@seamless-auth/types 0.8.0 → 0.10.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
package/CHANGELOG.md CHANGED
@@ -1,5 +1,56 @@
1
1
  # @seamless-auth/types
2
2
 
3
+ ## 0.10.0
4
+
5
+ ### Minor Changes
6
+
7
+ - 05e3897: Record who performed an audited action, not only who it happened to.
8
+
9
+ `AuthEventSchema` gains `actor_user_id`, and `AuthEventQuerySchema` gains an
10
+ `actorUserId` filter.
11
+
12
+ An administrator acting on someone else's account is recorded with the target in
13
+ `user_id` and the administrator in `actor_user_id`. Without it an administrative
14
+ event reads as though the user did it to themselves, which makes reviewing
15
+ administrative action after the fact impossible.
16
+
17
+ Additive and backward compatible. The field is nullable and optional, so events
18
+ written before the column existed still parse, as do events from a server that
19
+ does not populate it. `actorUserId` on the query schema is optional and unset
20
+ when absent.
21
+
22
+ ## 0.9.0
23
+
24
+ ### Minor Changes
25
+
26
+ - da415ff: Require identity proofing on admin-assisted device replacement.
27
+
28
+ **Breaking for callers of `DeviceReplacementRecoverySchema`.** The schema now
29
+ requires a `proofing` object:
30
+
31
+ ```ts
32
+ proofing: {
33
+ method: 'in_person' | 'remote_exception';
34
+ evidenceRef: string; // a ticket or case number, not the evidence itself
35
+ approver?: string; // required when method is 'remote_exception'
36
+ }
37
+ ```
38
+
39
+ Admin-assisted recovery revokes every session, removes every passkey and
40
+ disables TOTP, so it is the step social engineering aims at. It previously
41
+ carried no record of how the operator established who they were talking to, which
42
+ made a recovery impossible to review after the fact.
43
+
44
+ `in_person` is the default path and needs no approver. `remote_exception` is the
45
+ documented exception and does not validate without a named approver, so taking
46
+ the weaker path is a deliberate act with someone's name attached.
47
+
48
+ `evidenceRef` is a pointer rather than the evidence. It ends up in the audit
49
+ trail, where identifiers are redacted, so personal data does not belong in it.
50
+
51
+ Callers sending `{}` and relying on the clearing defaults will now fail
52
+ validation. Those defaults are unchanged.
53
+
3
54
  ## 0.8.0
4
55
 
5
56
  ### Minor Changes
@@ -3,15 +3,52 @@ export declare const UserIdParamSchema: z.ZodObject<{
3
3
  userId: z.ZodString;
4
4
  }, z.core.$strip>;
5
5
  export type UserIdParam = z.infer<typeof UserIdParamSchema>;
6
+ export declare const RecoveryProofingMethodSchema: z.ZodEnum<{
7
+ in_person: "in_person";
8
+ remote_exception: "remote_exception";
9
+ }>;
10
+ export type RecoveryProofingMethod = z.infer<typeof RecoveryProofingMethodSchema>;
11
+ /**
12
+ * How the operator established that the person asking is who they say they are.
13
+ *
14
+ * Admin-assisted recovery revokes every session, removes every passkey and
15
+ * disables TOTP, so it is the step social engineering aims at. Recording the
16
+ * proofing makes a recovery reviewable after the fact and forces the operator to
17
+ * have done it.
18
+ *
19
+ * `evidenceRef` is a pointer, for example a ticket or case number, not the
20
+ * evidence itself. Do not put personal data here: it is written to the audit
21
+ * trail, where identifiers are redacted.
22
+ */
23
+ export declare const RecoveryProofingSchema: z.ZodObject<{
24
+ method: z.ZodEnum<{
25
+ in_person: "in_person";
26
+ remote_exception: "remote_exception";
27
+ }>;
28
+ evidenceRef: z.ZodString;
29
+ approver: z.ZodOptional<z.ZodString>;
30
+ }, z.core.$strict>;
31
+ export type RecoveryProofing = z.infer<typeof RecoveryProofingSchema>;
6
32
  /**
7
33
  * What an operator clears when a user replaces a lost device. Each step is
8
34
  * opt-out rather than opt-in so a hurried recovery does not leave the old
9
35
  * device's credentials in place.
36
+ *
37
+ * `proofing` is required: this endpoint cannot be called without stating how
38
+ * identity was established.
10
39
  */
11
40
  export declare const DeviceReplacementRecoverySchema: z.ZodObject<{
12
41
  revokeSessions: z.ZodDefault<z.ZodBoolean>;
13
42
  removePasskeys: z.ZodDefault<z.ZodBoolean>;
14
43
  disableTotp: z.ZodDefault<z.ZodBoolean>;
44
+ proofing: z.ZodObject<{
45
+ method: z.ZodEnum<{
46
+ in_person: "in_person";
47
+ remote_exception: "remote_exception";
48
+ }>;
49
+ evidenceRef: z.ZodString;
50
+ approver: z.ZodOptional<z.ZodString>;
51
+ }, z.core.$strict>;
15
52
  }, z.core.$strict>;
16
53
  export type DeviceReplacementRecoveryRequest = z.infer<typeof DeviceReplacementRecoverySchema>;
17
54
  export declare const DeviceReplacementRecoveryResponseSchema: z.ZodObject<{
@@ -73,6 +110,7 @@ export declare const AdminUserDetailResponseSchema: z.ZodObject<{
73
110
  events: z.ZodArray<z.ZodObject<{
74
111
  id: z.ZodString;
75
112
  user_id: z.ZodOptional<z.ZodNullable<z.ZodString>>;
113
+ actor_user_id: z.ZodOptional<z.ZodNullable<z.ZodString>>;
76
114
  type: z.ZodString;
77
115
  ip_address: z.ZodOptional<z.ZodNullable<z.ZodString>>;
78
116
  user_agent: z.ZodOptional<z.ZodNullable<z.ZodString>>;
@@ -86,6 +124,7 @@ export declare const AdminUserAnomaliesResponseSchema: z.ZodObject<{
86
124
  suspiciousEvents: z.ZodArray<z.ZodObject<{
87
125
  id: z.ZodString;
88
126
  user_id: z.ZodOptional<z.ZodNullable<z.ZodString>>;
127
+ actor_user_id: z.ZodOptional<z.ZodNullable<z.ZodString>>;
89
128
  type: z.ZodString;
90
129
  ip_address: z.ZodOptional<z.ZodNullable<z.ZodString>>;
91
130
  user_agent: z.ZodOptional<z.ZodNullable<z.ZodString>>;
@@ -1 +1 @@
1
- {"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../src/schemas/admin/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAMxB,eAAO,MAAM,iBAAiB;;iBAE5B,CAAC;AAEH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAE5D;;;;GAIG;AACH,eAAO,MAAM,+BAA+B;;;;kBAMjC,CAAC;AAEZ,MAAM,MAAM,gCAAgC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AAE/F,eAAO,MAAM,uCAAuC;;;;;iBAKlD,CAAC;AAEH,MAAM,MAAM,iCAAiC,GAAG,CAAC,CAAC,KAAK,CACrD,OAAO,uCAAuC,CAC/C,CAAC;AAEF,eAAO,MAAM,6BAA6B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAKxC,CAAC;AAEH,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AAEpF,eAAO,MAAM,gCAAgC;;;;;;;;;;;;;iBAI3C,CAAC;AAEH,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gCAAgC,CAAC,CAAC"}
1
+ {"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../src/schemas/admin/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAMxB,eAAO,MAAM,iBAAiB;;iBAE5B,CAAC;AAEH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAE5D,eAAO,MAAM,4BAA4B;;;EAA4C,CAAC;AAEtF,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAElF;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,sBAAsB;;;;;;;kBAe/B,CAAC;AAEL,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAEtE;;;;;;;GAOG;AACH,eAAO,MAAM,+BAA+B;;;;;;;;;;;;kBAOjC,CAAC;AAEZ,MAAM,MAAM,gCAAgC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AAE/F,eAAO,MAAM,uCAAuC;;;;;iBAKlD,CAAC;AAEH,MAAM,MAAM,iCAAiC,GAAG,CAAC,CAAC,KAAK,CACrD,OAAO,uCAAuC,CAC/C,CAAC;AAEF,eAAO,MAAM,6BAA6B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAKxC,CAAC;AAEH,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AAEpF,eAAO,MAAM,gCAAgC;;;;;;;;;;;;;;iBAI3C,CAAC;AAEH,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gCAAgC,CAAC,CAAC"}
@@ -6,16 +6,49 @@ import { ApiUserSchema } from '../user/schema.js';
6
6
  export const UserIdParamSchema = z.object({
7
7
  userId: z.string(),
8
8
  });
9
+ export const RecoveryProofingMethodSchema = z.enum(['in_person', 'remote_exception']);
10
+ /**
11
+ * How the operator established that the person asking is who they say they are.
12
+ *
13
+ * Admin-assisted recovery revokes every session, removes every passkey and
14
+ * disables TOTP, so it is the step social engineering aims at. Recording the
15
+ * proofing makes a recovery reviewable after the fact and forces the operator to
16
+ * have done it.
17
+ *
18
+ * `evidenceRef` is a pointer, for example a ticket or case number, not the
19
+ * evidence itself. Do not put personal data here: it is written to the audit
20
+ * trail, where identifiers are redacted.
21
+ */
22
+ export const RecoveryProofingSchema = z
23
+ .object({
24
+ method: RecoveryProofingMethodSchema,
25
+ evidenceRef: z.string().trim().min(1).max(200),
26
+ approver: z.string().trim().min(1).max(200).optional(),
27
+ })
28
+ .strict()
29
+ .superRefine((value, ctx) => {
30
+ if (value.method === 'remote_exception' && !value.approver) {
31
+ ctx.addIssue({
32
+ code: 'custom',
33
+ path: ['approver'],
34
+ message: 'A remote exception requires a named approver',
35
+ });
36
+ }
37
+ });
9
38
  /**
10
39
  * What an operator clears when a user replaces a lost device. Each step is
11
40
  * opt-out rather than opt-in so a hurried recovery does not leave the old
12
41
  * device's credentials in place.
42
+ *
43
+ * `proofing` is required: this endpoint cannot be called without stating how
44
+ * identity was established.
13
45
  */
14
46
  export const DeviceReplacementRecoverySchema = z
15
47
  .object({
16
48
  revokeSessions: z.boolean().default(true),
17
49
  removePasskeys: z.boolean().default(true),
18
50
  disableTotp: z.boolean().default(true),
51
+ proofing: RecoveryProofingSchema,
19
52
  })
20
53
  .strict();
21
54
  export const DeviceReplacementRecoveryResponseSchema = z.object({
@@ -1 +1 @@
1
- {"version":3,"file":"schema.js","sourceRoot":"","sources":["../../../src/schemas/admin/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAE,wBAAwB,EAAE,MAAM,yBAAyB,CAAC;AACnE,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAElD,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACxC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;CACnB,CAAC,CAAC;AAIH;;;;GAIG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC;KAC7C,MAAM,CAAC;IACN,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IACzC,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IACzC,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;CACvC,CAAC;KACD,MAAM,EAAE,CAAC;AAIZ,MAAM,CAAC,MAAM,uCAAuC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9D,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IAC/C,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IAClD,uBAAuB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;CACxD,CAAC,CAAC;AAMH,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,CAAC,MAAM,CAAC;IACpD,IAAI,EAAE,aAAa;IACnB,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC;IAChC,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,wBAAwB,CAAC;IAC9C,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,eAAe,CAAC;CACjC,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC,MAAM,CAAC;IACvD,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,eAAe,CAAC;IAC1C,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAC/B,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;CACnC,CAAC,CAAC"}
1
+ {"version":3,"file":"schema.js","sourceRoot":"","sources":["../../../src/schemas/admin/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAE,wBAAwB,EAAE,MAAM,yBAAyB,CAAC;AACnE,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAElD,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACxC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;CACnB,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,kBAAkB,CAAC,CAAC,CAAC;AAItF;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC;KACpC,MAAM,CAAC;IACN,MAAM,EAAE,4BAA4B;IACpC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IAC9C,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;CACvD,CAAC;KACD,MAAM,EAAE;KACR,WAAW,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;IAC1B,IAAI,KAAK,CAAC,MAAM,KAAK,kBAAkB,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC;QAC3D,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,UAAU,CAAC;YAClB,OAAO,EAAE,8CAA8C;SACxD,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AAIL;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC;KAC7C,MAAM,CAAC;IACN,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IACzC,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IACzC,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IACtC,QAAQ,EAAE,sBAAsB;CACjC,CAAC;KACD,MAAM,EAAE,CAAC;AAIZ,MAAM,CAAC,MAAM,uCAAuC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9D,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IAC/C,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IAClD,uBAAuB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;CACxD,CAAC,CAAC;AAMH,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,CAAC,MAAM,CAAC;IACpD,IAAI,EAAE,aAAa;IACnB,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC;IAChC,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,wBAAwB,CAAC;IAC9C,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,eAAe,CAAC;CACjC,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC,MAAM,CAAC;IACvD,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,eAAe,CAAC;IAC1C,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAC/B,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;CACnC,CAAC,CAAC"}
@@ -80,6 +80,7 @@ export type AuthEventType = z.infer<typeof AuthEventTypeEnum>;
80
80
  export declare const AuthEventSchema: z.ZodObject<{
81
81
  id: z.ZodString;
82
82
  user_id: z.ZodOptional<z.ZodNullable<z.ZodString>>;
83
+ actor_user_id: z.ZodOptional<z.ZodNullable<z.ZodString>>;
83
84
  type: z.ZodString;
84
85
  ip_address: z.ZodOptional<z.ZodNullable<z.ZodString>>;
85
86
  user_agent: z.ZodOptional<z.ZodNullable<z.ZodString>>;
@@ -92,6 +93,7 @@ export declare const AuthEventQuerySchema: z.ZodObject<{
92
93
  limit: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
93
94
  offset: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
94
95
  userId: z.ZodOptional<z.ZodString>;
96
+ actorUserId: z.ZodOptional<z.ZodString>;
95
97
  type: z.ZodOptional<z.ZodUnion<readonly [z.ZodEnum<{
96
98
  admin_device_replacement_recovery: "admin_device_replacement_recovery";
97
99
  admin_session_revoked: "admin_session_revoked";
@@ -251,6 +253,7 @@ export declare const AuthEventsResponseSchema: z.ZodObject<{
251
253
  events: z.ZodArray<z.ZodObject<{
252
254
  id: z.ZodString;
253
255
  user_id: z.ZodOptional<z.ZodNullable<z.ZodString>>;
256
+ actor_user_id: z.ZodOptional<z.ZodNullable<z.ZodString>>;
254
257
  type: z.ZodString;
255
258
  ip_address: z.ZodOptional<z.ZodNullable<z.ZodString>>;
256
259
  user_agent: z.ZodOptional<z.ZodNullable<z.ZodString>>;
@@ -1 +1 @@
1
- {"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../src/schemas/authEvent/schema.ts"],"names":[],"mappings":"AAAA,OAAO,CAAC,MAAM,KAAK,CAAC;AAGpB,eAAO,MAAM,gBAAgB,gqDA2EnB,CAAC;AAEX,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAA2B,CAAC;AAE1D,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAI9D,eAAO,MAAM,eAAe;;;;;;;;;iBAS1B,CAAC;AAEH,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAExD,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAW/B,CAAC;AAEH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAElE,eAAO,MAAM,wBAAwB;;;;;;;;;;;;iBAGnC,CAAC;AAEH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC"}
1
+ {"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../src/schemas/authEvent/schema.ts"],"names":[],"mappings":"AAAA,OAAO,CAAC,MAAM,KAAK,CAAC;AAGpB,eAAO,MAAM,gBAAgB,gqDA2EnB,CAAC;AAEX,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAA2B,CAAC;AAE1D,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAI9D,eAAO,MAAM,eAAe;;;;;;;;;;iBAkB1B,CAAC;AAEH,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAExD,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAa/B,CAAC;AAEH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAElE,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;iBAGnC,CAAC;AAEH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC"}
@@ -82,6 +82,15 @@ export const AuthEventTypeEnum = z.enum(AUTH_EVENT_TYPES);
82
82
  export const AuthEventSchema = z.object({
83
83
  id: z.string(),
84
84
  user_id: z.string().nullable().optional(),
85
+ /**
86
+ * Who performed the action, when that is not the subject of it.
87
+ *
88
+ * An administrator acting on someone else's account is recorded with the
89
+ * target in `user_id` and the administrator here. Null for the ordinary case
90
+ * where a user acted on their own account, and for events written before the
91
+ * column existed.
92
+ */
93
+ actor_user_id: z.string().nullable().optional(),
85
94
  type: z.string(),
86
95
  ip_address: z.string().nullable().optional(),
87
96
  user_agent: z.string().nullable().optional(),
@@ -93,6 +102,8 @@ export const AuthEventQuerySchema = z.object({
93
102
  limit: z.coerce.number().min(1).max(100).default(10),
94
103
  offset: z.coerce.number().min(0).default(0),
95
104
  userId: z.string().optional(),
105
+ /** Filters to what one administrator did, rather than what happened to one user. */
106
+ actorUserId: z.string().optional(),
96
107
  type: z
97
108
  .union([AuthEventTypeEnum, z.string(), z.array(z.union([AuthEventTypeEnum, z.string()]))])
98
109
  .optional(),
@@ -1 +1 @@
1
- {"version":3,"file":"schema.js","sourceRoot":"","sources":["../../../src/schemas/authEvent/schema.ts"],"names":[],"mappings":"AAAA,OAAO,CAAC,MAAM,KAAK,CAAC;AACpB,OAAO,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC;AAE1C,MAAM,CAAC,MAAM,gBAAgB,GAAG;IAC9B,mCAAmC;IACnC,uBAAuB;IACvB,yBAAyB;IACzB,qBAAqB;IACrB,sBAAsB;IACtB,yBAAyB;IACzB,qBAAqB;IACrB,eAAe;IACf,gCAAgC;IAChC,aAAa;IACb,cAAc;IACd,iBAAiB;IACjB,iBAAiB;IACjB,cAAc;IACd,eAAe;IACf,kBAAkB;IAClB,eAAe;IACf,gBAAgB;IAChB,mBAAmB;IACnB,mBAAmB;IACnB,wCAAwC;IACxC,sBAAsB;IACtB,oBAAoB;IACpB,gBAAgB;IAChB,iBAAiB;IACjB,oBAAoB;IACpB,mBAAmB;IACnB,oBAAoB;IACpB,qBAAqB;IACrB,qBAAqB;IACrB,YAAY;IACZ,aAAa;IACb,gBAAgB;IAChB,qBAAqB;IACrB,sBAAsB;IACtB,yBAAyB;IACzB,sBAAsB;IACtB,uBAAuB;IACvB,0BAA0B;IAC1B,qBAAqB;IACrB,sBAAsB;IACtB,yBAAyB;IACzB,oBAAoB;IACpB,sBAAsB;IACtB,uBAAuB;IACvB,uBAAuB;IACvB,0BAA0B;IAC1B,mBAAmB;IACnB,gBAAgB;IAChB,iBAAiB;IACjB,oBAAoB;IACpB,qBAAqB;IACrB,oBAAoB;IACpB,uBAAuB;IACvB,eAAe;IACf,yBAAyB;IACzB,yBAAyB;IACzB,aAAa;IACb,cAAc;IACd,iBAAiB;IACjB,cAAc;IACd,kBAAkB;IAClB,mBAAmB;IACnB,sBAAsB;IACtB,cAAc;IACd,mBAAmB;IACnB,oBAAoB;IACpB,uBAAuB;IACvB,uBAAuB;IACvB,wBAAwB;IACxB,2BAA2B;IAC3B,8BAA8B;IAC9B,+BAA+B;IAC/B,kCAAkC;CAC1B,CAAC;AAEX,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;AAI1D,6EAA6E;AAC7E,6EAA6E;AAC7E,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;IACd,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACzC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC5C,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC5C,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE;IACtD,UAAU,EAAE,OAAO;IACnB,UAAU,EAAE,OAAO;CACpB,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACpD,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAE3C,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7B,IAAI,EAAE,CAAC;SACJ,KAAK,CAAC,CAAC,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;SACzF,QAAQ,EAAE;IAEb,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC3B,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC1B,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/C,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,eAAe,CAAC;IAChC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;CAClB,CAAC,CAAC"}
1
+ {"version":3,"file":"schema.js","sourceRoot":"","sources":["../../../src/schemas/authEvent/schema.ts"],"names":[],"mappings":"AAAA,OAAO,CAAC,MAAM,KAAK,CAAC;AACpB,OAAO,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC;AAE1C,MAAM,CAAC,MAAM,gBAAgB,GAAG;IAC9B,mCAAmC;IACnC,uBAAuB;IACvB,yBAAyB;IACzB,qBAAqB;IACrB,sBAAsB;IACtB,yBAAyB;IACzB,qBAAqB;IACrB,eAAe;IACf,gCAAgC;IAChC,aAAa;IACb,cAAc;IACd,iBAAiB;IACjB,iBAAiB;IACjB,cAAc;IACd,eAAe;IACf,kBAAkB;IAClB,eAAe;IACf,gBAAgB;IAChB,mBAAmB;IACnB,mBAAmB;IACnB,wCAAwC;IACxC,sBAAsB;IACtB,oBAAoB;IACpB,gBAAgB;IAChB,iBAAiB;IACjB,oBAAoB;IACpB,mBAAmB;IACnB,oBAAoB;IACpB,qBAAqB;IACrB,qBAAqB;IACrB,YAAY;IACZ,aAAa;IACb,gBAAgB;IAChB,qBAAqB;IACrB,sBAAsB;IACtB,yBAAyB;IACzB,sBAAsB;IACtB,uBAAuB;IACvB,0BAA0B;IAC1B,qBAAqB;IACrB,sBAAsB;IACtB,yBAAyB;IACzB,oBAAoB;IACpB,sBAAsB;IACtB,uBAAuB;IACvB,uBAAuB;IACvB,0BAA0B;IAC1B,mBAAmB;IACnB,gBAAgB;IAChB,iBAAiB;IACjB,oBAAoB;IACpB,qBAAqB;IACrB,oBAAoB;IACpB,uBAAuB;IACvB,eAAe;IACf,yBAAyB;IACzB,yBAAyB;IACzB,aAAa;IACb,cAAc;IACd,iBAAiB;IACjB,cAAc;IACd,kBAAkB;IAClB,mBAAmB;IACnB,sBAAsB;IACtB,cAAc;IACd,mBAAmB;IACnB,oBAAoB;IACpB,uBAAuB;IACvB,uBAAuB;IACvB,wBAAwB;IACxB,2BAA2B;IAC3B,8BAA8B;IAC9B,+BAA+B;IAC/B,kCAAkC;CAC1B,CAAC;AAEX,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;AAI1D,6EAA6E;AAC7E,6EAA6E;AAC7E,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;IACd,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACzC;;;;;;;OAOG;IACH,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC/C,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC5C,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC5C,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE;IACtD,UAAU,EAAE,OAAO;IACnB,UAAU,EAAE,OAAO;CACpB,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACpD,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAE3C,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7B,oFAAoF;IACpF,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,IAAI,EAAE,CAAC;SACJ,KAAK,CAAC,CAAC,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;SACzF,QAAQ,EAAE;IAEb,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC3B,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC1B,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/C,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,eAAe,CAAC;IAChC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;CAClB,CAAC,CAAC"}
@@ -53,6 +53,7 @@ export type LoginStatsResponse = z.infer<typeof LoginStatsResponseSchema>;
53
53
  export declare const PartialAuthEventSchema: z.ZodObject<{
54
54
  id: z.ZodOptional<z.ZodString>;
55
55
  user_id: z.ZodOptional<z.ZodOptional<z.ZodNullable<z.ZodString>>>;
56
+ actor_user_id: z.ZodOptional<z.ZodOptional<z.ZodNullable<z.ZodString>>>;
56
57
  type: z.ZodOptional<z.ZodString>;
57
58
  ip_address: z.ZodOptional<z.ZodOptional<z.ZodNullable<z.ZodString>>>;
58
59
  user_agent: z.ZodOptional<z.ZodOptional<z.ZodNullable<z.ZodString>>>;
@@ -65,6 +66,7 @@ export declare const SecurityAnomaliesResponseSchema: z.ZodObject<{
65
66
  suspiciousEvents: z.ZodArray<z.ZodObject<{
66
67
  id: z.ZodOptional<z.ZodString>;
67
68
  user_id: z.ZodOptional<z.ZodOptional<z.ZodNullable<z.ZodString>>>;
69
+ actor_user_id: z.ZodOptional<z.ZodOptional<z.ZodNullable<z.ZodString>>>;
68
70
  type: z.ZodOptional<z.ZodString>;
69
71
  ip_address: z.ZodOptional<z.ZodOptional<z.ZodNullable<z.ZodString>>>;
70
72
  user_agent: z.ZodOptional<z.ZodOptional<z.ZodNullable<z.ZodString>>>;
@@ -1 +1 @@
1
- {"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../src/schemas/metrics/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAKxB,eAAO,MAAM,qBAAqB;;;EAA0B,CAAC;AAE7D,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAEpE,eAAO,MAAM,kBAAkB;;;;;;;;iBAuC3B,CAAC;AAEL,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAE9D,eAAO,MAAM,0BAA0B;;;iBAGrC,CAAC;AAEH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAE9E,eAAO,MAAM,8BAA8B;;;;;iBAEzC,CAAC;AAEH,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,CAAC;AAEtF,eAAO,MAAM,8BAA8B;;;;iBAIzC,CAAC;AAEH,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,CAAC;AAEtF,eAAO,MAAM,iCAAiC;;;;;;iBAE5C,CAAC;AAEH,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iCAAiC,CAAC,CAAC;AAE5F,eAAO,MAAM,wBAAwB;;;;iBAInC,CAAC;AAEH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAE1E;;;GAGG;AACH,eAAO,MAAM,sBAAsB;;;;;;;;;iBAA4B,CAAC;AAEhE,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAEtE,eAAO,MAAM,+BAA+B;;;;;;;;;;;;iBAG1C,CAAC;AAEH,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AAExF,eAAO,MAAM,8BAA8B;;;;;;;;;;iBAUzC,CAAC;AAEH,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,CAAC"}
1
+ {"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../src/schemas/metrics/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAKxB,eAAO,MAAM,qBAAqB;;;EAA0B,CAAC;AAE7D,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAEpE,eAAO,MAAM,kBAAkB;;;;;;;;iBAuC3B,CAAC;AAEL,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAE9D,eAAO,MAAM,0BAA0B;;;iBAGrC,CAAC;AAEH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAE9E,eAAO,MAAM,8BAA8B;;;;;iBAEzC,CAAC;AAEH,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,CAAC;AAEtF,eAAO,MAAM,8BAA8B;;;;iBAIzC,CAAC;AAEH,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,CAAC;AAEtF,eAAO,MAAM,iCAAiC;;;;;;iBAE5C,CAAC;AAEH,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iCAAiC,CAAC,CAAC;AAE5F,eAAO,MAAM,wBAAwB;;;;iBAInC,CAAC;AAEH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAE1E;;;GAGG;AACH,eAAO,MAAM,sBAAsB;;;;;;;;;;iBAA4B,CAAC;AAEhE,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAEtE,eAAO,MAAM,+BAA+B;;;;;;;;;;;;;iBAG1C,CAAC;AAEH,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AAExF,eAAO,MAAM,8BAA8B;;;;;;;;;;iBAUzC,CAAC;AAEH,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,CAAC"}
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@seamless-auth/types",
3
- "version": "0.8.0",
3
+ "version": "0.10.0",
4
4
  "description": "Shared TypeScript types and Zod schemas for SeamlessAuth.",
5
5
  "author": "Fells Code, LLC",
6
6
  "license": "AGPL-3.0-only",
@@ -10,16 +10,55 @@ export const UserIdParamSchema = z.object({
10
10
 
11
11
  export type UserIdParam = z.infer<typeof UserIdParamSchema>;
12
12
 
13
+ export const RecoveryProofingMethodSchema = z.enum(['in_person', 'remote_exception']);
14
+
15
+ export type RecoveryProofingMethod = z.infer<typeof RecoveryProofingMethodSchema>;
16
+
17
+ /**
18
+ * How the operator established that the person asking is who they say they are.
19
+ *
20
+ * Admin-assisted recovery revokes every session, removes every passkey and
21
+ * disables TOTP, so it is the step social engineering aims at. Recording the
22
+ * proofing makes a recovery reviewable after the fact and forces the operator to
23
+ * have done it.
24
+ *
25
+ * `evidenceRef` is a pointer, for example a ticket or case number, not the
26
+ * evidence itself. Do not put personal data here: it is written to the audit
27
+ * trail, where identifiers are redacted.
28
+ */
29
+ export const RecoveryProofingSchema = z
30
+ .object({
31
+ method: RecoveryProofingMethodSchema,
32
+ evidenceRef: z.string().trim().min(1).max(200),
33
+ approver: z.string().trim().min(1).max(200).optional(),
34
+ })
35
+ .strict()
36
+ .superRefine((value, ctx) => {
37
+ if (value.method === 'remote_exception' && !value.approver) {
38
+ ctx.addIssue({
39
+ code: 'custom',
40
+ path: ['approver'],
41
+ message: 'A remote exception requires a named approver',
42
+ });
43
+ }
44
+ });
45
+
46
+ export type RecoveryProofing = z.infer<typeof RecoveryProofingSchema>;
47
+
13
48
  /**
14
49
  * What an operator clears when a user replaces a lost device. Each step is
15
50
  * opt-out rather than opt-in so a hurried recovery does not leave the old
16
51
  * device's credentials in place.
52
+ *
53
+ * `proofing` is required: this endpoint cannot be called without stating how
54
+ * identity was established.
17
55
  */
18
56
  export const DeviceReplacementRecoverySchema = z
19
57
  .object({
20
58
  revokeSessions: z.boolean().default(true),
21
59
  removePasskeys: z.boolean().default(true),
22
60
  disableTotp: z.boolean().default(true),
61
+ proofing: RecoveryProofingSchema,
23
62
  })
24
63
  .strict();
25
64
 
@@ -87,6 +87,15 @@ export type AuthEventType = z.infer<typeof AuthEventTypeEnum>;
87
87
  export const AuthEventSchema = z.object({
88
88
  id: z.string(),
89
89
  user_id: z.string().nullable().optional(),
90
+ /**
91
+ * Who performed the action, when that is not the subject of it.
92
+ *
93
+ * An administrator acting on someone else's account is recorded with the
94
+ * target in `user_id` and the administrator here. Null for the ordinary case
95
+ * where a user acted on their own account, and for events written before the
96
+ * column existed.
97
+ */
98
+ actor_user_id: z.string().nullable().optional(),
90
99
  type: z.string(),
91
100
  ip_address: z.string().nullable().optional(),
92
101
  user_agent: z.string().nullable().optional(),
@@ -102,6 +111,8 @@ export const AuthEventQuerySchema = z.object({
102
111
  offset: z.coerce.number().min(0).default(0),
103
112
 
104
113
  userId: z.string().optional(),
114
+ /** Filters to what one administrator did, rather than what happened to one user. */
115
+ actorUserId: z.string().optional(),
105
116
  type: z
106
117
  .union([AuthEventTypeEnum, z.string(), z.array(z.union([AuthEventTypeEnum, z.string()]))])
107
118
  .optional(),