@prenta/core 7.6.2 → 7.6.5

package/dist/api/validate-body.js

@@ -0,0 +1,168 @@
+import { z } from 'zod';
+import { json, readJsonBody } from './route-helpers.js';
+/**
+ * Schema failure for a JSON object body. `error` stays a string so existing
+ * clients keep working; `details` is the field list.
+ * A single issue uses its message as `error` so routes that already returned
+ * one sentence (empty bulk-apply items, and so on) stay compatible.
+ */
+function validationError(details) {
+    const first = details[0];
+    const error = details.length === 1 && first
+        ? first.message
+        : details
+            .map((detail) => (detail.path ? `${detail.path}: ${detail.message}` : detail.message))
+            .join('; ');
+    return json({ error: error || 'Invalid request body', details }, 400);
+}
+function zodDetails(error) {
+    return error.issues.map((issue) => ({
+        path: issue.path.map(String).join('.'),
+        message: issue.message,
+    }));
+}
+export function validateData(data, schema) {
+    const result = schema.safeParse(data);
+    if (!result.success) {
+        return { ok: false, error: validationError(zodDetails(result.error)) };
+    }
+    return { ok: true, data: result.data };
+}
+/** Invalid JSON or a non-object is 400, then `schema` is applied. */
+export async function validateBody(request, schema) {
+    const parsed = await readJsonBody(request);
+    if (!parsed.ok)
+        return parsed;
+    return validateData(parsed.data, schema);
+}
+const requiredString = (message) => z.string({ required_error: message, invalid_type_error: message }).trim().min(1, message);
+export const loginBodySchema = z.object({
+    email: requiredString('Email is required'),
+    password: z
+        .string({ required_error: 'Password is required', invalid_type_error: 'Password is required' })
+        .min(1, 'Password is required'),
+    captchaToken: z.string().optional(),
+});
+export const forgotPasswordBodySchema = z.object({
+    email: requiredString('Email is required'),
+});
+export const resetPasswordBodySchema = z.object({
+    token: requiredString('Token and new password are required'),
+    password: z
+        .string({
+        required_error: 'Token and new password are required',
+        invalid_type_error: 'Token and new password are required',
+    })
+        .min(8, 'Password must be at least 8 characters'),
+});
+export const totpVerifyBodySchema = z.object({
+    code: requiredString('Code is required'),
+});
+const mfaRequired = 'mfaPendingToken and code are required';
+export const totpLoginBodySchema = z.object({
+    mfaPendingToken: requiredString(mfaRequired),
+    code: requiredString(mfaRequired),
+});
+export const inviteBodySchema = z.object({
+    email: requiredString('Email is required'),
+    role: z.string().optional(),
+    message: z.string().optional(),
+    expiresInDays: z.number().optional(),
+});
+export const rolePatchBodySchema = z.object({
+    role: z
+        .string({
+        required_error: 'Select a valid role.',
+        invalid_type_error: 'Select a valid role.',
+    })
+        .min(1, 'Select a valid role.'),
+});
+export const apiKeyCreateBodySchema = z.object({
+    name: z
+        .string({ required_error: 'name is required', invalid_type_error: 'name is required' })
+        .trim()
+        .min(1, 'name is required')
+        .max(100, 'name must be 100 characters or fewer'),
+    scopes: z.record(z.unknown()).nullish(),
+    ipRestrictions: z.array(z.string()).optional(),
+    expiresAt: z.string().nullable().optional(),
+});
+export const transferContentBodySchema = z.object({
+    toUserId: requiredString('A recipient (toUserId) is required.'),
+});
+/**
+ * Collection writes carry arbitrary field maps. Unknown keys must survive
+ * (passthrough) or a partial update would drop custom fields. `title` / `slug`
+ * are only type-checked when present. Validate after `flattenDocumentWriteBody`.
+ */
+export const documentWriteBodySchema = z
+    .object({
+    title: z.string().nullable().optional(),
+    slug: z.string().nullable().optional(),
+})
+    .passthrough();
+export const mediaPresignBodySchema = z.object({
+    filename: requiredString('filename and contentType are required'),
+    contentType: requiredString('filename and contentType are required'),
+});
+export const mediaMetadataPatchSchema = z.object({
+    alt: z.string().optional(),
+    title: z.string().optional(),
+    filename: z.string().optional(),
+    caption: z.string().optional(),
+    description: z.string().optional(),
+    focusKeyword: z.string().optional(),
+    focalX: z.number().optional(),
+    focalY: z.number().optional(),
+    isDecorative: z.boolean().optional(),
+});
+export const mediaBulkUpdateBodySchema = z.object({
+    items: z
+        .array(z.unknown(), {
+        required_error: 'items must be a non-empty array',
+        invalid_type_error: 'items must be a non-empty array',
+    })
+        .min(1, 'items must be a non-empty array'),
+});
+const bulkDeleteConfirm = 'confirm: true is required for bulk media delete';
+export const mediaBulkDeleteBodySchema = z.object({
+    ids: z
+        .array(z.unknown(), {
+        required_error: 'ids must be a non-empty array',
+        invalid_type_error: 'ids must be a non-empty array',
+    })
+        .min(1, 'ids must be a non-empty array'),
+    confirm: z
+        .boolean({
+        required_error: bulkDeleteConfirm,
+        invalid_type_error: bulkDeleteConfirm,
+    })
+        .refine((value) => value === true, { message: bulkDeleteConfirm }),
+});
+const linkApplyRequired = 'sourceEntityId, targetEntityId, anchorText, and fingerprint are required';
+export const seoLinkApplyBodySchema = z.object({
+    sourceEntityId: requiredString(linkApplyRequired),
+    targetEntityId: requiredString(linkApplyRequired),
+    anchorText: requiredString(linkApplyRequired),
+    fingerprint: z
+        .string({ required_error: linkApplyRequired, invalid_type_error: linkApplyRequired })
+        .min(1, linkApplyRequired),
+});
+/** Shape only. FAQ length, uniqueness, and heading limits stay in the route. */
+export const seoApplyFixBodySchema = z
+    .object({
+    fingerprint: z.string().optional(),
+    includeItems: z.array(z.number().int().nonnegative()).optional(),
+    headingOverride: z.string().optional(),
+})
+    .passthrough();
+export const seoBulkApplyBodySchema = z.object({
+    items: z
+        .array(z.object({
+        kind: z.enum(['issue-fix', 'redirect']),
+        id: z.string().min(1),
+        fingerprint: z.string().optional(),
+    }))
+        .min(1, 'items must be a non-empty array.'),
+});
+//# sourceMappingURL=validate-body.js.map

package/dist/api/validate-body.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"validate-body.js","sourceRoot":"","sources":["../../src/api/validate-body.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AACvB,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AAOvD;;;;;GAKG;AACH,SAAS,eAAe,CAAC,OAAyB;IAChD,MAAM,KAAK,GAAG,OAAO,CAAC,CAAC,CAAC,CAAA;IACxB,MAAM,KAAK,GACT,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK;QAC3B,CAAC,CAAC,KAAK,CAAC,OAAO;QACf,CAAC,CAAC,OAAO;aACJ,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,IAAI,KAAK,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;aACrF,IAAI,CAAC,IAAI,CAAC,CAAA;IACnB,OAAO,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,IAAI,sBAAsB,EAAE,OAAO,EAAE,EAAE,GAAG,CAAC,CAAA;AACvE,CAAC;AAED,SAAS,UAAU,CAAC,KAAiB;IACnC,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAClC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;QACtC,OAAO,EAAE,KAAK,CAAC,OAAO;KACvB,CAAC,CAAC,CAAA;AACL,CAAC;AAED,MAAM,UAAU,YAAY,CAC1B,IAAa,EACb,MAAS;IAET,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,CAAA;IACrC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,eAAe,CAAC,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAA;IACxE,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAA;AACxC,CAAC;AAED,qEAAqE;AACrE,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,OAAgB,EAChB,MAAS;IAET,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,OAAO,CAAC,CAAA;IAC1C,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,OAAO,MAAM,CAAA;IAC7B,OAAO,YAAY,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;AAC1C,CAAC;AAED,MAAM,cAAc,GAAG,CAAC,OAAe,EAAE,EAAE,CACzC,CAAC,CAAC,MAAM,CAAC,EAAE,cAAc,EAAE,OAAO,EAAE,kBAAkB,EAAE,OAAO,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,CAAC,CAAA;AAE3F,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,KAAK,EAAE,cAAc,CAAC,mBAAmB,CAAC;IAC1C,QAAQ,EAAE,CAAC;SACR,MAAM,CAAC,EAAE,cAAc,EAAE,sBAAsB,EAAE,kBAAkB,EAAE,sBAAsB,EAAE,CAAC;SAC9F,GAAG,CAAC,CAAC,EAAE,sBAAsB,CAAC;IACjC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACpC,CAAC,CAAA;AAEF,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/C,KAAK,EAAE,cAAc,CAAC,mBAAmB,CAAC;CAC3C,CAAC,CAAA;AAEF,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,KAAK,EAAE,cAAc,CAAC,qCAAqC,CAAC;IAC5D,QAAQ,EAAE,CAAC;SACR,MAAM,CAAC;QACN,cAAc,EAAE,qCAAqC;QACrD,kBAAkB,EAAE,qCAAqC;KAC1D,CAAC;SACD,GAAG,CAAC,CAAC,EAAE,wCAAwC,CAAC;CACpD,CAAC,CAAA;AAEF,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C,IAAI,EAAE,cAAc,CAAC,kBAAkB,CAAC;CACzC,CAAC,CAAA;AAEF,MAAM,WAAW,GAAG,uCAAuC,CAAA;AAE3D,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,eAAe,EAAE,cAAc,CAAC,WAAW,CAAC;IAC5C,IAAI,EAAE,cAAc,CAAC,WAAW,CAAC;CAClC,CAAC,CAAA;AAEF,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,KAAK,EAAE,cAAc,CAAC,mBAAmB,CAAC;IAC1C,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC3B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC9B,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACrC,CAAC,CAAA;AAEF,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,IAAI,EAAE,CAAC;SACJ,MAAM,CAAC;QACN,cAAc,EAAE,sBAAsB;QACtC,kBAAkB,EAAE,sBAAsB;KAC3C,CAAC;SACD,GAAG,CAAC,CAAC,EAAE,sBAAsB,CAAC;CAClC,CAAC,CAAA;AAEF,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7C,IAAI,EAAE,CAAC;SACJ,MAAM,CAAC,EAAE,cAAc,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,CAAC;SACtF,IAAI,EAAE;SACN,GAAG,CAAC,CAAC,EAAE,kBAAkB,CAAC;SAC1B,GAAG,CAAC,GAAG,EAAE,sCAAsC,CAAC;IACnD,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;IACvC,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC9C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;CAC5C,CAAC,CAAA;AAEF,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,QAAQ,EAAE,cAAc,CAAC,qCAAqC,CAAC;CAChE,CAAC,CAAA;AAEF;;;;GAIG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC;KACrC,MAAM,CAAC;IACN,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACvC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;CACvC,CAAC;KACD,WAAW,EAAE,CAAA;AAEhB,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7C,QAAQ,EAAE,cAAc,CAAC,uCAAuC,CAAC;IACjE,WAAW,EAAE,cAAc,CAAC,uCAAuC,CAAC;CACrE,CAAC,CAAA;AAEF,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/C,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC1B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC/B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC9B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACnC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7B,YAAY,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CACrC,CAAC,CAAA;AAEF,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,KAAK,EAAE,CAAC;SACL,KAAK,CAAC,CAAC,CAAC,OAAO,EAAE,EAAE;QAClB,cAAc,EAAE,iCAAiC;QACjD,kBAAkB,EAAE,iCAAiC;KACtD,CAAC;SACD,GAAG,CAAC,CAAC,EAAE,iCAAiC,CAAC;CAC7C,CAAC,CAAA;AAEF,MAAM,iBAAiB,GAAG,iDAAiD,CAAA;AAE3E,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,GAAG,EAAE,CAAC;SACH,KAAK,CAAC,CAAC,CAAC,OAAO,EAAE,EAAE;QAClB,cAAc,EAAE,+BAA+B;QAC/C,kBAAkB,EAAE,+BAA+B;KACpD,CAAC;SACD,GAAG,CAAC,CAAC,EAAE,+BAA+B,CAAC;IAC1C,OAAO,EAAE,CAAC;SACP,OAAO,CAAC;QACP,cAAc,EAAE,iBAAiB;QACjC,kBAAkB,EAAE,iBAAiB;KACtC,CAAC;SACD,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,IAAI,EAAE,EAAE,OAAO,EAAE,iBAAiB,EAAE,CAAC;CACrE,CAAC,CAAA;AAEF,MAAM,iBAAiB,GAAG,0EAA0E,CAAA;AAEpG,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7C,cAAc,EAAE,cAAc,CAAC,iBAAiB,CAAC;IACjD,cAAc,EAAE,cAAc,CAAC,iBAAiB,CAAC;IACjD,UAAU,EAAE,cAAc,CAAC,iBAAiB,CAAC;IAC7C,WAAW,EAAE,CAAC;SACX,MAAM,CAAC,EAAE,cAAc,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,CAAC;SACpF,GAAG,CAAC,CAAC,EAAE,iBAAiB,CAAC;CAC7B,CAAC,CAAA;AAEF,gFAAgF;AAChF,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC;KACnC,MAAM,CAAC;IACN,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC,QAAQ,EAAE;IAChE,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACvC,CAAC;KACD,WAAW,EAAE,CAAA;AAEhB,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7C,KAAK,EAAE,CAAC;SACL,KAAK,CACJ,CAAC,CAAC,MAAM,CAAC;QACP,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC;QACvC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QACrB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KACnC,CAAC,CACH;SACA,GAAG,CAAC,CAAC,EAAE,kCAAkC,CAAC;CAC9C,CAAC,CAAA"}

package/dist/security/audit-export.d.ts

@@ -0,0 +1,42 @@
+/** Hard cap so an export cannot load the whole audit table in one response. */
+export declare const AUDIT_LOG_EXPORT_MAX = 10000;
+export interface AuditLogExportRow {
+    id: string;
+    event: string;
+    userId: string | null;
+    ipAddress: string | null;
+    userAgent: string | null;
+    details: unknown;
+    timestamp: Date | string;
+}
+export interface AuditLogExportDb {
+    auditLog: {
+        findMany: (args: {
+            where?: Record<string, unknown>;
+            orderBy?: {
+                timestamp: 'desc';
+            };
+            take?: number;
+        }) => Promise<AuditLogExportRow[]>;
+    };
+}
+export type AuditLogRange = {
+    ok: true;
+    from?: Date;
+    to?: Date;
+} | {
+    ok: false;
+    error: string;
+};
+/** `from` / `to` are optional ISO timestamps or `YYYY-MM-DD` (UTC, inclusive). */
+export declare function parseAuditLogRange(fromRaw: string | null, toRaw: string | null): AuditLogRange;
+export declare function loadAuditLogForExport(db: AuditLogExportDb, range: {
+    from?: Date;
+    to?: Date;
+}, max?: number): Promise<{
+    rows: AuditLogExportRow[];
+    truncated: boolean;
+}>;
+export declare function auditLogToCsv(rows: AuditLogExportRow[]): string;
+export declare function auditLogToJson(rows: AuditLogExportRow[], truncated: boolean): string;
+//# sourceMappingURL=audit-export.d.ts.map

package/dist/security/audit-export.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-export.d.ts","sourceRoot":"","sources":["../../src/security/audit-export.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAC/E,eAAO,MAAM,oBAAoB,QAAS,CAAA;AAE1C,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,MAAM,CAAA;IACV,KAAK,EAAE,MAAM,CAAA;IACb,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;IACrB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB,OAAO,EAAE,OAAO,CAAA;IAChB,SAAS,EAAE,IAAI,GAAG,MAAM,CAAA;CACzB;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE;QACR,QAAQ,EAAE,CAAC,IAAI,EAAE;YACf,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;YAC/B,OAAO,CAAC,EAAE;gBAAE,SAAS,EAAE,MAAM,CAAA;aAAE,CAAA;YAC/B,IAAI,CAAC,EAAE,MAAM,CAAA;SACd,KAAK,OAAO,CAAC,iBAAiB,EAAE,CAAC,CAAA;KACnC,CAAA;CACF;AAED,MAAM,MAAM,aAAa,GAAG;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,IAAI,CAAC,EAAE,IAAI,CAAC;IAAC,EAAE,CAAC,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAA;AAgB/F,kFAAkF;AAClF,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,aAAa,CAiB9F;AASD,wBAAsB,qBAAqB,CACzC,EAAE,EAAE,gBAAgB,EACpB,KAAK,EAAE;IAAE,IAAI,CAAC,EAAE,IAAI,CAAC;IAAC,EAAE,CAAC,EAAE,IAAI,CAAA;CAAE,EACjC,GAAG,SAAuB,GACzB,OAAO,CAAC;IAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC;IAAC,SAAS,EAAE,OAAO,CAAA;CAAE,CAAC,CAQ5D;AAcD,wBAAgB,aAAa,CAAC,IAAI,EAAE,iBAAiB,EAAE,GAAG,MAAM,CAe/D;AAED,wBAAgB,cAAc,CAAC,IAAI,EAAE,iBAAiB,EAAE,EAAE,SAAS,EAAE,OAAO,GAAG,MAAM,CAcpF"}

package/dist/security/audit-export.js

@@ -0,0 +1,93 @@
+/** Hard cap so an export cannot load the whole audit table in one response. */
+export const AUDIT_LOG_EXPORT_MAX = 10_000;
+const DATE_ONLY = /^\d{4}-\d{2}-\d{2}$/;
+function parseBound(value, endOfDay) {
+    const trimmed = value.trim();
+    if (!trimmed)
+        return null;
+    if (DATE_ONLY.test(trimmed)) {
+        const iso = endOfDay ? `${trimmed}T23:59:59.999Z` : `${trimmed}T00:00:00.000Z`;
+        const date = new Date(iso);
+        return Number.isNaN(date.getTime()) ? null : date;
+    }
+    const date = new Date(trimmed);
+    return Number.isNaN(date.getTime()) ? null : date;
+}
+/** `from` / `to` are optional ISO timestamps or `YYYY-MM-DD` (UTC, inclusive). */
+export function parseAuditLogRange(fromRaw, toRaw) {
+    let from;
+    let to;
+    if (fromRaw?.trim()) {
+        const parsed = parseBound(fromRaw, false);
+        if (!parsed)
+            return { ok: false, error: '"from" must be an ISO date or YYYY-MM-DD' };
+        from = parsed;
+    }
+    if (toRaw?.trim()) {
+        const parsed = parseBound(toRaw, DATE_ONLY.test(toRaw.trim()));
+        if (!parsed)
+            return { ok: false, error: '"to" must be an ISO date or YYYY-MM-DD' };
+        to = parsed;
+    }
+    if (from && to && from.getTime() > to.getTime()) {
+        return { ok: false, error: '"from" must be on or before "to"' };
+    }
+    return { ok: true, from, to };
+}
+function auditLogWhere(range) {
+    const timestamp = {};
+    if (range.from)
+        timestamp.gte = range.from;
+    if (range.to)
+        timestamp.lte = range.to;
+    return Object.keys(timestamp).length > 0 ? { timestamp } : {};
+}
+export async function loadAuditLogForExport(db, range, max = AUDIT_LOG_EXPORT_MAX) {
+    const rows = await db.auditLog.findMany({
+        where: auditLogWhere(range),
+        orderBy: { timestamp: 'desc' },
+        take: max + 1,
+    });
+    const truncated = rows.length > max;
+    return { rows: truncated ? rows.slice(0, max) : rows, truncated };
+}
+function isoTimestamp(value) {
+    const date = value instanceof Date ? value : new Date(value);
+    return Number.isNaN(date.getTime()) ? String(value) : date.toISOString();
+}
+function csvCell(value) {
+    const text = value == null ? '' : typeof value === 'string' ? value : (JSON.stringify(value) ?? '');
+    if (/[",\n\r]/.test(text))
+        return `"${text.replace(/"/g, '""')}"`;
+    return text;
+}
+export function auditLogToCsv(rows) {
+    const header = 'timestamp,event,userId,ipAddress,userAgent,details';
+    const lines = rows.map((row) => [
+        isoTimestamp(row.timestamp),
+        row.event,
+        row.userId,
+        row.ipAddress,
+        row.userAgent,
+        row.details ?? '',
+    ]
+        .map(csvCell)
+        .join(','));
+    return [header, ...lines].join('\n');
+}
+export function auditLogToJson(rows, truncated) {
+    return JSON.stringify({
+        count: rows.length,
+        truncated,
+        entries: rows.map((row) => ({
+            id: row.id,
+            timestamp: isoTimestamp(row.timestamp),
+            event: row.event,
+            userId: row.userId,
+            ipAddress: row.ipAddress,
+            userAgent: row.userAgent,
+            details: row.details ?? null,
+        })),
+    });
+}
+//# sourceMappingURL=audit-export.js.map

package/dist/security/audit-export.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-export.js","sourceRoot":"","sources":["../../src/security/audit-export.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAC/E,MAAM,CAAC,MAAM,oBAAoB,GAAG,MAAM,CAAA;AAwB1C,MAAM,SAAS,GAAG,qBAAqB,CAAA;AAEvC,SAAS,UAAU,CAAC,KAAa,EAAE,QAAiB;IAClD,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAA;IAC5B,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAA;IACzB,IAAI,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAC5B,MAAM,GAAG,GAAG,QAAQ,CAAC,CAAC,CAAC,GAAG,OAAO,gBAAgB,CAAC,CAAC,CAAC,GAAG,OAAO,gBAAgB,CAAA;QAC9E,MAAM,IAAI,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,CAAA;QAC1B,OAAO,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAA;IACnD,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,IAAI,CAAC,OAAO,CAAC,CAAA;IAC9B,OAAO,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAA;AACnD,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,kBAAkB,CAAC,OAAsB,EAAE,KAAoB;IAC7E,IAAI,IAAsB,CAAA;IAC1B,IAAI,EAAoB,CAAA;IACxB,IAAI,OAAO,EAAE,IAAI,EAAE,EAAE,CAAC;QACpB,MAAM,MAAM,GAAG,UAAU,CAAC,OAAO,EAAE,KAAK,CAAC,CAAA;QACzC,IAAI,CAAC,MAAM;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,0CAA0C,EAAE,CAAA;QACpF,IAAI,GAAG,MAAM,CAAA;IACf,CAAC;IACD,IAAI,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC;QAClB,MAAM,MAAM,GAAG,UAAU,CAAC,KAAK,EAAE,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAA;QAC9D,IAAI,CAAC,MAAM;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,wCAAwC,EAAE,CAAA;QAClF,EAAE,GAAG,MAAM,CAAA;IACb,CAAC;IACD,IAAI,IAAI,IAAI,EAAE,IAAI,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC;QAChD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,kCAAkC,EAAE,CAAA;IACjE,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,CAAA;AAC/B,CAAC;AAED,SAAS,aAAa,CAAC,KAAiC;IACtD,MAAM,SAAS,GAAyB,EAAE,CAAA;IAC1C,IAAI,KAAK,CAAC,IAAI;QAAE,SAAS,CAAC,GAAG,GAAG,KAAK,CAAC,IAAI,CAAA;IAC1C,IAAI,KAAK,CAAC,EAAE;QAAE,SAAS,CAAC,GAAG,GAAG,KAAK,CAAC,EAAE,CAAA;IACtC,OAAO,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAA;AAC/D,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,EAAoB,EACpB,KAAiC,EACjC,GAAG,GAAG,oBAAoB;IAE1B,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC;QACtC,KAAK,EAAE,aAAa,CAAC,KAAK,CAAC;QAC3B,OAAO,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE;QAC9B,IAAI,EAAE,GAAG,GAAG,CAAC;KACd,CAAC,CAAA;IACF,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,GAAG,GAAG,CAAA;IACnC,OAAO,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,SAAS,EAAE,CAAA;AACnE,CAAC;AAED,SAAS,YAAY,CAAC,KAAoB;IACxC,MAAM,IAAI,GAAG,KAAK,YAAY,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,CAAA;IAC5D,OAAO,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,CAAA;AAC1E,CAAC;AAED,SAAS,OAAO,CAAC,KAAc;IAC7B,MAAM,IAAI,GACR,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAA;IACxF,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,CAAA;IACjE,OAAO,IAAI,CAAA;AACb,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,IAAyB;IACrD,MAAM,MAAM,GAAG,oDAAoD,CAAA;IACnE,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAC7B;QACE,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC;QAC3B,GAAG,CAAC,KAAK;QACT,GAAG,CAAC,MAAM;QACV,GAAG,CAAC,SAAS;QACb,GAAG,CAAC,SAAS;QACb,GAAG,CAAC,OAAO,IAAI,EAAE;KAClB;SACE,GAAG,CAAC,OAAO,CAAC;SACZ,IAAI,CAAC,GAAG,CAAC,CACb,CAAA;IACD,OAAO,CAAC,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AACtC,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,IAAyB,EAAE,SAAkB;IAC1E,OAAO,IAAI,CAAC,SAAS,CAAC;QACpB,KAAK,EAAE,IAAI,CAAC,MAAM;QAClB,SAAS;QACT,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;YAC1B,EAAE,EAAE,GAAG,CAAC,EAAE;YACV,SAAS,EAAE,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC;YACtC,KAAK,EAAE,GAAG,CAAC,KAAK;YAChB,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,SAAS,EAAE,GAAG,CAAC,SAAS;YACxB,SAAS,EAAE,GAAG,CAAC,SAAS;YACxB,OAAO,EAAE,GAAG,CAAC,OAAO,IAAI,IAAI;SAC7B,CAAC,CAAC;KACJ,CAAC,CAAA;AACJ,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@prenta/core",
-  "version": "7.6.2",
+  "version": "7.6.5",
   "license": "MIT",
   "repository": {
     "type": "git",