@things-factory/auth-base 10.1.192 → 10.1.198

package/dist-server/service/audit/audit-query.js

@@ -0,0 +1,295 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AuditQuery = void 0;
+const tslib_1 = require("tslib");
+const type_graphql_1 = require("type-graphql");
+const typeorm_1 = require("typeorm");
+const shell_1 = require("@things-factory/shell");
+const domain_ownership_js_1 = require("../../utils/domain-ownership.js");
+const get_domain_users_js_1 = require("../../utils/get-domain-users.js");
+const privilege_js_1 = require("../privilege/privilege.js");
+const role_js_1 = require("../role/role.js");
+const user_js_1 = require("../user/user.js");
+const audit_action_js_1 = require("./audit-action.js");
+const audit_recorder_js_1 = require("./audit-recorder.js");
+const audit_request_js_1 = require("./audit-request.js");
+const audit_types_js_1 = require("./audit-types.js");
+/*
+ * Everybody's audit is `audit:query` (ADR-0141 §5). The domain owner does not pass on ownership - this is
+ * a sensitive door (ADR-0139) - and the superuser does, as a stated exception whose basis the check records.
+ * Every answer is this domain's only.
+ */
+const AUDIT_QUERY = '@privilege(category: "audit", privilege: "query", superUserGranted: true)';
+/* Reading the audit is recorded like any door, and left out of usage counts (§5-8 · §6.3). */
+const AUDIT_DOOR = 'audit:query';
+const MAX_PAGE = 200;
+function period(from, to) {
+    return { from: new Date(from), to: new Date(to) };
+}
+let AuditQuery = class AuditQuery {
+    async auditRecords(filter, context) {
+        const { domain } = context.state;
+        const { from, to } = period(filter.from, filter.to);
+        const limit = Math.min(Math.max(filter.limit || 50, 1), MAX_PAGE);
+        const page = Math.max(filter.page || 1, 1);
+        const qb = (0, shell_1.getRepository)(audit_request_js_1.AuditRequest)
+            .createQueryBuilder('request')
+            .leftJoinAndSelect('request.actor', 'actor')
+            .where('request.domain = :domainId', { domainId: domain.id })
+            .andWhere('request.createdAt >= :from AND request.createdAt <= :to', { from, to });
+        if (filter.actorId)
+            qb.andWhere('request.actor = :actorId', { actorId: filter.actorId });
+        /* A request is kept when one of its actions matches - the request line alone says nothing of doors. */
+        const conditions = [];
+        const params = {};
+        if (filter.door) {
+            conditions.push('action.door = :door');
+            params.door = filter.door;
+        }
+        if (filter.kind) {
+            conditions.push('action.kind = :kind');
+            params.kind = filter.kind;
+        }
+        if (filter.outcome === 'denied')
+            conditions.push("action.decision = 'denied'");
+        if (filter.outcome === 'error')
+            conditions.push("action.outcome = 'error' AND action.kind = 'door.result'");
+        if (filter.outcome === 'failed')
+            conditions.push("action.outcome = 'error' AND action.kind <> 'door.result'");
+        if (conditions.length) {
+            const exists = qb
+                .subQuery()
+                .select('1')
+                .from(audit_action_js_1.AuditAction, 'action')
+                .where('action.requestId = request.id')
+                .andWhere(conditions.join(' AND '))
+                .getQuery();
+            qb.andWhere(`EXISTS ${exists}`, params);
+        }
+        const [requests, total] = await qb
+            .orderBy('request.createdAt', 'DESC')
+            .skip((page - 1) * limit)
+            .take(limit)
+            .getManyAndCount();
+        const ids = requests.map(request => request.id);
+        const actions = ids.length
+            ? await (0, shell_1.getRepository)(audit_action_js_1.AuditAction)
+                .createQueryBuilder('action')
+                .where('action.requestId IN (:...ids)', { ids })
+                .andWhere(new typeorm_1.Brackets(where => where.where('action.domain = :domainId', { domainId: domain.id }).orWhere('action.domain IS NULL')))
+                .orderBy('action.createdAt', 'ASC')
+                .getMany()
+            : [];
+        return {
+            items: requests.map(request => ({ request, actions: actions.filter(action => action.requestId === request.id) })),
+            total
+        };
+    }
+    async auditPeople(from, to, context) {
+        const { domain } = context.state;
+        const range = period(from, to);
+        const members = await (0, get_domain_users_js_1.getDomainUsers)(domain);
+        const ownerIds = [...(await (0, domain_ownership_js_1.findDomainOwnerUserIds)(domain))].filter(id => !members.some(one => one.id === id));
+        const people = [...members, ...(ownerIds.length ? await (0, shell_1.getRepository)(user_js_1.User).find({ where: { id: (0, typeorm_1.In)(ownerIds) } }) : [])];
+        if (!people.length)
+            return [];
+        const ids = people.map(one => one.id);
+        const roleRows = await (0, shell_1.getRepository)(role_js_1.Role)
+            .createQueryBuilder('role')
+            .innerJoin('role.users', 'holder')
+            .select(['role.name AS "name"', 'holder.id AS "userId"'])
+            .where('role.domain = :domainId', { domainId: domain.id })
+            .andWhere('holder.id IN (:...ids)', { ids })
+            .getRawMany();
+        const sums = (rows) => new Map(rows.map(row => [row.actorId, row]));
+        const checkins = sums(await (0, shell_1.getRepository)(audit_action_js_1.AuditAction)
+            .createQueryBuilder('action')
+            .innerJoin('action.actor', 'actor')
+            .select('actor.id', 'actorId')
+            .addSelect('COUNT(*)', 'inPeriod')
+            .where("action.kind = 'auth.checkin'")
+            .andWhere('action.domain = :domainId', { domainId: domain.id })
+            .andWhere('action.createdAt >= :from AND action.createdAt <= :to', range)
+            .andWhere('actor.id IN (:...ids)', { ids })
+            .groupBy('actor.id')
+            .getRawMany());
+        /*
+         * The last check-in is read as rows, not as a raw MAX(): a raw value is the driver's text - sqlite
+         * gives UTC without a zone - and only the entity path turns it into the right moment.
+         */
+        const lastCheckins = new Map((await (0, shell_1.getRepository)(audit_action_js_1.AuditAction)
+            .createQueryBuilder('action')
+            .leftJoinAndSelect('action.actor', 'actor')
+            .where("action.kind = 'auth.checkin'")
+            .andWhere('action.domain = :domainId', { domainId: domain.id })
+            .andWhere('actor.id IN (:...ids)', { ids })
+            .andWhere(qb => {
+            const latest = qb
+                .subQuery()
+                .select('MAX(latest.createdAt)')
+                .from(audit_action_js_1.AuditAction, 'latest')
+                .where("latest.kind = 'auth.checkin'")
+                .andWhere('latest.domain = :domainId')
+                .andWhere('latest.actor = action.actor')
+                .getQuery();
+            return `action.createdAt = ${latest}`;
+        })
+            .getMany()).map(action => [action.actor?.id, action.createdAt]));
+        /* A sign-in may come before any domain is chosen, so failures are the member's wherever they were. */
+        const failures = sums(await (0, shell_1.getRepository)(audit_action_js_1.AuditAction)
+            .createQueryBuilder('action')
+            .innerJoin('action.actor', 'actor')
+            .select('actor.id', 'actorId')
+            .addSelect('COUNT(*)', 'failed')
+            .where("action.kind = 'auth.signin' AND action.outcome = 'error'")
+            .andWhere('action.createdAt >= :from AND action.createdAt <= :to', range)
+            .andWhere(new typeorm_1.Brackets(where => where.where('action.domain = :domainId', { domainId: domain.id }).orWhere('action.domain IS NULL')))
+            .andWhere('actor.id IN (:...ids)', { ids })
+            .groupBy('actor.id')
+            .getRawMany());
+        const doors = sums(await (0, shell_1.getRepository)(audit_action_js_1.AuditAction)
+            .createQueryBuilder('action')
+            .innerJoin('action.actor', 'actor')
+            .select('actor.id', 'actorId')
+            .addSelect("SUM(CASE WHEN action.decision = 'granted' THEN action.count ELSE 0 END)", 'granted')
+            .addSelect("SUM(CASE WHEN action.decision = 'denied' THEN action.count ELSE 0 END)", 'denied')
+            .where("action.kind = 'door.check'")
+            .andWhere('action.door <> :auditDoor', { auditDoor: AUDIT_DOOR })
+            .andWhere('action.domain = :domainId', { domainId: domain.id })
+            .andWhere('action.createdAt >= :from AND action.createdAt <= :to', range)
+            .groupBy('actor.id')
+            .getRawMany());
+        return people.map(user => ({
+            user,
+            roles: roleRows.filter(row => row.userId === user.id).map(row => row.name),
+            lastCheckinAt: lastCheckins.get(user.id),
+            checkins: Number(checkins.get(user.id)?.inPeriod || 0),
+            failedSignins: Number(failures.get(user.id)?.failed || 0),
+            granted: Number(doors.get(user.id)?.granted || 0),
+            denied: Number(doors.get(user.id)?.denied || 0)
+        }));
+    }
+    async auditDoors(from, to, context) {
+        const { domain } = context.state;
+        const observed = await (0, shell_1.getRepository)(audit_action_js_1.AuditAction)
+            .createQueryBuilder('action')
+            .leftJoin('action.actor', 'actor')
+            .select('action.door', 'door')
+            .addSelect('COUNT(DISTINCT actor.id)', 'people')
+            .addSelect("SUM(CASE WHEN action.decision = 'granted' THEN action.count ELSE 0 END)", 'granted')
+            .addSelect("SUM(CASE WHEN action.decision = 'denied' THEN action.count ELSE 0 END)", 'denied')
+            .where("action.kind = 'door.check'")
+            .andWhere('action.door <> :auditDoor', { auditDoor: AUDIT_DOOR })
+            .andWhere('action.domain = :domainId', { domainId: domain.id })
+            .andWhere('action.createdAt >= :from AND action.createdAt <= :to', period(from, to))
+            .groupBy('action.door')
+            .getRawMany();
+        const byDoor = new Map(observed.map(row => [row.door, row]));
+        const declared = await (0, shell_1.getRepository)(privilege_js_1.Privilege).find({ order: { category: 'ASC', name: 'ASC' } });
+        const doors = new Map();
+        for (const one of declared) {
+            const door = `${one.category}:${one.name}`;
+            if (door === AUDIT_DOOR)
+                continue;
+            doors.set(door, { door, category: one.category, privilege: one.name, people: 0, granted: 0, denied: 0 });
+        }
+        for (const [door, row] of byDoor) {
+            const [category, privilege] = door.includes(':') ? door.split(':') : [undefined, undefined];
+            doors.set(door, {
+                door,
+                category,
+                privilege,
+                people: Number(row.people || 0),
+                granted: Number(row.granted || 0),
+                denied: Number(row.denied || 0)
+            });
+        }
+        return [...doors.values()];
+    }
+    async auditHealth() {
+        return (0, audit_recorder_js_1.auditHealth)();
+    }
+    /*
+     * One's own record is what one did (ADR-0141 §5-5): the actor is the session's user, whatever is asked.
+     * What somebody else did to me is not here.
+     */
+    async myAuditActions(kind, limit, context) {
+        const { domain, user } = context.state;
+        if (!user)
+            throw new Error('No user specified');
+        const qb = (0, shell_1.getRepository)(audit_action_js_1.AuditAction)
+            .createQueryBuilder('action')
+            .leftJoinAndSelect('action.domain', 'domain')
+            .where('action.actor = :userId', { userId: user.id })
+            .andWhere(new typeorm_1.Brackets(where => where.where('action.domain = :domainId', { domainId: domain?.id }).orWhere('action.domain IS NULL')));
+        if (kind)
+            qb.andWhere('action.kind = :kind', { kind });
+        return await qb
+            .orderBy('action.createdAt', 'DESC')
+            .take(Math.min(Math.max(limit || 20, 1), MAX_PAGE))
+            .getMany();
+    }
+    /* Where an action came from - its request's address and browser. */
+    async request(action) {
+        return action.requestId ? await (0, shell_1.getRepository)(audit_request_js_1.AuditRequest).findOneBy({ id: action.requestId }) : null;
+    }
+};
+exports.AuditQuery = AuditQuery;
+tslib_1.__decorate([
+    (0, type_graphql_1.Directive)(AUDIT_QUERY),
+    (0, type_graphql_1.Query)(returns => audit_types_js_1.AuditRecordList, { description: "This domain's audit records - requests and what was done in them." }),
+    tslib_1.__param(0, (0, type_graphql_1.Arg)('filter')),
+    tslib_1.__param(1, (0, type_graphql_1.Ctx)()),
+    tslib_1.__metadata("design:type", Function),
+    tslib_1.__metadata("design:paramtypes", [audit_types_js_1.AuditRecordFilter, Object]),
+    tslib_1.__metadata("design:returntype", Promise)
+], AuditQuery.prototype, "auditRecords", null);
+tslib_1.__decorate([
+    (0, type_graphql_1.Directive)(AUDIT_QUERY),
+    (0, type_graphql_1.Query)(returns => [audit_types_js_1.AuditPerson], { description: "Each member's audit summary over a period, in this domain." }),
+    tslib_1.__param(0, (0, type_graphql_1.Arg)('from')),
+    tslib_1.__param(1, (0, type_graphql_1.Arg)('to')),
+    tslib_1.__param(2, (0, type_graphql_1.Ctx)()),
+    tslib_1.__metadata("design:type", Function),
+    tslib_1.__metadata("design:paramtypes", [Date, Date, Object]),
+    tslib_1.__metadata("design:returntype", Promise)
+], AuditQuery.prototype, "auditPeople", null);
+tslib_1.__decorate([
+    (0, type_graphql_1.Directive)(AUDIT_QUERY),
+    (0, type_graphql_1.Query)(returns => [audit_types_js_1.AuditDoor], {
+        description: 'Each door over a period, in this domain - every declared privilege, a door with no record in the period too.'
+    }),
+    tslib_1.__param(0, (0, type_graphql_1.Arg)('from')),
+    tslib_1.__param(1, (0, type_graphql_1.Arg)('to')),
+    tslib_1.__param(2, (0, type_graphql_1.Ctx)()),
+    tslib_1.__metadata("design:type", Function),
+    tslib_1.__metadata("design:paramtypes", [Date, Date, Object]),
+    tslib_1.__metadata("design:returntype", Promise)
+], AuditQuery.prototype, "auditDoors", null);
+tslib_1.__decorate([
+    (0, type_graphql_1.Directive)(AUDIT_QUERY),
+    (0, type_graphql_1.Query)(returns => audit_types_js_1.AuditHealth, { description: 'Audit writes this server process failed to store.' }),
+    tslib_1.__metadata("design:type", Function),
+    tslib_1.__metadata("design:paramtypes", []),
+    tslib_1.__metadata("design:returntype", Promise)
+], AuditQuery.prototype, "auditHealth", null);
+tslib_1.__decorate([
+    (0, type_graphql_1.Query)(returns => [audit_action_js_1.AuditAction], { description: 'What I did - in this domain, and my sign-ins.' }),
+    tslib_1.__param(0, (0, type_graphql_1.Arg)('kind', { nullable: true })),
+    tslib_1.__param(1, (0, type_graphql_1.Arg)('limit', type => type_graphql_1.Int, { nullable: true })),
+    tslib_1.__param(2, (0, type_graphql_1.Ctx)()),
+    tslib_1.__metadata("design:type", Function),
+    tslib_1.__metadata("design:paramtypes", [String, Number, Object]),
+    tslib_1.__metadata("design:returntype", Promise)
+], AuditQuery.prototype, "myAuditActions", null);
+tslib_1.__decorate([
+    (0, type_graphql_1.FieldResolver)(type => audit_request_js_1.AuditRequest, { nullable: true }),
+    tslib_1.__param(0, (0, type_graphql_1.Root)()),
+    tslib_1.__metadata("design:type", Function),
+    tslib_1.__metadata("design:paramtypes", [audit_action_js_1.AuditAction]),
+    tslib_1.__metadata("design:returntype", Promise)
+], AuditQuery.prototype, "request", null);
+exports.AuditQuery = AuditQuery = tslib_1.__decorate([
+    (0, type_graphql_1.Resolver)(audit_action_js_1.AuditAction)
+], AuditQuery);
+//# sourceMappingURL=audit-query.js.map

package/dist-server/service/audit/audit-query.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-query.js","sourceRoot":"","sources":["../../../server/service/audit/audit-query.ts"],"names":[],"mappings":";;;;AAAA,+CAA6F;AAC7F,qCAAsC;AAEtC,iDAAqD;AAErD,yEAAwE;AACxE,yEAAgE;AAChE,4DAAqD;AACrD,6CAAsC;AACtC,6CAAsC;AACtC,uDAA+C;AAC/C,2DAAiD;AACjD,yDAAiD;AACjD,qDAA0G;AAE1G;;;;GAIG;AACH,MAAM,WAAW,GAAG,2EAA2E,CAAA;AAE/F,8FAA8F;AAC9F,MAAM,UAAU,GAAG,aAAa,CAAA;AAEhC,MAAM,QAAQ,GAAG,GAAG,CAAA;AAEpB,SAAS,MAAM,CAAC,IAAU,EAAE,EAAQ;IAClC,OAAO,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,IAAI,CAAC,EAAE,CAAC,EAAE,CAAA;AACnD,CAAC;AAGM,IAAM,UAAU,GAAhB,MAAM,UAAU;IAGf,AAAN,KAAK,CAAC,YAAY,CAAgB,MAAyB,EAAS,OAAwB;QAC1F,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,KAAK,CAAA;QAChC,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,CAAA;QACnD,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAA;QACjE,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,EAAE,CAAC,CAAC,CAAA;QAE1C,MAAM,EAAE,GAAG,IAAA,qBAAa,EAAC,+BAAY,CAAC;aACnC,kBAAkB,CAAC,SAAS,CAAC;aAC7B,iBAAiB,CAAC,eAAe,EAAE,OAAO,CAAC;aAC3C,KAAK,CAAC,4BAA4B,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC;aAC5D,QAAQ,CAAC,yDAAyD,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAA;QAEpF,IAAI,MAAM,CAAC,OAAO;YAAE,EAAE,CAAC,QAAQ,CAAC,0BAA0B,EAAE,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAA;QAExF,uGAAuG;QACvG,MAAM,UAAU,GAAa,EAAE,CAAA;QAC/B,MAAM,MAAM,GAAwB,EAAE,CAAA;QACtC,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;YAChB,UAAU,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAA;YACtC,MAAM,CAAC,IAAI,GAAG,MAAM,CAAC,IAAI,CAAA;QAC3B,CAAC;QACD,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;YAChB,UAAU,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAA;YACtC,MAAM,CAAC,IAAI,GAAG,MAAM,CAAC,IAAI,CAAA;QAC3B,CAAC;QACD,IAAI,MAAM,CAAC,OAAO,KAAK,QAAQ;YAAE,UAAU,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAA;QAC9E,IAAI,MAAM,CAAC,OAAO,KAAK,OAAO;YAAE,UAAU,CAAC,IAAI,CAAC,0DAA0D,CAAC,CAAA;QAC3G,IAAI,MAAM,CAAC,OAAO,KAAK,QAAQ;YAAE,UAAU,CAAC,IAAI,CAAC,2DAA2D,CAAC,CAAA;QAE7G,IAAI,UAAU,CAAC,MAAM,EAAE,CAAC;YACtB,MAAM,MAAM,GAAG,EAAE;iBACd,QAAQ,EAAE;iBACV,MAAM,CAAC,GAAG,CAAC;iBACX,IAAI,CAAC,6BAAW,EAAE,QAAQ,CAAC;iBAC3B,KAAK,CAAC,+BAA+B,CAAC;iBACtC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;iBAClC,QAAQ,EAAE,CAAA;YACb,EAAE,CAAC,QAAQ,CAAC,UAAU,MAAM,EAAE,EAAE,MAAM,CAAC,CAAA;QACzC,CAAC;QAED,MAAM,CAAC,QAAQ,EAAE,KAAK,CAAC,GAAG,MAAM,EAAE;aAC/B,OAAO,CAAC,mBAAmB,EAAE,MAAM,CAAC;aACpC,IAAI,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,GAAG,KAAK,CAAC;aACxB,IAAI,CAAC,KAAK,CAAC;aACX,eAAe,EAAE,CAAA;QAEpB,MAAM,GAAG,GAAG,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;QAC/C,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM;YACxB,CAAC,CAAC,MAAM,IAAA,qBAAa,EAAC,6BAAW,CAAC;iBAC7B,kBAAkB,CAAC,QAAQ,CAAC;iBAC5B,KAAK,CAAC,+BAA+B,EAAE,EAAE,GAAG,EAAE,CAAC;iBAC/C,QAAQ,CAAC,IAAI,kBAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,2BAA2B,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,uBAAuB,CAAC,CAAC,CAAC;iBACnI,OAAO,CAAC,kBAAkB,EAAE,KAAK,CAAC;iBAClC,OAAO,EAAE;YACd,CAAC,CAAC,EAAE,CAAA;QAEN,OAAO;YACL,KAAK,EAAE,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,SAAS,KAAK,OAAO,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;YACjH,KAAK;SACN,CAAA;IACH,CAAC;IAIK,AAAN,KAAK,CAAC,WAAW,CAAc,IAAU,EAAa,EAAQ,EAAS,OAAwB;QAC7F,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,KAAK,CAAA;QAChC,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAA;QAE9B,MAAM,OAAO,GAAG,MAAM,IAAA,oCAAc,EAAC,MAAM,CAAC,CAAA;QAC5C,MAAM,QAAQ,GAAG,CAAC,GAAG,CAAC,MAAM,IAAA,4CAAsB,EAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAA;QAC9G,MAAM,MAAM,GAAG,CAAC,GAAG,OAAO,EAAE,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,IAAA,qBAAa,EAAC,cAAI,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,IAAA,YAAE,EAAC,QAAQ,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAA;QACxH,IAAI,CAAC,MAAM,CAAC,MAAM;YAAE,OAAO,EAAE,CAAA;QAE7B,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;QAErC,MAAM,QAAQ,GAAG,MAAM,IAAA,qBAAa,EAAC,cAAI,CAAC;aACvC,kBAAkB,CAAC,MAAM,CAAC;aAC1B,SAAS,CAAC,YAAY,EAAE,QAAQ,CAAC;aACjC,MAAM,CAAC,CAAC,qBAAqB,EAAE,uBAAuB,CAAC,CAAC;aACxD,KAAK,CAAC,yBAAyB,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC;aACzD,QAAQ,CAAC,wBAAwB,EAAE,EAAE,GAAG,EAAE,CAAC;aAC3C,UAAU,EAAE,CAAA;QAEf,MAAM,IAAI,GAAG,CAAC,IAAW,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC,CAAA;QAE1E,MAAM,QAAQ,GAAG,IAAI,CACnB,MAAM,IAAA,qBAAa,EAAC,6BAAW,CAAC;aAC7B,kBAAkB,CAAC,QAAQ,CAAC;aAC5B,SAAS,CAAC,cAAc,EAAE,OAAO,CAAC;aAClC,MAAM,CAAC,UAAU,EAAE,SAAS,CAAC;aAC7B,SAAS,CAAC,UAAU,EAAE,UAAU,CAAC;aACjC,KAAK,CAAC,8BAA8B,CAAC;aACrC,QAAQ,CAAC,2BAA2B,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC;aAC9D,QAAQ,CAAC,uDAAuD,EAAE,KAAK,CAAC;aACxE,QAAQ,CAAC,uBAAuB,EAAE,EAAE,GAAG,EAAE,CAAC;aAC1C,OAAO,CAAC,UAAU,CAAC;aACnB,UAAU,EAAE,CAChB,CAAA;QAED;;;WAGG;QACH,MAAM,YAAY,GAAG,IAAI,GAAG,CAC1B,CACE,MAAM,IAAA,qBAAa,EAAC,6BAAW,CAAC;aAC7B,kBAAkB,CAAC,QAAQ,CAAC;aAC5B,iBAAiB,CAAC,cAAc,EAAE,OAAO,CAAC;aAC1C,KAAK,CAAC,8BAA8B,CAAC;aACrC,QAAQ,CAAC,2BAA2B,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC;aAC9D,QAAQ,CAAC,uBAAuB,EAAE,EAAE,GAAG,EAAE,CAAC;aAC1C,QAAQ,CAAC,EAAE,CAAC,EAAE;YACb,MAAM,MAAM,GAAG,EAAE;iBACd,QAAQ,EAAE;iBACV,MAAM,CAAC,uBAAuB,CAAC;iBAC/B,IAAI,CAAC,6BAAW,EAAE,QAAQ,CAAC;iBAC3B,KAAK,CAAC,8BAA8B,CAAC;iBACrC,QAAQ,CAAC,2BAA2B,CAAC;iBACrC,QAAQ,CAAC,6BAA6B,CAAC;iBACvC,QAAQ,EAAE,CAAA;YACb,OAAO,sBAAsB,MAAM,EAAE,CAAA;QACvC,CAAC,CAAC;aACD,OAAO,EAAE,CACb,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,EAAE,MAAM,CAAC,SAAS,CAAmB,CAAC,CACxE,CAAA;QAED,sGAAsG;QACtG,MAAM,QAAQ,GAAG,IAAI,CACnB,MAAM,IAAA,qBAAa,EAAC,6BAAW,CAAC;aAC7B,kBAAkB,CAAC,QAAQ,CAAC;aAC5B,SAAS,CAAC,cAAc,EAAE,OAAO,CAAC;aAClC,MAAM,CAAC,UAAU,EAAE,SAAS,CAAC;aAC7B,SAAS,CAAC,UAAU,EAAE,QAAQ,CAAC;aAC/B,KAAK,CAAC,0DAA0D,CAAC;aACjE,QAAQ,CAAC,uDAAuD,EAAE,KAAK,CAAC;aACxE,QAAQ,CAAC,IAAI,kBAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,2BAA2B,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,uBAAuB,CAAC,CAAC,CAAC;aACnI,QAAQ,CAAC,uBAAuB,EAAE,EAAE,GAAG,EAAE,CAAC;aAC1C,OAAO,CAAC,UAAU,CAAC;aACnB,UAAU,EAAE,CAChB,CAAA;QAED,MAAM,KAAK,GAAG,IAAI,CAChB,MAAM,IAAA,qBAAa,EAAC,6BAAW,CAAC;aAC7B,kBAAkB,CAAC,QAAQ,CAAC;aAC5B,SAAS,CAAC,cAAc,EAAE,OAAO,CAAC;aAClC,MAAM,CAAC,UAAU,EAAE,SAAS,CAAC;aAC7B,SAAS,CAAC,yEAAyE,EAAE,SAAS,CAAC;aAC/F,SAAS,CAAC,wEAAwE,EAAE,QAAQ,CAAC;aAC7F,KAAK,CAAC,4BAA4B,CAAC;aACnC,QAAQ,CAAC,2BAA2B,EAAE,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC;aAChE,QAAQ,CAAC,2BAA2B,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC;aAC9D,QAAQ,CAAC,uDAAuD,EAAE,KAAK,CAAC;aACxE,OAAO,CAAC,UAAU,CAAC;aACnB,UAAU,EAAE,CAChB,CAAA;QAED,OAAO,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACzB,IAAI;YACJ,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,MAAM,KAAK,IAAI,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC;YAC1E,aAAa,EAAE,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACxC,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,QAAQ,IAAI,CAAC,CAAC;YACtD,aAAa,EAAE,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,MAAM,IAAI,CAAC,CAAC;YACzD,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,OAAO,IAAI,CAAC,CAAC;YACjD,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,MAAM,IAAI,CAAC,CAAC;SAChD,CAAC,CAAC,CAAA;IACL,CAAC;IAMK,AAAN,KAAK,CAAC,UAAU,CAAc,IAAU,EAAa,EAAQ,EAAS,OAAwB;QAC5F,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,KAAK,CAAA;QAEhC,MAAM,QAAQ,GAAG,MAAM,IAAA,qBAAa,EAAC,6BAAW,CAAC;aAC9C,kBAAkB,CAAC,QAAQ,CAAC;aAC5B,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;aACjC,MAAM,CAAC,aAAa,EAAE,MAAM,CAAC;aAC7B,SAAS,CAAC,0BAA0B,EAAE,QAAQ,CAAC;aAC/C,SAAS,CAAC,yEAAyE,EAAE,SAAS,CAAC;aAC/F,SAAS,CAAC,wEAAwE,EAAE,QAAQ,CAAC;aAC7F,KAAK,CAAC,4BAA4B,CAAC;aACnC,QAAQ,CAAC,2BAA2B,EAAE,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC;aAChE,QAAQ,CAAC,2BAA2B,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC;aAC9D,QAAQ,CAAC,uDAAuD,EAAE,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;aACnF,OAAO,CAAC,aAAa,CAAC;aACtB,UAAU,EAAE,CAAA;QAEf,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,CAAA;QAC5D,MAAM,QAAQ,GAAG,MAAM,IAAA,qBAAa,EAAC,wBAAS,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,CAAA;QAEjG,MAAM,KAAK,GAAG,IAAI,GAAG,EAAqB,CAAA;QAC1C,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;YAC3B,MAAM,IAAI,GAAG,GAAG,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,IAAI,EAAE,CAAA;YAC1C,IAAI,IAAI,KAAK,UAAU;gBAAE,SAAQ;YACjC,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,SAAS,EAAE,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,CAAA;QAC1G,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,MAAM,EAAE,CAAC;YACjC,MAAM,CAAC,QAAQ,EAAE,SAAS,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,SAAS,CAAC,CAAA;YAC3F,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE;gBACd,IAAI;gBACJ,QAAQ;gBACR,SAAS;gBACT,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,MAAM,IAAI,CAAC,CAAC;gBAC/B,OAAO,EAAE,MAAM,CAAC,GAAG,CAAC,OAAO,IAAI,CAAC,CAAC;gBACjC,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,MAAM,IAAI,CAAC,CAAC;aAChC,CAAC,CAAA;QACJ,CAAC;QAED,OAAO,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,CAAA;IAC5B,CAAC;IAIK,AAAN,KAAK,CAAC,WAAW;QACf,OAAO,IAAA,+BAAW,GAAiB,CAAA;IACrC,CAAC;IAED;;;OAGG;IAEG,AAAN,KAAK,CAAC,cAAc,CACe,IAAY,EACE,KAAa,EACrD,OAAwB;QAE/B,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,OAAO,CAAC,KAAK,CAAA;QACtC,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAA;QAE/C,MAAM,EAAE,GAAG,IAAA,qBAAa,EAAC,6BAAW,CAAC;aAClC,kBAAkB,CAAC,QAAQ,CAAC;aAC5B,iBAAiB,CAAC,eAAe,EAAE,QAAQ,CAAC;aAC5C,KAAK,CAAC,wBAAwB,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC;aACpD,QAAQ,CAAC,IAAI,kBAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,2BAA2B,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,uBAAuB,CAAC,CAAC,CAAC,CAAA;QAEvI,IAAI,IAAI;YAAE,EAAE,CAAC,QAAQ,CAAC,qBAAqB,EAAE,EAAE,IAAI,EAAE,CAAC,CAAA;QAEtD,OAAO,MAAM,EAAE;aACZ,OAAO,CAAC,kBAAkB,EAAE,MAAM,CAAC;aACnC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;aAClD,OAAO,EAAE,CAAA;IACd,CAAC;IAED,oEAAoE;IAE9D,AAAN,KAAK,CAAC,OAAO,CAAS,MAAmB;QACvC,OAAO,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,IAAA,qBAAa,EAAC,+BAAY,CAAC,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;IACxG,CAAC;CACF,CAAA;AA7PY,gCAAU;AAGf;IAFL,IAAA,wBAAS,EAAC,WAAW,CAAC;IACtB,IAAA,oBAAK,EAAC,OAAO,CAAC,EAAE,CAAC,gCAAe,EAAE,EAAE,WAAW,EAAE,mEAAmE,EAAE,CAAC;IACpG,mBAAA,IAAA,kBAAG,EAAC,QAAQ,CAAC,CAAA;IAA6B,mBAAA,IAAA,kBAAG,GAAE,CAAA;;6CAAzB,kCAAiB;;8CA4D1D;AAIK;IAFL,IAAA,wBAAS,EAAC,WAAW,CAAC;IACtB,IAAA,oBAAK,EAAC,OAAO,CAAC,EAAE,CAAC,CAAC,4BAAW,CAAC,EAAE,EAAE,WAAW,EAAE,4DAA4D,EAAE,CAAC;IAC5F,mBAAA,IAAA,kBAAG,EAAC,MAAM,CAAC,CAAA;IAAc,mBAAA,IAAA,kBAAG,EAAC,IAAI,CAAC,CAAA;IAAY,mBAAA,IAAA,kBAAG,GAAE,CAAA;;6CAAjC,IAAI,EAAiB,IAAI;;6CAqG7D;AAMK;IAJL,IAAA,wBAAS,EAAC,WAAW,CAAC;IACtB,IAAA,oBAAK,EAAC,OAAO,CAAC,EAAE,CAAC,CAAC,0BAAS,CAAC,EAAE;QAC7B,WAAW,EAAE,8GAA8G;KAC5H,CAAC;IACgB,mBAAA,IAAA,kBAAG,EAAC,MAAM,CAAC,CAAA;IAAc,mBAAA,IAAA,kBAAG,EAAC,IAAI,CAAC,CAAA;IAAY,mBAAA,IAAA,kBAAG,GAAE,CAAA;;6CAAjC,IAAI,EAAiB,IAAI;;4CAuC5D;AAIK;IAFL,IAAA,wBAAS,EAAC,WAAW,CAAC;IACtB,IAAA,oBAAK,EAAC,OAAO,CAAC,EAAE,CAAC,4BAAW,EAAE,EAAE,WAAW,EAAE,mDAAmD,EAAE,CAAC;;;;6CAGnG;AAOK;IADL,IAAA,oBAAK,EAAC,OAAO,CAAC,EAAE,CAAC,CAAC,6BAAW,CAAC,EAAE,EAAE,WAAW,EAAE,+CAA+C,EAAE,CAAC;IAE/F,mBAAA,IAAA,kBAAG,EAAC,MAAM,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAA;IAC/B,mBAAA,IAAA,kBAAG,EAAC,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC,kBAAG,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAA;IAC7C,mBAAA,IAAA,kBAAG,GAAE,CAAA;;;;gDAiBP;AAIK;IADL,IAAA,4BAAa,EAAC,IAAI,CAAC,EAAE,CAAC,+BAAY,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IACzC,mBAAA,IAAA,mBAAI,GAAE,CAAA;;6CAAS,6BAAW;;yCAExC;qBA5PU,UAAU;IADtB,IAAA,uBAAQ,EAAC,6BAAW,CAAC;GACT,UAAU,CA6PtB","sourcesContent":["import { Arg, Ctx, Directive, FieldResolver, Int, Query, Resolver, Root } from 'type-graphql'\nimport { Brackets, In } from 'typeorm'\n\nimport { getRepository } from '@things-factory/shell'\n\nimport { findDomainOwnerUserIds } from '../../utils/domain-ownership.js'\nimport { getDomainUsers } from '../../utils/get-domain-users.js'\nimport { Privilege } from '../privilege/privilege.js'\nimport { Role } from '../role/role.js'\nimport { User } from '../user/user.js'\nimport { AuditAction } from './audit-action.js'\nimport { auditHealth } from './audit-recorder.js'\nimport { AuditRequest } from './audit-request.js'\nimport { AuditDoor, AuditHealth, AuditPerson, AuditRecordFilter, AuditRecordList } from './audit-types.js'\n\n/*\n * Everybody's audit is `audit:query` (ADR-0141 §5). The domain owner does not pass on ownership - this is\n * a sensitive door (ADR-0139) - and the superuser does, as a stated exception whose basis the check records.\n * Every answer is this domain's only.\n */\nconst AUDIT_QUERY = '@privilege(category: \"audit\", privilege: \"query\", superUserGranted: true)'\n\n/* Reading the audit is recorded like any door, and left out of usage counts (§5-8 · §6.3). */\nconst AUDIT_DOOR = 'audit:query'\n\nconst MAX_PAGE = 200\n\nfunction period(from: Date, to: Date) {\n  return { from: new Date(from), to: new Date(to) }\n}\n\n@Resolver(AuditAction)\nexport class AuditQuery {\n  @Directive(AUDIT_QUERY)\n  @Query(returns => AuditRecordList, { description: \"This domain's audit records - requests and what was done in them.\" })\n  async auditRecords(@Arg('filter') filter: AuditRecordFilter, @Ctx() context: ResolverContext): Promise<AuditRecordList> {\n    const { domain } = context.state\n    const { from, to } = period(filter.from, filter.to)\n    const limit = Math.min(Math.max(filter.limit || 50, 1), MAX_PAGE)\n    const page = Math.max(filter.page || 1, 1)\n\n    const qb = getRepository(AuditRequest)\n      .createQueryBuilder('request')\n      .leftJoinAndSelect('request.actor', 'actor')\n      .where('request.domain = :domainId', { domainId: domain.id })\n      .andWhere('request.createdAt >= :from AND request.createdAt <= :to', { from, to })\n\n    if (filter.actorId) qb.andWhere('request.actor = :actorId', { actorId: filter.actorId })\n\n    /* A request is kept when one of its actions matches - the request line alone says nothing of doors. */\n    const conditions: string[] = []\n    const params: Record<string, any> = {}\n    if (filter.door) {\n      conditions.push('action.door = :door')\n      params.door = filter.door\n    }\n    if (filter.kind) {\n      conditions.push('action.kind = :kind')\n      params.kind = filter.kind\n    }\n    if (filter.outcome === 'denied') conditions.push(\"action.decision = 'denied'\")\n    if (filter.outcome === 'error') conditions.push(\"action.outcome = 'error' AND action.kind = 'door.result'\")\n    if (filter.outcome === 'failed') conditions.push(\"action.outcome = 'error' AND action.kind <> 'door.result'\")\n\n    if (conditions.length) {\n      const exists = qb\n        .subQuery()\n        .select('1')\n        .from(AuditAction, 'action')\n        .where('action.requestId = request.id')\n        .andWhere(conditions.join(' AND '))\n        .getQuery()\n      qb.andWhere(`EXISTS ${exists}`, params)\n    }\n\n    const [requests, total] = await qb\n      .orderBy('request.createdAt', 'DESC')\n      .skip((page - 1) * limit)\n      .take(limit)\n      .getManyAndCount()\n\n    const ids = requests.map(request => request.id)\n    const actions = ids.length\n      ? await getRepository(AuditAction)\n          .createQueryBuilder('action')\n          .where('action.requestId IN (:...ids)', { ids })\n          .andWhere(new Brackets(where => where.where('action.domain = :domainId', { domainId: domain.id }).orWhere('action.domain IS NULL')))\n          .orderBy('action.createdAt', 'ASC')\n          .getMany()\n      : []\n\n    return {\n      items: requests.map(request => ({ request, actions: actions.filter(action => action.requestId === request.id) })),\n      total\n    }\n  }\n\n  @Directive(AUDIT_QUERY)\n  @Query(returns => [AuditPerson], { description: \"Each member's audit summary over a period, in this domain.\" })\n  async auditPeople(@Arg('from') from: Date, @Arg('to') to: Date, @Ctx() context: ResolverContext): Promise<AuditPerson[]> {\n    const { domain } = context.state\n    const range = period(from, to)\n\n    const members = await getDomainUsers(domain)\n    const ownerIds = [...(await findDomainOwnerUserIds(domain))].filter(id => !members.some(one => one.id === id))\n    const people = [...members, ...(ownerIds.length ? await getRepository(User).find({ where: { id: In(ownerIds) } }) : [])]\n    if (!people.length) return []\n\n    const ids = people.map(one => one.id)\n\n    const roleRows = await getRepository(Role)\n      .createQueryBuilder('role')\n      .innerJoin('role.users', 'holder')\n      .select(['role.name AS \"name\"', 'holder.id AS \"userId\"'])\n      .where('role.domain = :domainId', { domainId: domain.id })\n      .andWhere('holder.id IN (:...ids)', { ids })\n      .getRawMany()\n\n    const sums = (rows: any[]) => new Map(rows.map(row => [row.actorId, row]))\n\n    const checkins = sums(\n      await getRepository(AuditAction)\n        .createQueryBuilder('action')\n        .innerJoin('action.actor', 'actor')\n        .select('actor.id', 'actorId')\n        .addSelect('COUNT(*)', 'inPeriod')\n        .where(\"action.kind = 'auth.checkin'\")\n        .andWhere('action.domain = :domainId', { domainId: domain.id })\n        .andWhere('action.createdAt >= :from AND action.createdAt <= :to', range)\n        .andWhere('actor.id IN (:...ids)', { ids })\n        .groupBy('actor.id')\n        .getRawMany()\n    )\n\n    /*\n     * The last check-in is read as rows, not as a raw MAX(): a raw value is the driver's text - sqlite\n     * gives UTC without a zone - and only the entity path turns it into the right moment.\n     */\n    const lastCheckins = new Map(\n      (\n        await getRepository(AuditAction)\n          .createQueryBuilder('action')\n          .leftJoinAndSelect('action.actor', 'actor')\n          .where(\"action.kind = 'auth.checkin'\")\n          .andWhere('action.domain = :domainId', { domainId: domain.id })\n          .andWhere('actor.id IN (:...ids)', { ids })\n          .andWhere(qb => {\n            const latest = qb\n              .subQuery()\n              .select('MAX(latest.createdAt)')\n              .from(AuditAction, 'latest')\n              .where(\"latest.kind = 'auth.checkin'\")\n              .andWhere('latest.domain = :domainId')\n              .andWhere('latest.actor = action.actor')\n              .getQuery()\n            return `action.createdAt = ${latest}`\n          })\n          .getMany()\n      ).map(action => [action.actor?.id, action.createdAt] as [string, Date])\n    )\n\n    /* A sign-in may come before any domain is chosen, so failures are the member's wherever they were. */\n    const failures = sums(\n      await getRepository(AuditAction)\n        .createQueryBuilder('action')\n        .innerJoin('action.actor', 'actor')\n        .select('actor.id', 'actorId')\n        .addSelect('COUNT(*)', 'failed')\n        .where(\"action.kind = 'auth.signin' AND action.outcome = 'error'\")\n        .andWhere('action.createdAt >= :from AND action.createdAt <= :to', range)\n        .andWhere(new Brackets(where => where.where('action.domain = :domainId', { domainId: domain.id }).orWhere('action.domain IS NULL')))\n        .andWhere('actor.id IN (:...ids)', { ids })\n        .groupBy('actor.id')\n        .getRawMany()\n    )\n\n    const doors = sums(\n      await getRepository(AuditAction)\n        .createQueryBuilder('action')\n        .innerJoin('action.actor', 'actor')\n        .select('actor.id', 'actorId')\n        .addSelect(\"SUM(CASE WHEN action.decision = 'granted' THEN action.count ELSE 0 END)\", 'granted')\n        .addSelect(\"SUM(CASE WHEN action.decision = 'denied' THEN action.count ELSE 0 END)\", 'denied')\n        .where(\"action.kind = 'door.check'\")\n        .andWhere('action.door <> :auditDoor', { auditDoor: AUDIT_DOOR })\n        .andWhere('action.domain = :domainId', { domainId: domain.id })\n        .andWhere('action.createdAt >= :from AND action.createdAt <= :to', range)\n        .groupBy('actor.id')\n        .getRawMany()\n    )\n\n    return people.map(user => ({\n      user,\n      roles: roleRows.filter(row => row.userId === user.id).map(row => row.name),\n      lastCheckinAt: lastCheckins.get(user.id),\n      checkins: Number(checkins.get(user.id)?.inPeriod || 0),\n      failedSignins: Number(failures.get(user.id)?.failed || 0),\n      granted: Number(doors.get(user.id)?.granted || 0),\n      denied: Number(doors.get(user.id)?.denied || 0)\n    }))\n  }\n\n  @Directive(AUDIT_QUERY)\n  @Query(returns => [AuditDoor], {\n    description: 'Each door over a period, in this domain - every declared privilege, a door with no record in the period too.'\n  })\n  async auditDoors(@Arg('from') from: Date, @Arg('to') to: Date, @Ctx() context: ResolverContext): Promise<AuditDoor[]> {\n    const { domain } = context.state\n\n    const observed = await getRepository(AuditAction)\n      .createQueryBuilder('action')\n      .leftJoin('action.actor', 'actor')\n      .select('action.door', 'door')\n      .addSelect('COUNT(DISTINCT actor.id)', 'people')\n      .addSelect(\"SUM(CASE WHEN action.decision = 'granted' THEN action.count ELSE 0 END)\", 'granted')\n      .addSelect(\"SUM(CASE WHEN action.decision = 'denied' THEN action.count ELSE 0 END)\", 'denied')\n      .where(\"action.kind = 'door.check'\")\n      .andWhere('action.door <> :auditDoor', { auditDoor: AUDIT_DOOR })\n      .andWhere('action.domain = :domainId', { domainId: domain.id })\n      .andWhere('action.createdAt >= :from AND action.createdAt <= :to', period(from, to))\n      .groupBy('action.door')\n      .getRawMany()\n\n    const byDoor = new Map(observed.map(row => [row.door, row]))\n    const declared = await getRepository(Privilege).find({ order: { category: 'ASC', name: 'ASC' } })\n\n    const doors = new Map<string, AuditDoor>()\n    for (const one of declared) {\n      const door = `${one.category}:${one.name}`\n      if (door === AUDIT_DOOR) continue\n      doors.set(door, { door, category: one.category, privilege: one.name, people: 0, granted: 0, denied: 0 })\n    }\n    for (const [door, row] of byDoor) {\n      const [category, privilege] = door.includes(':') ? door.split(':') : [undefined, undefined]\n      doors.set(door, {\n        door,\n        category,\n        privilege,\n        people: Number(row.people || 0),\n        granted: Number(row.granted || 0),\n        denied: Number(row.denied || 0)\n      })\n    }\n\n    return [...doors.values()]\n  }\n\n  @Directive(AUDIT_QUERY)\n  @Query(returns => AuditHealth, { description: 'Audit writes this server process failed to store.' })\n  async auditHealth(): Promise<AuditHealth> {\n    return auditHealth() as AuditHealth\n  }\n\n  /*\n   * One's own record is what one did (ADR-0141 §5-5): the actor is the session's user, whatever is asked.\n   * What somebody else did to me is not here.\n   */\n  @Query(returns => [AuditAction], { description: 'What I did - in this domain, and my sign-ins.' })\n  async myAuditActions(\n    @Arg('kind', { nullable: true }) kind: string,\n    @Arg('limit', type => Int, { nullable: true }) limit: number,\n    @Ctx() context: ResolverContext\n  ): Promise<AuditAction[]> {\n    const { domain, user } = context.state\n    if (!user) throw new Error('No user specified')\n\n    const qb = getRepository(AuditAction)\n      .createQueryBuilder('action')\n      .leftJoinAndSelect('action.domain', 'domain')\n      .where('action.actor = :userId', { userId: user.id })\n      .andWhere(new Brackets(where => where.where('action.domain = :domainId', { domainId: domain?.id }).orWhere('action.domain IS NULL')))\n\n    if (kind) qb.andWhere('action.kind = :kind', { kind })\n\n    return await qb\n      .orderBy('action.createdAt', 'DESC')\n      .take(Math.min(Math.max(limit || 20, 1), MAX_PAGE))\n      .getMany()\n  }\n\n  /* Where an action came from - its request's address and browser. */\n  @FieldResolver(type => AuditRequest, { nullable: true })\n  async request(@Root() action: AuditAction): Promise<AuditRequest | null> {\n    return action.requestId ? await getRepository(AuditRequest).findOneBy({ id: action.requestId }) : null\n  }\n}\n"]}

package/dist-server/service/audit/audit-recorder.d.ts

@@ -0,0 +1,77 @@
+import { EntityManager } from 'typeorm';
+import { AuditDetailValue } from './audit-kinds.js';
+export type AuditChannel = 'graphql' | 'http';
+export interface AuditActionInput {
+    kind: string;
+    door?: string;
+    decision?: 'granted' | 'denied';
+    basis?: string;
+    outcome?: 'ok' | 'error';
+    code?: string;
+    returned?: number;
+    targetKind?: string;
+    targetIds?: string[];
+    targetRole?: 'requested' | 'handled';
+    objectKind?: string;
+    objectId?: string;
+    detail?: Record<string, AuditDetailValue>;
+}
+interface MergedAction extends AuditActionInput {
+    count: number;
+    targets: Set<string>;
+    truncated: boolean;
+}
+export interface AuditScope {
+    requestId: string;
+    channel: AuditChannel;
+    context: any;
+    startedAt: number;
+    merged: Map<string, MergedAction>;
+    recorded: boolean;
+    eventActorId?: string;
+    eventDomainId?: string;
+}
+/** Runs `work` as one audited request; the request row and merged actions are written when it ends. */
+export declare function runInAuditScope<T>(context: any, channel: AuditChannel, work: () => Promise<T>): Promise<T>;
+export declare function currentAuditScope(): AuditScope | undefined;
+/**
+ * Notes a door check or result in the running request. Equal ones become one row with a count; their
+ * targets are kept together, up to 100 (ADR-0141 §3.2). Outside any request this does nothing - a
+ * subscription stream or a boot task is not audited at the door (§9 step 4).
+ */
+export declare function noteAuditAction(input: AuditActionInput): void;
+export interface RecordOptions {
+    /** The business transaction. Given, the event is written in it and a failure fails the change (§4-1). */
+    manager?: EntityManager;
+    /** Who did it, when the context does not know yet (a sign-in). `null` says nobody is known. */
+    actorId?: string | null;
+    /** Where, when it is not the request's domain (a role of another domain, a sign-in with no domain). */
+    domainId?: string | null;
+}
+/**
+ * Writes one event now. With `manager` it shares the caller's transaction and throws with it;
+ * without, it is written on its own and a failure is only counted (ADR-0141 §4-2 · §4-3 · §4-5).
+ */
+export declare function recordAuditAction(input: AuditActionInput, options?: RecordOptions): Promise<void>;
+/** The address a request came from - the first `x-forwarded-for` value, as the check-in record always took it. */
+export declare function addressOf(context: any): string | undefined;
+/**
+ * What a GraphQL request asked: its operation type and the root fields by their schema names - never
+ * an argument or a variable (ADR-0141 §3.4). A field with no `@privilege` leaves no action, so these
+ * names are what says which open door a request used. The parsed document is Apollo's and is not
+ * reachable from here; parsing again is the cost of knowing.
+ */
+export declare function operationOf(body: any): {
+    operationType?: string;
+    operationName?: string;
+    fields?: string;
+};
+/** Failures this server process detected since it started. Not those it never got to try. */
+export declare function auditHealth(): {
+    since: Date;
+    failures: number;
+    firstFailedAt: Date | null;
+    lastFailedAt: Date | null;
+};
+export declare function flushAudit(): Promise<void>;
+export {};