@orthacms/activity-server 0.3.0 → 0.4.0

package/dist/lib/activity/infrastructure/audit-event-mapping.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"audit-event-mapping.d.ts","sourceRoot":"","sources":["../../../../src/lib/activity/infrastructure/audit-event-mapping.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAGtD;;;;;;GAMG;AACH,MAAM,WAAW,QAAQ;IACrB,uEAAuE;IACvE,EAAE,EAAE,MAAM,CAAC;IACX,6EAA6E;IAC7E,IAAI,EAAE,MAAM,CAAC;IACb,gEAAgE;IAChE,WAAW,EAAE,MAAM,CAAC;IACpB,yCAAyC;IACzC,SAAS,EAAE,MAAM,CAAC;IAClB,gEAAgE;IAChE,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,8CAA8C;IAC9C,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,mEAAmE;IACnE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IACrC,qDAAqD;IACrD,EAAE,EAAE,IAAI,CAAC;CACZ;AAgKD;;;;;;;;;;;GAWG;AACH,qBAAa,yBAA0B,SAAQ,KAAK;gBACpC,KAAK,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM;CAMjD;AA+OD;;;GAGG;AACH,eAAO,MAAM,mBAAmB,EAE3B,SAAS,MAAM,EAAE,CAAC;AAgBvB;;;;;;;;;;;GAWG;AACH,wBAAgB,UAAU,CAAC,KAAK,EAAE,WAAW,GAAG,QAAQ,GAAG,IAAI,CAiB9D"}
+{"version":3,"file":"audit-event-mapping.d.ts","sourceRoot":"","sources":["../../../../src/lib/activity/infrastructure/audit-event-mapping.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAGtD;;;;;;GAMG;AACH,MAAM,WAAW,QAAQ;IACrB,uEAAuE;IACvE,EAAE,EAAE,MAAM,CAAC;IACX,6EAA6E;IAC7E,IAAI,EAAE,MAAM,CAAC;IACb,gEAAgE;IAChE,WAAW,EAAE,MAAM,CAAC;IACpB,yCAAyC;IACzC,SAAS,EAAE,MAAM,CAAC;IAClB,gEAAgE;IAChE,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,8CAA8C;IAC9C,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,mEAAmE;IACnE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IACrC,qDAAqD;IACrD,EAAE,EAAE,IAAI,CAAC;CACZ;AAgKD;;;;;;;;;;;GAWG;AACH,qBAAa,yBAA0B,SAAQ,KAAK;gBACpC,KAAK,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM;CAMjD;AAkRD;;;GAGG;AACH,eAAO,MAAM,mBAAmB,EAE3B,SAAS,MAAM,EAAE,CAAC;AAgBvB;;;;;;;;;;;GAWG;AACH,wBAAgB,UAAU,CAAC,KAAK,EAAE,WAAW,GAAG,QAAQ,GAAG,IAAI,CAiB9D"}

package/dist/lib/activity/infrastructure/audit-event-mapping.js

@@ -315,8 +315,35 @@ const FACET_MAPPERS = {
     // itself went from `pending` to `active` and gained a credential. Those are
     // different facts and a security review wants the first one.
     'user.activated': (e) => userSubject(e, USER_AUDIT_KINDS.ACTIVATED, null),
-    'auth.signed_in': (e) => userSubject(e, identity_server_1.IDENTITY_ACTIVITY_KINDS.USER_SIGNED_IN, null),
+    // The sign-in itself, plus **how** it happened. A password sign-in carries
+    // no method and reads as it always has; an SSO one records the provider, so
+    // the log can answer "which of these people came in through the directory,
+    // and which still hold a password?" — which is the first question after a
+    // provider is misconfigured or retired.
+    'auth.signed_in': (e) => userSubject(e, identity_server_1.IDENTITY_ACTIVITY_KINDS.USER_SIGNED_IN, e.payload.method === 'sso'
+        ? {
+            method: 'sso',
+            provider: nullableString(e.payload.provider)
+        }
+        : null),
     'auth.signed_out': (e) => userSubject(e, identity_server_1.IDENTITY_ACTIVITY_KINDS.USER_SIGNED_OUT, null),
+    // Single sign-on. Three separate facts, deliberately not folded into the
+    // sign-in above: a link means a second way into the account now exists, a
+    // provisioned account is the only kind this product creates without an
+    // invite, and a mapped role is an authorization change that an
+    // administrator did not make. A reviewer asking "where did this user come
+    // from?" is asking for the middle one, and a sign-in row cannot answer it.
+    'user.sso_linked': (e) => userSubject(e, identity_server_1.IDENTITY_ACTIVITY_KINDS.USER_SSO_LINKED, {
+        provider: nullableString(e.payload.provider)
+    }),
+    'user.sso_provisioned': (e) => userSubject(e, identity_server_1.IDENTITY_ACTIVITY_KINDS.USER_SSO_PROVISIONED, {
+        provider: nullableString(e.payload.provider),
+        role: nullableString(e.payload.role)
+    }),
+    'user.sso_role_mapped': (e) => userSubject(e, identity_server_1.IDENTITY_ACTIVITY_KINDS.USER_SSO_ROLE_MAPPED, {
+        provider: nullableString(e.payload.provider),
+        role: nullableString(e.payload.role)
+    }),
     // External-API bearer tokens. Nothing mapped these before, so minting and
     // revoking a long-lived key to workspace content left the log completely
     // silent (BUG-identity-server-01) — the audit trail could not answer "who

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@orthacms/activity-server",
-    "version": "0.3.0",
+    "version": "0.4.0",
     "description": "@orthacms/activity-server — part of Ortha CMS.",
     "license": "MIT",
     "homepage": "https://github.com/ortha-source/ortha-cms/tree/main/packages/activity/server",
@@ -28,13 +28,13 @@
     "dependencies": {
         "@nestjs/common": "^11.0.0",
         "@nestjs/swagger": "^11.4.6",
-        "@orthacms/bootstrap-server": "^0.3.0",
-        "@orthacms/copilot-domain": "^0.3.0",
-        "@orthacms/copilot-server": "^0.3.0",
-        "@orthacms/database": "^0.3.0",
-        "@orthacms/identity-server": "^0.3.0",
-        "@orthacms/tools-server": "^0.3.0",
-        "@orthacms/utils-server": "^0.3.0",
+        "@orthacms/bootstrap-server": "^0.4.0",
+        "@orthacms/copilot-domain": "^0.4.0",
+        "@orthacms/copilot-server": "^0.4.0",
+        "@orthacms/database": "^0.4.0",
+        "@orthacms/identity-server": "^0.4.0",
+        "@orthacms/tools-server": "^0.4.0",
+        "@orthacms/utils-server": "^0.4.0",
         "class-transformer": "^0.5.1",
         "class-validator": "^0.15.1",
         "drizzle-orm": "^0.45.0",