@seamless-auth/types 0.8.0 → 0.10.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +51 -0
- package/dist/schemas/admin/schema.d.ts +39 -0
- package/dist/schemas/admin/schema.d.ts.map +1 -1
- package/dist/schemas/admin/schema.js +33 -0
- package/dist/schemas/admin/schema.js.map +1 -1
- package/dist/schemas/authEvent/schema.d.ts +3 -0
- package/dist/schemas/authEvent/schema.d.ts.map +1 -1
- package/dist/schemas/authEvent/schema.js +11 -0
- package/dist/schemas/authEvent/schema.js.map +1 -1
- package/dist/schemas/metrics/schema.d.ts +2 -0
- package/dist/schemas/metrics/schema.d.ts.map +1 -1
- package/package.json +1 -1
- package/src/schemas/admin/schema.ts +39 -0
- package/src/schemas/authEvent/schema.ts +11 -0
package/CHANGELOG.md
CHANGED
|
@@ -1,5 +1,56 @@
|
|
|
1
1
|
# @seamless-auth/types
|
|
2
2
|
|
|
3
|
+
## 0.10.0
|
|
4
|
+
|
|
5
|
+
### Minor Changes
|
|
6
|
+
|
|
7
|
+
- 05e3897: Record who performed an audited action, not only who it happened to.
|
|
8
|
+
|
|
9
|
+
`AuthEventSchema` gains `actor_user_id`, and `AuthEventQuerySchema` gains an
|
|
10
|
+
`actorUserId` filter.
|
|
11
|
+
|
|
12
|
+
An administrator acting on someone else's account is recorded with the target in
|
|
13
|
+
`user_id` and the administrator in `actor_user_id`. Without it an administrative
|
|
14
|
+
event reads as though the user did it to themselves, which makes reviewing
|
|
15
|
+
administrative action after the fact impossible.
|
|
16
|
+
|
|
17
|
+
Additive and backward compatible. The field is nullable and optional, so events
|
|
18
|
+
written before the column existed still parse, as do events from a server that
|
|
19
|
+
does not populate it. `actorUserId` on the query schema is optional and unset
|
|
20
|
+
when absent.
|
|
21
|
+
|
|
22
|
+
## 0.9.0
|
|
23
|
+
|
|
24
|
+
### Minor Changes
|
|
25
|
+
|
|
26
|
+
- da415ff: Require identity proofing on admin-assisted device replacement.
|
|
27
|
+
|
|
28
|
+
**Breaking for callers of `DeviceReplacementRecoverySchema`.** The schema now
|
|
29
|
+
requires a `proofing` object:
|
|
30
|
+
|
|
31
|
+
```ts
|
|
32
|
+
proofing: {
|
|
33
|
+
method: 'in_person' | 'remote_exception';
|
|
34
|
+
evidenceRef: string; // a ticket or case number, not the evidence itself
|
|
35
|
+
approver?: string; // required when method is 'remote_exception'
|
|
36
|
+
}
|
|
37
|
+
```
|
|
38
|
+
|
|
39
|
+
Admin-assisted recovery revokes every session, removes every passkey and
|
|
40
|
+
disables TOTP, so it is the step social engineering aims at. It previously
|
|
41
|
+
carried no record of how the operator established who they were talking to, which
|
|
42
|
+
made a recovery impossible to review after the fact.
|
|
43
|
+
|
|
44
|
+
`in_person` is the default path and needs no approver. `remote_exception` is the
|
|
45
|
+
documented exception and does not validate without a named approver, so taking
|
|
46
|
+
the weaker path is a deliberate act with someone's name attached.
|
|
47
|
+
|
|
48
|
+
`evidenceRef` is a pointer rather than the evidence. It ends up in the audit
|
|
49
|
+
trail, where identifiers are redacted, so personal data does not belong in it.
|
|
50
|
+
|
|
51
|
+
Callers sending `{}` and relying on the clearing defaults will now fail
|
|
52
|
+
validation. Those defaults are unchanged.
|
|
53
|
+
|
|
3
54
|
## 0.8.0
|
|
4
55
|
|
|
5
56
|
### Minor Changes
|
|
@@ -3,15 +3,52 @@ export declare const UserIdParamSchema: z.ZodObject<{
|
|
|
3
3
|
userId: z.ZodString;
|
|
4
4
|
}, z.core.$strip>;
|
|
5
5
|
export type UserIdParam = z.infer<typeof UserIdParamSchema>;
|
|
6
|
+
export declare const RecoveryProofingMethodSchema: z.ZodEnum<{
|
|
7
|
+
in_person: "in_person";
|
|
8
|
+
remote_exception: "remote_exception";
|
|
9
|
+
}>;
|
|
10
|
+
export type RecoveryProofingMethod = z.infer<typeof RecoveryProofingMethodSchema>;
|
|
11
|
+
/**
|
|
12
|
+
* How the operator established that the person asking is who they say they are.
|
|
13
|
+
*
|
|
14
|
+
* Admin-assisted recovery revokes every session, removes every passkey and
|
|
15
|
+
* disables TOTP, so it is the step social engineering aims at. Recording the
|
|
16
|
+
* proofing makes a recovery reviewable after the fact and forces the operator to
|
|
17
|
+
* have done it.
|
|
18
|
+
*
|
|
19
|
+
* `evidenceRef` is a pointer, for example a ticket or case number, not the
|
|
20
|
+
* evidence itself. Do not put personal data here: it is written to the audit
|
|
21
|
+
* trail, where identifiers are redacted.
|
|
22
|
+
*/
|
|
23
|
+
export declare const RecoveryProofingSchema: z.ZodObject<{
|
|
24
|
+
method: z.ZodEnum<{
|
|
25
|
+
in_person: "in_person";
|
|
26
|
+
remote_exception: "remote_exception";
|
|
27
|
+
}>;
|
|
28
|
+
evidenceRef: z.ZodString;
|
|
29
|
+
approver: z.ZodOptional<z.ZodString>;
|
|
30
|
+
}, z.core.$strict>;
|
|
31
|
+
export type RecoveryProofing = z.infer<typeof RecoveryProofingSchema>;
|
|
6
32
|
/**
|
|
7
33
|
* What an operator clears when a user replaces a lost device. Each step is
|
|
8
34
|
* opt-out rather than opt-in so a hurried recovery does not leave the old
|
|
9
35
|
* device's credentials in place.
|
|
36
|
+
*
|
|
37
|
+
* `proofing` is required: this endpoint cannot be called without stating how
|
|
38
|
+
* identity was established.
|
|
10
39
|
*/
|
|
11
40
|
export declare const DeviceReplacementRecoverySchema: z.ZodObject<{
|
|
12
41
|
revokeSessions: z.ZodDefault<z.ZodBoolean>;
|
|
13
42
|
removePasskeys: z.ZodDefault<z.ZodBoolean>;
|
|
14
43
|
disableTotp: z.ZodDefault<z.ZodBoolean>;
|
|
44
|
+
proofing: z.ZodObject<{
|
|
45
|
+
method: z.ZodEnum<{
|
|
46
|
+
in_person: "in_person";
|
|
47
|
+
remote_exception: "remote_exception";
|
|
48
|
+
}>;
|
|
49
|
+
evidenceRef: z.ZodString;
|
|
50
|
+
approver: z.ZodOptional<z.ZodString>;
|
|
51
|
+
}, z.core.$strict>;
|
|
15
52
|
}, z.core.$strict>;
|
|
16
53
|
export type DeviceReplacementRecoveryRequest = z.infer<typeof DeviceReplacementRecoverySchema>;
|
|
17
54
|
export declare const DeviceReplacementRecoveryResponseSchema: z.ZodObject<{
|
|
@@ -73,6 +110,7 @@ export declare const AdminUserDetailResponseSchema: z.ZodObject<{
|
|
|
73
110
|
events: z.ZodArray<z.ZodObject<{
|
|
74
111
|
id: z.ZodString;
|
|
75
112
|
user_id: z.ZodOptional<z.ZodNullable<z.ZodString>>;
|
|
113
|
+
actor_user_id: z.ZodOptional<z.ZodNullable<z.ZodString>>;
|
|
76
114
|
type: z.ZodString;
|
|
77
115
|
ip_address: z.ZodOptional<z.ZodNullable<z.ZodString>>;
|
|
78
116
|
user_agent: z.ZodOptional<z.ZodNullable<z.ZodString>>;
|
|
@@ -86,6 +124,7 @@ export declare const AdminUserAnomaliesResponseSchema: z.ZodObject<{
|
|
|
86
124
|
suspiciousEvents: z.ZodArray<z.ZodObject<{
|
|
87
125
|
id: z.ZodString;
|
|
88
126
|
user_id: z.ZodOptional<z.ZodNullable<z.ZodString>>;
|
|
127
|
+
actor_user_id: z.ZodOptional<z.ZodNullable<z.ZodString>>;
|
|
89
128
|
type: z.ZodString;
|
|
90
129
|
ip_address: z.ZodOptional<z.ZodNullable<z.ZodString>>;
|
|
91
130
|
user_agent: z.ZodOptional<z.ZodNullable<z.ZodString>>;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../src/schemas/admin/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAMxB,eAAO,MAAM,iBAAiB;;iBAE5B,CAAC;AAEH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAE5D
|
|
1
|
+
{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../src/schemas/admin/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAMxB,eAAO,MAAM,iBAAiB;;iBAE5B,CAAC;AAEH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAE5D,eAAO,MAAM,4BAA4B;;;EAA4C,CAAC;AAEtF,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAElF;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,sBAAsB;;;;;;;kBAe/B,CAAC;AAEL,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAEtE;;;;;;;GAOG;AACH,eAAO,MAAM,+BAA+B;;;;;;;;;;;;kBAOjC,CAAC;AAEZ,MAAM,MAAM,gCAAgC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AAE/F,eAAO,MAAM,uCAAuC;;;;;iBAKlD,CAAC;AAEH,MAAM,MAAM,iCAAiC,GAAG,CAAC,CAAC,KAAK,CACrD,OAAO,uCAAuC,CAC/C,CAAC;AAEF,eAAO,MAAM,6BAA6B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAKxC,CAAC;AAEH,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AAEpF,eAAO,MAAM,gCAAgC;;;;;;;;;;;;;;iBAI3C,CAAC;AAEH,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gCAAgC,CAAC,CAAC"}
|
|
@@ -6,16 +6,49 @@ import { ApiUserSchema } from '../user/schema.js';
|
|
|
6
6
|
export const UserIdParamSchema = z.object({
|
|
7
7
|
userId: z.string(),
|
|
8
8
|
});
|
|
9
|
+
export const RecoveryProofingMethodSchema = z.enum(['in_person', 'remote_exception']);
|
|
10
|
+
/**
|
|
11
|
+
* How the operator established that the person asking is who they say they are.
|
|
12
|
+
*
|
|
13
|
+
* Admin-assisted recovery revokes every session, removes every passkey and
|
|
14
|
+
* disables TOTP, so it is the step social engineering aims at. Recording the
|
|
15
|
+
* proofing makes a recovery reviewable after the fact and forces the operator to
|
|
16
|
+
* have done it.
|
|
17
|
+
*
|
|
18
|
+
* `evidenceRef` is a pointer, for example a ticket or case number, not the
|
|
19
|
+
* evidence itself. Do not put personal data here: it is written to the audit
|
|
20
|
+
* trail, where identifiers are redacted.
|
|
21
|
+
*/
|
|
22
|
+
export const RecoveryProofingSchema = z
|
|
23
|
+
.object({
|
|
24
|
+
method: RecoveryProofingMethodSchema,
|
|
25
|
+
evidenceRef: z.string().trim().min(1).max(200),
|
|
26
|
+
approver: z.string().trim().min(1).max(200).optional(),
|
|
27
|
+
})
|
|
28
|
+
.strict()
|
|
29
|
+
.superRefine((value, ctx) => {
|
|
30
|
+
if (value.method === 'remote_exception' && !value.approver) {
|
|
31
|
+
ctx.addIssue({
|
|
32
|
+
code: 'custom',
|
|
33
|
+
path: ['approver'],
|
|
34
|
+
message: 'A remote exception requires a named approver',
|
|
35
|
+
});
|
|
36
|
+
}
|
|
37
|
+
});
|
|
9
38
|
/**
|
|
10
39
|
* What an operator clears when a user replaces a lost device. Each step is
|
|
11
40
|
* opt-out rather than opt-in so a hurried recovery does not leave the old
|
|
12
41
|
* device's credentials in place.
|
|
42
|
+
*
|
|
43
|
+
* `proofing` is required: this endpoint cannot be called without stating how
|
|
44
|
+
* identity was established.
|
|
13
45
|
*/
|
|
14
46
|
export const DeviceReplacementRecoverySchema = z
|
|
15
47
|
.object({
|
|
16
48
|
revokeSessions: z.boolean().default(true),
|
|
17
49
|
removePasskeys: z.boolean().default(true),
|
|
18
50
|
disableTotp: z.boolean().default(true),
|
|
51
|
+
proofing: RecoveryProofingSchema,
|
|
19
52
|
})
|
|
20
53
|
.strict();
|
|
21
54
|
export const DeviceReplacementRecoveryResponseSchema = z.object({
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"schema.js","sourceRoot":"","sources":["../../../src/schemas/admin/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAE,wBAAwB,EAAE,MAAM,yBAAyB,CAAC;AACnE,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAElD,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACxC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;CACnB,CAAC,CAAC;AAIH
|
|
1
|
+
{"version":3,"file":"schema.js","sourceRoot":"","sources":["../../../src/schemas/admin/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAE,wBAAwB,EAAE,MAAM,yBAAyB,CAAC;AACnE,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAElD,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACxC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;CACnB,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,kBAAkB,CAAC,CAAC,CAAC;AAItF;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC;KACpC,MAAM,CAAC;IACN,MAAM,EAAE,4BAA4B;IACpC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IAC9C,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;CACvD,CAAC;KACD,MAAM,EAAE;KACR,WAAW,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;IAC1B,IAAI,KAAK,CAAC,MAAM,KAAK,kBAAkB,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC;QAC3D,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,UAAU,CAAC;YAClB,OAAO,EAAE,8CAA8C;SACxD,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AAIL;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC;KAC7C,MAAM,CAAC;IACN,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IACzC,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IACzC,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IACtC,QAAQ,EAAE,sBAAsB;CACjC,CAAC;KACD,MAAM,EAAE,CAAC;AAIZ,MAAM,CAAC,MAAM,uCAAuC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9D,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IAC/C,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IAClD,uBAAuB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;CACxD,CAAC,CAAC;AAMH,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,CAAC,MAAM,CAAC;IACpD,IAAI,EAAE,aAAa;IACnB,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC;IAChC,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,wBAAwB,CAAC;IAC9C,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,eAAe,CAAC;CACjC,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC,MAAM,CAAC;IACvD,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,eAAe,CAAC;IAC1C,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAC/B,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;CACnC,CAAC,CAAC"}
|
|
@@ -80,6 +80,7 @@ export type AuthEventType = z.infer<typeof AuthEventTypeEnum>;
|
|
|
80
80
|
export declare const AuthEventSchema: z.ZodObject<{
|
|
81
81
|
id: z.ZodString;
|
|
82
82
|
user_id: z.ZodOptional<z.ZodNullable<z.ZodString>>;
|
|
83
|
+
actor_user_id: z.ZodOptional<z.ZodNullable<z.ZodString>>;
|
|
83
84
|
type: z.ZodString;
|
|
84
85
|
ip_address: z.ZodOptional<z.ZodNullable<z.ZodString>>;
|
|
85
86
|
user_agent: z.ZodOptional<z.ZodNullable<z.ZodString>>;
|
|
@@ -92,6 +93,7 @@ export declare const AuthEventQuerySchema: z.ZodObject<{
|
|
|
92
93
|
limit: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
|
|
93
94
|
offset: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
|
|
94
95
|
userId: z.ZodOptional<z.ZodString>;
|
|
96
|
+
actorUserId: z.ZodOptional<z.ZodString>;
|
|
95
97
|
type: z.ZodOptional<z.ZodUnion<readonly [z.ZodEnum<{
|
|
96
98
|
admin_device_replacement_recovery: "admin_device_replacement_recovery";
|
|
97
99
|
admin_session_revoked: "admin_session_revoked";
|
|
@@ -251,6 +253,7 @@ export declare const AuthEventsResponseSchema: z.ZodObject<{
|
|
|
251
253
|
events: z.ZodArray<z.ZodObject<{
|
|
252
254
|
id: z.ZodString;
|
|
253
255
|
user_id: z.ZodOptional<z.ZodNullable<z.ZodString>>;
|
|
256
|
+
actor_user_id: z.ZodOptional<z.ZodNullable<z.ZodString>>;
|
|
254
257
|
type: z.ZodString;
|
|
255
258
|
ip_address: z.ZodOptional<z.ZodNullable<z.ZodString>>;
|
|
256
259
|
user_agent: z.ZodOptional<z.ZodNullable<z.ZodString>>;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../src/schemas/authEvent/schema.ts"],"names":[],"mappings":"AAAA,OAAO,CAAC,MAAM,KAAK,CAAC;AAGpB,eAAO,MAAM,gBAAgB,gqDA2EnB,CAAC;AAEX,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAA2B,CAAC;AAE1D,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAI9D,eAAO,MAAM,eAAe
|
|
1
|
+
{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../src/schemas/authEvent/schema.ts"],"names":[],"mappings":"AAAA,OAAO,CAAC,MAAM,KAAK,CAAC;AAGpB,eAAO,MAAM,gBAAgB,gqDA2EnB,CAAC;AAEX,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAA2B,CAAC;AAE1D,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAI9D,eAAO,MAAM,eAAe;;;;;;;;;;iBAkB1B,CAAC;AAEH,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAExD,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAa/B,CAAC;AAEH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAElE,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;iBAGnC,CAAC;AAEH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC"}
|
|
@@ -82,6 +82,15 @@ export const AuthEventTypeEnum = z.enum(AUTH_EVENT_TYPES);
|
|
|
82
82
|
export const AuthEventSchema = z.object({
|
|
83
83
|
id: z.string(),
|
|
84
84
|
user_id: z.string().nullable().optional(),
|
|
85
|
+
/**
|
|
86
|
+
* Who performed the action, when that is not the subject of it.
|
|
87
|
+
*
|
|
88
|
+
* An administrator acting on someone else's account is recorded with the
|
|
89
|
+
* target in `user_id` and the administrator here. Null for the ordinary case
|
|
90
|
+
* where a user acted on their own account, and for events written before the
|
|
91
|
+
* column existed.
|
|
92
|
+
*/
|
|
93
|
+
actor_user_id: z.string().nullable().optional(),
|
|
85
94
|
type: z.string(),
|
|
86
95
|
ip_address: z.string().nullable().optional(),
|
|
87
96
|
user_agent: z.string().nullable().optional(),
|
|
@@ -93,6 +102,8 @@ export const AuthEventQuerySchema = z.object({
|
|
|
93
102
|
limit: z.coerce.number().min(1).max(100).default(10),
|
|
94
103
|
offset: z.coerce.number().min(0).default(0),
|
|
95
104
|
userId: z.string().optional(),
|
|
105
|
+
/** Filters to what one administrator did, rather than what happened to one user. */
|
|
106
|
+
actorUserId: z.string().optional(),
|
|
96
107
|
type: z
|
|
97
108
|
.union([AuthEventTypeEnum, z.string(), z.array(z.union([AuthEventTypeEnum, z.string()]))])
|
|
98
109
|
.optional(),
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"schema.js","sourceRoot":"","sources":["../../../src/schemas/authEvent/schema.ts"],"names":[],"mappings":"AAAA,OAAO,CAAC,MAAM,KAAK,CAAC;AACpB,OAAO,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC;AAE1C,MAAM,CAAC,MAAM,gBAAgB,GAAG;IAC9B,mCAAmC;IACnC,uBAAuB;IACvB,yBAAyB;IACzB,qBAAqB;IACrB,sBAAsB;IACtB,yBAAyB;IACzB,qBAAqB;IACrB,eAAe;IACf,gCAAgC;IAChC,aAAa;IACb,cAAc;IACd,iBAAiB;IACjB,iBAAiB;IACjB,cAAc;IACd,eAAe;IACf,kBAAkB;IAClB,eAAe;IACf,gBAAgB;IAChB,mBAAmB;IACnB,mBAAmB;IACnB,wCAAwC;IACxC,sBAAsB;IACtB,oBAAoB;IACpB,gBAAgB;IAChB,iBAAiB;IACjB,oBAAoB;IACpB,mBAAmB;IACnB,oBAAoB;IACpB,qBAAqB;IACrB,qBAAqB;IACrB,YAAY;IACZ,aAAa;IACb,gBAAgB;IAChB,qBAAqB;IACrB,sBAAsB;IACtB,yBAAyB;IACzB,sBAAsB;IACtB,uBAAuB;IACvB,0BAA0B;IAC1B,qBAAqB;IACrB,sBAAsB;IACtB,yBAAyB;IACzB,oBAAoB;IACpB,sBAAsB;IACtB,uBAAuB;IACvB,uBAAuB;IACvB,0BAA0B;IAC1B,mBAAmB;IACnB,gBAAgB;IAChB,iBAAiB;IACjB,oBAAoB;IACpB,qBAAqB;IACrB,oBAAoB;IACpB,uBAAuB;IACvB,eAAe;IACf,yBAAyB;IACzB,yBAAyB;IACzB,aAAa;IACb,cAAc;IACd,iBAAiB;IACjB,cAAc;IACd,kBAAkB;IAClB,mBAAmB;IACnB,sBAAsB;IACtB,cAAc;IACd,mBAAmB;IACnB,oBAAoB;IACpB,uBAAuB;IACvB,uBAAuB;IACvB,wBAAwB;IACxB,2BAA2B;IAC3B,8BAA8B;IAC9B,+BAA+B;IAC/B,kCAAkC;CAC1B,CAAC;AAEX,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;AAI1D,6EAA6E;AAC7E,6EAA6E;AAC7E,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;IACd,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACzC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC5C,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC5C,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE;IACtD,UAAU,EAAE,OAAO;IACnB,UAAU,EAAE,OAAO;CACpB,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACpD,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAE3C,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7B,IAAI,EAAE,CAAC;SACJ,KAAK,CAAC,CAAC,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;SACzF,QAAQ,EAAE;IAEb,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC3B,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC1B,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/C,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,eAAe,CAAC;IAChC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;CAClB,CAAC,CAAC"}
|
|
1
|
+
{"version":3,"file":"schema.js","sourceRoot":"","sources":["../../../src/schemas/authEvent/schema.ts"],"names":[],"mappings":"AAAA,OAAO,CAAC,MAAM,KAAK,CAAC;AACpB,OAAO,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC;AAE1C,MAAM,CAAC,MAAM,gBAAgB,GAAG;IAC9B,mCAAmC;IACnC,uBAAuB;IACvB,yBAAyB;IACzB,qBAAqB;IACrB,sBAAsB;IACtB,yBAAyB;IACzB,qBAAqB;IACrB,eAAe;IACf,gCAAgC;IAChC,aAAa;IACb,cAAc;IACd,iBAAiB;IACjB,iBAAiB;IACjB,cAAc;IACd,eAAe;IACf,kBAAkB;IAClB,eAAe;IACf,gBAAgB;IAChB,mBAAmB;IACnB,mBAAmB;IACnB,wCAAwC;IACxC,sBAAsB;IACtB,oBAAoB;IACpB,gBAAgB;IAChB,iBAAiB;IACjB,oBAAoB;IACpB,mBAAmB;IACnB,oBAAoB;IACpB,qBAAqB;IACrB,qBAAqB;IACrB,YAAY;IACZ,aAAa;IACb,gBAAgB;IAChB,qBAAqB;IACrB,sBAAsB;IACtB,yBAAyB;IACzB,sBAAsB;IACtB,uBAAuB;IACvB,0BAA0B;IAC1B,qBAAqB;IACrB,sBAAsB;IACtB,yBAAyB;IACzB,oBAAoB;IACpB,sBAAsB;IACtB,uBAAuB;IACvB,uBAAuB;IACvB,0BAA0B;IAC1B,mBAAmB;IACnB,gBAAgB;IAChB,iBAAiB;IACjB,oBAAoB;IACpB,qBAAqB;IACrB,oBAAoB;IACpB,uBAAuB;IACvB,eAAe;IACf,yBAAyB;IACzB,yBAAyB;IACzB,aAAa;IACb,cAAc;IACd,iBAAiB;IACjB,cAAc;IACd,kBAAkB;IAClB,mBAAmB;IACnB,sBAAsB;IACtB,cAAc;IACd,mBAAmB;IACnB,oBAAoB;IACpB,uBAAuB;IACvB,uBAAuB;IACvB,wBAAwB;IACxB,2BAA2B;IAC3B,8BAA8B;IAC9B,+BAA+B;IAC/B,kCAAkC;CAC1B,CAAC;AAEX,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;AAI1D,6EAA6E;AAC7E,6EAA6E;AAC7E,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;IACd,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACzC;;;;;;;OAOG;IACH,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC/C,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC5C,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC5C,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE;IACtD,UAAU,EAAE,OAAO;IACnB,UAAU,EAAE,OAAO;CACpB,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACpD,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAE3C,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7B,oFAAoF;IACpF,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,IAAI,EAAE,CAAC;SACJ,KAAK,CAAC,CAAC,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;SACzF,QAAQ,EAAE;IAEb,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC3B,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC1B,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/C,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,eAAe,CAAC;IAChC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;CAClB,CAAC,CAAC"}
|
|
@@ -53,6 +53,7 @@ export type LoginStatsResponse = z.infer<typeof LoginStatsResponseSchema>;
|
|
|
53
53
|
export declare const PartialAuthEventSchema: z.ZodObject<{
|
|
54
54
|
id: z.ZodOptional<z.ZodString>;
|
|
55
55
|
user_id: z.ZodOptional<z.ZodOptional<z.ZodNullable<z.ZodString>>>;
|
|
56
|
+
actor_user_id: z.ZodOptional<z.ZodOptional<z.ZodNullable<z.ZodString>>>;
|
|
56
57
|
type: z.ZodOptional<z.ZodString>;
|
|
57
58
|
ip_address: z.ZodOptional<z.ZodOptional<z.ZodNullable<z.ZodString>>>;
|
|
58
59
|
user_agent: z.ZodOptional<z.ZodOptional<z.ZodNullable<z.ZodString>>>;
|
|
@@ -65,6 +66,7 @@ export declare const SecurityAnomaliesResponseSchema: z.ZodObject<{
|
|
|
65
66
|
suspiciousEvents: z.ZodArray<z.ZodObject<{
|
|
66
67
|
id: z.ZodOptional<z.ZodString>;
|
|
67
68
|
user_id: z.ZodOptional<z.ZodOptional<z.ZodNullable<z.ZodString>>>;
|
|
69
|
+
actor_user_id: z.ZodOptional<z.ZodOptional<z.ZodNullable<z.ZodString>>>;
|
|
68
70
|
type: z.ZodOptional<z.ZodString>;
|
|
69
71
|
ip_address: z.ZodOptional<z.ZodOptional<z.ZodNullable<z.ZodString>>>;
|
|
70
72
|
user_agent: z.ZodOptional<z.ZodOptional<z.ZodNullable<z.ZodString>>>;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../src/schemas/metrics/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAKxB,eAAO,MAAM,qBAAqB;;;EAA0B,CAAC;AAE7D,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAEpE,eAAO,MAAM,kBAAkB;;;;;;;;iBAuC3B,CAAC;AAEL,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAE9D,eAAO,MAAM,0BAA0B;;;iBAGrC,CAAC;AAEH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAE9E,eAAO,MAAM,8BAA8B;;;;;iBAEzC,CAAC;AAEH,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,CAAC;AAEtF,eAAO,MAAM,8BAA8B;;;;iBAIzC,CAAC;AAEH,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,CAAC;AAEtF,eAAO,MAAM,iCAAiC;;;;;;iBAE5C,CAAC;AAEH,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iCAAiC,CAAC,CAAC;AAE5F,eAAO,MAAM,wBAAwB;;;;iBAInC,CAAC;AAEH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAE1E;;;GAGG;AACH,eAAO,MAAM,sBAAsB
|
|
1
|
+
{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../src/schemas/metrics/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAKxB,eAAO,MAAM,qBAAqB;;;EAA0B,CAAC;AAE7D,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAEpE,eAAO,MAAM,kBAAkB;;;;;;;;iBAuC3B,CAAC;AAEL,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAE9D,eAAO,MAAM,0BAA0B;;;iBAGrC,CAAC;AAEH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAE9E,eAAO,MAAM,8BAA8B;;;;;iBAEzC,CAAC;AAEH,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,CAAC;AAEtF,eAAO,MAAM,8BAA8B;;;;iBAIzC,CAAC;AAEH,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,CAAC;AAEtF,eAAO,MAAM,iCAAiC;;;;;;iBAE5C,CAAC;AAEH,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iCAAiC,CAAC,CAAC;AAE5F,eAAO,MAAM,wBAAwB;;;;iBAInC,CAAC;AAEH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAE1E;;;GAGG;AACH,eAAO,MAAM,sBAAsB;;;;;;;;;;iBAA4B,CAAC;AAEhE,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAEtE,eAAO,MAAM,+BAA+B;;;;;;;;;;;;;iBAG1C,CAAC;AAEH,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AAExF,eAAO,MAAM,8BAA8B;;;;;;;;;;iBAUzC,CAAC;AAEH,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,CAAC"}
|
package/package.json
CHANGED
|
@@ -10,16 +10,55 @@ export const UserIdParamSchema = z.object({
|
|
|
10
10
|
|
|
11
11
|
export type UserIdParam = z.infer<typeof UserIdParamSchema>;
|
|
12
12
|
|
|
13
|
+
export const RecoveryProofingMethodSchema = z.enum(['in_person', 'remote_exception']);
|
|
14
|
+
|
|
15
|
+
export type RecoveryProofingMethod = z.infer<typeof RecoveryProofingMethodSchema>;
|
|
16
|
+
|
|
17
|
+
/**
|
|
18
|
+
* How the operator established that the person asking is who they say they are.
|
|
19
|
+
*
|
|
20
|
+
* Admin-assisted recovery revokes every session, removes every passkey and
|
|
21
|
+
* disables TOTP, so it is the step social engineering aims at. Recording the
|
|
22
|
+
* proofing makes a recovery reviewable after the fact and forces the operator to
|
|
23
|
+
* have done it.
|
|
24
|
+
*
|
|
25
|
+
* `evidenceRef` is a pointer, for example a ticket or case number, not the
|
|
26
|
+
* evidence itself. Do not put personal data here: it is written to the audit
|
|
27
|
+
* trail, where identifiers are redacted.
|
|
28
|
+
*/
|
|
29
|
+
export const RecoveryProofingSchema = z
|
|
30
|
+
.object({
|
|
31
|
+
method: RecoveryProofingMethodSchema,
|
|
32
|
+
evidenceRef: z.string().trim().min(1).max(200),
|
|
33
|
+
approver: z.string().trim().min(1).max(200).optional(),
|
|
34
|
+
})
|
|
35
|
+
.strict()
|
|
36
|
+
.superRefine((value, ctx) => {
|
|
37
|
+
if (value.method === 'remote_exception' && !value.approver) {
|
|
38
|
+
ctx.addIssue({
|
|
39
|
+
code: 'custom',
|
|
40
|
+
path: ['approver'],
|
|
41
|
+
message: 'A remote exception requires a named approver',
|
|
42
|
+
});
|
|
43
|
+
}
|
|
44
|
+
});
|
|
45
|
+
|
|
46
|
+
export type RecoveryProofing = z.infer<typeof RecoveryProofingSchema>;
|
|
47
|
+
|
|
13
48
|
/**
|
|
14
49
|
* What an operator clears when a user replaces a lost device. Each step is
|
|
15
50
|
* opt-out rather than opt-in so a hurried recovery does not leave the old
|
|
16
51
|
* device's credentials in place.
|
|
52
|
+
*
|
|
53
|
+
* `proofing` is required: this endpoint cannot be called without stating how
|
|
54
|
+
* identity was established.
|
|
17
55
|
*/
|
|
18
56
|
export const DeviceReplacementRecoverySchema = z
|
|
19
57
|
.object({
|
|
20
58
|
revokeSessions: z.boolean().default(true),
|
|
21
59
|
removePasskeys: z.boolean().default(true),
|
|
22
60
|
disableTotp: z.boolean().default(true),
|
|
61
|
+
proofing: RecoveryProofingSchema,
|
|
23
62
|
})
|
|
24
63
|
.strict();
|
|
25
64
|
|
|
@@ -87,6 +87,15 @@ export type AuthEventType = z.infer<typeof AuthEventTypeEnum>;
|
|
|
87
87
|
export const AuthEventSchema = z.object({
|
|
88
88
|
id: z.string(),
|
|
89
89
|
user_id: z.string().nullable().optional(),
|
|
90
|
+
/**
|
|
91
|
+
* Who performed the action, when that is not the subject of it.
|
|
92
|
+
*
|
|
93
|
+
* An administrator acting on someone else's account is recorded with the
|
|
94
|
+
* target in `user_id` and the administrator here. Null for the ordinary case
|
|
95
|
+
* where a user acted on their own account, and for events written before the
|
|
96
|
+
* column existed.
|
|
97
|
+
*/
|
|
98
|
+
actor_user_id: z.string().nullable().optional(),
|
|
90
99
|
type: z.string(),
|
|
91
100
|
ip_address: z.string().nullable().optional(),
|
|
92
101
|
user_agent: z.string().nullable().optional(),
|
|
@@ -102,6 +111,8 @@ export const AuthEventQuerySchema = z.object({
|
|
|
102
111
|
offset: z.coerce.number().min(0).default(0),
|
|
103
112
|
|
|
104
113
|
userId: z.string().optional(),
|
|
114
|
+
/** Filters to what one administrator did, rather than what happened to one user. */
|
|
115
|
+
actorUserId: z.string().optional(),
|
|
105
116
|
type: z
|
|
106
117
|
.union([AuthEventTypeEnum, z.string(), z.array(z.union([AuthEventTypeEnum, z.string()]))])
|
|
107
118
|
.optional(),
|