@orthacms/activity-server 0.0.0-reserve.0

package/dist/lib/activity/infrastructure/audit-event-mapping.js

@@ -0,0 +1,402 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AUDITED_EVENT_KINDS = exports.UnmappableAuditEventError = void 0;
+exports.toAuditRow = toAuditRow;
+const identity_server_1 = require("@orthacms/identity-server");
+/**
+ * The **user.\*** audit kinds owned by the users context
+ * (`USER_ACTIVITY_KINDS` in `@orthacms/users-server`). Duplicated here as
+ * literals rather than imported, so the audit sink stays decoupled from every
+ * producer (activity depends on identity only); the parity unit test pins these
+ * strings against the exact rows the old in-band recorder wrote.
+ */
+const USER_AUDIT_KINDS = {
+    INVITED: 'user.invited',
+    INVITE_RESENT: 'user.invite_resent',
+    /**
+     * An admin minted a one-time password-reset link for a member. Recorded at
+     * **issue** time, not at redemption: handing someone a link that can take
+     * over an account is an administrative act in its own right, and it needs
+     * to be attributed to the admin who performed it even if the link is never
+     * used. The redemption shows up separately as `user.password_changed`,
+     * actored by the account holder.
+     */
+    PASSWORD_RESET_ISSUED: 'user.password_reset_issued',
+    INVITE_REVOKED: 'user.invite_revoked',
+    PROFILE_UPDATED: 'user.profile_updated',
+    ROLE_CHANGED: 'user.role_changed',
+    SUSPENDED: 'user.suspended',
+    REACTIVATED: 'user.reactivated',
+    /**
+     * A credential rotation. Unlike the kinds above this one has no in-band
+     * predecessor to stay bug-compatible with — `user.password_changed` was
+     * raised on the outbox by identity's aggregate but nothing mapped it, so
+     * the log recorded nothing at all when a password changed
+     * (BUG-identity-server-05).
+     */
+    PASSWORD_CHANGED: 'user.password_changed',
+    /**
+     * An invited account accepted its invite: set a first credential and went
+     * `pending` → `active`. Identity's aggregate has raised `user.activated`
+     * since the invite flow landed and `accept-invite.use-case.ts` appends it,
+     * but nothing mapped it — so the trail showed the invite, then a sign-in,
+     * and never the moment the account became usable. Verified against a live
+     * stack under ORT-42: one `POST /auth/invite/accept` appended both
+     * `user.activated` and `auth.signed_in`, both were stamped dispatched, and
+     * only the sign-in produced a row.
+     */
+    ACTIVATED: 'user.activated'
+};
+/**
+ * The **media.\*** audit kinds. Media's aggregates have raised these on the
+ * outbox since the asset/folder aggregates were introduced — their own comment
+ * calls the outbox "the post-commit audit + blob-GC seam" — but nothing
+ * consumed them, so **every** media write was unaudited: uploading, renaming,
+ * re-foldering, duplicating and deleting an asset, and creating, renaming and
+ * deleting a folder, all left the log completely silent. Verified live under
+ * ORT-42 (eight write paths, eight dispatched outbox rows, zero audit rows).
+ *
+ * The event kind is the audit kind: unlike `member.*` → `user.*` there is no
+ * pre-existing audit catalogue for media to stay bug-compatible with, so
+ * inventing a second set of names would only add a mapping to remember.
+ */
+const MEDIA_AUDIT_KINDS = {
+    ASSET_UPLOADED: 'media.asset.uploaded',
+    ASSET_UPDATED: 'media.asset.updated',
+    ASSET_MOVED: 'media.asset.moved',
+    ASSET_DELETED: 'media.asset.deleted',
+    FOLDER_CREATED: 'media.folder.created',
+    FOLDER_RENAMED: 'media.folder.renamed',
+    FOLDER_DELETED: 'media.folder.deleted'
+};
+/** Reads a payload field as a string (or `null` when absent/nullish). */
+function nullableString(value) {
+    return typeof value === 'string' ? value : null;
+}
+/** A `'user'`-subject facet whose subject is the event's aggregate. */
+function userSubject(event, kind, meta) {
+    return { kind, subjectType: 'user', subjectId: event.aggregateId, meta };
+}
+/** A `'workspace'`-subject facet whose subject is the event's aggregate. */
+function workspaceSubject(event, meta) {
+    // Workspace audit kinds are identical strings to their event kinds
+    // (identity owns them via IDENTITY_ACTIVITY_KINDS), so the event kind is the
+    // audit kind.
+    return {
+        kind: event.kind,
+        subjectType: 'workspace',
+        subjectId: event.aggregateId,
+        meta
+    };
+}
+/**
+ * A `'content_entry'`-subject facet. The audit kind mirrors the event kind
+ * (`entry.created`, `entry.published`, `entry.deleted`, …), and the entry's
+ * content type rides in `meta` so the log can name *what* happened to without
+ * joining anything.
+ *
+ * `extra` carries the few facts one kind has and the others do not — the
+ * changed `fields` on an update, and whether a delete was a recoverable
+ * tombstone (`soft`) or the row leaving the table. Everything else about an
+ * entry event is the same shape, which is why one mapper serves all seven.
+ */
+function entrySubject(event, extra = {}) {
+    return {
+        kind: event.kind,
+        subjectType: 'content_entry',
+        subjectId: event.aggregateId,
+        meta: {
+            contentType: nullableString(event.payload.contentType),
+            ...extra
+        }
+    };
+}
+/**
+ * An `'api_token'`-subject facet. The subject is the token, and the acting
+ * admin arrives separately as the actor.
+ *
+ * `meta` records what a reviewer needs to reason about the credential — its
+ * label, its scope, its workspace bucket, and the non-secret `lookupPrefix`
+ * that identifies it in the admin list. It deliberately carries **neither the
+ * plaintext nor the hash**: `api_tokens` stores only a SHA-256 precisely so a
+ * read of another table yields nothing usable, and the audit log is another
+ * table.
+ */
+function apiTokenSubject(event, auditKind) {
+    const payload = event.payload;
+    return {
+        kind: auditKind,
+        subjectType: 'api_token',
+        subjectId: event.aggregateId,
+        meta: {
+            name: nullableString(payload.name),
+            scope: nullableString(payload.scope),
+            workspaceIds: payload.workspaceIds ?? [],
+            lookupPrefix: nullableString(payload.lookupPrefix)
+        }
+    };
+}
+/**
+ * Thrown when an event cannot be mapped to a row that identifies its subject.
+ *
+ * Refusing is the point. `subject_id` is the **only** handle an audit row keeps
+ * on the entity it is about — there is no FK, no denormalised name, and
+ * `actor_email` belongs to the actor — so a row written with an empty subject
+ * is not a degraded record, it is an unreadable one, and nothing downstream can
+ * repair it. Throwing leaves the outbox row undispatched, so the dispatcher
+ * retries it with backoff and parks it at `MAX_DELIVERY_ATTEMPTS` where the
+ * dead-letter query (`dispatched_at IS NULL AND attempts >= 15`) surfaces it.
+ * The gap becomes loud instead of becoming a row nobody can read.
+ */
+class UnmappableAuditEventError extends Error {
+    constructor(event, reason) {
+        super(`Cannot map ${event.kind} (event ${event.eventId}) to an audit row: ${reason}`);
+        this.name = 'UnmappableAuditEventError';
+    }
+}
+exports.UnmappableAuditEventError = UnmappableAuditEventError;
+/**
+ * A workspace membership facet — subject is the affected **user**, not the
+ * workspace.
+ *
+ * A payload with no `userId` is refused rather than defaulted. It used to write
+ * `subjectId: '' `, which inserts cleanly against `subject_id text NOT NULL`
+ * and produces a row naming an action, a workspace and an actor but no subject
+ * — silent corruption of the trail, and (as ♿ A11Y-activity-server-01 records)
+ * a row whose Subject cell has no accessible name that no client can repair.
+ */
+function membershipSubject(event, auditKind) {
+    const payload = event.payload;
+    const userId = nullableString(payload.userId);
+    if (!userId) {
+        throw new UnmappableAuditEventError(event, 'payload.userId is missing, and the membership subject is the affected user');
+    }
+    return {
+        kind: auditKind,
+        subjectType: 'user',
+        subjectId: userId,
+        meta: {
+            workspaceId: event.aggregateId,
+            email: nullableString(payload.email)
+        }
+    };
+}
+/**
+ * A `'media_asset'`-subject facet. `meta` passes the event payload's own
+ * descriptive fields through — media's payloads differ per kind (`name`/`kind`
+ * on upload, the changed field on update, `folderId` on move, the storage key
+ * on delete) and each is exactly what a reviewer asking "what happened to this
+ * asset" wants, so the facet forwards the payload minus the actor rather than
+ * flattening every kind into one shape.
+ */
+function mediaAssetSubject(event) {
+    return {
+        kind: event.kind,
+        subjectType: 'media_asset',
+        subjectId: event.aggregateId,
+        meta: payloadWithoutActor(event)
+    };
+}
+/** A `'media_folder'`-subject facet. Same payload-passthrough as the asset one. */
+function mediaFolderSubject(event) {
+    return {
+        kind: event.kind,
+        subjectType: 'media_folder',
+        subjectId: event.aggregateId,
+        meta: payloadWithoutActor(event)
+    };
+}
+/**
+ * The event payload with `attachActor`'s `actor` key removed — the actor is
+ * lifted onto the row's own `actorId`/`actorEmail` columns by
+ * {@link toAuditRow}, so repeating it inside `meta` would only duplicate it.
+ */
+function payloadWithoutActor(event) {
+    const { actor: _actor, ...rest } = event.payload;
+    return rest;
+}
+/**
+ * The event-kind → audit-facet table. Each entry reproduces **exactly** the row
+ * the old in-band `recorder.record(...)` wrote for that action:
+ *
+ * | domain event               | audit kind                | subject / meta                                   |
+ * | -------------------------- | ------------------------- | ------------------------------------------------ |
+ * | `workspace.created`        | `workspace.created`       | workspace / `{ name, slug }`                      |
+ * | `workspace.updated`        | `workspace.updated`       | workspace / `{ fields }`                          |
+ * | `workspace.archived`       | `workspace.archived`      | workspace / `{}`                                  |
+ * | `workspace.unarchived`     | `workspace.unarchived`    | workspace / `{}`                                  |
+ * | `workspace.deleted`        | `workspace.deleted`       | workspace / `{ name, slug }`                      |
+ * | `workspace.member_added`   | `workspace.member_added`  | **user** / `{ workspaceId, email }`              |
+ * | `workspace.member_removed` | `workspace.member_removed`| **user** / `{ workspaceId, email }`              |
+ * | `workspace.content_granted`| `workspace.content_granted`| workspace / `{ slug, kind }`                     |
+ * | `workspace.content_revoked`| `workspace.content_revoked`| workspace / `{ slug }`                           |
+ * | `member.invited`           | `user.invited`            | user / `{ email }`                               |
+ * | `member.invite_resent`     | `user.invite_resent`      | user / `{ email }`                               |
+ * | `member.password_reset_issued` | `user.password_reset_issued` | user / `{ email }`                     |
+ * | `member.removed`           | `user.invite_revoked`     | user / `{ email }`                               |
+ * | `member.profile_updated`   | `user.profile_updated`    | user / `{ name: { from, to } }`                  |
+ * | `member.role_changed`      | `user.role_changed`       | user / `{ from, to }`                            |
+ * | `member.disabled`          | `user.suspended`          | user / `null`                                    |
+ * | `member.reactivated`       | `user.reactivated`        | user / `null`                                    |
+ * | `user.password_changed`    | `user.password_changed`   | user / `{ sessionsRevoked }`                     |
+ * | `user.activated`           | `user.activated`          | user / `null`                                    |
+ * | `api_token.created`        | `token.created`           | api_token / `{ name, scope, workspaceIds, lookupPrefix }` |
+ * | `api_token.revoked`        | `token.revoked`           | api_token / same shape                           |
+ * | `auth.signed_in`           | `user.signed_in`          | user / `null`                                    |
+ * | `auth.signed_out`          | `user.signed_out`         | user / `null`                                    |
+ * | `entry.created`            | `entry.created`           | content_entry / `{ contentType }`                |
+ * | `entry.updated`            | `entry.updated`           | content_entry / `{ contentType, fields }`        |
+ * | `entry.published`          | `entry.published`         | content_entry / `{ contentType }`                |
+ * | `entry.unpublished`        | `entry.unpublished`       | content_entry / `{ contentType }`                |
+ * | `entry.deleted`            | `entry.deleted`           | content_entry / `{ contentType, soft }`          |
+ * | `entry.restored`           | `entry.restored`          | content_entry / `{ contentType }`                |
+ * | `entry.purged`             | `entry.purged`            | content_entry / `{ contentType }`                |
+ * | `media.asset.uploaded`     | `media.asset.uploaded`    | media_asset / payload minus `actor`              |
+ * | `media.asset.updated`      | `media.asset.updated`     | media_asset / payload minus `actor`              |
+ * | `media.asset.moved`        | `media.asset.moved`       | media_asset / payload minus `actor`              |
+ * | `media.asset.deleted`      | `media.asset.deleted`     | media_asset / payload minus `actor`              |
+ * | `media.folder.created`     | `media.folder.created`    | media_folder / payload minus `actor`             |
+ * | `media.folder.renamed`     | `media.folder.renamed`    | media_folder / payload minus `actor`             |
+ * | `media.folder.deleted`     | `media.folder.deleted`    | media_folder / payload minus `actor`             |
+ *
+ * The actor (`actorId`/`actorEmail`) is not here — it rides on the event payload
+ * (`attachActor`) and is read uniformly by {@link toAuditRow}.
+ */
+const FACET_MAPPERS = {
+    'workspace.created': (e) => workspaceSubject(e, {
+        name: nullableString(e.payload.name),
+        slug: nullableString(e.payload.slug)
+    }),
+    'workspace.updated': (e) => workspaceSubject(e, { fields: e.payload.fields ?? [] }),
+    'workspace.archived': (e) => workspaceSubject(e, {}),
+    'workspace.unarchived': (e) => workspaceSubject(e, {}),
+    'workspace.deleted': (e) => workspaceSubject(e, {
+        name: nullableString(e.payload.name),
+        slug: nullableString(e.payload.slug)
+    }),
+    'workspace.member_added': (e) => membershipSubject(e, identity_server_1.IDENTITY_ACTIVITY_KINDS.WORKSPACE_MEMBER_ADDED),
+    'workspace.member_removed': (e) => membershipSubject(e, identity_server_1.IDENTITY_ACTIVITY_KINDS.WORKSPACE_MEMBER_REMOVED),
+    'workspace.content_granted': (e) => workspaceSubject(e, {
+        slug: nullableString(e.payload.slug),
+        kind: nullableString(e.payload.kind)
+    }),
+    'workspace.content_revoked': (e) => workspaceSubject(e, { slug: nullableString(e.payload.slug) }),
+    'member.invited': (e) => userSubject(e, USER_AUDIT_KINDS.INVITED, {
+        email: nullableString(e.payload.email)
+    }),
+    'member.invite_resent': (e) => userSubject(e, USER_AUDIT_KINDS.INVITE_RESENT, {
+        email: nullableString(e.payload.email)
+    }),
+    'member.password_reset_issued': (e) => userSubject(e, USER_AUDIT_KINDS.PASSWORD_RESET_ISSUED, {
+        email: nullableString(e.payload.email)
+    }),
+    'member.removed': (e) => userSubject(e, USER_AUDIT_KINDS.INVITE_REVOKED, {
+        email: nullableString(e.payload.email)
+    }),
+    'member.profile_updated': (e) => userSubject(e, USER_AUDIT_KINDS.PROFILE_UPDATED, {
+        name: e.payload.name ?? null
+    }),
+    'member.role_changed': (e) => userSubject(e, USER_AUDIT_KINDS.ROLE_CHANGED, {
+        from: nullableString(e.payload.from),
+        to: nullableString(e.payload.to)
+    }),
+    'member.disabled': (e) => userSubject(e, USER_AUDIT_KINDS.SUSPENDED, null),
+    'member.reactivated': (e) => userSubject(e, USER_AUDIT_KINDS.REACTIVATED, null),
+    // Credential rotation. The kind is passed straight through (identity's
+    // event kind and the audit kind are the same string), and `meta` records
+    // how many live sessions the change evicted — the number a security review
+    // actually wants: "the password changed AND N devices were signed out".
+    'user.password_changed': (e) => userSubject(e, USER_AUDIT_KINDS.PASSWORD_CHANGED, {
+        sessionsRevoked: e.payload.sessionsRevoked ?? null
+    }),
+    // Invite acceptance. `accept-invite.use-case.ts` appends this alongside
+    // `auth.signed_in`, and only the sign-in was ever mapped — so the trail
+    // recorded that an invited person signed in, but never that the account
+    // itself went from `pending` to `active` and gained a credential. Those are
+    // different facts and a security review wants the first one.
+    'user.activated': (e) => userSubject(e, USER_AUDIT_KINDS.ACTIVATED, null),
+    'auth.signed_in': (e) => userSubject(e, identity_server_1.IDENTITY_ACTIVITY_KINDS.USER_SIGNED_IN, null),
+    'auth.signed_out': (e) => userSubject(e, identity_server_1.IDENTITY_ACTIVITY_KINDS.USER_SIGNED_OUT, null),
+    // External-API bearer tokens. Nothing mapped these before, so minting and
+    // revoking a long-lived key to workspace content left the log completely
+    // silent (BUG-identity-server-01) — the audit trail could not answer "who
+    // issued this credential, when, and scoped to what".
+    'api_token.created': (e) => apiTokenSubject(e, identity_server_1.IDENTITY_ACTIVITY_KINDS.TOKEN_CREATED),
+    'api_token.revoked': (e) => apiTokenSubject(e, identity_server_1.IDENTITY_ACTIVITY_KINDS.TOKEN_REVOKED),
+    // Content publish lifecycle. `content-server` has raised these on the outbox
+    // since the entry aggregate was introduced — its own comment anticipated
+    // this subscriber — but nothing consumed them, so the log carried no content
+    // activity at all.
+    'entry.published': entrySubject,
+    'entry.unpublished': entrySubject,
+    // …and the ordinary editing lifecycle, which raised nothing at all until
+    // the entry writes moved onto the unit of work. Publishing was the only
+    // content action the log could answer for, so an editor could create,
+    // rewrite and delete every entry in the product and it stayed silent about
+    // the single most frequent action in a CMS.
+    'entry.created': (e) => entrySubject(e),
+    // `fields` names what actually changed — the `workspace.updated` shape, and
+    // what makes the row a review rather than a bare "someone saved this".
+    'entry.updated': (e) => entrySubject(e, { fields: e.payload.fields ?? [] }),
+    // `soft` is the difference between a tombstone the trash can restore and a
+    // row that left the table when this committed.
+    'entry.deleted': (e) => entrySubject(e, { soft: e.payload.soft === true }),
+    'entry.restored': (e) => entrySubject(e),
+    // The one content action with nothing left behind to inspect afterwards,
+    // and therefore the one this row is the only remaining record of.
+    'entry.purged': (e) => entrySubject(e),
+    // The media library. Every one of these was raised on the outbox and
+    // dropped on the floor: the dispatcher found no subscriber for the kind,
+    // stamped the row dispatched, and the audit log stayed silent about every
+    // upload, rename, move and deletion in the asset store.
+    [MEDIA_AUDIT_KINDS.ASSET_UPLOADED]: mediaAssetSubject,
+    [MEDIA_AUDIT_KINDS.ASSET_UPDATED]: mediaAssetSubject,
+    [MEDIA_AUDIT_KINDS.ASSET_MOVED]: mediaAssetSubject,
+    [MEDIA_AUDIT_KINDS.ASSET_DELETED]: mediaAssetSubject,
+    [MEDIA_AUDIT_KINDS.FOLDER_CREATED]: mediaFolderSubject,
+    [MEDIA_AUDIT_KINDS.FOLDER_RENAMED]: mediaFolderSubject,
+    [MEDIA_AUDIT_KINDS.FOLDER_DELETED]: mediaFolderSubject
+};
+/**
+ * Every event kind the activity subscriber audits — the dispatcher delivers
+ * only these to it.
+ */
+exports.AUDITED_EVENT_KINDS = Object.keys(FACET_MAPPERS);
+/** Reads the acting user off the event payload (`attachActor`'s `actor` key). */
+function readActor(payload) {
+    const actor = payload.actor;
+    return {
+        id: nullableString(actor?.id),
+        email: nullableString(actor?.email)
+    };
+}
+/**
+ * Maps a domain event to the audit row it should produce, or `null` when the
+ * kind is not audited. Pure and DB-free — the safety-net unit test asserts each
+ * kind's row equals what the old in-band recorder wrote.
+ *
+ * Throws {@link UnmappableAuditEventError} when the kind **is** audited but the
+ * payload cannot identify its subject. `null` and a throw mean different things
+ * on purpose: `null` is "not our event, skip it" and the dispatcher marks the
+ * row delivered; a throw is "this should have been audited and cannot be", so
+ * the row stays undispatched, is retried with backoff, and finally parks as a
+ * dead letter rather than becoming a row nobody can read.
+ */
+function toAuditRow(event) {
+    const mapper = FACET_MAPPERS[event.kind];
+    if (!mapper) {
+        return null;
+    }
+    const facet = mapper(event);
+    const actor = readActor(event.payload);
+    return {
+        id: event.eventId,
+        kind: facet.kind,
+        subjectType: facet.subjectType,
+        subjectId: facet.subjectId,
+        actorId: actor.id,
+        actorEmail: actor.email,
+        meta: facet.meta,
+        at: event.occurredAt
+    };
+}

package/dist/lib/activity/infrastructure/audit-event.subscriber.d.ts

@@ -0,0 +1,29 @@
+import { type OnApplicationBootstrap } from '@nestjs/common';
+import { OutboxDispatcher, type Database, type DomainEvent, type DomainEventSubscriber } from '@orthacms/database';
+/**
+ * The activity log's outbox subscriber — the audit trail's single live writer.
+ * On bootstrap it registers itself with the {@link OutboxDispatcher}, which then
+ * delivers every audited domain event (see {@link AUDITED_EVENT_KINDS}) here;
+ * {@link handle} maps each to the same `activity_events` row the old in-band
+ * `ACTIVITY_RECORDER` wrote.
+ *
+ * **Idempotent** (delivery is at-least-once): the row's primary key is the
+ * source event's id and the insert is `ON CONFLICT DO NOTHING`, so a
+ * re-delivered event never double-records.
+ */
+export declare class AuditEventSubscriber implements DomainEventSubscriber, OnApplicationBootstrap {
+    private readonly db;
+    private readonly dispatcher;
+    /** The audited event kinds — the dispatcher's delivery allow-list. */
+    readonly kinds: readonly string[];
+    constructor(db: Database, dispatcher: OutboxDispatcher);
+    /** Registers with the dispatcher once the app is up. */
+    onApplicationBootstrap(): void;
+    /**
+     * Maps one delivered event to its audit row and appends it. A kind with no
+     * mapping is ignored (defensive — the dispatcher only delivers our
+     * {@link kinds}); the `ON CONFLICT DO NOTHING` keeps redelivery a no-op.
+     */
+    handle(event: DomainEvent): Promise<void>;
+}
+//# sourceMappingURL=audit-event.subscriber.d.ts.map

package/dist/lib/activity/infrastructure/audit-event.subscriber.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-event.subscriber.d.ts","sourceRoot":"","sources":["../../../../src/lib/activity/infrastructure/audit-event.subscriber.ts"],"names":[],"mappings":"AAAA,OAAO,EAAc,KAAK,sBAAsB,EAAE,MAAM,gBAAgB,CAAC;AACzE,OAAO,EAEH,gBAAgB,EAChB,KAAK,QAAQ,EACb,KAAK,WAAW,EAChB,KAAK,qBAAqB,EAC7B,MAAM,oBAAoB,CAAC;AAI5B;;;;;;;;;;GAUG;AACH,qBACa,oBACT,YAAW,qBAAqB,EAAE,sBAAsB;IAMlC,OAAO,CAAC,QAAQ,CAAC,EAAE;IACrC,OAAO,CAAC,QAAQ,CAAC,UAAU;IAL/B,sEAAsE;IACtE,QAAQ,CAAC,KAAK,oBAAuB;gBAGE,EAAE,EAAE,QAAQ,EAC9B,UAAU,EAAE,gBAAgB;IAGjD,wDAAwD;IACxD,sBAAsB,IAAI,IAAI;IAI9B;;;;OAIG;IACG,MAAM,CAAC,KAAK,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC;CAUlD"}

package/dist/lib/activity/infrastructure/audit-event.subscriber.js

@@ -0,0 +1,54 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AuditEventSubscriber = void 0;
+const tslib_1 = require("tslib");
+const common_1 = require("@nestjs/common");
+const database_1 = require("@orthacms/database");
+const schema_1 = require("../../schema");
+const audit_event_mapping_1 = require("./audit-event-mapping");
+/**
+ * The activity log's outbox subscriber — the audit trail's single live writer.
+ * On bootstrap it registers itself with the {@link OutboxDispatcher}, which then
+ * delivers every audited domain event (see {@link AUDITED_EVENT_KINDS}) here;
+ * {@link handle} maps each to the same `activity_events` row the old in-band
+ * `ACTIVITY_RECORDER` wrote.
+ *
+ * **Idempotent** (delivery is at-least-once): the row's primary key is the
+ * source event's id and the insert is `ON CONFLICT DO NOTHING`, so a
+ * re-delivered event never double-records.
+ */
+let AuditEventSubscriber = class AuditEventSubscriber {
+    db;
+    dispatcher;
+    /** The audited event kinds — the dispatcher's delivery allow-list. */
+    kinds = audit_event_mapping_1.AUDITED_EVENT_KINDS;
+    constructor(db, dispatcher) {
+        this.db = db;
+        this.dispatcher = dispatcher;
+    }
+    /** Registers with the dispatcher once the app is up. */
+    onApplicationBootstrap() {
+        this.dispatcher.register(this);
+    }
+    /**
+     * Maps one delivered event to its audit row and appends it. A kind with no
+     * mapping is ignored (defensive — the dispatcher only delivers our
+     * {@link kinds}); the `ON CONFLICT DO NOTHING` keeps redelivery a no-op.
+     */
+    async handle(event) {
+        const row = (0, audit_event_mapping_1.toAuditRow)(event);
+        if (!row) {
+            return;
+        }
+        await this.db
+            .insert(schema_1.activityEvents)
+            .values(row)
+            .onConflictDoNothing({ target: schema_1.activityEvents.id });
+    }
+};
+exports.AuditEventSubscriber = AuditEventSubscriber;
+exports.AuditEventSubscriber = AuditEventSubscriber = tslib_1.__decorate([
+    (0, common_1.Injectable)(),
+    tslib_1.__param(0, (0, database_1.InjectDatabase)()),
+    tslib_1.__metadata("design:paramtypes", [Object, database_1.OutboxDispatcher])
+], AuditEventSubscriber);

package/dist/lib/activity/services/activity.service.d.ts

@@ -0,0 +1,55 @@
+import { type Database } from '@orthacms/database';
+import type { ActivityExecutor, ActivityRecorder, ActivityRecordInput } from '@orthacms/identity-server';
+import type { ListActivityQueryDto } from '../dto/list-activity-query.dto';
+import type { ActivityListView } from '../types/activity-view';
+/**
+ * Owns the audit trail: appends events (`record`) and serves the paginated
+ * read API (`list`). Implements {@link ActivityRecorder} so foundational
+ * plugins can record via the `ACTIVITY_RECORDER` token without depending on
+ * this package. Uses the shared Drizzle client directly (no repository
+ * wrapper, by repo convention).
+ */
+export declare class ActivityService implements ActivityRecorder {
+    private readonly db;
+    constructor(db: Database);
+    /**
+     * Appends one audit row. Pass `executor = tx` to record **in-band** with a
+     * mutation, so the audit row commits iff the mutation does; defaults to the
+     * root client. `at` defaults to now; `actorId`/`actorEmail`/`meta` are
+     * nullable.
+     *
+     * @deprecated Wave 3 moved auditing onto the outbox `AuditEventSubscriber`,
+     * the single live writer. This method (and the `ACTIVITY_RECORDER` binding)
+     * is retained only for a stable public surface — no caller writes through it
+     * anymore. Emit a domain event and let the subscriber record it instead.
+     */
+    record(input: ActivityRecordInput, executor?: ActivityExecutor): Promise<void>;
+    /**
+     * One page of events matching the filters, with a stable order: the
+     * whitelisted sort column (default `at desc`) plus an `id` tiebreaker so
+     * paging is deterministic across equal timestamps. `created_at` is never
+     * selected — the immutable write time stays off the wire.
+     */
+    list(query: ListActivityQueryDto): Promise<ActivityListView>;
+    /**
+     * The full `where` for the list: the structured params (`listPredicate`)
+     * AND-ed with the optional query-builder `?filter=` tree. The filter is
+     * parsed and translated against {@link ACTIVITY_FILTER_SCHEMA}; a malformed
+     * filter throws a `FilterException` (HTTP 400). `and(undefined, …)`
+     * collapses cleanly, so an unfiltered list still scans everything.
+     */
+    private listWhere;
+    /**
+     * The structured-param `where` for the list: every supplied filter
+     * intersected (AND). `and(undefined, …)` collapses to no filter, so an
+     * unfiltered list scans everything.
+     */
+    private listPredicate;
+    /**
+     * Case-insensitive substring match on the actor email snapshot, or
+     * `undefined` for no filter. LIKE metacharacters in the needle are escaped
+     * so a literal `%`/`_` search behaves literally.
+     */
+    private actorEmailPredicate;
+}
+//# sourceMappingURL=activity.service.d.ts.map

package/dist/lib/activity/services/activity.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"activity.service.d.ts","sourceRoot":"","sources":["../../../../src/lib/activity/services/activity.service.ts"],"names":[],"mappings":"AAYA,OAAO,EAAkB,KAAK,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAEnE,OAAO,KAAK,EACR,gBAAgB,EAChB,gBAAgB,EAChB,mBAAmB,EACtB,MAAM,2BAA2B,CAAC;AAInC,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,gCAAgC,CAAC;AAC3E,OAAO,KAAK,EAER,gBAAgB,EACnB,MAAM,wBAAwB,CAAC;AAQhC;;;;;;GAMG;AACH,qBACa,eAAgB,YAAW,gBAAgB;IACtB,OAAO,CAAC,QAAQ,CAAC,EAAE;gBAAF,EAAE,EAAE,QAAQ;IAE3D;;;;;;;;;;OAUG;IACG,MAAM,CACR,KAAK,EAAE,mBAAmB,EAC1B,QAAQ,GAAE,gBAA0B,GACrC,OAAO,CAAC,IAAI,CAAC;IAYhB;;;;;OAKG;IACG,IAAI,CAAC,KAAK,EAAE,oBAAoB,GAAG,OAAO,CAAC,gBAAgB,CAAC;IA8ClE;;;;;;OAMG;YACW,SAAS;IAWvB;;;;OAIG;IACH,OAAO,CAAC,aAAa;IAsBrB;;;;OAIG;IACH,OAAO,CAAC,mBAAmB;CAQ9B"}