@openora/core 0.4.0

package/dist/audit/plugin.js

@@ -0,0 +1,337 @@
+import { definePlugin, EVENT_BUS, DRIZZLE, ADMIN_GUARD } from '@openora/core/server';
+import { AUDIT_WRITER } from '@openora/core/contracts';
+import { AuditService } from './service/audit.service.js';
+import { createAuditRouter } from './router/index.js';
+const str = (v) => (typeof v === 'string' ? v : null);
+function isRecord(v) {
+    return typeof v === 'object' && v !== null;
+}
+function mapEventToRecord(topic, p) {
+    const result = /\.(failed|rejected|declined)$/.test(topic) ? 'failure' : 'success';
+    const base = {
+        actorType: 'system',
+        action: topic,
+        resourceType: topic.split('.')[0] ?? topic,
+        resourceId: null,
+        after: p,
+        result,
+        ip: typeof p['ip'] === 'string' ? p['ip'] : null,
+        userAgent: typeof p['userAgent'] === 'string' ? p['userAgent'] : null,
+    };
+    // payload `userId` is the SUBJECT player here, not the actor (an admin changed it).
+    if (topic === 'compliance.kyc.updated') {
+        return {
+            ...base,
+            actorType: p['actorId'] ? 'admin' : 'system',
+            actorId: str(p['actorId']),
+            resourceType: 'player',
+            resourceId: str(p['userId']),
+            before: { kycStatus: p['previousStatus'] ?? null },
+            after: { kycStatus: p['status'] ?? null },
+        };
+    }
+    // Player submitted KYC documents. actorId = the player; resourceId = the player.
+    if (topic === 'compliance.kyc.submitted') {
+        return {
+            ...base,
+            actorType: 'player',
+            actorId: str(p['userId']),
+            resourceType: 'player',
+            resourceId: str(p['userId']),
+            after: { referenceId: p['referenceId'] ?? null, provider: p['provider'] ?? null },
+        };
+    }
+    // System-driven re-KYC trigger. No admin actor; resource = the subject player.
+    if (topic === 'compliance.kyc.reverify_required') {
+        return {
+            ...base,
+            actorType: 'system',
+            resourceType: 'player',
+            resourceId: str(p['userId']),
+            after: { reason: p['reason'] ?? null },
+        };
+    }
+    // Admin added/changed a geo (country) rule. resourceId = the country code.
+    if (topic === 'compliance.geo-rule.added') {
+        return {
+            ...base,
+            actorType: typeof p['actorId'] === 'string' ? 'admin' : 'system',
+            actorId: str(p['actorId']),
+            resourceType: 'geo-rule',
+            resourceId: str(p['countryCode']),
+            after: { action: p['action'] ?? null },
+        };
+    }
+    // Player requested a withdrawal (funds held). actorId = the player; resourceId =
+    // the withdrawal transaction.
+    if (topic === 'wallet.withdrawal.requested') {
+        return {
+            ...base,
+            actorType: 'player',
+            actorId: str(p['userId']),
+            resourceType: 'withdrawal',
+            resourceId: str(p['transactionId']),
+            after: { amount: p['amount'], currency: p['currency'] },
+        };
+    }
+    // Admin approve/reject of a withdrawal, or a PSP-rail failure on an approved one.
+    // actorId = the reviewing admin; resourceId = the withdrawal transaction; reason
+    // carried on reject.
+    if (topic === 'wallet.withdrawal.approved' ||
+        topic === 'wallet.withdrawal.rejected' ||
+        topic === 'wallet.withdrawal.failed') {
+        return {
+            ...base,
+            actorType: 'admin',
+            actorId: str(p['adminId']),
+            resourceType: 'withdrawal',
+            resourceId: str(p['transactionId']),
+            after: {
+                userId: str(p['userId']),
+                amount: p['amount'],
+                currency: p['currency'],
+                reason: p['reason'] ?? null,
+            },
+        };
+    }
+    // actorId = acting admin; resourceId = subject role. permissions.changed/updated
+    // carries the matrix diff; assigned/revoked carries the target user in after.userId.
+    if (topic.startsWith('iam.role.')) {
+        const carriesMatrix = topic === 'iam.role.permissions.changed' || topic === 'iam.role.updated';
+        const carriesTarget = topic === 'iam.role.assigned' || topic === 'iam.role.revoked';
+        return {
+            ...base,
+            actorType: 'admin',
+            actorId: str(p['actorId']),
+            resourceType: 'role',
+            resourceId: str(p['roleId']),
+            before: carriesMatrix && isRecord(p['before']) ? p['before'] : null,
+            after: carriesMatrix
+                ? isRecord(p['after'])
+                    ? p['after']
+                    : null
+                : carriesTarget
+                    ? { userId: str(p['userId']) }
+                    : null,
+        };
+    }
+    // Admin cleared a lockout. resource = the unlocked user; before/after carry the
+    // failed-attempt + lockout state that was reset.
+    if (topic === 'identity.user.unlocked') {
+        return {
+            ...base,
+            actorType: 'admin',
+            actorId: str(p['actorId']),
+            resourceType: 'user',
+            resourceId: str(p['userId']),
+            before: {
+                failedLoginAttempts: p['previousFailedAttempts'] ?? null,
+                lockoutUntil: p['previousLockoutUntil'] ?? null,
+            },
+            after: { failedLoginAttempts: 0, lockoutUntil: null },
+        };
+    }
+    if (topic === 'identity.user.unauthorized_access') {
+        const resource = str(p['resource']) ?? 'admin';
+        const action = str(p['action']);
+        const role = p['role'] ? str(p['role']) : undefined;
+        return {
+            ...base,
+            actorType: role === 'player' ? 'player' : 'admin',
+            actorId: str(p['userId']),
+            resourceType: resource,
+            resourceId: action ? `${resource}:${action}` : null,
+            result: 'failure',
+        };
+    }
+    // A lockout is a system-driven security control: the subject is the resource, not the
+    // actor, and it is a failure outcome (the base regex would otherwise mark it success).
+    if (topic === 'identity.user.lockout.triggered') {
+        return {
+            ...base,
+            actorType: 'system',
+            resourceType: 'user',
+            resourceId: str(p['userId']),
+            result: 'failure',
+            after: { lockoutUntil: p['lockoutUntil'] ?? null },
+        };
+    }
+    // Player/Admin revoked one or all of their own sessions, or an admin forced it.
+    if (topic === 'identity.session.revoked' || topic === 'identity.sessions.revoked_all') {
+        const isSingle = topic === 'identity.session.revoked';
+        const actorId = p['actorId'] ? str(p['actorId']) : str(p['userId']);
+        const isForced = !!p['actorId'];
+        return {
+            ...base,
+            actorType: isForced ? 'admin' : 'player',
+            actorId,
+            resourceType: isSingle ? 'session' : 'user',
+            resourceId: isSingle ? str(p['sessionId']) : str(p['userId']),
+        };
+    }
+    // actorId = the player who (un)blocked; resource = the blocked player.
+    if (topic === 'chat.user.blocked' || topic === 'chat.user.unblocked') {
+        return {
+            ...base,
+            actorType: 'player',
+            actorId: str(p['blockerId']),
+            resourceType: 'player',
+            resourceId: str(p['blockedId']),
+        };
+    }
+    // actorType = admin (the only path flipping isActive is the back-office route);
+    // resource = the subject user. after carries the new active state.
+    if (topic === 'identity.user.deactivated' || topic === 'identity.user.reactivated') {
+        const isActive = topic === 'identity.user.reactivated';
+        return {
+            ...base,
+            actorType: 'admin',
+            actorId: str(p['actorId']),
+            resourceType: 'user',
+            resourceId: str(p['userId']),
+            before: { isActive: !isActive },
+            after: { isActive },
+        };
+    }
+    // System-automated or admin-manual tag assignment/removal.
+    // actorId = SYSTEM_ACTOR_ID (zero UUID) for automated ops; admin user id for manual.
+    if (topic === 'tag.player.assigned' || topic === 'tag.player.removed') {
+        const SYSTEM_ACTOR = '00000000-0000-0000-0000-000000000000';
+        const actorId = str(p['actorId']);
+        return {
+            ...base,
+            actorType: actorId === SYSTEM_ACTOR ? 'system' : 'admin',
+            actorId,
+            resourceType: 'player',
+            resourceId: str(p['playerId']),
+            after: { tagKey: p['tagKey'], reason: p['reason'] },
+        };
+    }
+    // Admin updated a tag rule configuration.
+    if (topic === 'tag.rule.upserted') {
+        return {
+            ...base,
+            actorType: 'admin',
+            actorId: str(p['actorId']),
+            resourceType: 'tag-rule',
+            resourceId: str(p['tagKey']),
+            after: isRecord(p['after']) ? p['after'] : null,
+        };
+    }
+    // RG admin actions. `userId` = subject player (resource), `actorId` = acting admin.
+    // limit.set + lifted carry a before-snapshot so the regulatory export is diffable.
+    if (topic === 'rg.limit.set' ||
+        topic === 'rg.cooling_off.activated' ||
+        topic === 'rg.self_exclusion.activated' ||
+        topic === 'rg.self_exclusion.lifted') {
+        const before = topic === 'rg.limit.set'
+            ? { amount: p['previousAmount'] ?? null }
+            : topic === 'rg.self_exclusion.lifted'
+                ? { status: 'active' }
+                : null;
+        return {
+            ...base,
+            actorType: 'admin',
+            actorId: str(p['actorId']),
+            resourceType: 'player',
+            resourceId: str(p['userId']),
+            before,
+            after: p,
+        };
+    }
+    // Wallet events carry the txn ref in transactionId; surface it as resourceId so
+    // a transaction reference is searchable (it otherwise stays buried in `after`).
+    if (topic.startsWith('wallet.')) {
+        return {
+            ...base,
+            actorType: 'player',
+            actorId: str(p['userId']),
+            resourceType: 'transaction',
+            resourceId: str(p['transactionId']),
+            after: p,
+        };
+    }
+    if (typeof p['userId'] === 'string') {
+        return { ...base, actorId: p['userId'], actorType: 'player' };
+    }
+    return base;
+}
+const SUBSCRIBED_TOPICS = [
+    'identity.user.registered',
+    'identity.user.login',
+    'identity.user.login.failed',
+    'identity.user.lockout.triggered',
+    'identity.user.unlocked',
+    'identity.user.logout',
+    'identity.2fa.enabled',
+    'identity.2fa.disabled',
+    'identity.password.reset',
+    'identity.email.verified',
+    'identity.profile.updated',
+    'identity.user.deactivated',
+    'identity.user.reactivated',
+    'identity.session.revoked',
+    'identity.sessions.revoked_all',
+    'identity.user.unauthorized_access',
+    'wallet.deposit.completed',
+    'wallet.withdrawal.completed',
+    'wallet.withdrawal.requested',
+    'wallet.withdrawal.approved',
+    'wallet.withdrawal.rejected',
+    'wallet.withdrawal.failed',
+    'gaming.round.started',
+    'gaming.round.ended',
+    // chat.message.sent is intentionally NOT audited: it is high-volume content
+    // already persisted in chatMessage; the moderation/block actions are what we audit.
+    'chat.user.blocked',
+    'chat.user.unblocked',
+    'compliance.limit.upserted',
+    'compliance.limit.removed',
+    'rg.limit.set',
+    'rg.cooling_off.activated',
+    'rg.self_exclusion.activated',
+    'rg.self_exclusion.lifted',
+    'rg.exclusion.login_blocked',
+    'compliance.kyc.updated',
+    'compliance.kyc.submitted',
+    'compliance.kyc.reverify_required',
+    'compliance.geo-rule.added',
+    'cms.page.published',
+    'iam.invitation.accepted',
+    'iam.role.created',
+    'iam.role.updated',
+    'iam.role.deleted',
+    'iam.role.permissions.changed',
+    'iam.role.assigned',
+    'iam.role.revoked',
+    'tag.player.assigned',
+    'tag.player.removed',
+    'tag.rule.upserted',
+];
+export default definePlugin({
+    id: 'audit',
+    register(ctx) {
+        // Subscriptions are wired before router factories run (create-app.ts boot order),
+        // so svcRef is null at registration but set before any real event arrives.
+        let svcRef = null;
+        ctx.provideSealed(AUDIT_WRITER, (c) => {
+            const svc = new AuditService(c.get(DRIZZLE), c.get(EVENT_BUS));
+            return {
+                record: (entry) => svc.record(entry).then(() => undefined),
+            };
+        });
+        for (const topic of SUBSCRIBED_TOPICS) {
+            ctx.events.on(topic, (payload) => {
+                if (!svcRef || !isRecord(payload))
+                    return;
+                void svcRef.record(mapEventToRecord(topic, payload));
+            });
+        }
+        ctx.routers.add('audit', (c) => {
+            const svc = new AuditService(c.get(DRIZZLE), c.get(EVENT_BUS));
+            svcRef = svc;
+            return createAuditRouter(svc, c.get(ADMIN_GUARD));
+        });
+    },
+});
+//# sourceMappingURL=plugin.js.map

package/dist/audit/plugin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin.js","sourceRoot":"","sources":["../../src/audit/plugin.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACrF,OAAO,EAAE,YAAY,EAAwB,MAAM,yBAAyB,CAAC;AAC7E,OAAO,EAAE,YAAY,EAAoB,MAAM,4BAA4B,CAAC;AAC5E,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAEtD,MAAM,GAAG,GAAG,CAAC,CAAU,EAAiB,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;AAE9E,SAAS,QAAQ,CAAC,CAAU;IAC1B,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,CAAC;AAC7C,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAa,EAAE,CAA0B;IACjE,MAAM,MAAM,GAAG,+BAA+B,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;IAEnF,MAAM,IAAI,GAAgB;QACxB,SAAS,EAAE,QAAQ;QACnB,MAAM,EAAE,KAAK;QACb,YAAY,EAAE,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK;QAC1C,UAAU,EAAE,IAAI;QAChB,KAAK,EAAE,CAAC;QACR,MAAM;QACN,EAAE,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI;QAChD,SAAS,EAAE,OAAO,CAAC,CAAC,WAAW,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI;KACtE,CAAC;IAEF,oFAAoF;IACpF,IAAI,KAAK,KAAK,wBAAwB,EAAE,CAAC;QACvC,OAAO;YACL,GAAG,IAAI;YACP,SAAS,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ;YAC5C,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;YAC1B,YAAY,EAAE,QAAQ;YACtB,UAAU,EAAE,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;YAC5B,MAAM,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC,gBAAgB,CAAC,IAAI,IAAI,EAAE;YAClD,KAAK,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC,QAAQ,CAAC,IAAI,IAAI,EAAE;SAC1C,CAAC;IACJ,CAAC;IAED,iFAAiF;IACjF,IAAI,KAAK,KAAK,0BAA0B,EAAE,CAAC;QACzC,OAAO;YACL,GAAG,IAAI;YACP,SAAS,EAAE,QAAQ;YACnB,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;YACzB,YAAY,EAAE,QAAQ;YACtB,UAAU,EAAE,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;YAC5B,KAAK,EAAE,EAAE,WAAW,EAAE,CAAC,CAAC,aAAa,CAAC,IAAI,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,UAAU,CAAC,IAAI,IAAI,EAAE;SAClF,CAAC;IACJ,CAAC;IAED,+EAA+E;IAC/E,IAAI,KAAK,KAAK,kCAAkC,EAAE,CAAC;QACjD,OAAO;YACL,GAAG,IAAI;YACP,SAAS,EAAE,QAAQ;YACnB,YAAY,EAAE,QAAQ;YACtB,UAAU,EAAE,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;YAC5B,KAAK,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,QAAQ,CAAC,IAAI,IAAI,EAAE;SACvC,CAAC;IACJ,CAAC;IAED,2EAA2E;IAC3E,IAAI,KAAK,KAAK,2BAA2B,EAAE,CAAC;QAC1C,OAAO;YACL,GAAG,IAAI;YACP,SAAS,EAAE,OAAO,CAAC,CAAC,SAAS,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ;YAChE,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;YAC1B,YAAY,EAAE,UAAU;YACxB,UAAU,EAAE,GAAG,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC;YACjC,KAAK,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,QAAQ,CAAC,IAAI,IAAI,EAAE;SACvC,CAAC;IACJ,CAAC;IAED,iFAAiF;IACjF,8BAA8B;IAC9B,IAAI,KAAK,KAAK,6BAA6B,EAAE,CAAC;QAC5C,OAAO;YACL,GAAG,IAAI;YACP,SAAS,EAAE,QAAQ;YACnB,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;YACzB,YAAY,EAAE,YAAY;YAC1B,UAAU,EAAE,GAAG,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC;YACnC,KAAK,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,QAAQ,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,UAAU,CAAC,EAAE;SACxD,CAAC;IACJ,CAAC;IAED,kFAAkF;IAClF,iFAAiF;IACjF,qBAAqB;IACrB,IACE,KAAK,KAAK,4BAA4B;QACtC,KAAK,KAAK,4BAA4B;QACtC,KAAK,KAAK,0BAA0B,EACpC,CAAC;QACD,OAAO;YACL,GAAG,IAAI;YACP,SAAS,EAAE,OAAO;YAClB,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;YAC1B,YAAY,EAAE,YAAY;YAC1B,UAAU,EAAE,GAAG,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC;YACnC,KAAK,EAAE;gBACL,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;gBACxB,MAAM,EAAE,CAAC,CAAC,QAAQ,CAAC;gBACnB,QAAQ,EAAE,CAAC,CAAC,UAAU,CAAC;gBACvB,MAAM,EAAE,CAAC,CAAC,QAAQ,CAAC,IAAI,IAAI;aAC5B;SACF,CAAC;IACJ,CAAC;IAED,iFAAiF;IACjF,qFAAqF;IACrF,IAAI,KAAK,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;QAClC,MAAM,aAAa,GAAG,KAAK,KAAK,8BAA8B,IAAI,KAAK,KAAK,kBAAkB,CAAC;QAC/F,MAAM,aAAa,GAAG,KAAK,KAAK,mBAAmB,IAAI,KAAK,KAAK,kBAAkB,CAAC;QACpF,OAAO;YACL,GAAG,IAAI;YACP,SAAS,EAAE,OAAO;YAClB,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;YAC1B,YAAY,EAAE,MAAM;YACpB,UAAU,EAAE,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;YAC5B,MAAM,EAAE,aAAa,IAAI,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI;YACnE,KAAK,EAAE,aAAa;gBAClB,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;oBACpB,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;oBACZ,CAAC,CAAC,IAAI;gBACR,CAAC,CAAC,aAAa;oBACb,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE;oBAC9B,CAAC,CAAC,IAAI;SACX,CAAC;IACJ,CAAC;IAED,gFAAgF;IAChF,iDAAiD;IACjD,IAAI,KAAK,KAAK,wBAAwB,EAAE,CAAC;QACvC,OAAO;YACL,GAAG,IAAI;YACP,SAAS,EAAE,OAAO;YAClB,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;YAC1B,YAAY,EAAE,MAAM;YACpB,UAAU,EAAE,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;YAC5B,MAAM,EAAE;gBACN,mBAAmB,EAAE,CAAC,CAAC,wBAAwB,CAAC,IAAI,IAAI;gBACxD,YAAY,EAAE,CAAC,CAAC,sBAAsB,CAAC,IAAI,IAAI;aAChD;YACD,KAAK,EAAE,EAAE,mBAAmB,EAAE,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE;SACtD,CAAC;IACJ,CAAC;IAED,IAAI,KAAK,KAAK,mCAAmC,EAAE,CAAC;QAClD,MAAM,QAAQ,GAAG,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,IAAI,OAAO,CAAC;QAC/C,MAAM,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;QAChC,MAAM,IAAI,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACpD,OAAO;YACL,GAAG,IAAI;YACP,SAAS,EAAE,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO;YACjD,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;YACzB,YAAY,EAAE,QAAQ;YACtB,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC,GAAG,QAAQ,IAAI,MAAM,EAAE,CAAC,CAAC,CAAC,IAAI;YACnD,MAAM,EAAE,SAAS;SAClB,CAAC;IACJ,CAAC;IAED,sFAAsF;IACtF,uFAAuF;IACvF,IAAI,KAAK,KAAK,iCAAiC,EAAE,CAAC;QAChD,OAAO;YACL,GAAG,IAAI;YACP,SAAS,EAAE,QAAQ;YACnB,YAAY,EAAE,MAAM;YACpB,UAAU,EAAE,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;YAC5B,MAAM,EAAE,SAAS;YACjB,KAAK,EAAE,EAAE,YAAY,EAAE,CAAC,CAAC,cAAc,CAAC,IAAI,IAAI,EAAE;SACnD,CAAC;IACJ,CAAC;IAED,gFAAgF;IAChF,IAAI,KAAK,KAAK,0BAA0B,IAAI,KAAK,KAAK,+BAA+B,EAAE,CAAC;QACtF,MAAM,QAAQ,GAAG,KAAK,KAAK,0BAA0B,CAAC;QACtD,MAAM,OAAO,GAAG,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;QACpE,MAAM,QAAQ,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QAChC,OAAO;YACL,GAAG,IAAI;YACP,SAAS,EAAE,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ;YACxC,OAAO;YACP,YAAY,EAAE,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM;YAC3C,UAAU,EAAE,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;SAC9D,CAAC;IACJ,CAAC;IAED,uEAAuE;IACvE,IAAI,KAAK,KAAK,mBAAmB,IAAI,KAAK,KAAK,qBAAqB,EAAE,CAAC;QACrE,OAAO;YACL,GAAG,IAAI;YACP,SAAS,EAAE,QAAQ;YACnB,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;YAC5B,YAAY,EAAE,QAAQ;YACtB,UAAU,EAAE,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;SAChC,CAAC;IACJ,CAAC;IAED,gFAAgF;IAChF,mEAAmE;IACnE,IAAI,KAAK,KAAK,2BAA2B,IAAI,KAAK,KAAK,2BAA2B,EAAE,CAAC;QACnF,MAAM,QAAQ,GAAG,KAAK,KAAK,2BAA2B,CAAC;QACvD,OAAO;YACL,GAAG,IAAI;YACP,SAAS,EAAE,OAAO;YAClB,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;YAC1B,YAAY,EAAE,MAAM;YACpB,UAAU,EAAE,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;YAC5B,MAAM,EAAE,EAAE,QAAQ,EAAE,CAAC,QAAQ,EAAE;YAC/B,KAAK,EAAE,EAAE,QAAQ,EAAE;SACpB,CAAC;IACJ,CAAC;IAED,2DAA2D;IAC3D,qFAAqF;IACrF,IAAI,KAAK,KAAK,qBAAqB,IAAI,KAAK,KAAK,oBAAoB,EAAE,CAAC;QACtE,MAAM,YAAY,GAAG,sCAAsC,CAAC;QAC5D,MAAM,OAAO,GAAG,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;QAClC,OAAO;YACL,GAAG,IAAI;YACP,SAAS,EAAE,OAAO,KAAK,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO;YACxD,OAAO;YACP,YAAY,EAAE,QAAQ;YACtB,UAAU,EAAE,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;YAC9B,KAAK,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,QAAQ,CAAC,EAAE;SACpD,CAAC;IACJ,CAAC;IAED,0CAA0C;IAC1C,IAAI,KAAK,KAAK,mBAAmB,EAAE,CAAC;QAClC,OAAO;YACL,GAAG,IAAI;YACP,SAAS,EAAE,OAAO;YAClB,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;YAC1B,YAAY,EAAE,UAAU;YACxB,UAAU,EAAE,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;YAC5B,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI;SAChD,CAAC;IACJ,CAAC;IACD,oFAAoF;IACpF,mFAAmF;IACnF,IACE,KAAK,KAAK,cAAc;QACxB,KAAK,KAAK,0BAA0B;QACpC,KAAK,KAAK,6BAA6B;QACvC,KAAK,KAAK,0BAA0B,EACpC,CAAC;QACD,MAAM,MAAM,GACV,KAAK,KAAK,cAAc;YACtB,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,gBAAgB,CAAC,IAAI,IAAI,EAAE;YACzC,CAAC,CAAC,KAAK,KAAK,0BAA0B;gBACpC,CAAC,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE;gBACtB,CAAC,CAAC,IAAI,CAAC;QACb,OAAO;YACL,GAAG,IAAI;YACP,SAAS,EAAE,OAAO;YAClB,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;YAC1B,YAAY,EAAE,QAAQ;YACtB,UAAU,EAAE,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;YAC5B,MAAM;YACN,KAAK,EAAE,CAAC;SACT,CAAC;IACJ,CAAC;IAED,gFAAgF;IAChF,gFAAgF;IAChF,IAAI,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAChC,OAAO;YACL,GAAG,IAAI;YACP,SAAS,EAAE,QAAQ;YACnB,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;YACzB,YAAY,EAAE,aAAa;YAC3B,UAAU,EAAE,GAAG,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC;YACnC,KAAK,EAAE,CAAC;SACT,CAAC;IACJ,CAAC;IAED,IAAI,OAAO,CAAC,CAAC,QAAQ,CAAC,KAAK,QAAQ,EAAE,CAAC;QACpC,OAAO,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC;IAChE,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,iBAAiB,GAAsB;IAC3C,0BAA0B;IAC1B,qBAAqB;IACrB,4BAA4B;IAC5B,iCAAiC;IACjC,wBAAwB;IACxB,sBAAsB;IACtB,sBAAsB;IACtB,uBAAuB;IACvB,yBAAyB;IACzB,yBAAyB;IACzB,0BAA0B;IAC1B,2BAA2B;IAC3B,2BAA2B;IAC3B,0BAA0B;IAC1B,+BAA+B;IAC/B,mCAAmC;IACnC,0BAA0B;IAC1B,6BAA6B;IAC7B,6BAA6B;IAC7B,4BAA4B;IAC5B,4BAA4B;IAC5B,0BAA0B;IAC1B,sBAAsB;IACtB,oBAAoB;IACpB,4EAA4E;IAC5E,oFAAoF;IACpF,mBAAmB;IACnB,qBAAqB;IACrB,2BAA2B;IAC3B,0BAA0B;IAC1B,cAAc;IACd,0BAA0B;IAC1B,6BAA6B;IAC7B,0BAA0B;IAC1B,4BAA4B;IAC5B,wBAAwB;IACxB,0BAA0B;IAC1B,kCAAkC;IAClC,2BAA2B;IAC3B,oBAAoB;IACpB,yBAAyB;IACzB,kBAAkB;IAClB,kBAAkB;IAClB,kBAAkB;IAClB,8BAA8B;IAC9B,mBAAmB;IACnB,kBAAkB;IAClB,qBAAqB;IACrB,oBAAoB;IACpB,mBAAmB;CACX,CAAC;AAEX,eAAe,YAAY,CAAC;IAC1B,EAAE,EAAE,OAAO;IACX,QAAQ,CAAC,GAAG;QACV,kFAAkF;QAClF,2EAA2E;QAC3E,IAAI,MAAM,GAAwB,IAAI,CAAC;QAEvC,GAAG,CAAC,aAAa,CAAC,YAAY,EAAE,CAAC,CAAC,EAAE,EAAE;YACpC,MAAM,GAAG,GAAG,IAAI,YAAY,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC;YAC/D,OAAO;gBACL,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC;aAC3D,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,KAAK,MAAM,KAAK,IAAI,iBAAiB,EAAE,CAAC;YACtC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC,OAAO,EAAE,EAAE;gBAC/B,IAAI,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;oBAAE,OAAO;gBAC1C,KAAK,MAAM,CAAC,MAAM,CAAC,gBAAgB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC;YACvD,CAAC,CAAC,CAAC;QACL,CAAC;QAED,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE;YAC7B,MAAM,GAAG,GAAG,IAAI,YAAY,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC;YAC/D,MAAM,GAAG,GAAG,CAAC;YACb,OAAO,iBAAiB,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC;QACpD,CAAC,CAAC,CAAC;IACL,CAAC;CACF,CAAC,CAAC"}

package/dist/audit/router/index.d.ts

@@ -0,0 +1,65 @@
+import { AdminGuard, type OssContext } from '@openora/core/server';
+import { AuditService } from '../service/audit.service.js';
+export declare function createAuditRouter(svc: AuditService, adminGuard: AdminGuard): {
+    list: import("@orpc/server").Procedure<import("@orpc/server").MergedInitialContext<OssContext & Record<never, never>, OssContext & Record<never, never>, OssContext>, OssContext, import("zod").ZodObject<{
+        page: import("zod").ZodDefault<import("zod").ZodCoercedNumber<unknown>>;
+        limit: import("zod").ZodDefault<import("zod").ZodCoercedNumber<unknown>>;
+        actorId: import("zod").ZodOptional<import("zod").ZodString>;
+        actorType: import("zod").ZodOptional<import("zod").ZodEnum<{
+            system: "system";
+            admin: "admin";
+            player: "player";
+        }>>;
+        action: import("zod").ZodOptional<import("zod").ZodString>;
+        actionPrefix: import("zod").ZodOptional<import("zod").ZodString>;
+        resourceType: import("zod").ZodOptional<import("zod").ZodString>;
+        resourceId: import("zod").ZodOptional<import("zod").ZodString>;
+        q: import("zod").ZodOptional<import("zod").ZodString>;
+        fromDate: import("zod").ZodOptional<import("zod").ZodString>;
+        toDate: import("zod").ZodOptional<import("zod").ZodString>;
+    }, import("zod/v4/core").$strip>, import("zod").ZodObject<{
+        items: import("zod").ZodArray<import("zod").ZodObject<{
+            id: import("zod").ZodUUID;
+            actorId: import("zod").ZodNullable<import("zod").ZodString>;
+            actorType: import("zod").ZodEnum<{
+                system: "system";
+                admin: "admin";
+                player: "player";
+            }>;
+            action: import("zod").ZodString;
+            resourceType: import("zod").ZodString;
+            resourceId: import("zod").ZodNullable<import("zod").ZodString>;
+            before: import("zod").ZodNullable<import("zod").ZodUnion<readonly [import("zod").ZodRecord<import("zod").ZodString, import("zod").ZodUnknown>, import("zod").ZodArray<import("zod").ZodUnknown>]>>;
+            after: import("zod").ZodNullable<import("zod").ZodUnion<readonly [import("zod").ZodRecord<import("zod").ZodString, import("zod").ZodUnknown>, import("zod").ZodArray<import("zod").ZodUnknown>]>>;
+            ip: import("zod").ZodNullable<import("zod").ZodString>;
+            userAgent: import("zod").ZodNullable<import("zod").ZodString>;
+            correlationId: import("zod").ZodNullable<import("zod").ZodString>;
+            result: import("zod").ZodNullable<import("zod").ZodString>;
+            seq: import("zod").ZodNumber;
+            prevHash: import("zod").ZodNullable<import("zod").ZodString>;
+            hash: import("zod").ZodString;
+            createdAt: import("zod").ZodISODateTime;
+        }, import("zod/v4/core").$strip>>;
+        total: import("zod").ZodNumber;
+        page: import("zod").ZodNumber;
+        limit: import("zod").ZodNumber;
+    }, import("zod/v4/core").$strip>, import("@orpc/server").MergedErrorMap<Record<never, never>, Record<never, never>>, Record<never, never>>;
+    exportCsv: import("@orpc/server").Procedure<import("@orpc/server").MergedInitialContext<OssContext & Record<never, never>, OssContext & Record<never, never>, OssContext>, OssContext, import("zod").ZodObject<{
+        actorId: import("zod").ZodOptional<import("zod").ZodString>;
+        action: import("zod").ZodOptional<import("zod").ZodString>;
+        actorType: import("zod").ZodOptional<import("zod").ZodEnum<{
+            system: "system";
+            admin: "admin";
+            player: "player";
+        }>>;
+        resourceType: import("zod").ZodOptional<import("zod").ZodString>;
+        resourceId: import("zod").ZodOptional<import("zod").ZodString>;
+        actionPrefix: import("zod").ZodOptional<import("zod").ZodString>;
+        q: import("zod").ZodOptional<import("zod").ZodString>;
+        fromDate: import("zod").ZodOptional<import("zod").ZodString>;
+        toDate: import("zod").ZodOptional<import("zod").ZodString>;
+    }, import("zod/v4/core").$strip>, import("zod").ZodObject<{
+        csv: import("zod").ZodString;
+    }, import("zod/v4/core").$strip>, import("@orpc/server").MergedErrorMap<Record<never, never>, Record<never, never>>, Record<never, never>>;
+};
+//# sourceMappingURL=index.d.ts.map

package/dist/audit/router/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/audit/router/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAwB,KAAK,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAEzF,OAAO,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAE3D,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,YAAY,EAAE,UAAU,EAAE,UAAU;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA8B1E"}

package/dist/audit/router/index.js

@@ -0,0 +1,32 @@
+import { implement } from '@orpc/server';
+import { getUserId, mapErrors } from '@openora/core/server';
+import { auditContract } from '../contract/index.js';
+export function createAuditRouter(svc, adminGuard) {
+    const os = implement(auditContract).$context();
+    return os.router({
+        list: os.list.handler(async ({ input, context }) => {
+            await adminGuard.assert(context, 'audit', 'view');
+            return mapErrors({}, () => svc.list(input));
+        }),
+        exportCsv: os.exportCsv.handler(async ({ input, context }) => {
+            await adminGuard.assert(context, 'audit', 'export');
+            const csv = await svc.exportCsv(input);
+            // Record AFTER producing the CSV so an export failure is not logged as a success.
+            const ip = context.request.headers['x-forwarded-for']?.split(',')[0]?.trim() ??
+                null;
+            const userAgent = context.request.headers['user-agent'] ?? null;
+            await svc.record({
+                actorId: getUserId(context),
+                actorType: 'admin',
+                action: 'audit.export',
+                resourceType: 'audit',
+                after: { filters: input },
+                ip,
+                userAgent,
+                result: 'success',
+            });
+            return { csv };
+        }),
+    });
+}
+//# sourceMappingURL=index.js.map

package/dist/audit/router/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/audit/router/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,OAAO,EAAc,SAAS,EAAE,SAAS,EAAmB,MAAM,sBAAsB,CAAC;AACzF,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAGrD,MAAM,UAAU,iBAAiB,CAAC,GAAiB,EAAE,UAAsB;IACzE,MAAM,EAAE,GAAG,SAAS,CAAC,aAAa,CAAC,CAAC,QAAQ,EAAc,CAAC;IAE3D,OAAO,EAAE,CAAC,MAAM,CAAC;QACf,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE;YACjD,MAAM,UAAU,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;YAClD,OAAO,SAAS,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;QAC9C,CAAC,CAAC;QAEF,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE;YAC3D,MAAM,UAAU,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;YACpD,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;YACvC,kFAAkF;YAClF,MAAM,EAAE,GACL,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,iBAAiB,CAAwB,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE;gBACzF,IAAI,CAAC;YACP,MAAM,SAAS,GAAI,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,YAAY,CAAwB,IAAI,IAAI,CAAC;YACxF,MAAM,GAAG,CAAC,MAAM,CAAC;gBACf,OAAO,EAAE,SAAS,CAAC,OAAO,CAAC;gBAC3B,SAAS,EAAE,OAAO;gBAClB,MAAM,EAAE,cAAc;gBACtB,YAAY,EAAE,OAAO;gBACrB,KAAK,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE;gBACzB,EAAE;gBACF,SAAS;gBACT,MAAM,EAAE,SAAS;aAClB,CAAC,CAAC;YACH,OAAO,EAAE,GAAG,EAAE,CAAC;QACjB,CAAC,CAAC;KACH,CAAC,CAAC;AACL,CAAC"}