 0 });
+				const { olderThanDays } = ctx.body;
+				if (olderThanDays < minimumRetentionDays) throw new APIError("BAD_REQUEST", { message: AUDIT_LOG_ERROR_CODES.AUDIT_RETENTION_TOO_SHORT });
+				const before = /* @__PURE__ */ new Date(Date.now() - olderThanDays * 864e5);
 				const deleted = await ctx.context.adapter.deleteMany({
 					model: "auditLog",
 					where: [{
 						field: "createdAt",
 						operator: "lt",
-						value: /* @__PURE__ */ new Date(Date.now() - ctx.body.olderThanDays * 864e5)
+						value: before
 					}]
 				});
+				const session = await getSessionFromCtx(ctx).catch(() => null);
+				await record(ctx, {
+					eventType: AUDIT_EVENT_TYPES.AUDIT_EVENTS_DELETED,
+					userId: session?.user.id ?? null,
+					identifier: session?.user.email ?? null,
+					actorType: session ? "admin" : "system",
+					eventData: {
+						olderThanDays,
+						before: before.toISOString(),
+						deleted
+					}
+				});
 				return ctx.json({ deleted });
 			})
 		},
@@ -853,4 +1249,4 @@ const auditLog = (options) => {
 };
 
 //#endregion
-export { auditLog as n, AUDIT_LOG_ERROR_CODES as t };
+export { verifyAuditEvent as n, AUDIT_LOG_ERROR_CODES as r, auditLog as t };