@serve.zone/dcrouter 18.1.0 → 18.2.0

package/dist_ts/security/classes.authentication-event-manager.js

@@ -0,0 +1,185 @@
+import * as plugins from '../plugins.js';
+import { logger } from '../logger.js';
+import { AuthenticationEventDoc } from '../db/documents/classes.authentication-event.doc.js';
+import { SecurityEventType, SecurityLogLevel, SecurityLogger, } from './classes.securitylogger.js';
+const MAX_IN_MEMORY_EVENTS = 10_000;
+const MAX_PERSIST_BATCH_SIZE = 500;
+export class AuthenticationEventManager {
+    dcRouterRef;
+    pendingEvents = new Map();
+    recentEvents = new Map();
+    flushInFlight;
+    pruneInFlight;
+    windowStatsInFlight = new Map();
+    constructor(dcRouterRef) {
+        this.dcRouterRef = dcRouterRef;
+    }
+    canPersist() {
+        return this.dcRouterRef.options.dbConfig?.enabled !== false
+            && Boolean(this.dcRouterRef.dcRouterDb?.isReady());
+    }
+    rememberEvent(eventArg) {
+        this.pendingEvents.set(eventArg.id, eventArg);
+        this.recentEvents.set(eventArg.id, eventArg);
+        while (this.pendingEvents.size > MAX_IN_MEMORY_EVENTS) {
+            const oldestId = this.pendingEvents.keys().next().value;
+            if (!oldestId)
+                break;
+            this.pendingEvents.delete(oldestId);
+            logger.log('error', 'Authentication event persistence buffer reached its limit; oldest event dropped');
+        }
+        while (this.recentEvents.size > MAX_IN_MEMORY_EVENTS) {
+            const oldestId = this.recentEvents.keys().next().value;
+            if (!oldestId)
+                break;
+            this.recentEvents.delete(oldestId);
+        }
+    }
+    async flushBufferedUnlocked() {
+        if (!this.canPersist() || this.pendingEvents.size === 0)
+            return;
+        const events = [...this.pendingEvents.values()];
+        for (let offset = 0; offset < events.length; offset += MAX_PERSIST_BATCH_SIZE) {
+            const batch = events.slice(offset, offset + MAX_PERSIST_BATCH_SIZE);
+            await AuthenticationEventDoc.upsertMany(batch);
+            for (const event of batch) {
+                if (this.pendingEvents.get(event.id) === event) {
+                    this.pendingEvents.delete(event.id);
+                }
+            }
+        }
+    }
+    async recordAttempt(optionsArg) {
+        const event = {
+            id: `auth-${plugins.uuid.v4()}`,
+            timestamp: Date.now(),
+            username: String(optionsArg.username || '').trim().toLowerCase() || 'unknown',
+            success: optionsArg.success,
+            requestedAuthSource: optionsArg.requestedAuthSource,
+            ...(optionsArg.userId ? { userId: optionsArg.userId } : {}),
+            ...(optionsArg.resolvedAuthSource
+                ? { resolvedAuthSource: optionsArg.resolvedAuthSource }
+                : {}),
+            ...(optionsArg.failureReason ? { failureReason: optionsArg.failureReason } : {}),
+        };
+        // Buffer before any asynchronous persistence so authentication cannot be
+        // held behind a slow database and the bounded drop policy remains effective.
+        this.rememberEvent(event);
+        try {
+            SecurityLogger.getInstance().logEvent({
+                level: event.success ? SecurityLogLevel.INFO : SecurityLogLevel.WARN,
+                type: SecurityEventType.AUTHENTICATION,
+                message: event.success ? 'Authentication succeeded' : 'Authentication failed',
+                userId: event.userId,
+                success: event.success,
+                details: { authenticationEvent: event },
+            });
+        }
+        catch (error) {
+            logger.log('warn', `Unable to mirror authentication event to the security log: ${error.message}`);
+        }
+        return event;
+    }
+    flushBuffered() {
+        if (this.flushInFlight)
+            return this.flushInFlight;
+        const run = this.flushBufferedUnlocked();
+        this.flushInFlight = run;
+        run.then(() => { if (this.flushInFlight === run)
+            this.flushInFlight = undefined; }, () => { if (this.flushInFlight === run)
+            this.flushInFlight = undefined; });
+        return run;
+    }
+    pruneBefore(cutoffArg) {
+        if (this.pruneInFlight)
+            return this.pruneInFlight;
+        const run = this.canPersist()
+            ? AuthenticationEventDoc.pruneBefore(cutoffArg)
+            : Promise.resolve(0);
+        this.pruneInFlight = run;
+        run.then(() => { if (this.pruneInFlight === run)
+            this.pruneInFlight = undefined; }, () => { if (this.pruneInFlight === run)
+            this.pruneInFlight = undefined; });
+        return run;
+    }
+    getInMemoryWindow(cutoffArg, limitArg) {
+        const events = [...this.recentEvents.values()]
+            .filter((event) => event.timestamp >= cutoffArg)
+            .sort((a, b) => b.timestamp - a.timestamp || b.id.localeCompare(a.id));
+        return {
+            windowStart: cutoffArg,
+            successes: events.filter((event) => event.success).length,
+            failures: events.filter((event) => !event.success).length,
+            events: events.slice(0, limitArg),
+        };
+    }
+    async getWindowStatsUnlocked(windowMsArg = 24 * 60 * 60 * 1000, limitArg = 100) {
+        const cutoff = Date.now() - windowMsArg;
+        if (!this.canPersist()) {
+            return this.getInMemoryWindow(cutoff, limitArg);
+        }
+        try {
+            await this.flushBuffered();
+        }
+        catch (error) {
+            logger.log('warn', `Unable to flush authentication event buffer: ${error.message}`);
+        }
+        try {
+            const durable = await AuthenticationEventDoc.getWindowSummary(cutoff, limitArg);
+            const buffered = [...this.pendingEvents.values()]
+                .filter((event) => event.timestamp >= cutoff);
+            const existingIds = new Set();
+            const bufferedIds = buffered.map((event) => event.id);
+            for (let offset = 0; offset < bufferedIds.length; offset += MAX_PERSIST_BATCH_SIZE) {
+                const existingBatch = await AuthenticationEventDoc.findExistingIds(bufferedIds.slice(offset, offset + MAX_PERSIST_BATCH_SIZE));
+                existingBatch.forEach((id) => existingIds.add(id));
+            }
+            const unpersisted = buffered.filter((event) => !existingIds.has(event.id));
+            const mergedById = new Map();
+            for (const event of durable.events)
+                mergedById.set(event.id, event);
+            for (const event of unpersisted) {
+                if (!mergedById.has(event.id))
+                    mergedById.set(event.id, event);
+            }
+            const mergedEvents = [...mergedById.values()]
+                .sort((a, b) => b.timestamp - a.timestamp || b.id.localeCompare(a.id))
+                .slice(0, limitArg);
+            return {
+                windowStart: cutoff,
+                successes: durable.successes + unpersisted.filter((event) => event.success).length,
+                failures: durable.failures + unpersisted.filter((event) => !event.success).length,
+                events: mergedEvents,
+            };
+        }
+        catch (error) {
+            logger.log('warn', `Unable to query durable authentication events: ${error.message}`);
+            return this.getInMemoryWindow(cutoff, limitArg);
+        }
+    }
+    getWindowStats(windowMsArg = 24 * 60 * 60 * 1000, limitArg = 100) {
+        if (!Number.isSafeInteger(windowMsArg) || windowMsArg <= 0) {
+            return Promise.reject(new Error('Authentication window must be a positive integer'));
+        }
+        if (!Number.isSafeInteger(limitArg) || limitArg <= 0 || limitArg > 500) {
+            return Promise.reject(new Error('Authentication event limit must be from 1 to 500'));
+        }
+        const key = `${windowMsArg}:${limitArg}`;
+        const existing = this.windowStatsInFlight.get(key);
+        if (existing)
+            return existing;
+        const run = this.getWindowStatsUnlocked(windowMsArg, limitArg);
+        this.windowStatsInFlight.set(key, run);
+        run.then(() => { if (this.windowStatsInFlight.get(key) === run)
+            this.windowStatsInFlight.delete(key); }, () => { if (this.windowStatsInFlight.get(key) === run)
+            this.windowStatsInFlight.delete(key); });
+        return run;
+    }
+    /** Test-only reset for the DcRouter-owned in-process buffers. */
+    async resetForTests() {
+        await this.flushInFlight?.catch(() => undefined);
+        this.pendingEvents.clear();
+        this.recentEvents.clear();
+    }
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY2xhc3Nlcy5hdXRoZW50aWNhdGlvbi1ldmVudC1tYW5hZ2VyLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vLi4vdHMvc2VjdXJpdHkvY2xhc3Nlcy5hdXRoZW50aWNhdGlvbi1ldmVudC1tYW5hZ2VyLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLE9BQU8sS0FBSyxPQUFPLE1BQU0sZUFBZSxDQUFDO0FBQ3pDLE9BQU8sRUFBRSxNQUFNLEVBQUUsTUFBTSxjQUFjLENBQUM7QUFFdEMsT0FBTyxFQUFFLHNCQUFzQixFQUFFLE1BQU0scURBQXFELENBQUM7QUFPN0YsT0FBTyxFQUNMLGlCQUFpQixFQUNqQixnQkFBZ0IsRUFDaEIsY0FBYyxHQUNmLE1BQU0sNkJBQTZCLENBQUM7QUFFckMsTUFBTSxvQkFBb0IsR0FBRyxNQUFNLENBQUM7QUFDcEMsTUFBTSxzQkFBc0IsR0FBRyxHQUFHLENBQUM7QUFTbkMsTUFBTSxPQUFPLDBCQUEwQjtJQU9qQjtJQU5aLGFBQWEsR0FBRyxJQUFJLEdBQUcsRUFBZ0MsQ0FBQztJQUN4RCxZQUFZLEdBQUcsSUFBSSxHQUFHLEVBQWdDLENBQUM7SUFDdkQsYUFBYSxDQUFpQjtJQUM5QixhQUFhLENBQW1CO0lBQ2hDLG1CQUFtQixHQUFHLElBQUksR0FBRyxFQUErQyxDQUFDO0lBRXJGLFlBQW9CLFdBQXFCO1FBQXJCLGdCQUFXLEdBQVgsV0FBVyxDQUFVO0lBQUcsQ0FBQztJQUVyQyxVQUFVO1FBQ2hCLE9BQU8sSUFBSSxDQUFDLFdBQVcsQ0FBQyxPQUFPLENBQUMsUUFBUSxFQUFFLE9BQU8sS0FBSyxLQUFLO2VBQ3RELE9BQU8sQ0FBQyxJQUFJLENBQUMsV0FBVyxDQUFDLFVBQVUsRUFBRSxPQUFPLEVBQUUsQ0FBQyxDQUFDO0lBQ3ZELENBQUM7SUFFTyxhQUFhLENBQUMsUUFBOEI7UUFDbEQsSUFBSSxDQUFDLGFBQWEsQ0FBQyxHQUFHLENBQUMsUUFBUSxDQUFDLEVBQUUsRUFBRSxRQUFRLENBQUMsQ0FBQztRQUM5QyxJQUFJLENBQUMsWUFBWSxDQUFDLEdBQUcsQ0FBQyxRQUFRLENBQUMsRUFBRSxFQUFFLFFBQVEsQ0FBQyxDQUFDO1FBQzdDLE9BQU8sSUFBSSxDQUFDLGFBQWEsQ0FBQyxJQUFJLEdBQUcsb0JBQW9CLEVBQUUsQ0FBQztZQUN0RCxNQUFNLFFBQVEsR0FBRyxJQUFJLENBQUMsYUFBYSxDQUFDLElBQUksRUFBRSxDQUFDLElBQUksRUFBRSxDQUFDLEtBQTJCLENBQUM7WUFDOUUsSUFBSSxDQUFDLFFBQVE7Z0JBQUUsTUFBTTtZQUNyQixJQUFJLENBQUMsYUFBYSxDQUFDLE1BQU0sQ0FBQyxRQUFRLENBQUMsQ0FBQztZQUNwQyxNQUFNLENBQUMsR0FBRyxDQUFDLE9BQU8sRUFBRSxpRkFBaUYsQ0FBQyxDQUFDO1FBQ3pHLENBQUM7UUFDRCxPQUFPLElBQUksQ0FBQyxZQUFZLENBQUMsSUFBSSxHQUFHLG9CQUFvQixFQUFFLENBQUM7WUFDckQsTUFBTSxRQUFRLEdBQUcsSUFBSSxDQUFDLFlBQVksQ0FBQyxJQUFJLEVBQUUsQ0FBQyxJQUFJLEVBQUUsQ0FBQyxLQUEyQixDQUFDO1lBQzdFLElBQUksQ0FBQyxRQUFRO2dCQUFFLE1BQU07WUFDckIsSUFBSSxDQUFDLFlBQVksQ0FBQyxNQUFNLENBQUMsUUFBUSxDQUFDLENBQUM7UUFDckMsQ0FBQztJQUNILENBQUM7SUFFTyxLQUFLLENBQUMscUJBQXFCO1FBQ2pDLElBQUksQ0FBQyxJQUFJLENBQUMsVUFBVSxFQUFFLElBQUksSUFBSSxDQUFDLGFBQWEsQ0FBQyxJQUFJLEtBQUssQ0FBQztZQUFFLE9BQU87UUFDaEUsTUFBTSxNQUFNLEdBQUcsQ0FBQyxHQUFHLElBQUksQ0FBQyxhQUFhLENBQUMsTUFBTSxFQUFFLENBQUMsQ0FBQztRQUNoRCxLQUFLLElBQUksTUFBTSxHQUFHLENBQUMsRUFBRSxNQUFNLEdBQUcsTUFBTSxDQUFDLE1BQU0sRUFBRSxNQUFNLElBQUksc0JBQXNCLEVBQUUsQ0FBQztZQUM5RSxNQUFNLEtBQUssR0FBRyxNQUFNLENBQUMsS0FBSyxDQUFDLE1BQU0sRUFBRSxNQUFNLEdBQUcsc0JBQXNCLENBQUMsQ0FBQztZQUNwRSxNQUFNLHNCQUFzQixDQUFDLFVBQVUsQ0FBQyxLQUFLLENBQUMsQ0FBQztZQUMvQyxLQUFLLE1BQU0sS0FBSyxJQUFJLEtBQUssRUFBRSxDQUFDO2dCQUMxQixJQUFJLElBQUksQ0FBQyxhQUFhLENBQUMsR0FBRyxDQUFDLEtBQUssQ0FBQyxFQUFFLENBQUMsS0FBSyxLQUFLLEVBQUUsQ0FBQztvQkFDL0MsSUFBSSxDQUFDLGFBQWEsQ0FBQyxNQUFNLENBQUMsS0FBSyxDQUFDLEVBQUUsQ0FBQyxDQUFDO2dCQUN0QyxDQUFDO1lBQ0gsQ0FBQztRQUNILENBQUM7SUFDSCxDQUFDO0lBRU0sS0FBSyxDQUFDLGFBQWEsQ0FBQyxVQU8xQjtRQUNDLE1BQU0sS0FBSyxHQUF5QjtZQUNsQyxFQUFFLEVBQUUsUUFBUSxPQUFPLENBQUMsSUFBSSxDQUFDLEVBQUUsRUFBRSxFQUFFO1lBQy9CLFNBQVMsRUFBRSxJQUFJLENBQUMsR0FBRyxFQUFFO1lBQ3JCLFFBQVEsRUFBRSxNQUFNLENBQUMsVUFBVSxDQUFDLFFBQVEsSUFBSSxFQUFFLENBQUMsQ0FBQyxJQUFJLEVBQUUsQ0FBQyxXQUFXLEVBQUUsSUFBSSxTQUFTO1lBQzdFLE9BQU8sRUFBRSxVQUFVLENBQUMsT0FBTztZQUMzQixtQkFBbUIsRUFBRSxVQUFVLENBQUMsbUJBQW1CO1lBQ25ELEdBQUcsQ0FBQyxVQUFVLENBQUMsTUFBTSxDQUFDLENBQUMsQ0FBQyxFQUFFLE1BQU0sRUFBRSxVQUFVLENBQUMsTUFBTSxFQUFFLENBQUMsQ0FBQyxDQUFDLEVBQUUsQ0FBQztZQUMzRCxHQUFHLENBQUMsVUFBVSxDQUFDLGtCQUFrQjtnQkFDL0IsQ0FBQyxDQUFDLEVBQUUsa0JBQWtCLEVBQUUsVUFBVSxDQUFDLGtCQUFrQixFQUFFO2dCQUN2RCxDQUFDLENBQUMsRUFBRSxDQUFDO1lBQ1AsR0FBRyxDQUFDLFVBQVUsQ0FBQyxhQUFhLENBQUMsQ0FBQyxDQUFDLEVBQUUsYUFBYSxFQUFFLFVBQVUsQ0FBQyxhQUFhLEVBQUUsQ0FBQyxDQUFDLENBQUMsRUFBRSxDQUFDO1NBQ2pGLENBQUM7UUFDRix5RUFBeUU7UUFDekUsNkVBQTZFO1FBQzdFLElBQUksQ0FBQyxhQUFhLENBQUMsS0FBSyxDQUFDLENBQUM7UUFDMUIsSUFBSSxDQUFDO1lBQ0gsY0FBYyxDQUFDLFdBQVcsRUFBRSxDQUFDLFFBQVEsQ0FBQztnQkFDcEMsS0FBSyxFQUFFLEtBQUssQ0FBQyxPQUFPLENBQUMsQ0FBQyxDQUFDLGdCQUFnQixDQUFDLElBQUksQ0FBQyxDQUFDLENBQUMsZ0JBQWdCLENBQUMsSUFBSTtnQkFDcEUsSUFBSSxFQUFFLGlCQUFpQixDQUFDLGNBQWM7Z0JBQ3RDLE9BQU8sRUFBRSxLQUFLLENBQUMsT0FBTyxDQUFDLENBQUMsQ0FBQywwQkFBMEIsQ0FBQyxDQUFDLENBQUMsdUJBQXVCO2dCQUM3RSxNQUFNLEVBQUUsS0FBSyxDQUFDLE1BQU07Z0JBQ3BCLE9BQU8sRUFBRSxLQUFLLENBQUMsT0FBTztnQkFDdEIsT0FBTyxFQUFFLEVBQUUsbUJBQW1CLEVBQUUsS0FBSyxFQUFFO2FBQ3hDLENBQUMsQ0FBQztRQUNMLENBQUM7UUFBQyxPQUFPLEtBQUssRUFBRSxDQUFDO1lBQ2YsTUFBTSxDQUFDLEdBQUcsQ0FBQyxNQUFNLEVBQUUsOERBQStELEtBQWUsQ0FBQyxPQUFPLEVBQUUsQ0FBQyxDQUFDO1FBQy9HLENBQUM7UUFDRCxPQUFPLEtBQUssQ0FBQztJQUNmLENBQUM7SUFFTSxhQUFhO1FBQ2xCLElBQUksSUFBSSxDQUFDLGFBQWE7WUFBRSxPQUFPLElBQUksQ0FBQyxhQUFhLENBQUM7UUFDbEQsTUFBTSxHQUFHLEdBQUcsSUFBSSxDQUFDLHFCQUFxQixFQUFFLENBQUM7UUFDekMsSUFBSSxDQUFDLGFBQWEsR0FBRyxHQUFHLENBQUM7UUFDekIsR0FBRyxDQUFDLElBQUksQ0FDTixHQUFHLEVBQUUsR0FBRyxJQUFJLElBQUksQ0FBQyxhQUFhLEtBQUssR0FBRztZQUFFLElBQUksQ0FBQyxhQUFhLEdBQUcsU0FBUyxDQUFDLENBQUMsQ0FBQyxFQUN6RSxHQUFHLEVBQUUsR0FBRyxJQUFJLElBQUksQ0FBQyxhQUFhLEtBQUssR0FBRztZQUFFLElBQUksQ0FBQyxhQUFhLEdBQUcsU0FBUyxDQUFDLENBQUMsQ0FBQyxDQUMxRSxDQUFDO1FBQ0YsT0FBTyxHQUFHLENBQUM7SUFDYixDQUFDO0lBRU0sV0FBVyxDQUFDLFNBQWlCO1FBQ2xDLElBQUksSUFBSSxDQUFDLGFBQWE7WUFBRSxPQUFPLElBQUksQ0FBQyxhQUFhLENBQUM7UUFDbEQsTUFBTSxHQUFHLEdBQUcsSUFBSSxDQUFDLFVBQVUsRUFBRTtZQUMzQixDQUFDLENBQUMsc0JBQXNCLENBQUMsV0FBVyxDQUFDLFNBQVMsQ0FBQztZQUMvQyxDQUFDLENBQUMsT0FBTyxDQUFDLE9BQU8sQ0FBQyxDQUFDLENBQUMsQ0FBQztRQUN2QixJQUFJLENBQUMsYUFBYSxHQUFHLEdBQUcsQ0FBQztRQUN6QixHQUFHLENBQUMsSUFBSSxDQUNOLEdBQUcsRUFBRSxHQUFHLElBQUksSUFBSSxDQUFDLGFBQWEsS0FBSyxHQUFHO1lBQUUsSUFBSSxDQUFDLGFBQWEsR0FBRyxTQUFTLENBQUMsQ0FBQyxDQUFDLEVBQ3pFLEdBQUcsRUFBRSxHQUFHLElBQUksSUFBSSxDQUFDLGFBQWEsS0FBSyxHQUFHO1lBQUUsSUFBSSxDQUFDLGFBQWEsR0FBRyxTQUFTLENBQUMsQ0FBQyxDQUFDLENBQzFFLENBQUM7UUFDRixPQUFPLEdBQUcsQ0FBQztJQUNiLENBQUM7SUFFTyxpQkFBaUIsQ0FBQyxTQUFpQixFQUFFLFFBQWdCO1FBQzNELE1BQU0sTUFBTSxHQUFHLENBQUMsR0FBRyxJQUFJLENBQUMsWUFBWSxDQUFDLE1BQU0sRUFBRSxDQUFDO2FBQzNDLE1BQU0sQ0FBQyxDQUFDLEtBQUssRUFBRSxFQUFFLENBQUMsS0FBSyxDQUFDLFNBQVMsSUFBSSxTQUFTLENBQUM7YUFDL0MsSUFBSSxDQUFDLENBQUMsQ0FBQyxFQUFFLENBQUMsRUFBRSxFQUFFLENBQUMsQ0FBQyxDQUFDLFNBQVMsR0FBRyxDQUFDLENBQUMsU0FBUyxJQUFJLENBQUMsQ0FBQyxFQUFFLENBQUMsYUFBYSxDQUFDLENBQUMsQ0FBQyxFQUFFLENBQUMsQ0FBQyxDQUFDO1FBQ3pFLE9BQU87WUFDTCxXQUFXLEVBQUUsU0FBUztZQUN0QixTQUFTLEVBQUUsTUFBTSxDQUFDLE1BQU0sQ0FBQyxDQUFDLEtBQUssRUFBRSxFQUFFLENBQUMsS0FBSyxDQUFDLE9BQU8sQ0FBQyxDQUFDLE1BQU07WUFDekQsUUFBUSxFQUFFLE1BQU0sQ0FBQyxNQUFNLENBQUMsQ0FBQyxLQUFLLEVBQUUsRUFBRSxDQUFDLENBQUMsS0FBSyxDQUFDLE9BQU8sQ0FBQyxDQUFDLE1BQU07WUFDekQsTUFBTSxFQUFFLE1BQU0sQ0FBQyxLQUFLLENBQUMsQ0FBQyxFQUFFLFFBQVEsQ0FBQztTQUNsQyxDQUFDO0lBQ0osQ0FBQztJQUVPLEtBQUssQ0FBQyxzQkFBc0IsQ0FDbEMsV0FBVyxHQUFHLEVBQUUsR0FBRyxFQUFFLEdBQUcsRUFBRSxHQUFHLElBQUksRUFDakMsUUFBUSxHQUFHLEdBQUc7UUFFZCxNQUFNLE1BQU0sR0FBRyxJQUFJLENBQUMsR0FBRyxFQUFFLEdBQUcsV0FBVyxDQUFDO1FBQ3hDLElBQUksQ0FBQyxJQUFJLENBQUMsVUFBVSxFQUFFLEVBQUUsQ0FBQztZQUN2QixPQUFPLElBQUksQ0FBQyxpQkFBaUIsQ0FBQyxNQUFNLEVBQUUsUUFBUSxDQUFDLENBQUM7UUFDbEQsQ0FBQztRQUVELElBQUksQ0FBQztZQUNILE1BQU0sSUFBSSxDQUFDLGFBQWEsRUFBRSxDQUFDO1FBQzdCLENBQUM7UUFBQyxPQUFPLEtBQUssRUFBRSxDQUFDO1lBQ2YsTUFBTSxDQUFDLEdBQUcsQ0FBQyxNQUFNLEVBQUUsZ0RBQWlELEtBQWUsQ0FBQyxPQUFPLEVBQUUsQ0FBQyxDQUFDO1FBQ2pHLENBQUM7UUFFRCxJQUFJLENBQUM7WUFDSCxNQUFNLE9BQU8sR0FBRyxNQUFNLHNCQUFzQixDQUFDLGdCQUFnQixDQUFDLE1BQU0sRUFBRSxRQUFRLENBQUMsQ0FBQztZQUNoRixNQUFNLFFBQVEsR0FBRyxDQUFDLEdBQUcsSUFBSSxDQUFDLGFBQWEsQ0FBQyxNQUFNLEVBQUUsQ0FBQztpQkFDOUMsTUFBTSxDQUFDLENBQUMsS0FBSyxFQUFFLEVBQUUsQ0FBQyxLQUFLLENBQUMsU0FBUyxJQUFJLE1BQU0sQ0FBQyxDQUFDO1lBQ2hELE1BQU0sV0FBVyxHQUFHLElBQUksR0FBRyxFQUFVLENBQUM7WUFDdEMsTUFBTSxXQUFXLEdBQUcsUUFBUSxDQUFDLEdBQUcsQ0FBQyxDQUFDLEtBQUssRUFBRSxFQUFFLENBQUMsS0FBSyxDQUFDLEVBQUUsQ0FBQyxDQUFDO1lBQ3RELEtBQUssSUFBSSxNQUFNLEdBQUcsQ0FBQyxFQUFFLE1BQU0sR0FBRyxXQUFXLENBQUMsTUFBTSxFQUFFLE1BQU0sSUFBSSxzQkFBc0IsRUFBRSxDQUFDO2dCQUNuRixNQUFNLGFBQWEsR0FBRyxNQUFNLHNCQUFzQixDQUFDLGVBQWUsQ0FDaEUsV0FBVyxDQUFDLEtBQUssQ0FBQyxNQUFNLEVBQUUsTUFBTSxHQUFHLHNCQUFzQixDQUFDLENBQzNELENBQUM7Z0JBQ0YsYUFBYSxDQUFDLE9BQU8sQ0FBQyxDQUFDLEVBQUUsRUFBRSxFQUFFLENBQUMsV0FBVyxDQUFDLEdBQUcsQ0FBQyxFQUFFLENBQUMsQ0FBQyxDQUFDO1lBQ3JELENBQUM7WUFDRCxNQUFNLFdBQVcsR0FBRyxRQUFRLENBQUMsTUFBTSxDQUFDLENBQUMsS0FBSyxFQUFFLEVBQUUsQ0FBQyxDQUFDLFdBQVcsQ0FBQyxHQUFHLENBQUMsS0FBSyxDQUFDLEVBQUUsQ0FBQyxDQUFDLENBQUM7WUFDM0UsTUFBTSxVQUFVLEdBQUcsSUFBSSxHQUFHLEVBQWdDLENBQUM7WUFDM0QsS0FBSyxNQUFNLEtBQUssSUFBSSxPQUFPLENBQUMsTUFBTTtnQkFBRSxVQUFVLENBQUMsR0FBRyxDQUFDLEtBQUssQ0FBQyxFQUFFLEVBQUUsS0FBSyxDQUFDLENBQUM7WUFDcEUsS0FBSyxNQUFNLEtBQUssSUFBSSxXQUFXLEVBQUUsQ0FBQztnQkFDaEMsSUFBSSxDQUFDLFVBQVUsQ0FBQyxHQUFHLENBQUMsS0FBSyxDQUFDLEVBQUUsQ0FBQztvQkFBRSxVQUFVLENBQUMsR0FBRyxDQUFDLEtBQUssQ0FBQyxFQUFFLEVBQUUsS0FBSyxDQUFDLENBQUM7WUFDakUsQ0FBQztZQUNELE1BQU0sWUFBWSxHQUFHLENBQUMsR0FBRyxVQUFVLENBQUMsTUFBTSxFQUFFLENBQUM7aUJBQzFDLElBQUksQ0FBQyxDQUFDLENBQUMsRUFBRSxDQUFDLEVBQUUsRUFBRSxDQUFDLENBQUMsQ0FBQyxTQUFTLEdBQUcsQ0FBQyxDQUFDLFNBQVMsSUFBSSxDQUFDLENBQUMsRUFBRSxDQUFDLGFBQWEsQ0FBQyxDQUFDLENBQUMsRUFBRSxDQUFDLENBQUM7aUJBQ3JFLEtBQUssQ0FBQyxDQUFDLEVBQUUsUUFBUSxDQUFDLENBQUM7WUFDdEIsT0FBTztnQkFDTCxXQUFXLEVBQUUsTUFBTTtnQkFDbkIsU0FBUyxFQUFFLE9BQU8sQ0FBQyxTQUFTLEdBQUcsV0FBVyxDQUFDLE1BQU0sQ0FBQyxDQUFDLEtBQUssRUFBRSxFQUFFLENBQUMsS0FBSyxDQUFDLE9BQU8sQ0FBQyxDQUFDLE1BQU07Z0JBQ2xGLFFBQVEsRUFBRSxPQUFPLENBQUMsUUFBUSxHQUFHLFdBQVcsQ0FBQyxNQUFNLENBQUMsQ0FBQyxLQUFLLEVBQUUsRUFBRSxDQUFDLENBQUMsS0FBSyxDQUFDLE9BQU8sQ0FBQyxDQUFDLE1BQU07Z0JBQ2pGLE1BQU0sRUFBRSxZQUFZO2FBQ3JCLENBQUM7UUFDSixDQUFDO1FBQUMsT0FBTyxLQUFLLEVBQUUsQ0FBQztZQUNmLE1BQU0sQ0FBQyxHQUFHLENBQUMsTUFBTSxFQUFFLGtEQUFtRCxLQUFlLENBQUMsT0FBTyxFQUFFLENBQUMsQ0FBQztZQUNqRyxPQUFPLElBQUksQ0FBQyxpQkFBaUIsQ0FBQyxNQUFNLEVBQUUsUUFBUSxDQUFDLENBQUM7UUFDbEQsQ0FBQztJQUNILENBQUM7SUFFTSxjQUFjLENBQ25CLFdBQVcsR0FBRyxFQUFFLEdBQUcsRUFBRSxHQUFHLEVBQUUsR0FBRyxJQUFJLEVBQ2pDLFFBQVEsR0FBRyxHQUFHO1FBRWQsSUFBSSxDQUFDLE1BQU0sQ0FBQyxhQUFhLENBQUMsV0FBVyxDQUFDLElBQUksV0FBVyxJQUFJLENBQUMsRUFBRSxDQUFDO1lBQzNELE9BQU8sT0FBTyxDQUFDLE1BQU0sQ0FBQyxJQUFJLEtBQUssQ0FBQyxrREFBa0QsQ0FBQyxDQUFDLENBQUM7UUFDdkYsQ0FBQztRQUNELElBQUksQ0FBQyxNQUFNLENBQUMsYUFBYSxDQUFDLFFBQVEsQ0FBQyxJQUFJLFFBQVEsSUFBSSxDQUFDLElBQUksUUFBUSxHQUFHLEdBQUcsRUFBRSxDQUFDO1lBQ3ZFLE9BQU8sT0FBTyxDQUFDLE1BQU0sQ0FBQyxJQUFJLEtBQUssQ0FBQyxrREFBa0QsQ0FBQyxDQUFDLENBQUM7UUFDdkYsQ0FBQztRQUNELE1BQU0sR0FBRyxHQUFHLEdBQUcsV0FBVyxJQUFJLFFBQVEsRUFBRSxDQUFDO1FBQ3pDLE1BQU0sUUFBUSxHQUFHLElBQUksQ0FBQyxtQkFBbUIsQ0FBQyxHQUFHLENBQUMsR0FBRyxDQUFDLENBQUM7UUFDbkQsSUFBSSxRQUFRO1lBQUUsT0FBTyxRQUFRLENBQUM7UUFDOUIsTUFBTSxHQUFHLEdBQUcsSUFBSSxDQUFDLHNCQUFzQixDQUFDLFdBQVcsRUFBRSxRQUFRLENBQUMsQ0FBQztRQUMvRCxJQUFJLENBQUMsbUJBQW1CLENBQUMsR0FBRyxDQUFDLEdBQUcsRUFBRSxHQUFHLENBQUMsQ0FBQztRQUN2QyxHQUFHLENBQUMsSUFBSSxDQUNOLEdBQUcsRUFBRSxHQUFHLElBQUksSUFBSSxDQUFDLG1CQUFtQixDQUFDLEdBQUcsQ0FBQyxHQUFHLENBQUMsS0FBSyxHQUFHO1lBQUUsSUFBSSxDQUFDLG1CQUFtQixDQUFDLE1BQU0sQ0FBQyxHQUFHLENBQUMsQ0FBQyxDQUFDLENBQUMsRUFDOUYsR0FBRyxFQUFFLEdBQUcsSUFBSSxJQUFJLENBQUMsbUJBQW1CLENBQUMsR0FBRyxDQUFDLEdBQUcsQ0FBQyxLQUFLLEdBQUc7WUFBRSxJQUFJLENBQUMsbUJBQW1CLENBQUMsTUFBTSxDQUFDLEdBQUcsQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUMvRixDQUFDO1FBQ0YsT0FBTyxHQUFHLENBQUM7SUFDYixDQUFDO0lBRUQsaUVBQWlFO0lBQzFELEtBQUssQ0FBQyxhQUFhO1FBQ3hCLE1BQU0sSUFBSSxDQUFDLGFBQWEsRUFBRSxLQUFLLENBQUMsR0FBRyxFQUFFLENBQUMsU0FBUyxDQUFDLENBQUM7UUFDakQsSUFBSSxDQUFDLGFBQWEsQ0FBQyxLQUFLLEVBQUUsQ0FBQztRQUMzQixJQUFJLENBQUMsWUFBWSxDQUFDLEtBQUssRUFBRSxDQUFDO0lBQzVCLENBQUM7Q0FDRiJ9

package/dist_ts/security/index.d.ts

@@ -3,3 +3,4 @@ export { IPReputationChecker, ReputationThreshold, IPType, type IReputationResul
 export { ContentScanner, ThreatCategory, type IScanResult, type IContentScannerOptions } from './classes.contentscanner.js';
 export { SecurityPolicyManager, type ISecurityPolicyManagerOptions, type IRemoteIngressFirewallSnapshot, } from './classes.security-policy-manager.js';
 export * from './classes.route-policy-augmenter.js';
+export * from './classes.authentication-event-manager.js';

package/dist_ts/security/index.js

@@ -3,4 +3,5 @@ export { IPReputationChecker, ReputationThreshold, IPType } from './classes.ipre
 export { ContentScanner, ThreatCategory } from './classes.contentscanner.js';
 export { SecurityPolicyManager, } from './classes.security-policy-manager.js';
 export * from './classes.route-policy-augmenter.js';
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi8uLi90cy9zZWN1cml0eS9pbmRleC50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxPQUFPLEVBQ0wsY0FBYyxFQUNkLGdCQUFnQixFQUNoQixpQkFBaUIsRUFFbEIsTUFBTSw2QkFBNkIsQ0FBQztBQUVyQyxPQUFPLEVBQ0wsbUJBQW1CLEVBQ25CLG1CQUFtQixFQUNuQixNQUFNLEVBR1AsTUFBTSxrQ0FBa0MsQ0FBQztBQUUxQyxPQUFPLEVBQ0wsY0FBYyxFQUNkLGNBQWMsRUFHZixNQUFNLDZCQUE2QixDQUFDO0FBRXJDLE9BQU8sRUFDTCxxQkFBcUIsR0FHdEIsTUFBTSxzQ0FBc0MsQ0FBQztBQUM5QyxjQUFjLHFDQUFxQyxDQUFDIn0=
+export * from './classes.authentication-event-manager.js';
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi8uLi90cy9zZWN1cml0eS9pbmRleC50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxPQUFPLEVBQ0wsY0FBYyxFQUNkLGdCQUFnQixFQUNoQixpQkFBaUIsRUFFbEIsTUFBTSw2QkFBNkIsQ0FBQztBQUVyQyxPQUFPLEVBQ0wsbUJBQW1CLEVBQ25CLG1CQUFtQixFQUNuQixNQUFNLEVBR1AsTUFBTSxrQ0FBa0MsQ0FBQztBQUUxQyxPQUFPLEVBQ0wsY0FBYyxFQUNkLGNBQWMsRUFHZixNQUFNLDZCQUE2QixDQUFDO0FBRXJDLE9BQU8sRUFDTCxxQkFBcUIsR0FHdEIsTUFBTSxzQ0FBc0MsQ0FBQztBQUM5QyxjQUFjLHFDQUFxQyxDQUFDO0FBQ3BELGNBQWMsMkNBQTJDLENBQUMifQ==

package/dist_ts_interfaces/data/stats.d.ts

@@ -82,6 +82,19 @@ export interface ISecurityEvent {
     domain?: string;
     success?: boolean;
 }
+export type TAuthenticationSource = 'auto' | 'local' | 'idp.global';
+export type TResolvedAuthenticationSource = Exclude<TAuthenticationSource, 'auto'>;
+export type TAuthenticationFailureReason = 'invalidCredentials' | 'serviceUnavailable' | 'identityIssuanceFailed' | 'internalError';
+export interface IAuthenticationEvent {
+    id: string;
+    timestamp: number;
+    username: string;
+    userId?: string;
+    success: boolean;
+    requestedAuthSource: TAuthenticationSource;
+    resolvedAuthSource?: TResolvedAuthenticationSource;
+    failureReason?: TAuthenticationFailureReason;
+}
 export interface ISecurityMetrics {
     blockedIPs: string[];
     reputationScores: {
@@ -91,6 +104,9 @@ export interface ISecurityMetrics {
     malwareDetected: number;
     phishingDetected: number;
     authenticationFailures: number;
+    authenticationSuccesses: number;
+    authenticationWindowStart: number;
+    authenticationEvents?: IAuthenticationEvent[];
     suspiciousActivities: number;
     recentEvents?: ISecurityEvent[];
 }