@robelest/convex-auth 0.0.4-preview.2 → 0.0.4-preview.21

package/dist/component/providers/passkey.d.ts

@@ -0,0 +1,57 @@
+//#region src/providers/passkey.d.ts
+/**
+ * Passkey (WebAuthn) authentication provider.
+ *
+ * ```ts
+ * import { Passkey } from "@robelest/convex-auth/providers";
+ *
+ * new Passkey({ rpName: "My App" })
+ * ```
+ *
+ * @module
+ */
+/**
+ * Configuration for the Passkey provider.
+ */
+interface PasskeyConfig {
+  /** Relying Party display name. Defaults to SITE_URL hostname. */
+  rpName?: string;
+  /** Relying Party ID (hostname). Defaults to SITE_URL hostname. */
+  rpId?: string;
+  /** Allowed origins for credential verification. Defaults to SITE_URL. */
+  origin?: string | string[];
+  /** Attestation conveyance preference. Defaults to "none". */
+  attestation?: "none" | "direct";
+  /** User verification requirement. Defaults to "required". */
+  userVerification?: "required" | "preferred" | "discouraged";
+  /** Resident key (discoverable credential) preference. Defaults to "preferred". */
+  residentKey?: "required" | "preferred" | "discouraged";
+  /** Restrict to platform or cross-platform authenticators. */
+  authenticatorAttachment?: "platform" | "cross-platform";
+  /** Supported COSE algorithms. Defaults to [-7 (ES256), -257 (RS256)]. */
+  algorithms?: number[];
+  /** Challenge expiration in ms. Defaults to 300_000 (5 minutes). */
+  challengeExpirationMs?: number;
+}
+/**
+ * Passkey (WebAuthn) authentication provider.
+ *
+ * Enables passwordless authentication via biometrics, security keys,
+ * and synced passkeys using the Web Authentication API.
+ *
+ * @example
+ * ```ts
+ * import { Passkey } from "@robelest/convex-auth/providers";
+ *
+ * new Passkey({ rpName: "My App" })
+ * ```
+ */
+declare class Passkey {
+  readonly id: string;
+  readonly type: "passkey";
+  readonly config: PasskeyConfig;
+  constructor(config?: PasskeyConfig);
+}
+//#endregion
+export { Passkey };
+//# sourceMappingURL=passkey.d.ts.map

package/dist/component/providers/passkey.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"passkey.d.ts","names":[],"sources":["../../../src/providers/passkey.ts"],"mappings":";;AAiBA;;;;;;;;;;;;;UAAiB,aAAA;EAkBM;EAhBrB,MAAA;EAgCkB;EA9BlB,IAAA;EAmCsC;EAjCtC,MAAA;EA8BS;EA5BT,WAAA;EA6BiB;EA3BjB,gBAAA;EA6BoB;EA3BpB,WAAA;EA2BsC;EAzBtC,uBAAA;;EAEA,UAAA;;EAEA,qBAAA;AAAA;;;;;;;;;;;;;;cAgBW,OAAA;EAAA,SACF,EAAA;EAAA,SACA,IAAA;EAAA,SACA,MAAA,EAAQ,aAAA;cAEL,MAAA,GAAQ,aAAA;AAAA"}

package/dist/component/providers/password.d.ts

@@ -0,0 +1,88 @@
+import { CredentialsConfig } from "./credentials.js";
+import { EmailConfig, GenericActionCtxWithAuthConfig } from "../server/types.js";
+import { DocumentByName, GenericDataModel, WithoutSystemFields } from "convex/server";
+import { Value } from "convex/values";
+
+//#region src/providers/password.d.ts
+/**
+ * The available options to a {@link Password} provider for Convex Auth.
+ */
+interface PasswordConfig<DataModel extends GenericDataModel> {
+  /**
+   * Uniquely identifies the provider, allowing to use
+   * multiple different {@link Password} providers.
+   */
+  id?: string;
+  /**
+   * Perform checks on provided params and customize the user
+   * information stored after sign up, including email normalization.
+   *
+   * Called for every flow ("signUp", "signIn", "reset",
+   * "reset-verification" and "email-verification").
+   */
+  profile?: (
+  /**
+   * The values passed to the `signIn` function.
+   */
+  params: Record<string, Value | undefined>,
+  /**
+   * Convex ActionCtx in case you want to read from or write to
+   * the database.
+   */
+  ctx: GenericActionCtxWithAuthConfig<DataModel>) => WithoutSystemFields<DocumentByName<DataModel, "User">> & {
+    email: string;
+  };
+  /**
+   * Performs custom validation on password provided during sign up or reset.
+   *
+   * Otherwise the default validation is used (password is not empty and
+   * at least 8 characters in length).
+   *
+   * If the provided password is invalid, implementations must throw an Error.
+   *
+   * @param password the password supplied during "signUp" or
+   *                 "reset-verification" flows.
+   */
+  validatePasswordRequirements?: (password: string) => void;
+  /**
+   * Provide hashing and verification functions if you want to control
+   * how passwords are hashed.
+   */
+  crypto?: CredentialsConfig["crypto"];
+  /**
+   * An email provider used to require verification
+   * before password reset.
+   */
+  reset?: EmailConfig | ((...args: any) => EmailConfig);
+  /**
+   * An email provider used to require verification
+   * before sign up / sign in.
+   */
+  verify?: EmailConfig | ((...args: any) => EmailConfig);
+}
+/**
+ * Email and password authentication provider.
+ *
+ * Passwords are by default hashed using scrypt.
+ * You can customize the hashing via the `crypto` option.
+ *
+ * Email verification is not required unless you pass
+ * an email provider to the `verify` option.
+ *
+ * @example
+ * ```ts
+ * import { Password } from "@robelest/convex-auth/providers";
+ *
+ * new Password()
+ * new Password({ verify: myEmailProvider })
+ * ```
+ */
+declare class Password<DataModel extends GenericDataModel = GenericDataModel> {
+  readonly id: string;
+  readonly type: "credentials";
+  readonly config: PasswordConfig<DataModel>;
+  constructor(config?: PasswordConfig<DataModel>);
+}
+//#endregion
+export { Password };
+//# sourceMappingURL=password.d.ts.map

package/dist/component/providers/password.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"password.d.ts","names":[],"sources":["../../../src/providers/password.ts"],"mappings":";;;;;;;;;UA4CiB,cAAA,mBAAiC,gBAAA;EAiBvB;;;;EAZzB,EAAA;EAkBK;;;;;;;EAVL,OAAA;EAkCA;;;EA9BE,MAAA,EAAQ,MAAA,SAAe,KAAA;EAmCzB;;;;EA9BE,GAAA,EAAK,8BAAA,CAA+B,SAAA,MACjC,mBAAA,CAAoB,cAAA,CAAe,SAAA;IACtC,KAAA;EAAA;EA2EiB;;;;;;;;;;;EA9DnB,4BAAA,IAAgC,QAAA;EA8DyB;;;;EAzDzD,MAAA,GAAS,iBAAA;EA4DuB;;;;EAvDhC,KAAA,GAAQ,WAAA,QAAmB,IAAA,UAAc,WAAA;EA0D4B;;;;EArDrE,MAAA,GAAS,WAAA,QAAmB,IAAA,UAAc,WAAA;AAAA;;;;;;;;;;;;;;;;;;cA+C/B,QAAA,mBAA2B,gBAAA,GAAmB,gBAAA;EAAA,SAChD,EAAA;EAAA,SACA,IAAA;EAAA,SACA,MAAA,EAAQ,cAAA,CAAe,SAAA;cAG9B,MAAA,GAAQ,cAAA,CAAe,SAAA;AAAA"}

package/dist/component/providers/phone.d.ts

@@ -0,0 +1,48 @@
+import { PhoneConfig } from "../server/types.js";
+
+//#region src/providers/phone.d.ts
+/**
+ * User-facing configuration for the {@link Phone} provider.
+ *
+ * Use this to send SMS or other phone-based verification messages during
+ * sign-in.
+ */
+interface PhoneProviderConfig {
+  /** Send the verification code to the user's phone. */
+  send: PhoneConfig["sendVerificationRequest"];
+  /** Provider ID override. Defaults to "phone". */
+  id?: string;
+  /** Token expiration in seconds. Defaults to 1200 (20 minutes). */
+  maxAge?: number;
+}
+/**
+ * Phone provider for SMS or phone-number verification flows.
+ *
+ * Wraps your `send()` implementation and materializes the runtime behavior
+ * Convex Auth needs for short-code or magic-link-style phone verification.
+ *
+ * @example
+ * ```ts
+ * import { Phone } from "@robelest/convex-auth/providers";
+ *
+ * const phone = new Phone({
+ *   send: async ({ identifier, token }) => {
+ *     await sms.send({ to: identifier, body: `Your sign-in code is ${token}` });
+ *   },
+ * });
+ * ```
+ */
+declare class Phone {
+  readonly config: PhoneProviderConfig;
+  readonly id: string;
+  readonly type: "phone";
+  /**
+   * Create a phone provider instance.
+   *
+   * @param config - Phone delivery and provider settings.
+   */
+  constructor(config: PhoneProviderConfig);
+}
+//#endregion
+export { Phone };
+//# sourceMappingURL=phone.d.ts.map

package/dist/component/providers/phone.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"phone.d.ts","names":[],"sources":["../../../src/providers/phone.ts"],"mappings":";;;;;;;;;UAgBiB,mBAAA;EA0BJ;EAxBX,IAAA,EAAM,WAAA;;EAEN,EAAA;EA+B4B;EA7B5B,MAAA;AAAA;;;;;;;;;;;;;;;;;;cAoBW,KAAA;EAAA,SASiB,MAAA,EAAQ,mBAAA;EAAA,SAR3B,EAAA;EAAA,SACA,IAAA;;;;;;cAOmB,MAAA,EAAQ,mBAAA;AAAA"}

package/dist/component/providers/sso.d.ts

@@ -0,0 +1,50 @@
+//#region src/providers/sso.d.ts
+/**
+ * Enterprise SSO provider (OIDC + SAML + SCIM).
+ *
+ * Adding `new SSO()` to your providers list enables enterprise SSO
+ * sign-in flows and registers the OIDC, SAML, and SCIM runtime HTTP
+ * routes. It also makes `auth.sso.*` available on the auth
+ * object returned by `createAuth`.
+ *
+ * ```ts
+ * import { SSO } from "@robelest/convex-auth/providers";
+ *
+ * const auth = createAuth(components.auth, {
+ *   providers: [new SSO(), new Password()],
+ * });
+ *
+ * // auth.sso is now available
+ * await auth.sso.admin.oidc.configure(ctx, { enterpriseId, clientId, ... });
+ * ```
+ *
+ * Without `new SSO()` in the providers list, `auth.sso` is not
+ * present on the returned object and accessing it is a TypeScript error.
+ *
+ * @module
+ */
+/**
+ * Enterprise SSO provider.
+ *
+ * Zero-configuration — sensible defaults are applied for all enterprise
+ * protocols (OIDC, SAML, SCIM). Per-tenant configuration is done at
+ * runtime via `auth.sso.*` helpers.
+ *
+ * @example
+ * ```ts
+ * import { createAuth } from "@robelest/convex-auth/component";
+ * import { SSO, Password } from "@robelest/convex-auth/providers";
+ * import { components } from "./_generated/api";
+ *
+ * export const auth = createAuth(components.auth, {
+ *   providers: [new SSO(), new Password()],
+ * });
+ * ```
+ */
+declare class SSO {
+  readonly id = "enterprise-sso";
+  readonly type: "sso";
+}
+//#endregion
+export { SSO };
+//# sourceMappingURL=sso.d.ts.map

package/dist/component/providers/sso.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sso.d.ts","names":[],"sources":["../../../src/providers/sso.ts"],"mappings":";;AA6CA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;cAAa,GAAA;EAAA,SACF,EAAA;EAAA,SACA,IAAA;AAAA"}

package/dist/component/providers/totp.d.ts

@@ -0,0 +1,45 @@
+//#region src/providers/totp.d.ts
+/**
+ * TOTP (Time-based One-Time Password) two-factor authentication provider.
+ *
+ * ```ts
+ * import { Totp } from "@robelest/convex-auth/providers";
+ *
+ * new Totp({ issuer: "My App" })
+ * ```
+ *
+ * @module
+ */
+/**
+ * Configuration for the TOTP provider.
+ */
+interface TotpConfig {
+  /** Issuer name shown in authenticator apps (e.g. "My App"). */
+  issuer?: string;
+  /** Number of digits in each code (default: 6). */
+  digits?: number;
+  /** Time period in seconds for code rotation (default: 30). */
+  period?: number;
+}
+/**
+ * TOTP (Time-based One-Time Password) two-factor authentication provider.
+ *
+ * Generates time-based one-time passwords compatible with authenticator
+ * apps like Google Authenticator and Authy.
+ *
+ * @example
+ * ```ts
+ * import { Totp } from "@robelest/convex-auth/providers";
+ *
+ * new Totp({ issuer: "My App" })
+ * ```
+ */
+declare class Totp {
+  readonly id: string;
+  readonly type: "totp";
+  readonly config: TotpConfig;
+  constructor(config?: TotpConfig);
+}
+//#endregion
+export { Totp };
+//# sourceMappingURL=totp.d.ts.map

package/dist/component/providers/totp.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"totp.d.ts","names":[],"sources":["../../../src/providers/totp.ts"],"mappings":";;AAiBA;;;;;;;;;AAsBA;;;;UAtBiB,UAAA;EAwBN;EAtBT,MAAA;EAuBiB;EArBjB,MAAA;EAuBoB;EArBpB,MAAA;AAAA;;;;;;;;;;;;;;cAgBW,IAAA;EAAA,SACF,EAAA;EAAA,SACA,IAAA;EAAA,SACA,MAAA,EAAQ,UAAA;cAEL,MAAA,GAAQ,UAAA;AAAA"}

package/dist/component/public/enterprise/audit.d.ts

@@ -0,0 +1,73 @@
+declare namespace audit_d_exports {
+  export { enterpriseAuditEventCreate, enterpriseAuditEventList };
+}
+/**
+ * Record a new audit event for an enterprise.
+ *
+ * Inserts an immutable audit log entry capturing who performed what action,
+ * on which subject, and whether it succeeded or failed. Use this to maintain
+ * a tamper-evident trail of security-relevant events.
+ *
+ * @param args.enterpriseId - The ID of the enterprise this event belongs to.
+ * @param args.groupId - The ID of the root group that owns the enterprise.
+ * @param args.eventType - A string identifying the type of event (e.g. `"user.login"`, `"scim.provision"`).
+ * @param args.actorType - The kind of actor: `"user"`, `"system"`, `"scim"`, `"api_key"`, or `"webhook"`.
+ * @param args.actorId - An optional identifier for the actor (e.g. a user ID or API key ID).
+ * @param args.subjectType - The type of the resource being acted upon (e.g. `"user"`, `"group"`).
+ * @param args.subjectId - An optional identifier for the subject resource.
+ * @param args.status - Whether the event represents a `"success"` or `"failure"`.
+ * @param args.occurredAt - Epoch timestamp (ms) when the event occurred.
+ * @param args.requestId - An optional correlation ID tying this event to a specific request.
+ * @param args.ip - An optional IP address of the actor.
+ * @param args.metadata - An optional arbitrary object with additional event details.
+ * @returns The ID of the newly created `EnterpriseAuditEvent` document.
+ *
+ * @example
+ * ```ts
+ * const eventId = await ctx.runMutation(
+ *   components.auth.enterprise.enterpriseAuditEventCreate,
+ *   {
+ *     enterpriseId,
+ *     groupId: orgGroupId,
+ *     eventType: "user.login",
+ *     actorType: "user",
+ *     actorId: userId,
+ *     subjectType: "session",
+ *     subjectId: sessionId,
+ *     status: "success",
+ *     occurredAt: Date.now(),
+ *     ip: "203.0.113.42",
+ *   },
+ * );
+ * ```
+ */
+declare const enterpriseAuditEventCreate: any;
+/**
+ * List audit events, optionally filtered by enterprise or group.
+ *
+ * Returns audit events in reverse chronological order. When `enterpriseId` is
+ * provided, events are filtered using the `enterprise_id_occurred_at` index.
+ * When only `groupId` is provided, the `group_id_occurred_at` index is used.
+ * If neither filter is given, the most recent events across all enterprises
+ * are returned.
+ *
+ * @param args.enterpriseId - An optional enterprise ID to scope events to a single enterprise.
+ * @param args.groupId - An optional group ID to scope events to a single group.
+ * @param args.limit - Maximum number of events to return (clamped between 1 and 100, defaults to 50).
+ * @returns An array of audit event documents, most recent first.
+ *
+ * @example
+ * ```ts
+ * const events = await ctx.runQuery(
+ *   components.auth.enterprise.enterpriseAuditEventList,
+ *   { enterpriseId, limit: 20 },
+ * );
+ * for (const event of events) {
+ *   console.log(event.eventType, event.actorType, event.status);
+ * }
+ * ```
+ */
+declare const enterpriseAuditEventList: any;
+//#endregion
+export { audit_d_exports, enterpriseAuditEventCreate, enterpriseAuditEventList };
+//# sourceMappingURL=audit.d.ts.map

package/dist/component/public/enterprise/audit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit.d.ts","names":[],"sources":["../../../../src/component/public/enterprise/audit.ts"],"mappings":";;;;;;;;;;AA4CA;;;;;AA8CA;;;;;;;;;;;;;;;;;;;;;;;;;;;;cA9Ca,0BAAA;;;;;;;;;;;;;;;;;;;;;;;;;;cA8CA,wBAAA"}

package/dist/component/public/enterprise/audit.js

@@ -0,0 +1,108 @@
+import { mutation, query } from "../../functions.js";
+import { vAuditActorType, vAuditStatus, vEnterpriseAuditEventDoc } from "../../model.js";
+import { v } from "convex/values";
+
+//#region src/component/public/enterprise/audit.ts
+/**
+* Record a new audit event for an enterprise.
+*
+* Inserts an immutable audit log entry capturing who performed what action,
+* on which subject, and whether it succeeded or failed. Use this to maintain
+* a tamper-evident trail of security-relevant events.
+*
+* @param args.enterpriseId - The ID of the enterprise this event belongs to.
+* @param args.groupId - The ID of the root group that owns the enterprise.
+* @param args.eventType - A string identifying the type of event (e.g. `"user.login"`, `"scim.provision"`).
+* @param args.actorType - The kind of actor: `"user"`, `"system"`, `"scim"`, `"api_key"`, or `"webhook"`.
+* @param args.actorId - An optional identifier for the actor (e.g. a user ID or API key ID).
+* @param args.subjectType - The type of the resource being acted upon (e.g. `"user"`, `"group"`).
+* @param args.subjectId - An optional identifier for the subject resource.
+* @param args.status - Whether the event represents a `"success"` or `"failure"`.
+* @param args.occurredAt - Epoch timestamp (ms) when the event occurred.
+* @param args.requestId - An optional correlation ID tying this event to a specific request.
+* @param args.ip - An optional IP address of the actor.
+* @param args.metadata - An optional arbitrary object with additional event details.
+* @returns The ID of the newly created `EnterpriseAuditEvent` document.
+*
+* @example
+* ```ts
+* const eventId = await ctx.runMutation(
+*   components.auth.enterprise.enterpriseAuditEventCreate,
+*   {
+*     enterpriseId,
+*     groupId: orgGroupId,
+*     eventType: "user.login",
+*     actorType: "user",
+*     actorId: userId,
+*     subjectType: "session",
+*     subjectId: sessionId,
+*     status: "success",
+*     occurredAt: Date.now(),
+*     ip: "203.0.113.42",
+*   },
+* );
+* ```
+*/
+const enterpriseAuditEventCreate = mutation({
+	args: {
+		enterpriseId: v.id("Enterprise"),
+		groupId: v.id("Group"),
+		eventType: v.string(),
+		actorType: vAuditActorType,
+		actorId: v.optional(v.string()),
+		subjectType: v.string(),
+		subjectId: v.optional(v.string()),
+		status: vAuditStatus,
+		occurredAt: v.number(),
+		requestId: v.optional(v.string()),
+		ip: v.optional(v.string()),
+		metadata: v.optional(v.any())
+	},
+	returns: v.id("EnterpriseAuditEvent"),
+	handler: async (ctx, args) => {
+		return await ctx.db.insert("EnterpriseAuditEvent", args);
+	}
+});
+/**
+* List audit events, optionally filtered by enterprise or group.
+*
+* Returns audit events in reverse chronological order. When `enterpriseId` is
+* provided, events are filtered using the `enterprise_id_occurred_at` index.
+* When only `groupId` is provided, the `group_id_occurred_at` index is used.
+* If neither filter is given, the most recent events across all enterprises
+* are returned.
+*
+* @param args.enterpriseId - An optional enterprise ID to scope events to a single enterprise.
+* @param args.groupId - An optional group ID to scope events to a single group.
+* @param args.limit - Maximum number of events to return (clamped between 1 and 100, defaults to 50).
+* @returns An array of audit event documents, most recent first.
+*
+* @example
+* ```ts
+* const events = await ctx.runQuery(
+*   components.auth.enterprise.enterpriseAuditEventList,
+*   { enterpriseId, limit: 20 },
+* );
+* for (const event of events) {
+*   console.log(event.eventType, event.actorType, event.status);
+* }
+* ```
+*/
+const enterpriseAuditEventList = query({
+	args: {
+		enterpriseId: v.optional(v.id("Enterprise")),
+		groupId: v.optional(v.id("Group")),
+		limit: v.optional(v.number())
+	},
+	returns: v.array(vEnterpriseAuditEventDoc),
+	handler: async (ctx, args) => {
+		const limit = Math.min(Math.max(args.limit ?? 50, 1), 100);
+		if (args.enterpriseId !== void 0) return await ctx.db.query("EnterpriseAuditEvent").withIndex("enterprise_id_occurred_at", (idx) => idx.eq("enterpriseId", args.enterpriseId)).order("desc").take(limit);
+		if (args.groupId !== void 0) return await ctx.db.query("EnterpriseAuditEvent").withIndex("group_id_occurred_at", (idx) => idx.eq("groupId", args.groupId)).order("desc").take(limit);
+		return await ctx.db.query("EnterpriseAuditEvent").order("desc").take(limit);
+	}
+});
+
+//#endregion
+export { enterpriseAuditEventCreate, enterpriseAuditEventList };
+//# sourceMappingURL=audit.js.map

package/dist/component/public/enterprise/audit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit.js","names":[],"sources":["../../../../src/component/public/enterprise/audit.ts"],"sourcesContent":["import { v } from \"convex/values\";\nimport { mutation, query } from \"../../functions\";\nimport { vAuditActorType, vAuditStatus, vEnterpriseAuditEventDoc } from \"../../model\";\n\n/**\n * Record a new audit event for an enterprise.\n *\n * Inserts an immutable audit log entry capturing who performed what action,\n * on which subject, and whether it succeeded or failed. Use this to maintain\n * a tamper-evident trail of security-relevant events.\n *\n * @param args.enterpriseId - The ID of the enterprise this event belongs to.\n * @param args.groupId - The ID of the root group that owns the enterprise.\n * @param args.eventType - A string identifying the type of event (e.g. `\"user.login\"`, `\"scim.provision\"`).\n * @param args.actorType - The kind of actor: `\"user\"`, `\"system\"`, `\"scim\"`, `\"api_key\"`, or `\"webhook\"`.\n * @param args.actorId - An optional identifier for the actor (e.g. a user ID or API key ID).\n * @param args.subjectType - The type of the resource being acted upon (e.g. `\"user\"`, `\"group\"`).\n * @param args.subjectId - An optional identifier for the subject resource.\n * @param args.status - Whether the event represents a `\"success\"` or `\"failure\"`.\n * @param args.occurredAt - Epoch timestamp (ms) when the event occurred.\n * @param args.requestId - An optional correlation ID tying this event to a specific request.\n * @param args.ip - An optional IP address of the actor.\n * @param args.metadata - An optional arbitrary object with additional event details.\n * @returns The ID of the newly created `EnterpriseAuditEvent` document.\n *\n * @example\n * ```ts\n * const eventId = await ctx.runMutation(\n *   components.auth.enterprise.enterpriseAuditEventCreate,\n *   {\n *     enterpriseId,\n *     groupId: orgGroupId,\n *     eventType: \"user.login\",\n *     actorType: \"user\",\n *     actorId: userId,\n *     subjectType: \"session\",\n *     subjectId: sessionId,\n *     status: \"success\",\n *     occurredAt: Date.now(),\n *     ip: \"203.0.113.42\",\n *   },\n * );\n * ```\n */\nexport const enterpriseAuditEventCreate = mutation({\n  args: {\n    enterpriseId: v.id(\"Enterprise\"),\n    groupId: v.id(\"Group\"),\n    eventType: v.string(),\n    actorType: vAuditActorType,\n    actorId: v.optional(v.string()),\n    subjectType: v.string(),\n    subjectId: v.optional(v.string()),\n    status: vAuditStatus,\n    occurredAt: v.number(),\n    requestId: v.optional(v.string()),\n    ip: v.optional(v.string()),\n    metadata: v.optional(v.any()),\n  },\n  returns: v.id(\"EnterpriseAuditEvent\"),\n  handler: async (ctx, args) => {\n    return await ctx.db.insert(\"EnterpriseAuditEvent\", args);\n  },\n});\n\n/**\n * List audit events, optionally filtered by enterprise or group.\n *\n * Returns audit events in reverse chronological order. When `enterpriseId` is\n * provided, events are filtered using the `enterprise_id_occurred_at` index.\n * When only `groupId` is provided, the `group_id_occurred_at` index is used.\n * If neither filter is given, the most recent events across all enterprises\n * are returned.\n *\n * @param args.enterpriseId - An optional enterprise ID to scope events to a single enterprise.\n * @param args.groupId - An optional group ID to scope events to a single group.\n * @param args.limit - Maximum number of events to return (clamped between 1 and 100, defaults to 50).\n * @returns An array of audit event documents, most recent first.\n *\n * @example\n * ```ts\n * const events = await ctx.runQuery(\n *   components.auth.enterprise.enterpriseAuditEventList,\n *   { enterpriseId, limit: 20 },\n * );\n * for (const event of events) {\n *   console.log(event.eventType, event.actorType, event.status);\n * }\n * ```\n */\nexport const enterpriseAuditEventList = query({\n  args: {\n    enterpriseId: v.optional(v.id(\"Enterprise\")),\n    groupId: v.optional(v.id(\"Group\")),\n    limit: v.optional(v.number()),\n  },\n  returns: v.array(vEnterpriseAuditEventDoc),\n  handler: async (ctx, args) => {\n    const limit = Math.min(Math.max(args.limit ?? 50, 1), 100);\n    if (args.enterpriseId !== undefined) {\n      return await ctx.db\n        .query(\"EnterpriseAuditEvent\")\n        .withIndex(\"enterprise_id_occurred_at\", (idx) =>\n          idx.eq(\"enterpriseId\", args.enterpriseId!),\n        )\n        .order(\"desc\")\n        .take(limit);\n    }\n    if (args.groupId !== undefined) {\n      return await ctx.db\n        .query(\"EnterpriseAuditEvent\")\n        .withIndex(\"group_id_occurred_at\", (idx) =>\n          idx.eq(\"groupId\", args.groupId!),\n        )\n        .order(\"desc\")\n        .take(limit);\n    }\n    return await ctx.db.query(\"EnterpriseAuditEvent\").order(\"desc\").take(limit);\n  },\n});\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA4CA,MAAa,6BAA6B,SAAS;CACjD,MAAM;EACJ,cAAc,EAAE,GAAG,aAAa;EAChC,SAAS,EAAE,GAAG,QAAQ;EACtB,WAAW,EAAE,QAAQ;EACrB,WAAW;EACX,SAAS,EAAE,SAAS,EAAE,QAAQ,CAAC;EAC/B,aAAa,EAAE,QAAQ;EACvB,WAAW,EAAE,SAAS,EAAE,QAAQ,CAAC;EACjC,QAAQ;EACR,YAAY,EAAE,QAAQ;EACtB,WAAW,EAAE,SAAS,EAAE,QAAQ,CAAC;EACjC,IAAI,EAAE,SAAS,EAAE,QAAQ,CAAC;EAC1B,UAAU,EAAE,SAAS,EAAE,KAAK,CAAC;EAC9B;CACD,SAAS,EAAE,GAAG,uBAAuB;CACrC,SAAS,OAAO,KAAK,SAAS;AAC5B,SAAO,MAAM,IAAI,GAAG,OAAO,wBAAwB,KAAK;;CAE3D,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;AA2BF,MAAa,2BAA2B,MAAM;CAC5C,MAAM;EACJ,cAAc,EAAE,SAAS,EAAE,GAAG,aAAa,CAAC;EAC5C,SAAS,EAAE,SAAS,EAAE,GAAG,QAAQ,CAAC;EAClC,OAAO,EAAE,SAAS,EAAE,QAAQ,CAAC;EAC9B;CACD,SAAS,EAAE,MAAM,yBAAyB;CAC1C,SAAS,OAAO,KAAK,SAAS;EAC5B,MAAM,QAAQ,KAAK,IAAI,KAAK,IAAI,KAAK,SAAS,IAAI,EAAE,EAAE,IAAI;AAC1D,MAAI,KAAK,iBAAiB,OACxB,QAAO,MAAM,IAAI,GACd,MAAM,uBAAuB,CAC7B,UAAU,8BAA8B,QACvC,IAAI,GAAG,gBAAgB,KAAK,aAAc,CAC3C,CACA,MAAM,OAAO,CACb,KAAK,MAAM;AAEhB,MAAI,KAAK,YAAY,OACnB,QAAO,MAAM,IAAI,GACd,MAAM,uBAAuB,CAC7B,UAAU,yBAAyB,QAClC,IAAI,GAAG,WAAW,KAAK,QAAS,CACjC,CACA,MAAM,OAAO,CACb,KAAK,MAAM;AAEhB,SAAO,MAAM,IAAI,GAAG,MAAM,uBAAuB,CAAC,MAAM,OAAO,CAAC,KAAK,MAAM;;CAE9E,CAAC"}