@payfit/audit-log 3.17.11 → 3.18.0

package/README.md

@@ -4,13 +4,13 @@ The SDK is an npm package that sends audit-log records to the durable SQS ingest
 
 ## Using the SDK in your project
 
-First, install it :
+First, install it:
 
 ```sh
 npm i @payfit/audit-log
 ```
 
-Then, you must instanciate a client :
+Then, instantiate a client:
 
 ```ts
 import { AuditLogger } from '@payfit/audit-log'
@@ -43,6 +43,29 @@ logger.log({
 })
 ```
 
+## Validation and failure handling
+
+Before sending an audit log to SQS, the SDK validates values that would either
+fail PostgreSQL persistence or be changed silently by `JSON.stringify`.
+
+Validation rejects:
+
+- U+0000 and unpaired UTF-16 surrogates in persisted strings
+- Empty required fields and strings exceeding their PostgreSQL column limit
+- Circular references and `BigInt` values
+- `undefined`, functions, and symbols in `payload` or `scope`
+- `NaN`, `Infinity`, and `-Infinity` in `payload` or `scope`
+
+`userIp` is forwarded unchanged so non-standard but recoverable values are not
+discarded.
+
+`AuditLogger.log()` remains non-throwing. On validation failure, it does not send
+the record to SQS, increments the `validation_failed` metric, and emits an
+`audit-log validation failed` error containing `validation.path` and
+`validation.reason`. The error also contains the complete audit record so it can
+be recovered; configure log access and retention accordingly because the record
+may contain personal data.
+
 ## Contributing
 
 ### Building the SDK
@@ -59,9 +82,13 @@ from the repository root (where the workspace `package.json` is located).
 
 ### Testing
 
-For now, no unit tests have been written, but it should arrive soon !
+Run the SDK test suite from the repository root:
+
+```sh
+corepack yarn nx run sdk:test
+```
 
-### Playing around with he SDK
+### Playing around with the SDK
 
 Could it be for testing some changes you made, or just to discover how to use the SDK, there is a [playground](./playground) at your disposal.
 

package/dist/index.d.ts

@@ -4,11 +4,11 @@ import { IAuditLogTransport } from './transport/interface';
 /**
  * The allowed Namespaces for the AuditLog
  */
-export type AuditNamespaces = 'employee' | 'company' | 'permissions' | 'absence' | 'expense' | 'payments' | 'auth' | 'billing' | 'modules' | 'integrations' | 'partnerApi' | 'donation' | 'notificationSettings' | 'people' | 'subscriptions' | 'organization' | 'declarations' | 'pricing' | 'payroll' | 'jetlang' | 'files' | 'versioner' | 'live-timing';
+export type AuditNamespaces = 'employee' | 'company' | 'permissions' | 'absence' | 'expense' | 'payments' | 'auth' | 'billing' | 'modules' | 'integrations' | 'partnerApi' | 'donation' | 'notificationSettings' | 'people' | 'subscriptions' | 'organization' | 'declarations' | 'pricing' | 'payroll' | 'jetlang' | 'files' | 'versioner' | 'live-timing' | 'employee-insurance';
 /**
  * The allowed targets for the AuditLog
  */
-export type AuditTargets = 'reporting' | 'employee' | 'employee.settings' | 'employee-request' | 'company' | 'company.billings' | 'company.billing' | 'company.variables' | 'company.settings' | 'company.emails' | 'company.addons' | 'company.plans' | 'company.modules' | 'declaration.metadata' | 'user.role' | 'user.account' | 'user.primaryEmail' | 'user.secondaryEmail' | 'user.locale' | 'user.notificationSettings' | 'user.mfa' | 'role' | 'team' | 'department' | 'workflow' | 'integration' | 'apiAccess' | 'individual' | 'association' | 'association.archived' | 'donation' | 'donation.amount' | 'donation.auth.partner.portal' | 'donation.company.onboarding' | 'donation.taxReceipt' | 'donationPayment.status' | 'people.document.comments' | 'people.document.notifications' | 'people.document.reactions' | 'people.document.status' | 'people.document.answers' | 'people.oneOne' | 'people.campaign' | 'people.assessment' | 'people.assessment.360details' | 'people.assessment.managerRequests' | 'people.assessment.manager' | 'people.assessment.answers' | 'people.assessment.feedbacks' | 'iban' | 'salary-payments.connect' | 'salary-payments.pay.url' | 'advance-salary-payments.pay.url' | 'variable' | 'jetlang-data' | 'access-logs' | 'event' | 'topic' | 'file' | 'file.presigned-url' | 'archive' | 'payslip.merge';
+export type AuditTargets = 'reporting' | 'employee' | 'employee.settings' | 'employee-request' | 'company' | 'company.billings' | 'company.billing' | 'company.variables' | 'company.settings' | 'company.emails' | 'company.addons' | 'company.plans' | 'company.modules' | 'declaration.metadata' | 'user.role' | 'user.account' | 'user.primaryEmail' | 'user.secondaryEmail' | 'user.locale' | 'user.notificationSettings' | 'user.mfa' | 'role' | 'team' | 'department' | 'workflow' | 'integration' | 'apiAccess' | 'individual' | 'association' | 'association.archived' | 'donation' | 'donation.amount' | 'donation.auth.partner.portal' | 'donation.company.onboarding' | 'donation.taxReceipt' | 'donationPayment.status' | 'people.document.comments' | 'people.document.notifications' | 'people.document.reactions' | 'people.document.status' | 'people.document.answers' | 'people.oneOne' | 'people.campaign' | 'people.assessment' | 'people.assessment.360details' | 'people.assessment.managerRequests' | 'people.assessment.manager' | 'people.assessment.answers' | 'people.assessment.feedbacks' | 'iban' | 'salary-payments.connect' | 'salary-payments.pay.url' | 'advance-salary-payments.pay.url' | 'variable' | 'jetlang-data' | 'access-logs' | 'event' | 'topic' | 'file' | 'file.presigned-url' | 'archive' | 'payslip.merge' | 'employee-insurance.employer' | 'employee-insurance.token.employer' | 'employee-insurance.token.employee';
 /**
  * The allowed Events for the AuditLog
  */

package/dist/index.js

@@ -1 +1 @@
-"use strict";var w=Object.defineProperty;var f=(s,e,t)=>e in s?w(s,e,{enumerable:!0,configurable:!0,writable:!0,value:t}):s[e]=t;var i=(s,e,t)=>f(s,typeof e!="symbol"?e+"":e,t);Object.defineProperty(exports,Symbol.toStringTag,{value:"Module"});const v=require("uuid"),o=require("winston"),S=require("hot-shots"),h=require("@aws-sdk/client-sqs"),E=require("zlib"),y="audit-logs",_="@payfit/audit-log",q=()=>{const s=process.env.LOG_LEVEL;return s&&s.trim()!==""?s.trim():"info"},L=(s,e)=>o.createLogger({level:q(),silent:process.env.NODE_ENV==="test",exitOnError:!1,defaultMeta:{namespace:y,sdk:_,service:s,environment:e},format:o.format.combine(o.format.timestamp(),o.format.errors({stack:!0}),o.format.json()),transports:[new o.transports.Console]}),M="payfit.audit_logs.",p=s=>Object.entries(s).filter(([,e])=>e!==void 0&&e!=="").map(([e,t])=>`${e}:${String(t)}`);class b{constructor(){i(this,"client");this.client=new S.StatsD({prefix:M,errorHandler:()=>{},cacheDns:!0})}increment(e,t){this.client.increment(e,1,p(t))}histogram(e,t,n){this.client.histogram(e,t,p(n))}async close(){await new Promise(e=>{this.client.close(()=>e())})}}const A=()=>new b;function U(s){return E.brotliCompressSync(new TextEncoder().encode(s)).toString("base64")}function C(s){return s instanceof Error&&s.message.includes("Message must be shorter than")}const O="eu-west-3",z={dev:"https://sqs.eu-west-3.amazonaws.com/533547282673/audit-logs-ingest",staging:"https://sqs.eu-west-3.amazonaws.com/589883667243/audit-logs-ingest",prod:"https://sqs.eu-west-3.amazonaws.com/614948436281/audit-logs-ingest"},D={working:"staging",production:"prod",development:"dev"};class N{constructor(e,t){i(this,"environment");i(this,"logger");i(this,"client");i(this,"queueUrl");this.environment=e,this.logger=t;const n=D[e]??e;if(this.queueUrl=z[n],!this.queueUrl){t==null||t.warn("audit-logs SDK: no SQS queue URL configured for this environment, audit logs are disabled",{environment:e});return}this.client=new h.SQSClient({region:O})}async create(e){var n;if(!this.client||!this.queueUrl)return{compressed:!1};const t=JSON.stringify(e);try{return await this.send(t),{compressed:!1}}catch(c){if(!C(c))throw c;return(n=this.logger)==null||n.info("audit-log payload exceeds the SQS size limit, retrying with Brotli compression",{id:e.id,namespace:e.namespace}),await this.send(U(t)),{compressed:!0}}}async send(e){await this.client.send(new h.SendMessageCommand({QueueUrl:this.queueUrl,MessageBody:e}))}}class T{constructor(e,t={}){i(this,"params");i(this,"transport");i(this,"logger");i(this,"metrics");this.params=e,this.logger=t.logger??L(e.service,e.environment),this.transport=t.transport??new N(e.environment,this.logger),this.metrics=t.metrics??A()}async log({scope:e,account:t,...n}){const c=v.v4(),{environment:g,service:d}=this.params,r={...n,...t,service:d,id:c,environment:g,...e&&{scope:e}},a={service:d,environment:g,namespace:r.namespace,event:r.event,target:r.target},u=Date.now();try{const{compressed:l}=await this.transport.create(r);this.metrics.increment("sent",{...a,compressed:String(l)}),this.metrics.histogram("send_duration_ms",Date.now()-u,a),this.logger.debug("audit-log sent",{id:r.id,event:r.event,target:r.target})}catch(l){this.metrics.increment("send_failed",a),this.metrics.histogram("send_duration_ms",Date.now()-u,a);const m=l.message;try{this.logger.error("audit-log write failed",{audit_log:r,error:m})}catch{this.metrics.increment("serialization_failed",a);try{this.logger.error("audit-log write failed (serialization failed)",{audit_log_meta:{id:r.id,service:r.service,environment:r.environment,namespace:r.namespace,event:r.event,target:r.target},error:m})}catch{}}}}}exports.AuditLogger=T;
+"use strict";var E=Object.defineProperty;var b=(t,e,r)=>e in t?E(t,e,{enumerable:!0,configurable:!0,writable:!0,value:r}):t[e]=r;var n=(t,e,r)=>b(t,typeof e!="symbol"?e+"":e,r);Object.defineProperty(exports,Symbol.toStringTag,{value:"Module"});const _=require("uuid"),d=require("winston"),A=require("hot-shots"),y=require("@aws-sdk/client-sqs"),L=require("zlib"),q="audit-logs",v="@payfit/audit-log",I=()=>{const t=process.env.LOG_LEVEL;return t&&t.trim()!==""?t.trim():"info"},U=(t,e)=>d.createLogger({level:I(),silent:process.env.NODE_ENV==="test",exitOnError:!1,defaultMeta:{namespace:q,sdk:v,service:t,environment:e},format:d.format.combine(d.format.timestamp(),d.format.errors({stack:!0}),d.format.json()),transports:[new d.transports.Console]}),M="payfit.audit_logs.",S=t=>Object.entries(t).filter(([,e])=>e!==void 0&&e!=="").map(([e,r])=>`${e}:${String(r)}`);class ${constructor(){n(this,"client");this.client=new A.StatsD({prefix:M,errorHandler:()=>{},cacheDns:!0})}increment(e,r){this.client.increment(e,1,S(r))}histogram(e,r,i){this.client.histogram(e,r,S(i))}async close(){await new Promise(e=>{this.client.close(()=>e())})}}const z=()=>new $;function C(t){return L.brotliCompressSync(new TextEncoder().encode(t)).toString("base64")}function O(t){return t instanceof Error&&t.message.includes("Message must be shorter than")}const D="eu-west-3",N={dev:"https://sqs.eu-west-3.amazonaws.com/533547282673/audit-logs-ingest",staging:"https://sqs.eu-west-3.amazonaws.com/589883667243/audit-logs-ingest",prod:"https://sqs.eu-west-3.amazonaws.com/614948436281/audit-logs-ingest"},x={working:"staging",production:"prod",development:"dev"};class R{constructor(e,r){n(this,"environment");n(this,"logger");n(this,"client");n(this,"queueUrl");this.environment=e,this.logger=r;const i=x[e]??e;if(this.queueUrl=N[i],!this.queueUrl){r==null||r.warn("audit-logs SDK: no SQS queue URL configured for this environment, audit logs are disabled",{environment:e});return}this.client=new y.SQSClient({region:D})}async create(e){var i;if(!this.client||!this.queueUrl)return{compressed:!1};const r=JSON.stringify(e);try{return await this.send(r),{compressed:!1}}catch(c){if(!O(c))throw c;return(i=this.logger)==null||i.info("audit-log payload exceeds the SQS size limit, retrying with Brotli compression",{id:e.id,namespace:e.namespace}),await this.send(C(r)),{compressed:!0}}}async send(e){await this.client.send(new y.SendMessageCommand({QueueUrl:this.queueUrl,MessageBody:e}))}}class o extends Error{constructor(r,i){super(`${r}: ${i}`);n(this,"path");n(this,"reason");this.path=r,this.reason=i,this.name="AuditLogValidationError"}}const T={countryCode:2,internalId:64,namespace:64,service:64,event:64,target:64,environment:64,holdingId:24,companyId:24,employeeId:24,individualId:24,roleId:24,specialRole:32,email:320},P=new Set(["namespace","service","event","target","environment"]),Q=t=>{for(let e=0;e<t.length;e+=1){const r=t.charCodeAt(e);if(r>=55296&&r<=56319){if(e+1>=t.length)return!0;const i=t.charCodeAt(e+1);if(i<56320||i>57343)return!0;e+=1}else if(r>=56320&&r<=57343)return!0}return!1},u=(t,e,r={})=>{if(t==null){if(r.required)throw new o(e,"must not be empty");return}if(typeof t!="string")throw new o(e,"must be a string");if(r.required&&t==="")throw new o(e,"must not be empty");if(t.includes("\0"))throw new o(e,"contains U+0000");if(Q(t))throw new o(e,"contains unpaired UTF-16 surrogate");if(r.limit!==void 0&&Array.from(t).length>r.limit)throw new o(e,`exceeds PostgreSQL limit of ${r.limit} characters`)},j=(t,e)=>/^[A-Za-z_][A-Za-z0-9_]*$/.test(e)?`${t}.${e}`:`${t}[key]`,m=(t,e,r)=>{if(typeof t=="string"){u(t,e);return}if(typeof t=="bigint")throw new o(e,"BigInt is not JSON-serializable");if(typeof t>"u"||typeof t=="function"||typeof t=="symbol")throw new o(e,`${typeof t} is not JSON-serializable`);if(typeof t=="number"&&!Number.isFinite(t))throw new o(e,"must be a finite number");if(!(t===null||typeof t!="object")){if(r.has(t))throw new o(e,"contains a circular reference");r.add(t),Array.isArray(t)?t.forEach((i,c)=>m(i,`${e}[${c}]`,r)):Object.entries(t).forEach(([i,c])=>{u(i,e),m(c,j(e,i),r)}),r.delete(t)}},F=t=>{for(const[e,r]of Object.entries(T))u(t[e],e,{limit:r,required:P.has(e)});t.payload!==void 0&&t.payload!==null&&m(t.payload,"payload",new Set),t.scope!==void 0&&t.scope!==null&&m(t.scope,"scope",new Set)};class V{constructor(e,r={}){n(this,"params");n(this,"transport");n(this,"logger");n(this,"metrics");this.params=e,this.logger=r.logger??U(e.service,e.environment),this.transport=r.transport??new R(e.environment,this.logger),this.metrics=r.metrics??z()}async log({scope:e,account:r,...i}){const c=_.v4(),{environment:f,service:h}=this.params,s={...i,...r,service:h,id:c,environment:f,...e&&{scope:e}},l={service:h,environment:f,namespace:s.namespace,event:s.event,target:s.target},w=Date.now();try{F(s);const{compressed:g}=await this.transport.create(s);this.metrics.increment("sent",{...l,compressed:String(g)}),this.metrics.histogram("send_duration_ms",Date.now()-w,l),this.logger.debug("audit-log sent",{id:s.id,event:s.event,target:s.target})}catch(g){const a=g instanceof o?g:void 0;this.metrics.increment(a?"validation_failed":"send_failed",l),this.metrics.histogram("send_duration_ms",Date.now()-w,l);const p=g.message;try{this.logger.error(a?"audit-log validation failed":"audit-log write failed",{audit_log:s,error:p,...a&&{validation:{path:a.path,reason:a.reason}}})}catch{this.metrics.increment("serialization_failed",l);try{this.logger.error(a?"audit-log validation failed (serialization failed)":"audit-log write failed (serialization failed)",{audit_log_meta:{id:s.id,service:s.service,environment:s.environment,namespace:s.namespace,event:s.event,target:s.target},error:p,...a&&{validation:{path:a.path,reason:a.reason}}})}catch{}}}}}exports.AuditLogger=V;

package/dist/index.mjs

@@ -1,43 +1,43 @@
-var p = Object.defineProperty;
-var f = (s, e, t) => e in s ? p(s, e, { enumerable: !0, configurable: !0, writable: !0, value: t }) : s[e] = t;
-var i = (s, e, t) => f(s, typeof e != "symbol" ? e + "" : e, t);
-import { v4 as w } from "uuid";
-import { createLogger as v, transports as S, format as c } from "winston";
-import { StatsD as E } from "hot-shots";
-import { SQSClient as _, SendMessageCommand as y } from "@aws-sdk/client-sqs";
-import { brotliCompressSync as L } from "zlib";
-const M = "audit-logs", A = "@payfit/audit-log", U = () => {
-  const s = process.env.LOG_LEVEL;
-  return s && s.trim() !== "" ? s.trim() : "info";
-}, q = (s, e) => v({
-  level: U(),
+var S = Object.defineProperty;
+var E = (t, e, r) => e in t ? S(t, e, { enumerable: !0, configurable: !0, writable: !0, value: r }) : t[e] = r;
+var n = (t, e, r) => E(t, typeof e != "symbol" ? e + "" : e, r);
+import { v4 as _ } from "uuid";
+import { createLogger as b, transports as A, format as m } from "winston";
+import { StatsD as L } from "hot-shots";
+import { SQSClient as v, SendMessageCommand as I } from "@aws-sdk/client-sqs";
+import { brotliCompressSync as U } from "zlib";
+const q = "audit-logs", C = "@payfit/audit-log", M = () => {
+  const t = process.env.LOG_LEVEL;
+  return t && t.trim() !== "" ? t.trim() : "info";
+}, $ = (t, e) => b({
+  level: M(),
   silent: process.env.NODE_ENV === "test",
   exitOnError: !1,
   defaultMeta: {
-    namespace: M,
-    sdk: A,
-    service: s,
+    namespace: q,
+    sdk: C,
+    service: t,
     environment: e
   },
-  format: c.combine(c.timestamp(), c.errors({ stack: !0 }), c.json()),
-  transports: [new S.Console()]
-}), C = "payfit.audit_logs.", h = (s) => Object.entries(s).filter(([, e]) => e !== void 0 && e !== "").map(([e, t]) => `${e}:${String(t)}`);
-class b {
+  format: m.combine(m.timestamp(), m.errors({ stack: !0 }), m.json()),
+  transports: [new A.Console()]
+}), z = "payfit.audit_logs.", y = (t) => Object.entries(t).filter(([, e]) => e !== void 0 && e !== "").map(([e, r]) => `${e}:${String(r)}`);
+class O {
   constructor() {
-    i(this, "client");
-    this.client = new E({
-      prefix: C,
+    n(this, "client");
+    this.client = new L({
+      prefix: z,
       // Loss of metrics never breaks the caller — DogStatsD UDP is best-effort by design.
       errorHandler: () => {
       },
       cacheDns: !0
     });
   }
-  increment(e, t) {
-    this.client.increment(e, 1, h(t));
+  increment(e, r) {
+    this.client.increment(e, 1, y(r));
   }
-  histogram(e, t, n) {
-    this.client.histogram(e, t, h(n));
+  histogram(e, r, i) {
+    this.client.histogram(e, r, y(i));
   }
   async close() {
     await new Promise((e) => {
@@ -45,110 +45,209 @@ class b {
     });
   }
 }
-const D = () => new b();
-function N(s) {
-  return L(new TextEncoder().encode(s)).toString("base64");
+const D = () => new O();
+function N(t) {
+  return U(new TextEncoder().encode(t)).toString("base64");
 }
-function O(s) {
-  return s instanceof Error && s.message.includes("Message must be shorter than");
+function x(t) {
+  return t instanceof Error && t.message.includes("Message must be shorter than");
 }
-const z = "eu-west-3", x = {
+const R = "eu-west-3", Q = {
   dev: "https://sqs.eu-west-3.amazonaws.com/533547282673/audit-logs-ingest",
   staging: "https://sqs.eu-west-3.amazonaws.com/589883667243/audit-logs-ingest",
   prod: "https://sqs.eu-west-3.amazonaws.com/614948436281/audit-logs-ingest"
-}, Q = {
+}, T = {
   working: "staging",
   production: "prod",
   development: "dev"
 };
-class R {
-  constructor(e, t) {
-    i(this, "environment");
-    i(this, "logger");
-    i(this, "client");
-    i(this, "queueUrl");
-    this.environment = e, this.logger = t;
-    const n = Q[e] ?? e;
-    if (this.queueUrl = x[n], !this.queueUrl) {
-      t == null || t.warn("audit-logs SDK: no SQS queue URL configured for this environment, audit logs are disabled", { environment: e });
+class F {
+  constructor(e, r) {
+    n(this, "environment");
+    n(this, "logger");
+    n(this, "client");
+    n(this, "queueUrl");
+    this.environment = e, this.logger = r;
+    const i = T[e] ?? e;
+    if (this.queueUrl = Q[i], !this.queueUrl) {
+      r == null || r.warn("audit-logs SDK: no SQS queue URL configured for this environment, audit logs are disabled", { environment: e });
       return;
     }
-    this.client = new _({ region: z });
+    this.client = new v({ region: R });
   }
   async create(e) {
-    var n;
+    var i;
     if (!this.client || !this.queueUrl)
       return { compressed: !1 };
-    const t = JSON.stringify(e);
+    const r = JSON.stringify(e);
     try {
-      return await this.send(t), { compressed: !1 };
-    } catch (a) {
-      if (!O(a))
-        throw a;
-      return (n = this.logger) == null || n.info("audit-log payload exceeds the SQS size limit, retrying with Brotli compression", { id: e.id, namespace: e.namespace }), await this.send(N(t)), { compressed: !0 };
+      return await this.send(r), { compressed: !1 };
+    } catch (c) {
+      if (!x(c))
+        throw c;
+      return (i = this.logger) == null || i.info("audit-log payload exceeds the SQS size limit, retrying with Brotli compression", { id: e.id, namespace: e.namespace }), await this.send(N(r)), { compressed: !0 };
     }
   }
   async send(e) {
-    await this.client.send(new y({
+    await this.client.send(new I({
       QueueUrl: this.queueUrl,
       MessageBody: e
     }));
   }
 }
-class j {
-  constructor(e, t = {}) {
-    i(this, "params");
-    i(this, "transport");
-    i(this, "logger");
-    i(this, "metrics");
-    this.params = e, this.logger = t.logger ?? q(e.service, e.environment), this.transport = t.transport ?? new R(e.environment, this.logger), this.metrics = t.metrics ?? D();
+class o extends Error {
+  constructor(r, i) {
+    super(`${r}: ${i}`);
+    n(this, "path");
+    n(this, "reason");
+    this.path = r, this.reason = i, this.name = "AuditLogValidationError";
   }
-  async log({ scope: e, account: t, ...n }) {
-    const a = w(), { environment: l, service: g } = this.params, r = {
-      ...n,
-      ...t,
-      service: g,
-      id: a,
-      environment: l,
+}
+const P = {
+  countryCode: 2,
+  internalId: 64,
+  namespace: 64,
+  service: 64,
+  event: 64,
+  target: 64,
+  environment: 64,
+  holdingId: 24,
+  companyId: 24,
+  employeeId: 24,
+  individualId: 24,
+  roleId: 24,
+  specialRole: 32,
+  email: 320
+}, V = /* @__PURE__ */ new Set([
+  "namespace",
+  "service",
+  "event",
+  "target",
+  "environment"
+]), j = (t) => {
+  for (let e = 0; e < t.length; e += 1) {
+    const r = t.charCodeAt(e);
+    if (r >= 55296 && r <= 56319) {
+      if (e + 1 >= t.length)
+        return !0;
+      const i = t.charCodeAt(e + 1);
+      if (i < 56320 || i > 57343)
+        return !0;
+      e += 1;
+    } else if (r >= 56320 && r <= 57343)
+      return !0;
+  }
+  return !1;
+}, f = (t, e, r = {}) => {
+  if (t == null) {
+    if (r.required)
+      throw new o(e, "must not be empty");
+    return;
+  }
+  if (typeof t != "string")
+    throw new o(e, "must be a string");
+  if (r.required && t === "")
+    throw new o(e, "must not be empty");
+  if (t.includes("\0"))
+    throw new o(e, "contains U+0000");
+  if (j(t))
+    throw new o(e, "contains unpaired UTF-16 surrogate");
+  if (r.limit !== void 0 && Array.from(t).length > r.limit)
+    throw new o(e, `exceeds PostgreSQL limit of ${r.limit} characters`);
+}, G = (t, e) => /^[A-Za-z_][A-Za-z0-9_]*$/.test(e) ? `${t}.${e}` : `${t}[key]`, g = (t, e, r) => {
+  if (typeof t == "string") {
+    f(t, e);
+    return;
+  }
+  if (typeof t == "bigint")
+    throw new o(e, "BigInt is not JSON-serializable");
+  if (typeof t > "u" || typeof t == "function" || typeof t == "symbol")
+    throw new o(e, `${typeof t} is not JSON-serializable`);
+  if (typeof t == "number" && !Number.isFinite(t))
+    throw new o(e, "must be a finite number");
+  if (!(t === null || typeof t != "object")) {
+    if (r.has(t))
+      throw new o(e, "contains a circular reference");
+    r.add(t), Array.isArray(t) ? t.forEach((i, c) => g(i, `${e}[${c}]`, r)) : Object.entries(t).forEach(([i, c]) => {
+      f(i, e), g(c, G(e, i), r);
+    }), r.delete(t);
+  }
+}, J = (t) => {
+  for (const [e, r] of Object.entries(P))
+    f(t[e], e, {
+      limit: r,
+      required: V.has(e)
+    });
+  t.payload !== void 0 && t.payload !== null && g(t.payload, "payload", /* @__PURE__ */ new Set()), t.scope !== void 0 && t.scope !== null && g(t.scope, "scope", /* @__PURE__ */ new Set());
+};
+class X {
+  constructor(e, r = {}) {
+    n(this, "params");
+    n(this, "transport");
+    n(this, "logger");
+    n(this, "metrics");
+    this.params = e, this.logger = r.logger ?? $(e.service, e.environment), this.transport = r.transport ?? new F(e.environment, this.logger), this.metrics = r.metrics ?? D();
+  }
+  async log({ scope: e, account: r, ...i }) {
+    const c = _(), { environment: u, service: h } = this.params, s = {
+      ...i,
+      ...r,
+      service: h,
+      id: c,
+      environment: u,
       ...e && { scope: e }
-    }, o = {
-      service: g,
-      environment: l,
-      namespace: r.namespace,
-      event: r.event,
-      target: r.target
-    }, d = Date.now();
+    }, d = {
+      service: h,
+      environment: u,
+      namespace: s.namespace,
+      event: s.event,
+      target: s.target
+    }, p = Date.now();
     try {
-      const { compressed: m } = await this.transport.create(r);
+      J(s);
+      const { compressed: l } = await this.transport.create(s);
       this.metrics.increment("sent", {
-        ...o,
-        compressed: String(m)
-      }), this.metrics.histogram("send_duration_ms", Date.now() - d, o), this.logger.debug("audit-log sent", {
-        id: r.id,
-        event: r.event,
-        target: r.target
+        ...d,
+        compressed: String(l)
+      }), this.metrics.histogram("send_duration_ms", Date.now() - p, d), this.logger.debug("audit-log sent", {
+        id: s.id,
+        event: s.event,
+        target: s.target
       });
-    } catch (m) {
-      this.metrics.increment("send_failed", o), this.metrics.histogram("send_duration_ms", Date.now() - d, o);
-      const u = m.message;
+    } catch (l) {
+      const a = l instanceof o ? l : void 0;
+      this.metrics.increment(a ? "validation_failed" : "send_failed", d), this.metrics.histogram("send_duration_ms", Date.now() - p, d);
+      const w = l.message;
       try {
-        this.logger.error("audit-log write failed", {
-          audit_log: r,
-          error: u
+        this.logger.error(a ? "audit-log validation failed" : "audit-log write failed", {
+          audit_log: s,
+          error: w,
+          ...a && {
+            validation: {
+              path: a.path,
+              reason: a.reason
+            }
+          }
         });
       } catch {
-        this.metrics.increment("serialization_failed", o);
+        this.metrics.increment("serialization_failed", d);
         try {
-          this.logger.error("audit-log write failed (serialization failed)", {
+          this.logger.error(a ? "audit-log validation failed (serialization failed)" : "audit-log write failed (serialization failed)", {
             audit_log_meta: {
-              id: r.id,
-              service: r.service,
-              environment: r.environment,
-              namespace: r.namespace,
-              event: r.event,
-              target: r.target
+              id: s.id,
+              service: s.service,
+              environment: s.environment,
+              namespace: s.namespace,
+              event: s.event,
+              target: s.target
             },
-            error: u
+            error: w,
+            ...a && {
+              validation: {
+                path: a.path,
+                reason: a.reason
+              }
+            }
           });
         } catch {
         }
@@ -157,5 +256,5 @@ class j {
   }
 }
 export {
-  j as AuditLogger
+  X as AuditLogger
 };

package/dist/metrics.d.ts

@@ -1,5 +1,5 @@
 export declare const METRIC_PREFIX = "payfit.audit_logs.";
-export type MetricName = 'sent' | 'send_failed' | 'serialization_failed' | 'send_duration_ms';
+export type MetricName = 'sent' | 'send_failed' | 'validation_failed' | 'serialization_failed' | 'send_duration_ms';
 export interface MetricTags {
     service: string;
     environment: string;

package/dist/validation.d.ts

@@ -0,0 +1,7 @@
+import type { IAuditLogCreationData } from './transport/interface';
+export declare class AuditLogValidationError extends Error {
+    readonly path: string;
+    readonly reason: string;
+    constructor(path: string, reason: string);
+}
+export declare const validateAuditLogForPersistence: (event: IAuditLogCreationData) => void;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@payfit/audit-log",
-  "version": "3.17.11",
+  "version": "3.18.0",
   "repository": {
     "type": "git",
     "url": "https://github.com/PayFit/audit-logs.git",