@kya-os/mcp-i-cloudflare 1.5.8-canary.4 → 1.5.8-canary.40

package/dist/runtime/audit-logger.js

@@ -0,0 +1,276 @@
+/**
+ * Cloudflare Audit Logger
+ *
+ * Cloudflare Workers-compatible implementation of IAuditLogger using Web Crypto API.
+ * This implementation uses Web Crypto API instead of Node.js crypto for compatibility
+ * with Cloudflare Workers environment.
+ */
+/**
+ * Format milliseconds into human-readable interval string
+ */
+function formatTimeInterval(ms) {
+    if (ms === undefined || ms === null)
+        return "unknown";
+    if (ms === 0)
+        return "0ms";
+    const TIME_INTERVALS = {
+        SECOND: 1000,
+        MINUTE: 60 * 1000,
+        HOUR: 60 * 60 * 1000,
+        DAY: 24 * 60 * 60 * 1000,
+        WEEK: 7 * 24 * 60 * 60 * 1000,
+    };
+    if (ms % TIME_INTERVALS.WEEK === 0) {
+        const weeks = ms / TIME_INTERVALS.WEEK;
+        return weeks === 1 ? "weekly" : `${weeks}-weekly`;
+    }
+    if (ms % TIME_INTERVALS.DAY === 0) {
+        const days = ms / TIME_INTERVALS.DAY;
+        return days === 1 ? "daily" : `${days}-daily`;
+    }
+    if (ms % TIME_INTERVALS.HOUR === 0) {
+        const hours = ms / TIME_INTERVALS.HOUR;
+        return hours === 1 ? "hourly" : `${hours}-hourly`;
+    }
+    if (ms % TIME_INTERVALS.MINUTE === 0) {
+        const minutes = ms / TIME_INTERVALS.MINUTE;
+        return minutes === 1 ? "minutely" : `${minutes}-minutely`;
+    }
+    if (ms % TIME_INTERVALS.SECOND === 0) {
+        const seconds = ms / TIME_INTERVALS.SECOND;
+        return seconds === 1 ? "every-second" : `${seconds}-secondly`;
+    }
+    return `${ms}ms`;
+}
+/**
+ * Cloudflare-compatible audit logger implementation
+ *
+ * Uses Web Crypto API for cryptographic operations instead of Node.js crypto.
+ * Implements the same audit.v1 format and rotation logic as the Node.js version.
+ */
+export class CloudflareAuditLogger {
+    config;
+    sessionAuditLog = new Set(); // Track first call per session
+    totalRecordsLogged = 0; // Total records logged (for count rotation)
+    currentLogSize = 0; // Current log size in bytes (for size rotation)
+    lastRotationTime = Date.now(); // Last rotation timestamp (for time rotation)
+    destroyed = false; // Track if logger has been destroyed
+    constructor(config = {}) {
+        const rotationConfig = config.rotation
+            ? {
+                strategy: "custom",
+                ...config.rotation,
+            }
+            : undefined;
+        this.config = {
+            enabled: true,
+            logFunction: console.log,
+            includePayloads: false,
+            ...config,
+            rotation: rotationConfig,
+        };
+    }
+    /**
+     * Log an audit record (with session deduplication)
+     */
+    async logAuditRecord(context) {
+        if (this.destroyed) {
+            throw new Error("CloudflareAuditLogger has been destroyed");
+        }
+        if (!this.config.enabled) {
+            return;
+        }
+        // Check if this is the first call for this session
+        const sessionKey = `${context.session.sessionId}:${context.session.audience}`;
+        if (this.sessionAuditLog.has(sessionKey)) {
+            return; // Already logged for this session
+        }
+        // Mark session as logged
+        this.sessionAuditLog.add(sessionKey);
+        // Create audit record
+        // Extract kid from identity (may be kid, keyId, or derived from did)
+        const kid = context.identity.kid ||
+            context.identity.keyId ||
+            context.identity.did.split(":").pop() ||
+            "unknown";
+        const auditRecord = {
+            version: "audit.v1",
+            ts: Math.floor(Date.now() / 1000),
+            session: context.session.sessionId,
+            audience: context.session.audience,
+            did: context.identity.did,
+            kid,
+            reqHash: context.requestHash,
+            resHash: context.responseHash,
+            verified: context.verified,
+            scope: context.scopeId || "-",
+        };
+        // Format as frozen audit line
+        const auditLine = this.formatAuditLine(auditRecord);
+        // Track size in bytes (UTF-8) - using TextEncoder instead of Buffer
+        const encoder = new TextEncoder();
+        const sizeBytes = encoder.encode(auditLine).length;
+        this.currentLogSize += sizeBytes;
+        this.totalRecordsLogged++;
+        // Emit audit record
+        this.config.logFunction(auditLine);
+        // Check if rotation is needed (event-driven)
+        await this.checkRotation();
+    }
+    /**
+     * Log an event (without session deduplication)
+     */
+    async logEvent(context) {
+        if (this.destroyed) {
+            throw new Error("CloudflareAuditLogger has been destroyed");
+        }
+        if (!this.config.enabled) {
+            return;
+        }
+        // Generate event hash using Web Crypto API
+        const eventHash = await this.hashEvent(context.eventType, context.eventData);
+        // Create audit record (same format as regular audit logs)
+        // Extract kid from identity (may be kid, keyId, or derived from did)
+        const kid = context.identity.kid ||
+            context.identity.keyId ||
+            context.identity.did.split(":").pop() ||
+            "unknown";
+        const auditRecord = {
+            version: "audit.v1",
+            ts: Math.floor(Date.now() / 1000),
+            session: context.session.sessionId,
+            audience: context.session.audience,
+            did: context.identity.did,
+            kid,
+            reqHash: `sha256:${eventHash}`,
+            resHash: `sha256:${eventHash}`, // Same hash for events
+            verified: "yes",
+            scope: context.eventType, // Use eventType as scope
+        };
+        // Format and log (NO session deduplication check)
+        const auditLine = this.formatAuditLine(auditRecord);
+        // Track size and count
+        const encoder = new TextEncoder();
+        const sizeBytes = encoder.encode(auditLine).length;
+        this.currentLogSize += sizeBytes;
+        this.totalRecordsLogged++;
+        // Emit audit record
+        this.config.logFunction(auditLine);
+        // Check rotation
+        await this.checkRotation();
+    }
+    /**
+     * Generate deterministic hash for event using Web Crypto API
+     */
+    async hashEvent(type, data) {
+        const content = JSON.stringify({
+            type,
+            data,
+            ts: Date.now(),
+            nonce: this.generateRandomHex(16),
+        });
+        // Use Web Crypto API for SHA-256 hashing
+        const encoder = new TextEncoder();
+        const dataBuffer = encoder.encode(content);
+        const hashBuffer = await crypto.subtle.digest("SHA-256", dataBuffer);
+        const hashArray = Array.from(new Uint8Array(hashBuffer));
+        const hashHex = hashArray
+            .map((b) => b.toString(16).padStart(2, "0"))
+            .join("");
+        return hashHex;
+    }
+    /**
+     * Generate random hex string using Web Crypto API
+     */
+    generateRandomHex(length) {
+        const randomBytes = crypto.getRandomValues(new Uint8Array(length));
+        return Array.from(randomBytes)
+            .map((b) => b.toString(16).padStart(2, "0"))
+            .join("");
+    }
+    /**
+     * Format audit record as frozen audit line
+     * Format: audit.v1 ts=<unix> session=<id> audience=<host> did=<did> kid=<kid> reqHash=<sha256:..> resHash=<sha256:..> verified=yes|no scope=<scopeId|->
+     */
+    formatAuditLine(record) {
+        const fields = [
+            `${record.version}`,
+            `ts=${record.ts}`,
+            `session=${record.session}`,
+            `audience=${record.audience}`,
+            `did=${record.did}`,
+            `kid=${record.kid}`,
+            `reqHash=${record.reqHash}`,
+            `resHash=${record.resHash}`,
+            `verified=${record.verified}`,
+            `scope=${record.scope}`,
+        ];
+        return fields.join(" ");
+    }
+    /**
+     * Check if rotation is needed and trigger if necessary (event-driven)
+     */
+    async checkRotation() {
+        if (!this.config.rotation) {
+            return;
+        }
+        const { strategy, sizeLimit, timeInterval, countThreshold, hooks } = this.config.rotation;
+        let shouldRotate = false;
+        let trigger = "";
+        // Size-based rotation
+        if (strategy === "size" && sizeLimit && this.currentLogSize >= sizeLimit) {
+            shouldRotate = true;
+            trigger = "size-limit";
+            await hooks?.onSizeLimit?.(this.currentLogSize, sizeLimit);
+        }
+        // Time-based rotation (event-driven, not timer-based)
+        if (strategy === "time" &&
+            timeInterval &&
+            Date.now() - this.lastRotationTime >= timeInterval) {
+            shouldRotate = true;
+            trigger = "time-interval";
+            const interval = formatTimeInterval(timeInterval);
+            await hooks?.onTimeBased?.(interval);
+        }
+        // Count-based rotation
+        if (strategy === "count" &&
+            countThreshold &&
+            this.totalRecordsLogged >= countThreshold) {
+            shouldRotate = true;
+            trigger = "count-threshold";
+            await hooks?.onCountThreshold?.(this.totalRecordsLogged, countThreshold);
+        }
+        // Trigger rotation if needed
+        if (shouldRotate) {
+            await this.rotateNow(trigger);
+        }
+    }
+    /**
+     * Rotate audit log now (manually triggered)
+     */
+    async rotateNow(trigger = "manual") {
+        if (!this.config.rotation?.hooks?.onRotation) {
+            return;
+        }
+        const context = {
+            strategy: this.config.rotation.strategy || "custom",
+            trigger,
+            recordsLogged: this.totalRecordsLogged,
+            timestamp: Date.now(),
+        };
+        // Call rotation hook
+        await this.config.rotation.hooks.onRotation(context);
+        // Reset rotation counters
+        this.currentLogSize = 0;
+        this.lastRotationTime = Date.now();
+        this.totalRecordsLogged = 0;
+    }
+    /**
+     * Destroy the logger (cleanup)
+     */
+    destroy() {
+        this.destroyed = true;
+        this.sessionAuditLog.clear();
+    }
+}
+//# sourceMappingURL=audit-logger.js.map

package/dist/runtime/audit-logger.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-logger.js","sourceRoot":"","sources":["../../src/runtime/audit-logger.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAkDH;;GAEG;AACH,SAAS,kBAAkB,CAAC,EAAsB;IAChD,IAAI,EAAE,KAAK,SAAS,IAAI,EAAE,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IACtD,IAAI,EAAE,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAE3B,MAAM,cAAc,GAAG;QACrB,MAAM,EAAE,IAAI;QACZ,MAAM,EAAE,EAAE,GAAG,IAAI;QACjB,IAAI,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI;QACpB,GAAG,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI;QACxB,IAAI,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI;KACrB,CAAC;IAEX,IAAI,EAAE,GAAG,cAAc,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QACnC,MAAM,KAAK,GAAG,EAAE,GAAG,cAAc,CAAC,IAAI,CAAC;QACvC,OAAO,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,KAAK,SAAS,CAAC;IACpD,CAAC;IACD,IAAI,EAAE,GAAG,cAAc,CAAC,GAAG,KAAK,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,GAAG,EAAE,GAAG,cAAc,CAAC,GAAG,CAAC;QACrC,OAAO,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,IAAI,QAAQ,CAAC;IAChD,CAAC;IACD,IAAI,EAAE,GAAG,cAAc,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QACnC,MAAM,KAAK,GAAG,EAAE,GAAG,cAAc,CAAC,IAAI,CAAC;QACvC,OAAO,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,KAAK,SAAS,CAAC;IACpD,CAAC;IACD,IAAI,EAAE,GAAG,cAAc,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACrC,MAAM,OAAO,GAAG,EAAE,GAAG,cAAc,CAAC,MAAM,CAAC;QAC3C,OAAO,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,OAAO,WAAW,CAAC;IAC5D,CAAC;IACD,IAAI,EAAE,GAAG,cAAc,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACrC,MAAM,OAAO,GAAG,EAAE,GAAG,cAAc,CAAC,MAAM,CAAC;QAC3C,OAAO,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,GAAG,OAAO,WAAW,CAAC;IAChE,CAAC;IACD,OAAO,GAAG,EAAE,IAAI,CAAC;AACnB,CAAC;AAED;;;;;GAKG;AACH,MAAM,OAAO,qBAAqB;IACxB,MAAM,CAAwB;IAC9B,eAAe,GAAG,IAAI,GAAG,EAAU,CAAC,CAAC,+BAA+B;IACpE,kBAAkB,GAAG,CAAC,CAAC,CAAC,4CAA4C;IACpE,cAAc,GAAG,CAAC,CAAC,CAAC,gDAAgD;IACpE,gBAAgB,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,8CAA8C;IAC7E,SAAS,GAAG,KAAK,CAAC,CAAC,qCAAqC;IAEhE,YAAY,SAAsB,EAAE;QAClC,MAAM,cAAc,GAAG,MAAM,CAAC,QAAQ;YACpC,CAAC,CAAC;gBACE,QAAQ,EAAE,QAAiC;gBAC3C,GAAG,MAAM,CAAC,QAAQ;aACnB;YACH,CAAC,CAAC,SAAS,CAAC;QAEd,IAAI,CAAC,MAAM,GAAG;YACZ,OAAO,EAAE,IAAI;YACb,WAAW,EAAE,OAAO,CAAC,GAAG;YACxB,eAAe,EAAE,KAAK;YACtB,GAAG,MAAM;YACT,QAAQ,EAAE,cAAc;SACA,CAAC;IAC7B,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,cAAc,CAAC,OAAqB;QACxC,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YACnB,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;QAC9D,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACzB,OAAO;QACT,CAAC;QAED,mDAAmD;QACnD,MAAM,UAAU,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,SAAS,IAAI,OAAO,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;QAC9E,IAAI,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;YACzC,OAAO,CAAC,kCAAkC;QAC5C,CAAC;QAED,yBAAyB;QACzB,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAErC,sBAAsB;QACtB,qEAAqE;QACrE,MAAM,GAAG,GACN,OAAO,CAAC,QAAgB,CAAC,GAAG;YAC5B,OAAO,CAAC,QAAgB,CAAC,KAAK;YAC/B,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE;YACrC,SAAS,CAAC;QAEZ,MAAM,WAAW,GAAgB;YAC/B,OAAO,EAAE,UAAU;YACnB,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;YACjC,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,SAAS;YAClC,QAAQ,EAAE,OAAO,CAAC,OAAO,CAAC,QAAQ;YAClC,GAAG,EAAE,OAAO,CAAC,QAAQ,CAAC,GAAG;YACzB,GAAG;YACH,OAAO,EAAE,OAAO,CAAC,WAAW;YAC5B,OAAO,EAAE,OAAO,CAAC,YAAY;YAC7B,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,KAAK,EAAE,OAAO,CAAC,OAAO,IAAI,GAAG;SAC9B,CAAC;QAEF,8BAA8B;QAC9B,MAAM,SAAS,GAAG,IAAI,CAAC,eAAe,CAAC,WAAW,CAAC,CAAC;QAEpD,oEAAoE;QACpE,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;QAClC,MAAM,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC;QACnD,IAAI,CAAC,cAAc,IAAI,SAAS,CAAC;QACjC,IAAI,CAAC,kBAAkB,EAAE,CAAC;QAE1B,oBAAoB;QACpB,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;QAEnC,6CAA6C;QAC7C,MAAM,IAAI,CAAC,aAAa,EAAE,CAAC;IAC7B,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,QAAQ,CAAC,OAA0B;QACvC,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YACnB,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;QAC9D,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACzB,OAAO;QACT,CAAC;QAED,2CAA2C;QAC3C,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,SAAS,CACpC,OAAO,CAAC,SAAS,EACjB,OAAO,CAAC,SAAS,CAClB,CAAC;QAEF,0DAA0D;QAC1D,qEAAqE;QACrE,MAAM,GAAG,GACN,OAAO,CAAC,QAAgB,CAAC,GAAG;YAC5B,OAAO,CAAC,QAAgB,CAAC,KAAK;YAC/B,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE;YACrC,SAAS,CAAC;QAEZ,MAAM,WAAW,GAAgB;YAC/B,OAAO,EAAE,UAAU;YACnB,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;YACjC,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,SAAS;YAClC,QAAQ,EAAE,OAAO,CAAC,OAAO,CAAC,QAAQ;YAClC,GAAG,EAAE,OAAO,CAAC,QAAQ,CAAC,GAAG;YACzB,GAAG;YACH,OAAO,EAAE,UAAU,SAAS,EAAE;YAC9B,OAAO,EAAE,UAAU,SAAS,EAAE,EAAE,uBAAuB;YACvD,QAAQ,EAAE,KAAK;YACf,KAAK,EAAE,OAAO,CAAC,SAAS,EAAE,yBAAyB;SACpD,CAAC;QAEF,kDAAkD;QAClD,MAAM,SAAS,GAAG,IAAI,CAAC,eAAe,CAAC,WAAW,CAAC,CAAC;QAEpD,uBAAuB;QACvB,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;QAClC,MAAM,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC;QACnD,IAAI,CAAC,cAAc,IAAI,SAAS,CAAC;QACjC,IAAI,CAAC,kBAAkB,EAAE,CAAC;QAE1B,oBAAoB;QACpB,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;QAEnC,iBAAiB;QACjB,MAAM,IAAI,CAAC,aAAa,EAAE,CAAC;IAC7B,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,SAAS,CAAC,IAAY,EAAE,IAAU;QAC9C,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC;YAC7B,IAAI;YACJ,IAAI;YACJ,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE;YACd,KAAK,EAAE,IAAI,CAAC,iBAAiB,CAAC,EAAE,CAAC;SAClC,CAAC,CAAC;QAEH,yCAAyC;QACzC,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;QAClC,MAAM,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAC3C,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;QACrE,MAAM,SAAS,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC;QACzD,MAAM,OAAO,GAAG,SAAS;aACtB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;aAC3C,IAAI,CAAC,EAAE,CAAC,CAAC;QAEZ,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;OAEG;IACK,iBAAiB,CAAC,MAAc;QACtC,MAAM,WAAW,GAAG,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;QACnE,OAAO,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC;aAC3B,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;aAC3C,IAAI,CAAC,EAAE,CAAC,CAAC;IACd,CAAC;IAED;;;OAGG;IACK,eAAe,CAAC,MAAmB;QACzC,MAAM,MAAM,GAAG;YACb,GAAG,MAAM,CAAC,OAAO,EAAE;YACnB,MAAM,MAAM,CAAC,EAAE,EAAE;YACjB,WAAW,MAAM,CAAC,OAAO,EAAE;YAC3B,YAAY,MAAM,CAAC,QAAQ,EAAE;YAC7B,OAAO,MAAM,CAAC,GAAG,EAAE;YACnB,OAAO,MAAM,CAAC,GAAG,EAAE;YACnB,WAAW,MAAM,CAAC,OAAO,EAAE;YAC3B,WAAW,MAAM,CAAC,OAAO,EAAE;YAC3B,YAAY,MAAM,CAAC,QAAQ,EAAE;YAC7B,SAAS,MAAM,CAAC,KAAK,EAAE;SACxB,CAAC;QAEF,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC1B,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,aAAa;QACzB,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;YAC1B,OAAO;QACT,CAAC;QAED,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,YAAY,EAAE,cAAc,EAAE,KAAK,EAAE,GAChE,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC;QAEvB,IAAI,YAAY,GAAG,KAAK,CAAC;QACzB,IAAI,OAAO,GAAG,EAAE,CAAC;QAEjB,sBAAsB;QACtB,IAAI,QAAQ,KAAK,MAAM,IAAI,SAAS,IAAI,IAAI,CAAC,cAAc,IAAI,SAAS,EAAE,CAAC;YACzE,YAAY,GAAG,IAAI,CAAC;YACpB,OAAO,GAAG,YAAY,CAAC;YACvB,MAAM,KAAK,EAAE,WAAW,EAAE,CAAC,IAAI,CAAC,cAAc,EAAE,SAAS,CAAC,CAAC;QAC7D,CAAC;QAED,sDAAsD;QACtD,IACE,QAAQ,KAAK,MAAM;YACnB,YAAY;YACZ,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,gBAAgB,IAAI,YAAY,EAClD,CAAC;YACD,YAAY,GAAG,IAAI,CAAC;YACpB,OAAO,GAAG,eAAe,CAAC;YAC1B,MAAM,QAAQ,GAAG,kBAAkB,CAAC,YAAY,CAAC,CAAC;YAClD,MAAM,KAAK,EAAE,WAAW,EAAE,CAAC,QAAQ,CAAC,CAAC;QACvC,CAAC;QAED,uBAAuB;QACvB,IACE,QAAQ,KAAK,OAAO;YACpB,cAAc;YACd,IAAI,CAAC,kBAAkB,IAAI,cAAc,EACzC,CAAC;YACD,YAAY,GAAG,IAAI,CAAC;YACpB,OAAO,GAAG,iBAAiB,CAAC;YAC5B,MAAM,KAAK,EAAE,gBAAgB,EAAE,CAAC,IAAI,CAAC,kBAAkB,EAAE,cAAc,CAAC,CAAC;QAC3E,CAAC;QAED,6BAA6B;QAC7B,IAAI,YAAY,EAAE,CAAC;YACjB,MAAM,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QAChC,CAAC;IACH,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,SAAS,CAAC,UAAkB,QAAQ;QACxC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;YAC7C,OAAO;QACT,CAAC;QAED,MAAM,OAAO,GAAyB;YACpC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,IAAI,QAAQ;YACnD,OAAO;YACP,aAAa,EAAE,IAAI,CAAC,kBAAkB;YACtC,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;SACtB,CAAC;QAEF,qBAAqB;QACrB,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;QAErD,0BAA0B;QAC1B,IAAI,CAAC,cAAc,GAAG,CAAC,CAAC;QACxB,IAAI,CAAC,gBAAgB,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACnC,IAAI,CAAC,kBAAkB,GAAG,CAAC,CAAC;IAC9B,CAAC;IAED;;OAEG;IACH,OAAO;QACL,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC;QACtB,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,CAAC;IAC/B,CAAC;CACF"}

package/dist/runtime/oauth-handler.d.ts

@@ -14,6 +14,7 @@ export interface HonoContext {
     header: (name: string, value: string) => void;
 }
 import type { ConsentService } from '../services/consent.service';
+import type { OAuthSecurityService } from '../services/oauth-security.service';
 export interface OAuthCallbackConfig {
     /**
      * AgentShield API URL (defaults to AGENTSHIELD_API_URL env var)
@@ -27,6 +28,10 @@ export interface OAuthCallbackConfig {
      * ConsentService instance for OAuth identity linking (Phase 4)
      */
     consentService?: ConsentService;
+    /**
+     * OAuthSecurityService instance for CSRF-protected state validation
+     */
+    oauthSecurityService?: OAuthSecurityService;
     /**
      * Custom success HTML template (optional)
      */

package/dist/runtime/oauth-handler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"oauth-handler.d.ts","sourceRoot":"","sources":["../../src/runtime/oauth-handler.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH,MAAM,WAAW,WAAW;IAC1B,GAAG,EAAE,GAAG,CAAC;IACT,GAAG,EAAE;QACH,KAAK,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,CAAC;QAC3C,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,CAAC;KAC9C,CAAC;IACF,IAAI,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,KAAK,QAAQ,CAAC;IAClD,IAAI,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE,MAAM,CAAC,EAAE,MAAM,KAAK,QAAQ,CAAC;IACjD,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,IAAI,CAAC;CAC/C;AAID,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAGlE,MAAM,WAAW,mBAAmB;IAClC;;OAEG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAE3B;;OAEG;IACH,iBAAiB,CAAC,EAAE,WAAW,CAAC;IAEhC;;OAEG;IACH,cAAc,CAAC,EAAE,cAAc,CAAC;IAEhC;;OAEG;IACH,eAAe,CAAC,EAAE,CAAC,IAAI,EAAE,gBAAgB,KAAK,MAAM,CAAC;IAErD;;OAEG;IACH,aAAa,CAAC,EAAE,CAAC,KAAK,EAAE,cAAc,KAAK,MAAM,CAAC;IAElD;;OAEG;IACH,SAAS,CAAC,EAAE,OAAO,CAAC;IAEpB;;OAEG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,gBAAgB;IAC/B,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,UAAU;IACzB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,qBAAqB;IACpC,gBAAgB,EAAE,MAAM,CAAC;IACzB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,MAAM,CAAC;IACtB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AA8KD;;;;;GAKG;AACH,wBAAgB,0BAA0B,CAAC,MAAM,GAAE,mBAAwB,IAC3D,GAAG,WAAW,uBA4Q7B;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,sBAAsB,CAAC,CAAC,EAAE,WAAW,GAAG,MAAM,GAAG,IAAI,CAoBpE"}
+{"version":3,"file":"oauth-handler.d.ts","sourceRoot":"","sources":["../../src/runtime/oauth-handler.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH,MAAM,WAAW,WAAW;IAC1B,GAAG,EAAE,GAAG,CAAC;IACT,GAAG,EAAE;QACH,KAAK,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,CAAC;QAC3C,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,CAAC;KAC9C,CAAC;IACF,IAAI,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,KAAK,QAAQ,CAAC;IAClD,IAAI,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE,MAAM,CAAC,EAAE,MAAM,KAAK,QAAQ,CAAC;IACjD,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,IAAI,CAAC;CAC/C;AAID,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAElE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,oCAAoC,CAAC;AAE/E,MAAM,WAAW,mBAAmB;IAClC;;OAEG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAE3B;;OAEG;IACH,iBAAiB,CAAC,EAAE,WAAW,CAAC;IAEhC;;OAEG;IACH,cAAc,CAAC,EAAE,cAAc,CAAC;IAEhC;;OAEG;IACH,oBAAoB,CAAC,EAAE,oBAAoB,CAAC;IAE5C;;OAEG;IACH,eAAe,CAAC,EAAE,CAAC,IAAI,EAAE,gBAAgB,KAAK,MAAM,CAAC;IAErD;;OAEG;IACH,aAAa,CAAC,EAAE,CAAC,KAAK,EAAE,cAAc,KAAK,MAAM,CAAC;IAElD;;OAEG;IACH,SAAS,CAAC,EAAE,OAAO,CAAC;IAEpB;;OAEG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,gBAAgB;IAC/B,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,UAAU;IACzB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,qBAAqB;IACpC,gBAAgB,EAAE,MAAM,CAAC;IACzB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,MAAM,CAAC;IACtB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AA8KD;;;;;GAKG;AACH,wBAAgB,0BAA0B,CAAC,MAAM,GAAE,mBAAwB,IAC3D,GAAG,WAAW,uBAoY7B;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,sBAAsB,CAAC,CAAC,EAAE,WAAW,GAAG,MAAM,GAAG,IAAI,CAoBpE"}

package/dist/runtime/oauth-handler.js

@@ -184,7 +184,7 @@ export function createOAuthCallbackHandler(config = {}) {
     return async (c) => {
         const env = c.env;
         // Get configuration with defaults
-        const { agentShieldApiUrl = env.AGENTSHIELD_API_URL || 'https://hobbs.work', delegationStorage, consentService, successTemplate = defaultSuccessTemplate, errorTemplate = defaultErrorTemplate, autoClose = true, autoCloseDelay = 5000 } = config;
+        const { agentShieldApiUrl = env.AGENTSHIELD_API_URL || 'https://hobbs.work', delegationStorage, consentService, oauthSecurityService, successTemplate = defaultSuccessTemplate, errorTemplate = defaultErrorTemplate, autoClose = true, autoCloseDelay = 5000 } = config;
         // Get query parameters
         const code = c.req.query('code');
         const stateParam = c.req.query('state');
@@ -192,7 +192,12 @@ export function createOAuthCallbackHandler(config = {}) {
         // Handle OAuth errors
         if (error) {
             const errorDescription = c.req.query('error_description') || 'Authorization failed';
-            console.error('[OAuth] Error from provider:', error, errorDescription);
+            console.error('[OAuth] 🔒 SECURITY EVENT: Error from provider:', {
+                error,
+                errorDescription,
+                timestamp: new Date().toISOString(),
+                eventType: 'oauth_provider_error'
+            });
             const html = errorTemplate({
                 error,
                 description: errorDescription
@@ -201,25 +206,89 @@ export function createOAuthCallbackHandler(config = {}) {
         }
         // Validate required parameters
         if (!code || !stateParam) {
-            console.error('[OAuth] Missing code or state parameter');
+            console.error('[OAuth] 🔒 SECURITY EVENT: Missing required parameters:', {
+                hasCode: !!code,
+                hasState: !!stateParam,
+                timestamp: new Date().toISOString(),
+                eventType: 'oauth_validation_failed',
+                reason: 'missing_parameters'
+            });
             const html = errorTemplate({
                 error: 'invalid_request',
                 description: 'Missing authorization code or state parameter'
             });
             return c.html(html, 400);
         }
-        // Decode state parameter
+        // ✅ CSRF Protection: Retrieve and validate state from secure storage
         let state;
-        try {
-            state = JSON.parse(atob(stateParam));
+        let stateData = null;
+        if (oauthSecurityService) {
+            // Use secure state validation (CSRF-protected)
+            try {
+                stateData = await oauthSecurityService.getOAuthState(stateParam);
+                if (!stateData) {
+                    console.error('[OAuth] 🔒 SECURITY EVENT: State validation failed - state not found or expired:', {
+                        stateParam: stateParam.substring(0, 20) + '...',
+                        timestamp: new Date().toISOString(),
+                        eventType: 'csrf_protection_failed',
+                        reason: 'state_not_found_or_expired'
+                    });
+                    const html = errorTemplate({
+                        error: 'invalid_state',
+                        description: 'Invalid or expired state parameter. This may be a CSRF attack or the authorization request has expired.'
+                    });
+                    return c.html(html, 400);
+                }
+                // Extract state from stored data
+                state = {
+                    project_id: stateData.project_id,
+                    agent_did: stateData.agent_did,
+                    session_id: stateData.session_id,
+                    delegation_id: stateData.delegation_id,
+                };
+                console.log('[OAuth] 🔒 SECURITY EVENT: State validated successfully:', {
+                    projectId: state.project_id,
+                    agentDid: state.agent_did.substring(0, 20) + '...',
+                    sessionId: state.session_id?.substring(0, 20) + '...',
+                    timestamp: new Date().toISOString(),
+                    eventType: 'csrf_protection_success',
+                    stateStoredAt: stateData.storedAt
+                });
+            }
+            catch (err) {
+                console.error('[OAuth] 🔒 SECURITY EVENT: State validation error:', {
+                    error: err instanceof Error ? err.message : String(err),
+                    stateParam: stateParam.substring(0, 20) + '...',
+                    timestamp: new Date().toISOString(),
+                    eventType: 'csrf_protection_error',
+                    reason: 'validation_exception'
+                });
+                const html = errorTemplate({
+                    error: 'invalid_state',
+                    description: 'Failed to validate state parameter'
+                });
+                return c.html(html, 400);
+            }
         }
-        catch (err) {
-            console.error('[OAuth] Failed to decode state:', err);
-            const html = errorTemplate({
-                error: 'invalid_state',
-                description: 'Invalid state parameter'
-            });
-            return c.html(html, 400);
+        else {
+            // Fallback: Decode state parameter directly (less secure, but backward compatible)
+            console.warn('[OAuth] ⚠️ SECURITY WARNING: OAuthSecurityService not provided, using insecure state decoding');
+            try {
+                state = JSON.parse(atob(stateParam));
+            }
+            catch (err) {
+                console.error('[OAuth] 🔒 SECURITY EVENT: Failed to decode state:', {
+                    error: err instanceof Error ? err.message : String(err),
+                    timestamp: new Date().toISOString(),
+                    eventType: 'oauth_validation_failed',
+                    reason: 'state_decode_error'
+                });
+                const html = errorTemplate({
+                    error: 'invalid_state',
+                    description: 'Invalid state parameter'
+                });
+                return c.html(html, 400);
+            }
         }
         const { project_id, agent_did, session_id, delegation_id } = state;
         // Validate session ID
@@ -231,11 +300,14 @@ export function createOAuthCallbackHandler(config = {}) {
             });
             return c.html(html, 400);
         }
-        console.log('[OAuth] Processing authorization code exchange:', {
+        console.log('[OAuth] 🔒 SECURITY EVENT: Processing authorization code exchange:', {
             projectId: project_id,
             agentDid: agent_did.substring(0, 20) + '...',
-            sessionId: session_id,
-            delegationId: delegation_id
+            sessionId: session_id?.substring(0, 20) + '...',
+            delegationId: delegation_id,
+            timestamp: new Date().toISOString(),
+            eventType: 'oauth_code_exchange_start',
+            hasSecureState: !!oauthSecurityService
         });
         try {
             // Exchange authorization code for delegation token
@@ -255,9 +327,13 @@ export function createOAuthCallbackHandler(config = {}) {
             });
             if (!tokenResponse.ok) {
                 const errorText = await tokenResponse.text();
-                console.error('[OAuth] Token exchange failed:', {
+                console.error('[OAuth] 🔒 SECURITY EVENT: Token exchange failed:', {
                     status: tokenResponse.status,
-                    error: errorText
+                    error: errorText.substring(0, 200),
+                    projectId: project_id,
+                    agentDid: agent_did.substring(0, 20) + '...',
+                    timestamp: new Date().toISOString(),
+                    eventType: 'oauth_token_exchange_failed'
                 });
                 const html = errorTemplate({
                     error: 'token_exchange_failed',
@@ -268,18 +344,26 @@ export function createOAuthCallbackHandler(config = {}) {
             const tokenData = await tokenResponse.json();
             // Validate token response
             if (!tokenData.delegation_token) {
-                console.error('[OAuth] No delegation token in response:', tokenData);
+                console.error('[OAuth] 🔒 SECURITY EVENT: Invalid token response:', {
+                    hasDelegationToken: !!tokenData.delegation_token,
+                    responseKeys: Object.keys(tokenData),
+                    projectId: project_id,
+                    timestamp: new Date().toISOString(),
+                    eventType: 'oauth_invalid_token_response'
+                });
                 const html = errorTemplate({
                     error: 'invalid_response',
                     description: 'Invalid token response from authorization server'
                 });
                 return c.html(html, 500);
             }
-            console.log('[OAuth] Token exchange successful:', {
+            console.log('[OAuth] 🔒 SECURITY EVENT: Token exchange successful:', {
                 delegationId: tokenData.delegation_id,
                 sessionId: tokenData.session_id || session_id,
                 expiresIn: tokenData.expires_in,
-                scopes: tokenData.scopes
+                scopes: tokenData.scopes,
+                timestamp: new Date().toISOString(),
+                eventType: 'oauth_token_exchange_success'
             });
             // Phase 4 PR #3: Extract OAuth user info and link to User DID
             let oauthIdentity = null;
@@ -320,16 +404,26 @@ export function createOAuthCallbackHandler(config = {}) {
                         // Set OAuth identity cookie for consent page
                         const cookieValue = encodeURIComponent(JSON.stringify(oauthIdentity));
                         c.header("Set-Cookie", `oauth_identity=${cookieValue}; HttpOnly; Secure; SameSite=Lax; Max-Age=604800; Path=/`);
-                        console.log('[OAuth] OAuth identity linked and cookie set:', {
+                        console.log('[OAuth] 🔒 SECURITY EVENT: OAuth identity linked and cookie set:', {
                             provider: oauthIdentity.provider,
                             subject: oauthIdentity.subject.substring(0, 20) + '...',
                             userDid: userDid.substring(0, 20) + '...',
+                            sessionId: session_id?.substring(0, 20) + '...',
+                            timestamp: new Date().toISOString(),
+                            eventType: 'oauth_identity_linked',
+                            cookieSet: true
                         });
                     }
                 }
                 catch (error) {
                     // OAuth linking errors are non-fatal - log but continue
-                    console.error('[OAuth] Failed to link OAuth identity (non-fatal):', error);
+                    console.error('[OAuth] 🔒 SECURITY EVENT: Failed to link OAuth identity (non-fatal):', {
+                        error: error instanceof Error ? error.message : String(error),
+                        sessionId: session_id?.substring(0, 20) + '...',
+                        timestamp: new Date().toISOString(),
+                        eventType: 'oauth_identity_linking_failed',
+                        severity: 'warning'
+                    });
                 }
             }
             // Store delegation token in KV if storage is configured
@@ -350,11 +444,15 @@ export function createOAuthCallbackHandler(config = {}) {
                         await delegationStorage.put(userAgentKey, tokenData.delegation_token, {
                             expirationTtl: ttl
                         });
-                        console.log('[OAuth] Delegation token stored with user+agent DID:', {
-                            key: userAgentKey,
+                        console.log('[OAuth] 🔒 SECURITY EVENT: Delegation token stored with user+agent DID:', {
+                            key: userAgentKey.substring(0, 50) + '...',
                             ttl,
                             agentDid: agent_did.substring(0, 20) + '...',
-                            delegationId: tokenData.delegation_id
+                            userDid: sessionUserDid.substring(0, 20) + '...',
+                            delegationId: tokenData.delegation_id,
+                            timestamp: new Date().toISOString(),
+                            eventType: 'delegation_token_stored',
+                            storageType: 'user_agent_scoped'
                         });
                     }
                     // Backward compatibility: Agent-only key (24 hour TTL)
@@ -362,11 +460,15 @@ export function createOAuthCallbackHandler(config = {}) {
                     await delegationStorage.put(legacyKey, tokenData.delegation_token, {
                         expirationTtl: 24 * 60 * 60 // 24 hours only
                     });
-                    console.log('[OAuth] Delegation token stored with legacy agent key:', {
-                        key: legacyKey,
+                    console.log('[OAuth] 🔒 SECURITY EVENT: Delegation token stored with legacy agent key:', {
+                        key: legacyKey.substring(0, 50) + '...',
                         ttl: 24 * 60 * 60,
                         agentDid: agent_did.substring(0, 20) + '...',
-                        delegationId: tokenData.delegation_id
+                        delegationId: tokenData.delegation_id,
+                        timestamp: new Date().toISOString(),
+                        eventType: 'delegation_token_stored',
+                        storageType: 'legacy_agent_scoped',
+                        warning: 'Legacy format - migrate to user+agent scoped tokens'
                     });
                     // Session cache for fast lookup (shorter TTL for performance)
                     await delegationStorage.put(sessionKey, JSON.stringify({
@@ -377,16 +479,25 @@ export function createOAuthCallbackHandler(config = {}) {
                     }), {
                         expirationTtl: Math.min(ttl, 1800) // 30 minutes or token TTL, whichever is shorter
                     });
-                    console.log('[OAuth] Delegation token cached for session:', {
-                        key: sessionKey,
+                    console.log('[OAuth] 🔒 SECURITY EVENT: Delegation token cached for session:', {
+                        key: sessionKey.substring(0, 50) + '...',
                         ttl: Math.min(ttl, 1800),
-                        sessionId: session_id,
-                        userDid: sessionUserDid,
+                        sessionId: session_id?.substring(0, 20) + '...',
+                        userDid: sessionUserDid?.substring(0, 20) + '...',
+                        timestamp: new Date().toISOString(),
+                        eventType: 'delegation_token_cached',
+                        storageType: 'session_cache'
                     });
                 }
                 catch (storageError) {
                     // Storage errors are non-fatal - log but continue
-                    console.error('[OAuth] Storage error (non-fatal):', storageError);
+                    console.error('[OAuth] 🔒 SECURITY EVENT: Storage error (non-fatal):', {
+                        error: storageError instanceof Error ? storageError.message : String(storageError),
+                        sessionId: session_id?.substring(0, 20) + '...',
+                        timestamp: new Date().toISOString(),
+                        eventType: 'delegation_storage_error',
+                        severity: 'warning'
+                    });
                 }
             }
             // Return success page
@@ -399,7 +510,13 @@ export function createOAuthCallbackHandler(config = {}) {
             return c.html(html);
         }
         catch (error) {
-            console.error('[OAuth] Unexpected error:', error);
+            console.error('[OAuth] 🔒 SECURITY EVENT: Unexpected error:', {
+                error: error instanceof Error ? error.message : String(error),
+                stack: error instanceof Error ? error.stack : undefined,
+                timestamp: new Date().toISOString(),
+                eventType: 'oauth_unexpected_error',
+                severity: 'error'
+            });
             const html = errorTemplate({
                 error: 'internal_error',
                 description: error instanceof Error ? error.message : 'An unexpected error occurred'