npm - @wildo-ai/saas-backend-lib - Versions diffs - 1.1.1 → 1.1.3 - Mend

@wildo-ai/saas-backend-lib 1.1.1 → 1.1.3

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (972) hide show

package/dist/esm/compliance/audit-trails/services/audit-event-dispatcher.backend.service.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"audit-event-dispatcher.backend.service.js","sourceRoot":"","sources":["../../../../../../src/compliance/audit-trails/services/audit-event-dispatcher.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;;;;;;;;;;;;;AAEH,OAAO,kBAAkB,CAAC;AAC1B,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAC/C,OAAO,EAAE,EAAE,IAAI,MAAM,EAAE,MAAM,MAAM,CAAC;AACpC,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,QAAQ,CAAC;AACjE,OAAO,EAAE,kBAAkB,EAAE,MAAM,gDAAgD,CAAC;AACpF,OAAO,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAC7F,OAAO,EAAE,uBAAuB,EAAE,MAAM,sEAAsE,CAAC;AAC/G,OAAO,EAAE,oCAAoC,EAAE,MAAM,2GAA2G,CAAC;AACjK,OAAO,EAAE,yCAAyC,EAAE,MAAM,qGAAqG,CAAC;AAChK,OAAO,EAAE,mBAAmB,EAAE,MAAM,gDAAgD,CAAC;AACrF,OAAO,EAAE,+BAA+B,EAAE,MAAM,gFAAgF,CAAC;AACjI,OAAO,EACL,iBAAiB,EACjB,sBAAsB,EACtB,gBAAgB,EAChB,2BAA2B,EAM3B,aAAa,GACd,MAAM,uBAAuB,CAAC;AAG/B,oDAAoD;AACpD,MAAM,gBAAgB,GAAG,+BAA+B,CAAC;AACzD,yCAAyC;AACzC,MAAM,qBAAqB,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AAC5C,oEAAoE;AACpE,MAAM,uBAAuB,GAAG,IAAI,CAAC;AACrC,0IAA0I;AAC1I,MAAM,wBAAwB,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AAC/C,4EAA4E;AAC5E,MAAM,0BAA0B,GAAG,IAAI,CAAC;AAExC,uDAAuD;AACvD,MAAM,cAAc,GAA2B;IAC7C,MAAM,EAAE,CAAC;IACT,SAAS,EAAE,CAAC;IACZ,UAAU,EAAE,CAAC;CACd,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG;IACjC,YAAY,EAAE,cAAc;CACpB,CAAC;AAcJ,IAAM,kCAAkC,GAAxC,MAAM,kCAAkC;IASS;IACU;IACoB;IACjB;IACe;IAZjE,QAAQ,CAA+D;IAExF,mEAAmE;IAClD,aAAa,GAAG,IAAI,GAAG,EAA8C,CAAC;IACvF,qGAAqG;IACpF,gBAAgB,GAAG,IAAI,GAAG,EAAqE,CAAC;IAEjH,YACsD,MAAqB,EACX,gBAAyC,EACrB,gBAAsD,EACvE,YAAiC,EAClB,oBAA+D;QAJ3F,WAAM,GAAN,MAAM,CAAe;QACX,qBAAgB,GAAhB,gBAAgB,CAAyB;QACrB,qBAAgB,GAAhB,gBAAgB,CAAsC;QACvE,iBAAY,GAAZ,YAAY,CAAqB;QAClB,yBAAoB,GAApB,oBAAoB,CAA2C;QAE/I,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,oCAAoC,CAAC,CAAC;QAC9E,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,oCAAoC,EAAE,KAAK,CAAC,CAAC;IAC/E,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAgDG;IACI,KAAK,CAAC,gCAAgC,CAC3C,EAAyB,EACzB,UAAmE,EACnE,cAAsB;QAEtB,gEAAgE;QAChE,IAAI,CAAC,cAAc;YAAE,OAAO;QAE5B,IAAI,KAA6B,CAAC;QAClC,IAAI,CAAC;YACH,KAAK,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,EAAE,EAAE,cAAc,CAAC,CAAC;QAC/D,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,sFAAsF;YACtF,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,mCAAmC,EAAE;gBACvD,KAAK;gBACL,SAAS,EAAE,UAAU,CAAC,SAAS;gBAC/B,cAAc;aACf,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAED,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,IAAI,CAAC;gBACH,QAAQ,IAAI,CAAC,IAAI,EAAE,CAAC;oBAClB,KAAK,mBAAmB,CAAC,YAAY;wBACnC,MAAM,IAAI,CAAC,sBAAsB,CAAC,EAAE,EAAE,UAAU,EAAE,cAAc,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;wBACnF,MAAM;oBACR;wBACE,gFAAgF;wBAChF,8EAA8E;wBAC9E,kFAAkF;wBAClF,iFAAiF;wBACjF,4EAA4E;wBAC5E,yEAAyE;wBACzE,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAChB,wHAAwH,EACxH,EAAE,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,UAAU,CAAC,SAAS,EAAE,cAAc,EAAE,CACzE,CAAC;wBACF,MAAM;gBACV,CAAC;YACH,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,0EAA0E;gBAC1E,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,qDAAqD,EAAE;oBACzE,KAAK;oBACL,QAAQ,EAAE,IAAI,CAAC,IAAI;oBACnB,SAAS,EAAE,UAAU,CAAC,SAAS;oBAC/B,cAAc;iBACf,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;OAYG;IACK,KAAK,CAAC,qBAAqB,CACjC,EAAyB,EACzB,cAAsB;QAEtB,MAAM,KAAK,GAA2B,EAAE,CAAC;QAEzC,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,EAAE,EAAE,cAAc,CAAC,CAAC;QACxE,IAAI,UAAU,EAAE,OAAO,EAAE,CAAC;YACxB,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,mBAAmB,CAAC,YAAY,EAAE,UAAU,EAAE,CAAC,CAAC;QACrE,CAAC;QAED,kFAAkF;QAClF,4DAA4D;QAC5D,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;;;;;;;OAQG;IACK,KAAK,CAAC,qBAAqB,CACjC,EAAyB,EACzB,cAAsB;QAEtB,MAAM,MAAM,GAAG,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;QACzD,IAAI,MAAM,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,QAAQ,GAAG,wBAAwB,EAAE,CAAC;YACtE,OAAO,MAAM,CAAC,MAAM,CAAC;QACvB,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,oBAAoB,CAAC,EAAE,EAAE,aAAa,CAAC,YAAY,EAAE,cAAc,CAAC,CAAC;QAChH,IAAI,IAAI,CAAC,gBAAgB,CAAC,IAAI,IAAI,0BAA0B,EAAE,CAAC;YAC7D,MAAM,SAAS,GAAG,IAAI,CAAC,gBAAgB,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC;YAC5D,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;gBAC5B,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YAC1C,CAAC;QACH,CAAC;QACD,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,cAAc,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QAC5E,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;;;;OAMG;IACK,KAAK,CAAC,sBAAsB,CAClC,EAAyB,EACzB,UAAmE,EACnE,cAAsB,EACtB,UAAgC;QAEhC,8FAA8F;QAC9F,MAAM,cAAc,GAAG,2BAA2B,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;QAEzE,oCAAoC;QACpC,IAAI,CAAC,IAAI,CAAC,kBAAkB,CAAC,UAAU,CAAC,SAAS,EAAE,cAAc,EAAE,UAAU,CAAC,EAAE,CAAC;YAC/E,IAAI,CAAC,QAAQ,CAAC,mCAAmC,EAAE;gBACjD,SAAS,EAAE,UAAU,CAAC,SAAS;gBAC/B,cAAc;aACf,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAED,oDAAoD;QACpD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,EAAE,EAAE,cAAc,CAAC,CAAC;QAE/D,0DAA0D;QAC1D,MAAM,KAAK,GAAI,UAAU,CAAC,SAAqC,EAAE,aAAmC,CAAC;QACrG,MAAM,OAAO,GAAI,UAAU,CAAC,SAAqC,EAAE,eAAqC,CAAC;QAEzG,8EAA8E;QAC9E,MAAM,QAAQ,GAAG,IAAI,CAAC,cAAc,CAAC,UAAU,EAAE,cAAc,EAAE,cAAc,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;QAE1G,kEAAkE;QAClE,wEAAwE;QACxE,+EAA+E;QAC/E,+CAA+C;QAC/C,MAAM,IAAI,CAAC,0BAA0B,CAAC,EAAE,QAAQ,EAAE,cAAc,EAAE,UAAU,EAAE,CAAC,CAAC;QAEhF,IAAI,CAAC,QAAQ,CAAC,wCAAwC,EAAE;YACtD,OAAO,EAAE,QAAQ,CAAC,OAAO;YACzB,SAAS,EAAE,UAAU,CAAC,SAAS;YAC/B,cAAc;SACf,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA+BG;IACI,KAAK,CAAC,0BAA0B,CAAC,MAMvC;QACC,MAAM,EAAE,QAAQ,EAAE,cAAc,EAAE,UAAU,EAAE,GAAG,MAAM,CAAC;QACxD,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,IAAI,aAAa,CAAC,YAAY,CAAC;QAEjE,gFAAgF;QAChF,sEAAsE;QACtE,MAAM,YAAY,GAAG,IAAI,CAAC,oBAAoB,CAAC,QAAQ,CAAC,CAAC;QAEzD,iFAAiF;QACjF,iFAAiF;QACjF,kFAAkF;QAClF,MAAM,IAAI,CAAC,YAAY,CAAC,kBAAkB,CACxC,+BAA+B,EAC/B;YACE,QAAQ;YACR,YAAY;YACZ,cAAc;YACd,SAAS;YACT,OAAO,EAAE,MAAM,CAAC,OAAO,IAAI,cAAc;YACzC,UAAU,EAAE;gBACV,UAAU,EAAE,UAAU,CAAC,UAAU;gBACjC,UAAU,EAAE,UAAU,CAAC,UAAU;gBACjC,cAAc,EAAE,UAAU,CAAC,cAAc;gBACzC,cAAc,EAAE,UAAU,CAAC,cAAc;gBACzC,WAAW,EAAE,UAAU,CAAC,WAAW;gBACnC,aAAa,EAAE,UAAU,CAAC,aAAa;gBACvC,QAAQ,EAAE,UAAU,CAAC,QAAQ;aAC9B;SACF,CACF,CAAC;IACJ,CAAC;IAED;;OAEG;IACK,kBAAkB,CACxB,SAAiB,EACjB,cAA8E,EAC9E,MAA4B;QAE5B,MAAM,MAAM,GAAG,MAAM,CAAC,WAAW,CAAC;QAElC,wBAAwB;QACxB,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,cAAc,CAAC,QAAQ,CAAC,EAAE,CAAC;YACzD,OAAO,KAAK,CAAC;QACf,CAAC;QAED,yBAAyB;QACzB,MAAM,kBAAkB,GAAG,cAAc,CAAC,cAAc,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QACxE,MAAM,oBAAoB,GAAG,cAAc,CAAC,MAAM,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;QACzE,IAAI,kBAAkB,GAAG,oBAAoB,EAAE,CAAC;YAC9C,OAAO,KAAK,CAAC;QACf,CAAC;QAED,mDAAmD;QACnD,IAAI,MAAM,CAAC,kBAAkB,IAAI,MAAM,CAAC,kBAAkB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtE,IAAI,CAAC,MAAM,CAAC,kBAAkB,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;gBACnD,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;OAEG;IACK,cAAc,CACpB,UAAmE,EACnE,cAAsB,EACtB,cAA8E,EAC9E,gBAAyB,EACzB,aAAsB,EACtB,eAAwB;QAExB,MAAM,SAAS,GAAG,UAAU,CAAC,SAAoC,CAAC;QAElE,OAAO;YACL,OAAO,EAAE,MAAM,EAAE;YACjB,SAAS,EAAE,UAAU,CAAC,SAAS;YAC/B,aAAa,EAAE,cAAc,CAAC,QAAQ;YACtC,QAAQ,EAAE,cAAc,CAAC,QAAQ;YACjC,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,aAAa,EAAE,UAAU,CAAC,aAAa;YACvC,sGAAsG;YACtG,gBAAgB,EAAE,UAAU,CAAC,gBAAgB;YAC7C,mBAAmB,EAAE,UAAU,CAAC,mBAAmB;YAEnD,cAAc;YACd,gBAAgB,EAAE,mCAAmC;YACrD,aAAa;YACb,eAAe;YACf,MAAM,EAAE,UAAU,CAAC,MAAM;YACzB,SAAS,EAAG,SAAS,CAAC,KAAgB,IAAI,SAAS;YAEnD,aAAa,EAAE,IAAI,CAAC,gBAAgB,CAAC,aAAa;YAClD,aAAa,EAAE,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,OAAO;YACjD,iBAAiB,EAAE,IAAI,CAAC,gBAAgB,CAAC,cAAc;YAEvD,yDAAyD;YACzD,UAAU,EAAG,SAAS,CAAC,UAAqB,IAAI,SAAS;YACzD,UAAU,EAAG,SAAS,CAAC,UAAqB,IAAI,SAAS;YACzD,WAAW,EAAG,SAAS,CAAC,WAAsB,IAAI,SAAS;YAC3D,cAAc,EAAG,SAAS,CAAC,cAAyB,IAAI,SAAS;YACjE,SAAS,EAAG,SAAS,CAAC,SAAoB,IAAI,SAAS;YACvD,SAAS,EAAG,SAAS,CAAC,SAAoB,IAAI,SAAS;YAEvD,SAAS,EAAE,SAAgC;YAE3C,OAAO,EAAE,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC,SAAS,CAAC;YACjD,aAAa,EAAG,SAAS,CAAC,aAAwB,IAAK,SAAS,CAAC,MAAiB,IAAI,SAAS;SAChG,CAAC;IACJ,CAAC;IAED;;OAEG;IACK,aAAa,CAAC,SAAiB;QACrC,MAAM,iBAAiB,GAAG;YACxB,sBAAsB,CAAC,iBAAiB;YACxC,sBAAsB,CAAC,mBAAmB;YAC1C,sBAAsB,CAAC,qBAAqB;YAC5C,sBAAsB,CAAC,4BAA4B;YACnD,sBAAsB,CAAC,iBAAiB;YACxC,sBAAsB,CAAC,8BAA8B;YACrD,sBAAsB,CAAC,mBAAmB;SAC3C,CAAC;QAEF,OAAO,iBAAiB,CAAC,QAAQ,CAAC,SAAmC,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC,CAAC,iBAAiB,CAAC,OAAO,CAAC;IACjI,CAAC;IAED,gEAAgE;IAChE,8BAA8B;IAC9B,gEAAgE;IAEhE;;;;OAIG;IACK,KAAK,CAAC,eAAe,CAAC,EAAyB,EAAE,cAAsB;QAC7E,oBAAoB;QACpB,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;QACtD,IAAI,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,qBAAqB,EAAE,CAAC;YACrE,OAAO,MAAM,CAAC,IAAI,CAAC;QACrB,CAAC;QAED,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,IAAI,CAAC,oBAAoB,CAAC,oBAAoB,CAAC,gBAAgB,CAAC,aAAa,CAAC,CAAC;YAChG,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAgC,EAAE,EAAE,cAAc,CAAC,CAAC;YAEnF,IAAI,GAAG,EAAE,IAAI,EAAE,CAAC;gBACd,kFAAkF;gBAClF,IAAI,IAAI,CAAC,aAAa,CAAC,IAAI,IAAI,uBAAuB,EAAE,CAAC;oBACvD,MAAM,SAAS,GAAG,IAAI,CAAC,aAAa,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC;oBACzD,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;wBAC5B,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;oBACvC,CAAC;gBACH,CAAC;gBACD,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,cAAc,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;gBACjF,OAAO,GAAG,CAAC,IAAI,CAAC;YAClB,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,yDAAyD;QAC3D,CAAC;QAED,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,gEAAgE;IAChE,6BAA6B;IAC7B,gEAAgE;IAEhE;;;OAGG;IACK,oBAAoB,CAAC,QAAoC;QAC/D,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;QACnC,OAAO,UAAU,CAAC,QAAQ,EAAE,OAAO,CAAC;aACjC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;aAChC,MAAM,CAAC,KAAK,CAAC,CAAC;IACnB,CAAC;IAED;;;OAGG;IACK,WAAW;QACjB,OAAO,UAAU,CAAC,QAAQ,CAAC;aACxB,MAAM,CAAC,GAAG,gBAAgB,IAAI,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC;aAC7F,MAAM,EAAE,CAAC;IACd,CAAC;IAED;;;OAGG;IACI,kBAAkB,CAAC,QAAoC,EAAE,YAAoB;QAClF,MAAM,YAAY,GAAG,IAAI,CAAC,oBAAoB,CAAC,QAAQ,CAAC,CAAC;QACzD,oFAAoF;QACpF,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;QACvD,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;QACvD,IAAI,WAAW,CAAC,MAAM,KAAK,WAAW,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC;QAC5D,OAAO,eAAe,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;IACnD,CAAC;CACF,CAAA;AArdY,kCAAkC;IAD9C,UAAU,EAAE;IAUR,WAAA,MAAM,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAA;IACjC,WAAA,MAAM,CAAC,kBAAkB,CAAC,gBAAgB,CAAC,CAAA;IAC3C,WAAA,MAAM,CAAC,kBAAkB,CAAC,oCAAoC,CAAC,CAAA;IAC/D,WAAA,MAAM,CAAC,kBAAkB,CAAC,mBAAmB,CAAC,CAAA;IAC9C,WAAA,MAAM,CAAC,kBAAkB,CAAC,kCAAkC,CAAC,CAAA;qCAJF,aAAa;QACO,uBAAuB;QACH,oCAAoC;QACzD,mBAAmB;QACI,yCAAyC;GAbtI,kCAAkC,CAqd9C","sourcesContent":["/*\n Audit Event Dispatcher Backend Service\n \n Layer 2 of the three-layer audit event pipeline (Step 18).\n * Receives audit events after MongoDB write and dispatches them\n * to the organization's SIEM endpoint if configured.\n \n This is fire-and-forget — if dispatch fails, the audit log\n * in MongoDB remains authoritative.\n /\n\nimport 'reflect-metadata';\nimport { inject, injectable } from 'inversify';\nimport { v4 as uuidv4 } from 'uuid';\nimport { createHmac, createHash, timingSafeEqual } from 'crypto';\nimport { SAAS_SERVICE_TYPES } from '~wildo-backend-lib/inject/models/service-types';\nimport { LoggerService } from '~wildo-backend-lib/monitoring/logger/services/logger.service';\nimport { AppConfigurationService } from '~wildo-backend-lib/config/services/app-configuration.backend.service';\nimport { AuthOrganizationConfigurationService } from '~wildo-backend-lib/security/authentications/services/admin-config/auth-organization-configuration.service';\nimport { RepositoriesRegistryHandlerBackendService } from '~wildo-backend-lib/base-classes/services/repositories/repositories-registry-handler.backend.service';\nimport { QueueBackendService } from '~wildo-backend-lib/queue/queue.backend.service';\nimport { SIEM_WEBHOOK_DELIVERY_BATCH_REF } from '~wildo-backend-lib/base-classes/services/batches/engine-custom-batch-manifests';\nimport {\n AuditEventOutcome,\n CoreAuditableEventType,\n CoreResourceType,\n getAuditEventClassification,\n type SecurityAuditEventEnvelope,\n type AuditEventCategory,\n type AuditEventSeverity,\n type AuditableEvent,\n type SiemExportConfigBase,\n AuthScopeType,\n} from '@wildo-ai/saas-models';\nimport type { ExecutionContext } from '~wildo-backend-lib/runtime/models/execution-context.backend.schemas';\n\n/* F6: HMAC domain separator for event integrity /\nconst SIEM_HMAC_DOMAIN = 'wildo:siem:event-integrity:v1';\n/* F3: Org name cache TTL (5 minutes) /\nconst ORG_NAME_CACHE_TTL_MS = 5 60 * 1000;\n/** B4: Max entries in org name cache to prevent unbounded growth /\nconst ORG_NAME_CACHE_MAX_SIZE = 1000;\n/* R2: SIEM-config cache TTL (5 min) — the config is otherwise read (via an audited, self-elevating `readAsSystem`) per event per org. /\nconst SIEM_CONFIG_CACHE_TTL_MS = 5 60 * 1000;\n/** R2: Max entries in the SIEM-config cache to prevent unbounded growth. /\nconst SIEM_CONFIG_CACHE_MAX_SIZE = 1000;\n\n/* Severity ordering for minimum severity filtering /\nconst SEVERITY_ORDER: Record<string, number> = {\n 'info': 0,\n 'warning': 1,\n 'critical': 2,\n};\n\n/\n The per-org audit sink TYPES an organization can route its authenticated audit\n * events to. Today the only type is the SIEM webhook. Adding a per-org destination\n * later (e.g. per-org immudb, per observability §11) is a new member HERE + a branch\n * in `_resolveOrgAuditSinks` + a `case` in `dispatchToOrganizationAuditSinks` — the F4\n * routing (org from the authenticated EC) and the envelope/HMAC contracts do not change.\n /\nexport const PerOrgAuditSinkType = {\n SIEM_WEBHOOK: 'siem_webhook',\n} as const;\nexport type PerOrgAuditSinkType = (typeof PerOrgAuditSinkType)[keyof typeof PerOrgAuditSinkType];\n\n/\n A per-org audit sink RESOLVED for a specific org, carrying exactly the config needed\n * to deliver one event to it. A discriminated union (one member today) — the dispatcher\n * fans out by `type`, so a new sink type extends this union rather than reshaping callers.\n /\ntype ResolvedOrgAuditSink = {\n type: typeof PerOrgAuditSinkType.SIEM_WEBHOOK;\n siemConfig: SiemExportConfigBase;\n};\n\n@injectable()\nexport class AuditEventDispatcherBackendService {\n private readonly logDebug: (message: string, context?: Record<string, unknown>) => void;\n\n /* F3: Lightweight org name cache to avoid per-event DB lookups /\n private readonly _orgNameCache = new Map<string, { name: string; cachedAt: number }>();\n /* R2: per-org SIEM-config cache — avoids a per-event per-org audited `readAsSystem` config load. /\n private readonly _siemConfigCache = new Map<string, { config: SiemExportConfigBase \| null; cachedAt: number }>();\n\n constructor(\n @inject(SAAS_SERVICE_TYPES.Logger) private readonly logger: LoggerService,\n @inject(SAAS_SERVICE_TYPES.AppConfigService) private readonly appConfigService: AppConfigurationService,\n @inject(SAAS_SERVICE_TYPES.AuthOrganizationConfigurationService) private readonly orgConfigService: AuthOrganizationConfigurationService,\n @inject(SAAS_SERVICE_TYPES.QueueBackendService) private readonly queueService: QueueBackendService,\n @inject(SAAS_SERVICE_TYPES.RepositoriesRegistryHandlerService) private readonly repositoriesRegistry: RepositoriesRegistryHandlerBackendService,\n ) {\n this.logDebug = this.logger.debugByType('AuditEventDispatcherBackendService');\n this.logger.setDebugTypeLogging('AuditEventDispatcherBackendService', false);\n }\n\n /\n Dispatch an audit event to the organization's configured per-org audit SINKS.\n \n F4 (tenant segregation): the caller (`AuditLogsBackendService`) passes the\n * AUTHENTICATED org (resolved from the request `ExecutionContext`), NEVER the\n * caller-supplied `auditEvent.organizationId`. Sink config is loaded for THIS org\n * only (`_resolveOrgAuditSinks`), so an event can only reach the sinks of the tenant\n * it is authenticated for.\n \n Layer 2 of the pipeline: called after the MongoDB write (Layer 1), wired directly\n * into `AuditLogsBackendService` (NOT a resource pipeline post-hook). Fire-and-forget\n * — a resolution or per-sink delivery failure is logged but NEVER thrown onto the\n * business op, and per-sink failures are ISOLATED (F7) so one destination never\n * suppresses another.\n \n The seam: `_resolveOrgAuditSinks` returns the 0..N sinks the org has configured\n * (today only a SIEM webhook); this method fans each out by its `type`. Adding a\n * per-org destination later = a new {@link PerOrgAuditSinkType} + a resolver branch +\n * a `case` here.\n \n ── APPLICATION scope is RESERVED / DORMANT — there is NO app-scoped producer ──────\n * This producer is ORGANIZATION-scoped ONLY, on purpose. The F4 model routes on a\n * TRUSTED authenticated tenant (org), and the sole caller (`AuditLogsBackendService`)\n * fans out over the event's verified member orgs. There is deliberately no\n * `dispatchToApplicationAuditSinks` / `_resolveAppAuditSinks`.\n \n The SIEM export-config and delivery-DLQ resources DO each carry an `APPLICATION`\n * polymorphic variant (uniform with SSO/SCIM over `AUTH_SCOPE_VARIANTS`), and every\n * downstream seam is already scope-generic: `loadSiemExportConfig(ec, APPLICATION, appId)`,\n * {@link enqueueSiemWebhookDelivery} (`scopeType`/`scopeId`), the delivery worker's\n * circuit-breaker key, and `_enqueueToDLQ`'s `APPLICATION_SIEM_DELIVERY_DLQ` branch all\n * accept the app scope. But NOTHING emits a first-time app-scoped delivery. The only\n * caller that passes `scopeType: APPLICATION` today is the SIEM-DLQ retry custom-impl,\n * which is itself unreachable in production: an `APPLICATION_SIEM_DELIVERY_DLQ` row can\n * only be born from a FAILED app-scoped delivery — and none is ever produced — so the\n * app config-read, app DLQ, and app retry are mutually reachable only through each other.\n * NOTE the operator-visible trap this leaves: an app super-admin CAN enable\n * `APPLICATION_SIEM_EXPORT_CONFIG` (its own custom-impl + APP_ADMIN_SUPER_ADMIN roles)\n * and it will silently deliver NOTHING until a producer exists.\n \n To make it real — a SCOPED feature, NOT a mechanical mirror; settle the design fork\n * FIRST (which events an app SIEM receives, whether spanning all tenants, and how it\n * composes with per-org delivery so an event is not double-sent) — add a sibling\n * `_resolveAppAuditSinks(ec, appId)` loading the APP config, a\n * `dispatchToApplicationAuditSinks` fanning out identically, and a producer that calls it\n * with an app context, reusing the SAME envelope/HMAC/scope contract via\n * `enqueueSiemWebhookDelivery({ scopeType: AuthScopeType.APPLICATION, scopeId })`. Until\n * then, treat the APP variant as reserved plumbing, not a wired path.\n /\n public async dispatchToOrganizationAuditSinks(\n ec: ExecutionContext<any>,\n auditEvent: Omit<AuditableEvent, '_id' \| 'createdAt' \| 'updatedAt'>,\n organizationId: string,\n ): Promise<void> {\n // No authenticated org → no per-org dispatch (fail-closed, F4).\n if (!organizationId) return;\n\n let sinks: ResolvedOrgAuditSink[];\n try {\n sinks = await this._resolveOrgAuditSinks(ec, organizationId);\n } catch (error) {\n // Fire-and-forget: a config-resolution failure must never throw onto the business op.\n this.logger.error?.('Failed to resolve org audit sinks', {\n error,\n eventType: auditEvent.eventType,\n organizationId,\n });\n return;\n }\n\n for (const sink of sinks) {\n try {\n switch (sink.type) {\n case PerOrgAuditSinkType.SIEM_WEBHOOK:\n await this._dispatchToSiemWebhook(ec, auditEvent, organizationId, sink.siemConfig);\n break;\n default:\n // F-1 safety net: a future `PerOrgAuditSinkType` member with no `case` above is\n // LOGGED, never silently dropped (the original finding was a silent no-op). A\n // single-member discriminated union does NOT narrow this `default` to `never`, so\n // a compile-time `assertNever(sink)` guard only becomes possible once a 2nd sink\n // type exists — convert this branch to it then. Until then the resolver's +\n // switch's JSDoc pointers (\"add a case here\") + this warn are the guard.\n this.logger.warn?.(\n 'Unhandled per-org audit sink type — event NOT delivered to this sink; add a `case` in dispatchToOrganizationAuditSinks',\n { sinkType: sink.type, eventType: auditEvent.eventType, organizationId },\n );\n break;\n }\n } catch (error) {\n // Per-sink isolation (F7): one org sink failing never affects the others.\n this.logger.error?.('Failed to dispatch audit event to an org audit sink', {\n error,\n sinkType: sink.type,\n eventType: auditEvent.eventType,\n organizationId,\n });\n }\n }\n }\n\n /\n Resolve the per-org audit SINKS an org has configured — the 0..N destinations\n * {@link dispatchToOrganizationAuditSinks} fans an event out to. Keyed on the org the\n * caller already validated as authenticated (F4). Today the only per-org sink type is\n * the SIEM webhook; a future per-org destination appends its own descriptor HERE.\n \n Two-level feature gate for `CoreFeature.SECURITY_EVENT_EXPORT`:\n * Level 1 (here): `siemConfig.enabled` — the runtime gate.\n * Level 2 (admin API): `FeatureGateService` checks the org's subscription tier has\n * `SECURITY_EVENT_EXPORT` before allowing `enabled = true`. We cannot use\n * `FeatureResolutionService` here (fire-and-forget context; internal ECs bypass\n * feature resolution), so the pre-validated `enabled` flag IS the per-org gate.\n /\n private async _resolveOrgAuditSinks(\n ec: ExecutionContext<any>,\n organizationId: string,\n ): Promise<ResolvedOrgAuditSink[]> {\n const sinks: ResolvedOrgAuditSink[] = [];\n\n const siemConfig = await this._loadSiemConfigCached(ec, organizationId);\n if (siemConfig?.enabled) {\n sinks.push({ type: PerOrgAuditSinkType.SIEM_WEBHOOK, siemConfig });\n }\n\n // Future per-org sink types (e.g. per-org immudb) resolve here — each appends its\n // own descriptor; the dispatcher switch fans out by `type`.\n return sinks;\n }\n\n /\n R2: load the org's SIEM config through a short-TTL cache. Without it,\n * {@link _resolveOrgAuditSinks} reads the config via a self-elevating `readAsSystem` PER\n * EVENT PER ORG — and `readAsSystem` ALSO emits a `SYSTEM_CONTEXT_READ` audit — so every\n * routed audit event (× N orgs on the multi-org fan-out) doubled the audit-write volume to\n * the DB + immudb. Mirrors {@link _orgNameCache}: an enable/disable/rename takes effect within\n * the TTL, acceptable for a rarely-changed config. `null` is cached too (an org with no SIEM\n * config) so a non-configured org is not re-read every event.\n /\n private async _loadSiemConfigCached(\n ec: ExecutionContext<any>,\n organizationId: string,\n ): Promise<SiemExportConfigBase \| null> {\n const cached = this._siemConfigCache.get(organizationId);\n if (cached && Date.now() - cached.cachedAt < SIEM_CONFIG_CACHE_TTL_MS) {\n return cached.config;\n }\n const config = await this.orgConfigService.loadSiemExportConfig(ec, AuthScopeType.ORGANIZATION, organizationId);\n if (this._siemConfigCache.size >= SIEM_CONFIG_CACHE_MAX_SIZE) {\n const oldestKey = this._siemConfigCache.keys().next().value;\n if (oldestKey !== undefined) {\n this._siemConfigCache.delete(oldestKey);\n }\n }\n this._siemConfigCache.set(organizationId, { config, cachedAt: Date.now() });\n return config;\n }\n\n /\n Deliver one event to an org's SIEM webhook sink: apply the sink's per-event filter,\n * build + HMAC the envelope, and enqueue for async delivery via the SIEM webhook\n * delivery worker (`siemWebhookDeliveryBatchService`, registered under\n * `SIEM_WEBHOOK_DELIVERY_BATCH_REF` in `start-application`). May throw; the caller\n * isolates per-sink failures.\n /\n private async _dispatchToSiemWebhook(\n ec: ExecutionContext<any>,\n auditEvent: Omit<AuditableEvent, '_id' \| 'createdAt' \| 'updatedAt'>,\n organizationId: string,\n siemConfig: SiemExportConfigBase,\n ): Promise<void> {\n // Classify the event (always returns a value; defaults to data_access/info for unknown types)\n const classification = getAuditEventClassification(auditEvent.eventType);\n\n // Apply the sink's per-event filter\n if (!this._passesEventFilter(auditEvent.eventType, classification, siemConfig)) {\n this.logDebug('Event filtered out by SIEM config', {\n eventType: auditEvent.eventType,\n organizationId,\n });\n return;\n }\n\n // F3: Resolve org name for SIEM analyst readability\n const orgName = await this._resolveOrgName(ec, organizationId);\n\n // Extract application context from eventData if available\n const appId = (auditEvent.eventData as Record<string, unknown>)?.applicationId as string \| undefined;\n const appName = (auditEvent.eventData as Record<string, unknown>)?.applicationName as string \| undefined;\n\n // Build the envelope (F3: includes orgName, Task 3.12c: includes app context)\n const envelope = this._buildEnvelope(auditEvent, organizationId, classification, orgName, appId, appName);\n\n // Enqueue for async delivery through the single job-contract seam\n // (payload shape + F6 envelope HMAC + batch ref). This dispatch path is\n // org-scoped; {@link enqueueSiemWebhookDelivery} defaults scopeType/scopeId to\n // the organization, so behaviour is unchanged.\n await this.enqueueSiemWebhookDelivery({ envelope, organizationId, siemConfig });\n\n this.logDebug('Audit event enqueued for SIEM delivery', {\n eventId: envelope.eventId,\n eventType: auditEvent.eventType,\n organizationId,\n });\n }\n\n /\n Enqueue ONE already-built envelope for async SIEM webhook delivery.\n \n The SINGLE authority for the SIEM delivery-job contract — the\n * {@link SIEMDeliveryJobPayload} shape, the F6 envelope HMAC, and the\n * `SIEM_WEBHOOK_DELIVERY_BATCH_REF` batch ref — shared by two producers:\n * 1. first-time dispatch ({@link _dispatchToSiemWebhook}, org scope), and\n * 2. manual DLQ drain (the `siem-delivery-dlq` RETRY_SINGLE / RETRY_ALL\n * custom impls), which re-enqueue a dead-lettered row's STORED envelope\n * for either the ORG or APP scope.\n \n Keeping this in one place is not cosmetic: the delivery worker has no\n * back-reference to a DLQ row, so a retry that fails is re-captured as a\n * brand-new DLQ row. If the retry path built a subtly different payload (a\n * dropped `siemConfig` field, a stale HMAC domain), the mismatch would surface\n * only as a silently looping dead-letter — never a compile error. One seam\n * makes that class of drift impossible.\n \n @param params.scopeType Defaults to {@link AuthScopeType.ORGANIZATION} (the\n * first-time dispatch path is org-only). The DLQ APP variant passes\n * {@link AuthScopeType.APPLICATION} so the worker's circuit-breaker key and\n * any re-DLQ capture resolve to the application scope, not the org. NOTE: the\n * SIEM-DLQ retry custom-impl is the ONLY caller that passes `APPLICATION` today —\n * there is NO first-time app-scoped producer (the APPLICATION variant is reserved /\n * dormant; see {@link dispatchToOrganizationAuditSinks} for the full rationale and\n * the wiring a future app producer would add).\n * @param params.scopeId Defaults to `organizationId`.\n \n May throw on enqueue failure — the CALLER decides isolation: the dispatch\n * path swallows it per-sink (fire-and-forget, F7); the DLQ retry surfaces it to\n * the operator so the row is left intact for another attempt.\n /\n public async enqueueSiemWebhookDelivery(params: {\n envelope: SecurityAuditEventEnvelope;\n organizationId: string;\n siemConfig: SiemExportConfigBase;\n scopeType?: AuthScopeType;\n scopeId?: string;\n }): Promise<void> {\n const { envelope, organizationId, siemConfig } = params;\n const scopeType = params.scopeType ?? AuthScopeType.ORGANIZATION;\n\n // F6: HMAC integrity signature over the envelope payload — computed HERE so the\n // key/domain never diverges between the dispatch and retry producers.\n const envelopeHmac = this._computeEnvelopeHmac(envelope);\n\n // Using the shared constant keeps enqueue ↔ registration ↔ spec cross-validation\n // on one literal. The `siemConfig` projection strips the config to the transport\n // fields the worker needs (no eventFilter — filtering already happened upstream).\n await this.queueService.enqueueCustomBatch(\n SIEM_WEBHOOK_DELIVERY_BATCH_REF,\n {\n envelope,\n envelopeHmac,\n organizationId,\n scopeType,\n scopeId: params.scopeId ?? organizationId,\n siemConfig: {\n webhookUrl: siemConfig.webhookUrl,\n authMethod: siemConfig.authMethod,\n authCredential: siemConfig.authCredential,\n authHeaderName: siemConfig.authHeaderName,\n eventFormat: siemConfig.eventFormat,\n customHeaders: siemConfig.customHeaders,\n delivery: siemConfig.delivery,\n },\n },\n );\n }\n\n /\n Check if an event passes the org's SIEM event filter.\n /\n private _passesEventFilter(\n eventType: string,\n classification: { category: AuditEventCategory; severity: AuditEventSeverity },\n config: SiemExportConfigBase,\n ): boolean {\n const filter = config.eventFilter;\n\n // Check category filter\n if (!filter.categories.includes(classification.category)) {\n return false;\n }\n\n // Check severity minimum\n const eventSeverityOrder = SEVERITY_ORDER[classification.severity] ?? 0;\n const minimumSeverityOrder = SEVERITY_ORDER[filter.severityMinimum] ?? 0;\n if (eventSeverityOrder < minimumSeverityOrder) {\n return false;\n }\n\n // Check specific event type filter (if configured)\n if (filter.specificEventTypes && filter.specificEventTypes.length > 0) {\n if (!filter.specificEventTypes.includes(eventType)) {\n return false;\n }\n }\n\n return true;\n }\n\n /\n Build a SecurityAuditEventEnvelope from an audit event.\n /\n private _buildEnvelope(\n auditEvent: Omit<AuditableEvent, '_id' \| 'createdAt' \| 'updatedAt'>,\n organizationId: string,\n classification: { category: AuditEventCategory; severity: AuditEventSeverity },\n organizationName?: string,\n applicationId?: string,\n applicationName?: string,\n ): SecurityAuditEventEnvelope {\n const eventData = auditEvent.eventData as Record<string, unknown>;\n\n return {\n eventId: uuidv4(),\n eventType: auditEvent.eventType,\n eventCategory: classification.category,\n severity: classification.severity,\n timestamp: new Date().toISOString(),\n correlationId: auditEvent.correlationId,\n // Undefined unless the application opted in — the row itself is only ever populated under the policy.\n clientInstanceId: auditEvent.clientInstanceId,\n frontendServiceName: auditEvent.frontendServiceName,\n\n organizationId,\n organizationName, // F3: Populated via org name cache\n applicationId,\n applicationName,\n userId: auditEvent.userId,\n userEmail: (eventData.email as string) \|\| undefined,\n\n sourceService: this.appConfigService.applicationId,\n sourceVersion: process.env.APP_VERSION \|\| '0.0.0',\n sourceEnvironment: this.appConfigService.applicationEnv,\n\n // Auth-specific context from eventData (when applicable)\n authMethod: (eventData.authMethod as string) \|\| undefined,\n authSource: (eventData.authSource as string) \|\| undefined,\n providerRef: (eventData.providerRef as string) \|\| undefined,\n connectionType: (eventData.connectionType as string) \|\| undefined,\n ipAddress: (eventData.ipAddress as string) \|\| undefined,\n userAgent: (eventData.userAgent as string) \|\| undefined,\n\n eventData: eventData as Record<string, any>,\n\n outcome: this._inferOutcome(auditEvent.eventType),\n outcomeReason: (eventData.failureReason as string) \|\| (eventData.reason as string) \|\| undefined,\n };\n }\n\n /\n Infer success/failure outcome from event type.\n /\n private _inferOutcome(eventType: string): AuditEventOutcome {\n const failureEventTypes = [\n CoreAuditableEventType.USER_LOGIN_FAILED,\n CoreAuditableEventType.USER_ACCOUNT_LOCKED,\n CoreAuditableEventType.USER_SSO_LOGIN_FAILED,\n CoreAuditableEventType.USER_SSO_ENFORCEMENT_BLOCKED,\n CoreAuditableEventType.SAML_LOGIN_FAILED,\n CoreAuditableEventType.SAML_ASSERTION_REPLAY_DETECTED,\n CoreAuditableEventType.MACHINE_AUTH_FAILED,\n ];\n\n return failureEventTypes.includes(eventType as CoreAuditableEventType) ? AuditEventOutcome.FAILURE : AuditEventOutcome.SUCCESS;\n }\n\n // ─────────────────────────────────────────────────────────────\n // F3: Organization Name Cache\n // ─────────────────────────────────────────────────────────────\n\n /\n F3: Resolve organization name with a lightweight in-memory cache.\n * Cache entries expire after ORG_NAME_CACHE_TTL_MS to pick up renames.\n * Returns undefined if lookup fails (fire-and-forget context — don't throw).\n /\n private async _resolveOrgName(ec: ExecutionContext<any>, organizationId: string): Promise<string \| undefined> {\n // Check cache first\n const cached = this._orgNameCache.get(organizationId);\n if (cached && (Date.now() - cached.cachedAt) < ORG_NAME_CACHE_TTL_MS) {\n return cached.name;\n }\n\n try {\n const orgsRepo = this.repositoriesRegistry.getRepositoryOrThrow(CoreResourceType.ORGANIZATIONS);\n const org = await orgsRepo.read<{ _id: string; name: string }>(ec, organizationId);\n\n if (org?.name) {\n // B4: Evict oldest entries when cache exceeds max size (simple LRU approximation)\n if (this._orgNameCache.size >= ORG_NAME_CACHE_MAX_SIZE) {\n const oldestKey = this._orgNameCache.keys().next().value;\n if (oldestKey !== undefined) {\n this._orgNameCache.delete(oldestKey);\n }\n }\n this._orgNameCache.set(organizationId, { name: org.name, cachedAt: Date.now() });\n return org.name;\n }\n } catch {\n // Fire-and-forget — org name is optional in the envelope\n }\n\n return undefined;\n }\n\n // ─────────────────────────────────────────────────────────────\n // F6: Event Integrity (HMAC)\n // ─────────────────────────────────────────────────────────────\n\n /\n F6: Compute HMAC-SHA256 over the serialized envelope for integrity protection.\n * The delivery service verifies this HMAC before processing, detecting queue tampering.\n /\n private _computeEnvelopeHmac(envelope: SecurityAuditEventEnvelope): string {\n const hmacKey = this._getHmacKey();\n return createHmac('sha256', hmacKey)\n .update(JSON.stringify(envelope))\n .digest('hex');\n }\n\n /\n Derive a 256-bit HMAC key from the app's session encryption key\n * using SHA-256 with a domain separator (consistent with SIEM encryption key derivation).\n /\n private _getHmacKey(): Buffer {\n return createHash('sha256')\n .update(`${SIEM_HMAC_DOMAIN}:${this.appConfigService.secrets.security.session.encryptionKey}`)\n .digest();\n }\n\n /\n F6: Public static-like method to verify envelope HMAC on the delivery side.\n * Returns true if the HMAC matches, false otherwise.\n */\n public verifyEnvelopeHmac(envelope: SecurityAuditEventEnvelope, expectedHmac: string): boolean {\n const computedHmac = this._computeEnvelopeHmac(envelope);\n // Use crypto.timingSafeEqual for constant-time comparison (prevents timing attacks)\n const computedBuf = Buffer.from(computedHmac, 'utf-8');\n const expectedBuf = Buffer.from(expectedHmac, 'utf-8');\n if (computedBuf.length !== expectedBuf.length) return false;\n return timingSafeEqual(computedBuf, expectedBuf);\n }\n}\n"]}
1	+ {"version":3,"file":"audit-event-dispatcher.backend.service.js","sourceRoot":"","sources":["../../../../../../src/compliance/audit-trails/services/audit-event-dispatcher.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;;;;;;;;;;;;;AAEH,OAAO,kBAAkB,CAAC;AAC1B,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAEzD,OAAO,EAAE,EAAE,IAAI,MAAM,EAAE,MAAM,MAAM,CAAC;AACpC,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,QAAQ,CAAC;AACjE,OAAO,EAAE,kBAAkB,EAAE,MAAM,gDAAgD,CAAC;AACpF,OAAO,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAC7F,OAAO,EAAE,uBAAuB,EAAE,MAAM,sEAAsE,CAAC;AAC/G,OAAO,EAAE,oCAAoC,EAAE,MAAM,2GAA2G,CAAC;AACjK,OAAO,EAAE,yCAAyC,EAAE,MAAM,qGAAqG,CAAC;AAChK,OAAO,EAAE,mBAAmB,EAAE,MAAM,gDAAgD,CAAC;AACrF,OAAO,EAAE,gBAAgB,EAAE,MAAM,4FAA4F,CAAC;AAC9H,OAAO,EAAE,2BAA2B,EAAE,MAAM,8EAA8E,CAAC;AAC3H,OAAO,EAAE,+BAA+B,EAAE,MAAM,gFAAgF,CAAC;AACjI,OAAO,EACL,iBAAiB,EACjB,sBAAsB,EACtB,gBAAgB,EAChB,2BAA2B,EAM3B,aAAa,GACd,MAAM,uBAAuB,CAAC;AAI/B,oDAAoD;AACpD,MAAM,gBAAgB,GAAG,+BAA+B,CAAC;AAEzD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8CG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,EAAE,GAAG,IAAI,CAAC;AACtD,4GAA4G;AAC5G,MAAM,0BAA0B,GAAG,IAAI,CAAC;AAExC;;;;;;;;;GASG;AACH,MAAM,yBAAyB,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AAChD,qGAAqG;AACrG,MAAM,uBAAuB,GAAG,IAAI,CAAC;AAErC;;;;;;;;GAQG;AACH,MAAM,uCAAuC,GAAG,qCAAqC,CAAC;AAEtF,uDAAuD;AACvD,MAAM,cAAc,GAA2B;IAC7C,MAAM,EAAE,CAAC;IACT,SAAS,EAAE,CAAC;IACZ,UAAU,EAAE,CAAC;CACd,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG;IACjC,YAAY,EAAE,cAAc;CACpB,CAAC;AAcJ,IAAM,kCAAkC,GAAxC,MAAM,kCAAkC;IA6CS;IACU;IACoB;IACjB;IACe;IASV;IAzDvD,QAAQ,CAA+D;IAExF;;;;;;;;OAQG;IACc,aAAa,GAAG,IAAI,gBAAgB,CAAqB;QACxE,cAAc,EAAE,yBAAyB;QACzC,UAAU,EAAE,uBAAuB;KACpC,CAAC,CAAC;IAEH,gHAAgH;IAC/F,gBAAgB,GAAG,IAAI,gBAAgB,CAA8B;QACpF,cAAc,EAAE,4BAA4B;QAC5C,UAAU,EAAE,0BAA0B;QACtC,gBAAgB,EAAE,CAAC,cAAc,EAAE,KAAK,EAAE,EAAE;QAC1C,kGAAkG;QAClG,mGAAmG;QACnG,iGAAiG;QACjG,2FAA2F;QAC3F,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,+HAA+H,EAAE;YACnJ,cAAc;YACd,cAAc,EAAE,4BAA4B;YAC5C,GAAG,2BAA2B,CAAC,KAAK,CAAC;SACtC,CAAC;KACL,CAAC,CAAC;IAEH;;;;;;;;OAQG;IACK,6BAA6B,GAAG,KAAK,CAAC;IAE9C,YACsD,MAAqB,EACX,gBAAyC,EACrB,gBAAsD,EACvE,YAAiC,EAClB,oBAA+D,EASzE,YAA2B;QAb7C,WAAM,GAAN,MAAM,CAAe;QACX,qBAAgB,GAAhB,gBAAgB,CAAyB;QACrB,qBAAgB,GAAhB,gBAAgB,CAAsC;QACvE,iBAAY,GAAZ,YAAY,CAAqB;QAClB,yBAAoB,GAApB,oBAAoB,CAA2C;QASzE,iBAAY,GAAZ,YAAY,CAAe;QAEjG,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,oCAAoC,CAAC,CAAC;QAC9E,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,oCAAoC,EAAE,KAAK,CAAC,CAAC;IAC/E,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAgDG;IACI,KAAK,CAAC,gCAAgC,CAC3C,EAAyB,EACzB,UAAmE,EACnE,cAAsB;QAEtB,gEAAgE;QAChE,IAAI,CAAC,cAAc;YAAE,OAAO;QAE5B,mGAAmG;QACnG,+FAA+F;QAC/F,kGAAkG;QAClG,mDAAmD;QACnD,KAAK,IAAI,CAAC,6BAA6B,EAAE,CAAC;QAE1C,IAAI,KAA6B,CAAC;QAClC,IAAI,CAAC;YACH,KAAK,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,EAAE,EAAE,cAAc,CAAC,CAAC;QAC/D,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,sFAAsF;YACtF,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,mCAAmC,EAAE;gBACvD,KAAK;gBACL,SAAS,EAAE,UAAU,CAAC,SAAS;gBAC/B,cAAc;aACf,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAED,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,IAAI,CAAC;gBACH,QAAQ,IAAI,CAAC,IAAI,EAAE,CAAC;oBAClB,KAAK,mBAAmB,CAAC,YAAY;wBACnC,MAAM,IAAI,CAAC,sBAAsB,CAAC,EAAE,EAAE,UAAU,EAAE,cAAc,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;wBACnF,MAAM;oBACR;wBACE,gFAAgF;wBAChF,8EAA8E;wBAC9E,kFAAkF;wBAClF,iFAAiF;wBACjF,4EAA4E;wBAC5E,yEAAyE;wBACzE,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAChB,wHAAwH,EACxH,EAAE,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,UAAU,CAAC,SAAS,EAAE,cAAc,EAAE,CACzE,CAAC;wBACF,MAAM;gBACV,CAAC;YACH,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,0EAA0E;gBAC1E,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,qDAAqD,EAAE;oBACzE,KAAK;oBACL,QAAQ,EAAE,IAAI,CAAC,IAAI;oBACnB,SAAS,EAAE,UAAU,CAAC,SAAS;oBAC/B,cAAc;iBACf,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;OAYG;IACK,KAAK,CAAC,qBAAqB,CACjC,EAAyB,EACzB,cAAsB;QAEtB,MAAM,KAAK,GAA2B,EAAE,CAAC;QAEzC,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,EAAE,EAAE,cAAc,CAAC,CAAC;QACxE,IAAI,UAAU,EAAE,OAAO,EAAE,CAAC;YACxB,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,mBAAmB,CAAC,YAAY,EAAE,UAAU,EAAE,CAAC,CAAC;QACrE,CAAC;QAED,kFAAkF;QAClF,4DAA4D;QAC5D,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;;;;;;;;;;;;;;;;;OAkBG;IACK,KAAK,CAAC,qBAAqB,CACjC,EAAyB,EACzB,cAAsB;QAEtB,OAAO,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,cAAc,EAAE,GAAG,EAAE,CACpD,IAAI,CAAC,gBAAgB,CAAC,oBAAoB,CAAC,EAAE,EAAE,aAAa,CAAC,YAAY,EAAE,cAAc,CAAC,CAC3F,CAAC;IACJ,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAwDG;IACI,oBAAoB,CAAC,cAAsB;QAChD,IAAI,CAAC,gBAAgB,CAAC,UAAU,CAAC,cAAc,CAAC,CAAC;QACjD,IAAI,CAAC,8BAA8B,CAAC,cAAc,CAAC,CAAC;IACtD,CAAC;IAED;;;;;OAKG;IACK,8BAA8B,CAAC,cAAsB;QAC3D,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,EAAE,cAAc,EAAE,CAAC;QACnD,oGAAoG;QACpG,iGAAiG;QACjG,yBAAyB;QACzB,IAAI,CAAC,MAAM;YAAE,OAAO;QAEpB,KAAK,MAAM;aACR,OAAO,CAAC,IAAI,CAAC,oBAAoB,EAAE,EAAE,cAAc,CAAC;aACpD,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE,CACxB,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,sGAAsG,EAAE;YAC1H,cAAc;YACd,cAAc,EAAE,4BAA4B;YAC5C,GAAG,2BAA2B,CAAC,KAAK,CAAC;SACtC,CAAC,CACH,CAAC;IACN,CAAC;IAED,+FAA+F;IACvF,oBAAoB;QAC1B,OAAO,GAAG,IAAI,CAAC,YAAY,EAAE,YAAY,EAAE,IAAI,EAAE,GAAG,uCAAuC,EAAE,CAAC;IAChG,CAAC;IAED;;;;;;;;;;;;;;;;OAgBG;IACK,KAAK,CAAC,6BAA6B;QACzC,IAAI,IAAI,CAAC,6BAA6B;YAAE,OAAO;QAC/C,IAAI,CAAC,6BAA6B,GAAG,IAAI,CAAC;QAE1C,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,EAAE,cAAc,EAAE,CAAC;QACnD,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,+FAA+F;YAC/F,IAAI,CAAC,QAAQ,CAAC,yFAAyF,CAAC,CAAC;YACzG,OAAO;QACT,CAAC;QAED,IAAI,UAAuC,CAAC;QAC5C,IAAI,CAAC;YACH,iGAAiG;YACjG,iCAAiC;YACjC,UAAU,GAAG,MAAM,CAAC,SAAS,EAAqB,CAAC;YACnD,UAAU,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAAc,EAAE,EAAE,CACxC,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,2CAA2C,EAAE,EAAE,GAAG,2BAA2B,CAAC,KAAK,CAAC,EAAE,CAAC,CAC5G,CAAC;YACF,UAAU,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;gBACxB,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,wFAAwF,CAAC,CAAC;gBAC7G,IAAI,CAAC,6BAA6B,GAAG,KAAK,CAAC;YAC7C,CAAC,CAAC,CAAC;YACH,MAAM,UAAU,CAAC,OAAO,EAAE,CAAC;YAC3B,MAAM,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,oBAAoB,EAAE,EAAE,CAAC,cAAsB,EAAE,EAAE;gBACjF,mFAAmF;gBACnF,IAAI,CAAC,gBAAgB,CAAC,UAAU,CAAC,cAAc,CAAC,CAAC;gBACjD,IAAI,CAAC,QAAQ,CAAC,6DAA6D,EAAE,EAAE,cAAc,EAAE,CAAC,CAAC;YACnG,CAAC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,UAAU,EAAE,CAAC;gBACf,IAAI,CAAC;oBACH,MAAM,UAAU,CAAC,OAAO,EAAE,CAAC;gBAC7B,CAAC;gBAAC,MAAM,CAAC;oBACP,uCAAuC;gBACzC,CAAC;YACH,CAAC;YACD,IAAI,CAAC,6BAA6B,GAAG,KAAK,CAAC,CAAC,kCAAkC;YAC9E,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,wGAAwG,EAAE;gBAC5H,cAAc,EAAE,4BAA4B;gBAC5C,GAAG,2BAA2B,CAAC,KAAK,CAAC;aACtC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED;;;;;;OAMG;IACK,KAAK,CAAC,sBAAsB,CAClC,EAAyB,EACzB,UAAmE,EACnE,cAAsB,EACtB,UAAgC;QAEhC,8FAA8F;QAC9F,MAAM,cAAc,GAAG,2BAA2B,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;QAEzE,oCAAoC;QACpC,IAAI,CAAC,IAAI,CAAC,kBAAkB,CAAC,UAAU,CAAC,SAAS,EAAE,cAAc,EAAE,UAAU,CAAC,EAAE,CAAC;YAC/E,IAAI,CAAC,QAAQ,CAAC,mCAAmC,EAAE;gBACjD,SAAS,EAAE,UAAU,CAAC,SAAS;gBAC/B,cAAc;aACf,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAED,oDAAoD;QACpD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,EAAE,EAAE,cAAc,CAAC,CAAC;QAE/D,0DAA0D;QAC1D,MAAM,KAAK,GAAI,UAAU,CAAC,SAAqC,EAAE,aAAmC,CAAC;QACrG,MAAM,OAAO,GAAI,UAAU,CAAC,SAAqC,EAAE,eAAqC,CAAC;QAEzG,8EAA8E;QAC9E,MAAM,QAAQ,GAAG,IAAI,CAAC,cAAc,CAAC,UAAU,EAAE,cAAc,EAAE,cAAc,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;QAE1G,kEAAkE;QAClE,wEAAwE;QACxE,+EAA+E;QAC/E,+CAA+C;QAC/C,MAAM,IAAI,CAAC,0BAA0B,CAAC,EAAE,QAAQ,EAAE,cAAc,EAAE,UAAU,EAAE,CAAC,CAAC;QAEhF,IAAI,CAAC,QAAQ,CAAC,wCAAwC,EAAE;YACtD,OAAO,EAAE,QAAQ,CAAC,OAAO;YACzB,SAAS,EAAE,UAAU,CAAC,SAAS;YAC/B,cAAc;SACf,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA+BG;IACI,KAAK,CAAC,0BAA0B,CAAC,MAMvC;QACC,MAAM,EAAE,QAAQ,EAAE,cAAc,EAAE,UAAU,EAAE,GAAG,MAAM,CAAC;QACxD,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,IAAI,aAAa,CAAC,YAAY,CAAC;QAEjE,gFAAgF;QAChF,sEAAsE;QACtE,MAAM,YAAY,GAAG,IAAI,CAAC,oBAAoB,CAAC,QAAQ,CAAC,CAAC;QAEzD,iFAAiF;QACjF,iFAAiF;QACjF,kFAAkF;QAClF,MAAM,IAAI,CAAC,YAAY,CAAC,kBAAkB,CACxC,+BAA+B,EAC/B;YACE,QAAQ;YACR,YAAY;YACZ,cAAc;YACd,SAAS;YACT,OAAO,EAAE,MAAM,CAAC,OAAO,IAAI,cAAc;YACzC,UAAU,EAAE;gBACV,UAAU,EAAE,UAAU,CAAC,UAAU;gBACjC,UAAU,EAAE,UAAU,CAAC,UAAU;gBACjC,cAAc,EAAE,UAAU,CAAC,cAAc;gBACzC,cAAc,EAAE,UAAU,CAAC,cAAc;gBACzC,WAAW,EAAE,UAAU,CAAC,WAAW;gBACnC,aAAa,EAAE,UAAU,CAAC,aAAa;gBACvC,QAAQ,EAAE,UAAU,CAAC,QAAQ;aAC9B;SACF,CACF,CAAC;IACJ,CAAC;IAED;;OAEG;IACK,kBAAkB,CACxB,SAAiB,EACjB,cAA8E,EAC9E,MAA4B;QAE5B,MAAM,MAAM,GAAG,MAAM,CAAC,WAAW,CAAC;QAElC,wBAAwB;QACxB,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,cAAc,CAAC,QAAQ,CAAC,EAAE,CAAC;YACzD,OAAO,KAAK,CAAC;QACf,CAAC;QAED,yBAAyB;QACzB,MAAM,kBAAkB,GAAG,cAAc,CAAC,cAAc,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QACxE,MAAM,oBAAoB,GAAG,cAAc,CAAC,MAAM,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;QACzE,IAAI,kBAAkB,GAAG,oBAAoB,EAAE,CAAC;YAC9C,OAAO,KAAK,CAAC;QACf,CAAC;QAED,mDAAmD;QACnD,IAAI,MAAM,CAAC,kBAAkB,IAAI,MAAM,CAAC,kBAAkB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtE,IAAI,CAAC,MAAM,CAAC,kBAAkB,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;gBACnD,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;OAEG;IACK,cAAc,CACpB,UAAmE,EACnE,cAAsB,EACtB,cAA8E,EAC9E,gBAAyB,EACzB,aAAsB,EACtB,eAAwB;QAExB,MAAM,SAAS,GAAG,UAAU,CAAC,SAAoC,CAAC;QAElE,OAAO;YACL,OAAO,EAAE,IAAI,CAAC,uBAAuB,CAAC,UAAU,CAAC;YACjD,SAAS,EAAE,UAAU,CAAC,SAAS;YAC/B,aAAa,EAAE,cAAc,CAAC,QAAQ;YACtC,QAAQ,EAAE,cAAc,CAAC,QAAQ;YACjC,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,aAAa,EAAE,UAAU,CAAC,aAAa;YACvC,sGAAsG;YACtG,gBAAgB,EAAE,UAAU,CAAC,gBAAgB;YAC7C,mBAAmB,EAAE,UAAU,CAAC,mBAAmB;YAEnD,cAAc;YACd,gBAAgB,EAAE,mCAAmC;YACrD,aAAa;YACb,eAAe;YACf,MAAM,EAAE,UAAU,CAAC,MAAM;YACzB,SAAS,EAAG,SAAS,CAAC,KAAgB,IAAI,SAAS;YAEnD,aAAa,EAAE,IAAI,CAAC,gBAAgB,CAAC,aAAa;YAClD,aAAa,EAAE,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,OAAO;YACjD,iBAAiB,EAAE,IAAI,CAAC,gBAAgB,CAAC,cAAc;YAEvD,yDAAyD;YACzD,UAAU,EAAG,SAAS,CAAC,UAAqB,IAAI,SAAS;YACzD,UAAU,EAAG,SAAS,CAAC,UAAqB,IAAI,SAAS;YACzD,WAAW,EAAG,SAAS,CAAC,WAAsB,IAAI,SAAS;YAC3D,cAAc,EAAG,SAAS,CAAC,cAAyB,IAAI,SAAS;YACjE,SAAS,EAAG,SAAS,CAAC,SAAoB,IAAI,SAAS;YACvD,SAAS,EAAG,SAAS,CAAC,SAAoB,IAAI,SAAS;YAEvD,SAAS,EAAE,SAAgC;YAE3C,OAAO,EAAE,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC,SAAS,CAAC;YACjD,aAAa,EAAG,SAAS,CAAC,aAAwB,IAAK,SAAS,CAAC,MAAiB,IAAI,SAAS;SAChG,CAAC;IACJ,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAmDG;IACK,uBAAuB,CAAC,UAAmE;QACjG,IAAI,UAAU,CAAC,OAAO,EAAE,CAAC;YACvB,OAAO,UAAU,CAAC,OAAO,CAAC;QAC5B,CAAC;QAED,MAAM,aAAa,GAAG,MAAM,EAAE,CAAC;QAC/B,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAChB,iLAAiL,EACjL,EAAE,SAAS,EAAE,UAAU,CAAC,SAAS,EAAE,aAAa,EAAE,CACnD,CAAC;QACF,OAAO,aAAa,CAAC;IACvB,CAAC;IAED;;OAEG;IACK,aAAa,CAAC,SAAiB;QACrC,MAAM,iBAAiB,GAAG;YACxB,sBAAsB,CAAC,iBAAiB;YACxC,sBAAsB,CAAC,mBAAmB;YAC1C,sBAAsB,CAAC,qBAAqB;YAC5C,sBAAsB,CAAC,4BAA4B;YACnD,sBAAsB,CAAC,iBAAiB;YACxC,sBAAsB,CAAC,8BAA8B;YACrD,sBAAsB,CAAC,mBAAmB;SAC3C,CAAC;QAEF,OAAO,iBAAiB,CAAC,QAAQ,CAAC,SAAmC,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC,CAAC,iBAAiB,CAAC,OAAO,CAAC;IACjI,CAAC;IAED,gEAAgE;IAChE,8BAA8B;IAC9B,gEAAgE;IAEhE;;;;;;;;;;;;;;;;;;;;;OAqBG;IACK,KAAK,CAAC,eAAe,CAAC,EAAyB,EAAE,cAAsB;QAC7E,OAAO,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,cAAc,EAAE,KAAK,IAAI,EAAE;YACvD,IAAI,CAAC;gBACH,MAAM,QAAQ,GAAG,IAAI,CAAC,oBAAoB,CAAC,oBAAoB,CAAC,gBAAgB,CAAC,aAAa,CAAC,CAAC;gBAChG,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAgC,EAAE,EAAE,cAAc,CAAC,CAAC;gBACnF,OAAO,GAAG,EAAE,IAAI,IAAI,SAAS,CAAC;YAChC,CAAC;YAAC,MAAM,CAAC;gBACP,0DAA0D;gBAC1D,OAAO,SAAS,CAAC;YACnB,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;IAED,gEAAgE;IAChE,6BAA6B;IAC7B,gEAAgE;IAEhE;;;OAGG;IACK,oBAAoB,CAAC,QAAoC;QAC/D,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;QACnC,OAAO,UAAU,CAAC,QAAQ,EAAE,OAAO,CAAC;aACjC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;aAChC,MAAM,CAAC,KAAK,CAAC,CAAC;IACnB,CAAC;IAED;;;OAGG;IACK,WAAW;QACjB,OAAO,UAAU,CAAC,QAAQ,CAAC;aACxB,MAAM,CAAC,GAAG,gBAAgB,IAAI,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC;aAC7F,MAAM,EAAE,CAAC;IACd,CAAC;IAED;;;OAGG;IACI,kBAAkB,CAAC,QAAoC,EAAE,YAAoB;QAClF,MAAM,YAAY,GAAG,IAAI,CAAC,oBAAoB,CAAC,QAAQ,CAAC,CAAC;QACzD,oFAAoF;QACpF,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;QACvD,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;QACvD,IAAI,WAAW,CAAC,MAAM,KAAK,WAAW,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC;QAC5D,OAAO,eAAe,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;IACnD,CAAC;CACF,CAAA;AAnuBY,kCAAkC;IAD9C,UAAU,EAAE;IA8CR,WAAA,MAAM,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAA;IACjC,WAAA,MAAM,CAAC,kBAAkB,CAAC,gBAAgB,CAAC,CAAA;IAC3C,WAAA,MAAM,CAAC,kBAAkB,CAAC,oCAAoC,CAAC,CAAA;IAC/D,WAAA,MAAM,CAAC,kBAAkB,CAAC,mBAAmB,CAAC,CAAA;IAC9C,WAAA,MAAM,CAAC,kBAAkB,CAAC,kCAAkC,CAAC,CAAA;IAS7D,WAAA,MAAM,CAAC,kBAAkB,CAAC,YAAY,CAAC,CAAA;IAAE,WAAA,QAAQ,EAAE,CAAA;qCAbQ,aAAa;QACO,uBAAuB;QACH,oCAAoC;QACzD,mBAAmB;QACI,yCAAyC;GAjDtI,kCAAkC,CAmuB9C","sourcesContent":["/*\n Audit Event Dispatcher Backend Service\n \n Layer 2 of the three-layer audit event pipeline (Step 18).\n * Receives audit events after MongoDB write and dispatches them\n * to the organization's SIEM endpoint if configured.\n \n This is fire-and-forget — if dispatch fails, the audit log\n * in MongoDB remains authoritative.\n /\n\nimport 'reflect-metadata';\nimport { inject, injectable, optional } from 'inversify';\nimport type { RedisClientType } from 'redis';\nimport { v4 as uuidv4 } from 'uuid';\nimport { createHmac, createHash, timingSafeEqual } from 'crypto';\nimport { SAAS_SERVICE_TYPES } from '~wildo-backend-lib/inject/models/service-types';\nimport { LoggerService } from '~wildo-backend-lib/monitoring/logger/services/logger.service';\nimport { AppConfigurationService } from '~wildo-backend-lib/config/services/app-configuration.backend.service';\nimport { AuthOrganizationConfigurationService } from '~wildo-backend-lib/security/authentications/services/admin-config/auth-organization-configuration.service';\nimport { RepositoriesRegistryHandlerBackendService } from '~wildo-backend-lib/base-classes/services/repositories/repositories-registry-handler.backend.service';\nimport { QueueBackendService } from '~wildo-backend-lib/queue/queue.backend.service';\nimport { LeasedValueCache } from '~wildo-backend-lib/compliance/audit-trails/services/utils/leased-value-cache.backend.utils';\nimport { projectCaughtErrorLogFields } from '~wildo-backend-lib/errors/utils/error-log-level-classification.backend.utils';\nimport { SIEM_WEBHOOK_DELIVERY_BATCH_REF } from '~wildo-backend-lib/base-classes/services/batches/engine-custom-batch-manifests';\nimport {\n AuditEventOutcome,\n CoreAuditableEventType,\n CoreResourceType,\n getAuditEventClassification,\n type SecurityAuditEventEnvelope,\n type AuditEventCategory,\n type AuditEventSeverity,\n type AuditableEvent,\n type SiemExportConfigBase,\n AuthScopeType,\n} from '@wildo-ai/saas-models';\nimport type { ExecutionContext } from '~wildo-backend-lib/runtime/models/execution-context.backend.schemas';\nimport type { RedisService } from '~wildo-backend-lib/databases/services/redis.service';\n\n/* F6: HMAC domain separator for event integrity /\nconst SIEM_HMAC_DOMAIN = 'wildo:siem:event-integrity:v1';\n\n/\n *A SIEM export configuration change takes effect on EVERY replica within 60 seconds — and within\n milliseconds when the change goes through the engine.*\n \n * That sentence is the guarantee this subsystem makes, and the two halves come from two different\n * mechanisms, so read both before changing either.\n \n ## Why the number is 60 seconds, and why it used to be 300\n \n The lease is the ONLY thing that covers a write no hook can see — a repository-tier write, or a\n * direct database write. There is a live one: `examples/wonder-todos/e2e/adapter.ts` (`case 'siem'`)\n * repoints an organization's export config with `upsertOrganizationSingleton(...)`, straight at the\n * store, bypassing the engine entirely. Its own comment records what the old 300 s cost — \"A freshly\n provisioned org has a cold 5-min config cache, so the first login cold-reads this\"* — i.e. the lane\n * is correct only because it is ORDERED to run before the organization's first audited action. A\n * five-minute convergence bound is not something a scenario, or an operator doing surgery, can wait\n * for; it is something they have to design around. Sixty seconds is something they can wait for.\n \n The old 300 s was never chosen for that job — it was chosen to bound READ AMPLIFICATION, because a\n * miss costs more than a repository read: `AuthOrganizationConfigurationService.loadSiemExportConfig`\n * reads through `readAsSystem`, which emits its own `system_context_read` audit row to the database\n * AND to immudb. So shortening the lease multiplies audit-trail plumbing noise, not just queries.\n * Two properties make 60 s affordable anyway:\n \n - Refreshes are LAZY and STALE-WHILE-REVALIDATE ({@link LeasedValueCache}). A quiet organization\n * costs one read per event, not one per minute; only a continuously busy one reaches the ceiling of\n * one read per lease per replica. At 60 s that ceiling is 60 reads/hour/replica per ACTIVE\n * organization — for an organization emitting 1000 audit events an hour, under 5 % amplification of\n * its own audit volume, against 12/hour before.\n * - Nothing blocks on it. Past the lease the cached value is served immediately and the re-read\n * runs off the emission path, so shortening it costs read volume and never latency.\n \n ## The other half: the engine-routed write converges in milliseconds\n \n {@link AuditEventDispatcherBackendService.invalidateSiemConfig} drops the local entry AND publishes\n * the organization id on {@link SIEM_CONFIG_INVALIDATION_CHANNEL_SUFFIX}, which every replica\n * subscribes to. Before that broadcast the invalidation reached exactly ONE process — the one that\n * happened to handle the write — and every other replica served the stale value for the rest of the\n * lease, which is the defect this constant's neighbours document.\n \n Do not raise this back toward the read-amplification number. If the amplification ever needs to\n * come down, the right lever is the `system_context_read` row on the config read itself:\n * `SystemAccessBackendService.readAsSystem` already takes `suppressSystemAudit`, and its own JSDoc\n * names this exact read — \"the audit pipeline resolving … an org's SIEM config to ROUTE an audit\n event\"* — as the case it exists for. `loadSiemExportConfig` is the one such reader that does not\n * pass it. Fixing that makes a miss cost a single indexed read and removes the constraint entirely.\n /\nexport const SIEM_CONFIG_REFRESH_AFTER_MS = 60 1000;\n/** R2: Max entries in the SIEM-config cache to prevent unbounded growth. Least-recently-used is evicted. /\nconst SIEM_CONFIG_CACHE_MAX_SIZE = 1000;\n\n/\n F3: how long a cached organization NAME is served before a background re-read.\n \n Deliberately NOT the same constant as {@link SIEM_CONFIG_REFRESH_AFTER_MS}, though the mechanism is\n * now shared. A stale name is a stale LABEL on an exported envelope — the `organizationId` beside it\n * is authoritative and unaffected, so a rename showing up late is cosmetic. A stale export config\n * decides whether the event is routed AT ALL. Same defect shape, different consequence class, so they\n * get the same machinery and their own numbers: five minutes buys back the read volume that the\n * config's sixty seconds spends, and nothing depends on a rename propagating faster.\n /\nconst ORG_NAME_REFRESH_AFTER_MS = 5 60 * 1000;\n/** B4: Max entries in org name cache to prevent unbounded growth. Least-recently-used is evicted. /\nconst ORG_NAME_CACHE_MAX_SIZE = 1000;\n\n/\n The Redis channel carrying cross-replica SIEM-config invalidations. App-prefixed at use, so tenants\n * of one Redis never cross — the convention {@link RedisService.getAppPrefix} exists for.\n \n Broadcast rather than a shared cache, and the distinction is the whole design: the emission path\n * never touches Redis, so a Redis outage degrades convergence to the lease instead of degrading\n * ROUTING. A shared-store cache would have put a network round trip on the path an audit event takes\n * and made delivery depend on a store that can be down.\n /\nconst SIEM_CONFIG_INVALIDATION_CHANNEL_SUFFIX = 'audit:siem-export-config:invalidate';\n\n/* Severity ordering for minimum severity filtering /\nconst SEVERITY_ORDER: Record<string, number> = {\n 'info': 0,\n 'warning': 1,\n 'critical': 2,\n};\n\n/\n The per-org audit sink TYPES an organization can route its authenticated audit\n * events to. Today the only type is the SIEM webhook. Adding a per-org destination\n * later (e.g. per-org immudb, per observability §11) is a new member HERE + a branch\n * in `_resolveOrgAuditSinks` + a `case` in `dispatchToOrganizationAuditSinks` — the F4\n * routing (org from the authenticated EC) and the envelope/HMAC contracts do not change.\n /\nexport const PerOrgAuditSinkType = {\n SIEM_WEBHOOK: 'siem_webhook',\n} as const;\nexport type PerOrgAuditSinkType = (typeof PerOrgAuditSinkType)[keyof typeof PerOrgAuditSinkType];\n\n/\n A per-org audit sink RESOLVED for a specific org, carrying exactly the config needed\n * to deliver one event to it. A discriminated union (one member today) — the dispatcher\n * fans out by `type`, so a new sink type extends this union rather than reshaping callers.\n /\ntype ResolvedOrgAuditSink = {\n type: typeof PerOrgAuditSinkType.SIEM_WEBHOOK;\n siemConfig: SiemExportConfigBase;\n};\n\n@injectable()\nexport class AuditEventDispatcherBackendService {\n private readonly logDebug: (message: string, context?: Record<string, unknown>) => void;\n\n /\n F3: org NAME cache — a display label on the envelope. See {@link ORG_NAME_REFRESH_AFTER_MS}.\n \n No `onRefreshFailure`, and it would be dead code if there were one: {@link _resolveOrgName}'s loader\n * swallows its own error and yields `undefined`, so nothing this cache runs can ever reject. That\n * swallow is what makes the negative result CACHEABLE, which is the amplification fix described there;\n * the price is that a persistently unreadable organization row is silent, which is the right trade for\n * an optional label whose authoritative sibling (`organizationId`) is on the envelope regardless.\n /\n private readonly _orgNameCache = new LeasedValueCache<string \| undefined>({\n refreshAfterMs: ORG_NAME_REFRESH_AFTER_MS,\n maxEntries: ORG_NAME_CACHE_MAX_SIZE,\n });\n\n /* R2: per-org SIEM-config cache — the value that decides ROUTING. See {@link SIEM_CONFIG_REFRESH_AFTER_MS}. /\n private readonly _siemConfigCache = new LeasedValueCache<SiemExportConfigBase \| null>({\n refreshAfterMs: SIEM_CONFIG_REFRESH_AFTER_MS,\n maxEntries: SIEM_CONFIG_CACHE_MAX_SIZE,\n onRefreshFailure: (organizationId, error) =>\n // ERROR, not WARN, and the asymmetry with the org-name cache above is the point: while this keeps\n // failing the replica is routing on a configuration nobody can confirm, so the guarantee stated on\n // `SIEM_CONFIG_REFRESH_AFTER_MS` is suspended for this organization. Backed off one lease by the\n // cache, so a persistently unreadable config produces one line a minute, not one an event.\n this.logger.error?.('Background refresh of an organization SIEM export config failed — routing continues on the LAST KNOWN config for this replica', {\n organizationId,\n refreshAfterMs: SIEM_CONFIG_REFRESH_AFTER_MS,\n ...projectCaughtErrorLogFields(error),\n }),\n });\n\n /\n Latch so {@link _ensureInvalidationSubscriber} is idempotent; cleared on `end` so a dropped\n * subscriber re-arms.\n \n Deliberately the ONLY subscriber state kept. `A2ATaskCancellationBackendService` also holds the\n * client itself, because it has a shutdown path that closes it; this service has none, and a field\n * nothing reads is a field the next reader has to reason about for nothing. The socket keeps the\n * subscriber alive on its own, and a connection that emitted `end` is already closed.\n /\n private _invalidationSubscribeStarted = false;\n\n constructor(\n @inject(SAAS_SERVICE_TYPES.Logger) private readonly logger: LoggerService,\n @inject(SAAS_SERVICE_TYPES.AppConfigService) private readonly appConfigService: AppConfigurationService,\n @inject(SAAS_SERVICE_TYPES.AuthOrganizationConfigurationService) private readonly orgConfigService: AuthOrganizationConfigurationService,\n @inject(SAAS_SERVICE_TYPES.QueueBackendService) private readonly queueService: QueueBackendService,\n @inject(SAAS_SERVICE_TYPES.RepositoriesRegistryHandlerService) private readonly repositoriesRegistry: RepositoriesRegistryHandlerBackendService,\n /\n `@optional()` and APPENDED LAST — the constructor-parameter discipline.\n \n Optional because the cross-replica broadcast is an OPTIMISATION over the lease, never a\n * precondition for routing: a container with no Redis binding (several partial test containers, and\n * any single-replica deployment) must still dispatch audit events, converging on the lease alone.\n * Appended last so the five existing construction sites keep compiling unchanged.\n /\n @inject(SAAS_SERVICE_TYPES.RedisService) @optional() private readonly redisService?: RedisService,\n ) {\n this.logDebug = this.logger.debugByType('AuditEventDispatcherBackendService');\n this.logger.setDebugTypeLogging('AuditEventDispatcherBackendService', false);\n }\n\n /\n Dispatch an audit event to the organization's configured per-org audit SINKS.\n \n F4 (tenant segregation): the caller (`AuditLogsBackendService`) passes the\n * AUTHENTICATED org (resolved from the request `ExecutionContext`), NEVER the\n * caller-supplied `auditEvent.organizationId`. Sink config is loaded for THIS org\n * only (`_resolveOrgAuditSinks`), so an event can only reach the sinks of the tenant\n * it is authenticated for.\n \n Layer 2 of the pipeline: called after the MongoDB write (Layer 1), wired directly\n * into `AuditLogsBackendService` (NOT a resource pipeline post-hook). Fire-and-forget\n * — a resolution or per-sink delivery failure is logged but NEVER thrown onto the\n * business op, and per-sink failures are ISOLATED (F7) so one destination never\n * suppresses another.\n \n The seam: `_resolveOrgAuditSinks` returns the 0..N sinks the org has configured\n * (today only a SIEM webhook); this method fans each out by its `type`. Adding a\n * per-org destination later = a new {@link PerOrgAuditSinkType} + a resolver branch +\n * a `case` here.\n \n ── APPLICATION scope is RESERVED / DORMANT — there is NO app-scoped producer ──────\n * This producer is ORGANIZATION-scoped ONLY, on purpose. The F4 model routes on a\n * TRUSTED authenticated tenant (org), and the sole caller (`AuditLogsBackendService`)\n * fans out over the event's verified member orgs. There is deliberately no\n * `dispatchToApplicationAuditSinks` / `_resolveAppAuditSinks`.\n \n The SIEM export-config and delivery-DLQ resources DO each carry an `APPLICATION`\n * polymorphic variant (uniform with SSO/SCIM over `AUTH_SCOPE_VARIANTS`), and every\n * downstream seam is already scope-generic: `loadSiemExportConfig(ec, APPLICATION, appId)`,\n * {@link enqueueSiemWebhookDelivery} (`scopeType`/`scopeId`), the delivery worker's\n * circuit-breaker key, and `_enqueueToDLQ`'s `APPLICATION_SIEM_DELIVERY_DLQ` branch all\n * accept the app scope. But NOTHING emits a first-time app-scoped delivery. The only\n * caller that passes `scopeType: APPLICATION` today is the SIEM-DLQ retry custom-impl,\n * which is itself unreachable in production: an `APPLICATION_SIEM_DELIVERY_DLQ` row can\n * only be born from a FAILED app-scoped delivery — and none is ever produced — so the\n * app config-read, app DLQ, and app retry are mutually reachable only through each other.\n * NOTE the operator-visible trap this leaves: an app super-admin CAN enable\n * `APPLICATION_SIEM_EXPORT_CONFIG` (its own custom-impl + APP_ADMIN_SUPER_ADMIN roles)\n * and it will silently deliver NOTHING until a producer exists.\n \n To make it real — a SCOPED feature, NOT a mechanical mirror; settle the design fork\n * FIRST (which events an app SIEM receives, whether spanning all tenants, and how it\n * composes with per-org delivery so an event is not double-sent) — add a sibling\n * `_resolveAppAuditSinks(ec, appId)` loading the APP config, a\n * `dispatchToApplicationAuditSinks` fanning out identically, and a producer that calls it\n * with an app context, reusing the SAME envelope/HMAC/scope contract via\n * `enqueueSiemWebhookDelivery({ scopeType: AuthScopeType.APPLICATION, scopeId })`. Until\n * then, treat the APP variant as reserved plumbing, not a wired path.\n /\n public async dispatchToOrganizationAuditSinks(\n ec: ExecutionContext<any>,\n auditEvent: Omit<AuditableEvent, '_id' \| 'createdAt' \| 'updatedAt'>,\n organizationId: string,\n ): Promise<void> {\n // No authenticated org → no per-org dispatch (fail-closed, F4).\n if (!organizationId) return;\n\n // Arm the fleet invalidation subscriber on first use, so nothing has to order it at startup. Never\n // awaited: it performs a Redis duplicate + connect + subscribe on the first dispatch, and this\n // event must not wait for it. The window it leaves — one connect — is bounded by the lease, which\n // is what covers every un-broadcast change anyway.\n void this._ensureInvalidationSubscriber();\n\n let sinks: ResolvedOrgAuditSink[];\n try {\n sinks = await this._resolveOrgAuditSinks(ec, organizationId);\n } catch (error) {\n // Fire-and-forget: a config-resolution failure must never throw onto the business op.\n this.logger.error?.('Failed to resolve org audit sinks', {\n error,\n eventType: auditEvent.eventType,\n organizationId,\n });\n return;\n }\n\n for (const sink of sinks) {\n try {\n switch (sink.type) {\n case PerOrgAuditSinkType.SIEM_WEBHOOK:\n await this._dispatchToSiemWebhook(ec, auditEvent, organizationId, sink.siemConfig);\n break;\n default:\n // F-1 safety net: a future `PerOrgAuditSinkType` member with no `case` above is\n // LOGGED, never silently dropped (the original finding was a silent no-op). A\n // single-member discriminated union does NOT narrow this `default` to `never`, so\n // a compile-time `assertNever(sink)` guard only becomes possible once a 2nd sink\n // type exists — convert this branch to it then. Until then the resolver's +\n // switch's JSDoc pointers (\"add a case here\") + this warn are the guard.\n this.logger.warn?.(\n 'Unhandled per-org audit sink type — event NOT delivered to this sink; add a `case` in dispatchToOrganizationAuditSinks',\n { sinkType: sink.type, eventType: auditEvent.eventType, organizationId },\n );\n break;\n }\n } catch (error) {\n // Per-sink isolation (F7): one org sink failing never affects the others.\n this.logger.error?.('Failed to dispatch audit event to an org audit sink', {\n error,\n sinkType: sink.type,\n eventType: auditEvent.eventType,\n organizationId,\n });\n }\n }\n }\n\n /\n Resolve the per-org audit SINKS an org has configured — the 0..N destinations\n * {@link dispatchToOrganizationAuditSinks} fans an event out to. Keyed on the org the\n * caller already validated as authenticated (F4). Today the only per-org sink type is\n * the SIEM webhook; a future per-org destination appends its own descriptor HERE.\n \n Two-level feature gate for `CoreFeature.SECURITY_EVENT_EXPORT`:\n * Level 1 (here): `siemConfig.enabled` — the runtime gate.\n * Level 2 (admin API): `FeatureGateService` checks the org's subscription tier has\n * `SECURITY_EVENT_EXPORT` before allowing `enabled = true`. We cannot use\n * `FeatureResolutionService` here (fire-and-forget context; internal ECs bypass\n * feature resolution), so the pre-validated `enabled` flag IS the per-org gate.\n /\n private async _resolveOrgAuditSinks(\n ec: ExecutionContext<any>,\n organizationId: string,\n ): Promise<ResolvedOrgAuditSink[]> {\n const sinks: ResolvedOrgAuditSink[] = [];\n\n const siemConfig = await this._loadSiemConfigCached(ec, organizationId);\n if (siemConfig?.enabled) {\n sinks.push({ type: PerOrgAuditSinkType.SIEM_WEBHOOK, siemConfig });\n }\n\n // Future per-org sink types (e.g. per-org immudb) resolve here — each appends its\n // own descriptor; the dispatcher switch fans out by `type`.\n return sinks;\n }\n\n /\n R2: load the org's SIEM config through the leased cache.\n \n Without a cache, {@link _resolveOrgAuditSinks} reads the config via a self-elevating `readAsSystem`\n * PER EVENT PER ORG — and `readAsSystem` ALSO emits a `SYSTEM_CONTEXT_READ` audit — so every routed\n * audit event (× N orgs on the multi-org fan-out) doubled the audit-write volume to the DB + immudb.\n * `null` is cached too (an org whose config load failed) so a non-configured org is not re-read every\n * event.\n \n The cache is STALE-WHILE-REVALIDATE ({@link LeasedValueCache}), so only the very first event for an\n * organization waits on a read; every later one is served from memory while the refresh runs off this\n * path. That is what lets {@link SIEM_CONFIG_REFRESH_AFTER_MS} be sixty seconds rather than five\n * minutes — read the guarantee stated there before changing it.\n \n The loader closes over `ec`, which is the audit service's synthesised super-admin APPLICATION-scoped\n * temp context (`audit-logs.backend.service.ts:284`, handed here at `:349`) and is therefore equally\n * privileged on every call — the precondition {@link LeasedValueCache} states for joining an in-flight\n * load. `loadSiemExportConfig` in fact ignores `ec` entirely (`void ec`) and reads system-context.\n /\n private async _loadSiemConfigCached(\n ec: ExecutionContext<any>,\n organizationId: string,\n ): Promise<SiemExportConfigBase \| null> {\n return this._siemConfigCache.get(organizationId, () =>\n this.orgConfigService.loadSiemExportConfig(ec, AuthScopeType.ORGANIZATION, organizationId),\n );\n }\n\n /\n Drop one organization's cached SIEM config so the NEXT event re-reads it.\n \n ## Why this exists\n \n Without it the cache had no invalidation at all — only the 5-minute TTL and the size-1000\n * FIFO — so enabling a sink left the organization's events unrouted for up to that window, and\n * audit events are not replayed. The ENABLE direction is the sharp one: `null` is cached\n * deliberately (see {@link _loadSiemConfigCached}) and `null` is exactly the state an\n * organization is in the moment before it first configures a sink, so the first five minutes of\n * a newly-pointed SIEM were silently empty.\n \n ## Where it is called from, and why not from the config service\n \n From a postfix hook on the SIEM-export-config RESOURCE\n * (`siem-export-config-cache-invalidation.custom-impl.backend.service.ts`), not from\n * `AuthOrganizationConfigurationService.saveSiemExportConfig`.\n \n That service was the obvious call site and it is the WRONG one: it is only one of the writers.\n * The config is an ordinary resource, so an update also lands through\n * `ServicesRegistryHandler.update` on `organizationSiemExportConfig` directly. Hooking the\n * service would have applied the invariant at one of two call sites, which is the defect shape\n * `.claude/rules/invariant-call-site-enumeration.md` exists to stop. The resource operation is\n * the chokepoint BOTH writers pass through — `saveSiemExportConfig` itself dispatches its write\n * via `ServicesRegistryHandler`, so covering the resource covers it for free.\n \n Note `saveSiemExportConfig` separately refreshes its OWN `siemExportConfigs` map. That is a\n * different cache in a different service and was never the one deciding routing.\n \n ## Semantics\n \n Deleting the entry rather than overwriting it: the next read goes to the repository, so this\n * cannot install a wrong value, only force a re-read. Idempotent, and a no-op for an\n * organization with no entry — which is the common case, since only organizations that have\n * raised an audit event since the last eviction are in the map at all. Synchronous and\n * infallible on purpose, so the caller needs no error handling.\n \n ## It reaches EVERY replica, which it did not before\n \n The local drop above is only ever correct for ONE process — the one that happened to handle the\n * write. With N replicas behind a load balancer, the other N-1 went on serving the pre-write config\n * for the rest of the lease, so \"the invalidation covers engine-routed writes\" was true of a single\n * instance and false of every real deployment. The broadcast closes that: the organization id goes\n * out on {@link SIEM_CONFIG_INVALIDATION_CHANNEL_SUFFIX} and every replica's subscriber drops its own\n * entry within milliseconds.\n \n The publish is fire-and-forget and cannot fail this call: a broadcast that does not go out degrades\n * the OTHER replicas to the lease, which is exactly where they were before, and refusing a\n * configuration write to protect a cache would invert the priority. This method's synchronous,\n * infallible contract therefore still holds for its caller.\n \n What it still does NOT cover, and cannot. A write that never reaches the service tier — a\n * repository-tier write, or a direct database write like `examples/wonder-todos/e2e/adapter.ts`'s\n * `upsertOrganizationSingleton('organizationSiemExportConfig', …)` — raises no postfix hook, so\n * nothing calls this and nothing is broadcast. For those the lease is the entire guarantee; that is\n * why it is chosen and argued at {@link SIEM_CONFIG_REFRESH_AFTER_MS} rather than left incidental.\n /\n public invalidateSiemConfig(organizationId: string): void {\n this._siemConfigCache.invalidate(organizationId);\n this._publishSiemConfigInvalidation(organizationId);\n }\n\n /\n Tell the rest of the fleet to drop this organization's cached SIEM config.\n \n Returns nothing and awaits nothing — the caller is a postfix write hook whose contract is that it\n * cannot fail the write it follows.\n /\n private _publishSiemConfigInvalidation(organizationId: string): void {\n const client = this.redisService?.getReadyClient();\n // A not-ready client is the normal state wherever Redis is unconfigured (single-replica, local dev,\n // several test containers). It is not an error: the local drop already happened, and there is no\n // other replica to tell.\n if (!client) return;\n\n void client\n .publish(this._invalidationChannel(), organizationId)\n .catch((error: unknown) =>\n this.logger.error?.('Failed to broadcast a SIEM export config invalidation — other replicas converge on the lease instead', {\n organizationId,\n refreshAfterMs: SIEM_CONFIG_REFRESH_AFTER_MS,\n ...projectCaughtErrorLogFields(error),\n }),\n );\n }\n\n /* App-prefixed so two applications sharing one Redis never invalidate each other's caches. /\n private _invalidationChannel(): string {\n return `${this.redisService?.getAppPrefix() ?? ''}${SIEM_CONFIG_INVALIDATION_CHANNEL_SUFFIX}`;\n }\n\n /\n Arm this replica's single subscriber to the invalidation channel. Idempotent.\n \n Called (never awaited) from {@link dispatchToOrganizationAuditSinks}, so no startup ordering is\n * required and nothing has to be wired in `start-application` — the same lazy-arm pattern\n * `A2ATaskCancellationBackendService.ensureSubscriber` uses, for the same reason.\n \n Fails OPEN by design: a replica that cannot subscribe still routes audit events, converging on the\n * lease instead of on the broadcast. The failure is logged at ERROR because a persistent one silently\n * returns that replica to the per-process behaviour this mechanism exists to remove.\n \n Two details are copied deliberately rather than reinvented, because each was a recorded defect in\n * the A2A original: the `end` handler RE-ARMS (a subscriber that connected and then dropped — a Redis\n * restart, a failover, an idle reap — otherwise stayed dead for the life of the process while every\n * other signal looked healthy), and the catch DESTROYS a half-built connection (`connect()` can\n * succeed while `subscribe()` throws, and retrying without destroying leaks one socket per attempt).\n /\n private async _ensureInvalidationSubscriber(): Promise<void> {\n if (this._invalidationSubscribeStarted) return;\n this._invalidationSubscribeStarted = true;\n\n const client = this.redisService?.getReadyClient();\n if (!client) {\n // Not an error: no Redis means no other replica to hear from. Latched so this is decided once.\n this.logDebug('Redis unavailable — cross-replica SIEM-config invalidation is disabled for this replica');\n return;\n }\n\n let subscriber: RedisClientType \| undefined;\n try {\n // `node-redis` forbids ordinary commands on a subscribed connection, so this MUST be a duplicate\n // rather than the shared client.\n subscriber = client.duplicate() as RedisClientType;\n subscriber.on('error', (error: unknown) =>\n this.logger.error?.('SIEM-config invalidation subscriber error', { ...projectCaughtErrorLogFields(error) }),\n );\n subscriber.on('end', () => {\n this.logger.warn?.('SIEM-config invalidation subscriber closed; re-arming so the next dispatch rebuilds it');\n this._invalidationSubscribeStarted = false;\n });\n await subscriber.connect();\n await subscriber.subscribe(this._invalidationChannel(), (organizationId: string) => {\n // Local drop only — never a re-publish, or one write would loop the fleet forever.\n this._siemConfigCache.invalidate(organizationId);\n this.logDebug('Dropped a cached SIEM export config on a fleet invalidation', { organizationId });\n });\n } catch (error) {\n if (subscriber) {\n try {\n await subscriber.destroy();\n } catch {\n / already dead — nothing to reclaim /\n }\n }\n this._invalidationSubscribeStarted = false; // allow a later dispatch to retry\n this.logger.error?.('Failed to subscribe to the SIEM-config invalidation channel — this replica converges on the lease only', {\n refreshAfterMs: SIEM_CONFIG_REFRESH_AFTER_MS,\n ...projectCaughtErrorLogFields(error),\n });\n }\n }\n\n /\n Deliver one event to an org's SIEM webhook sink: apply the sink's per-event filter,\n * build + HMAC the envelope, and enqueue for async delivery via the SIEM webhook\n * delivery worker (`siemWebhookDeliveryBatchService`, registered under\n * `SIEM_WEBHOOK_DELIVERY_BATCH_REF` in `start-application`). May throw; the caller\n * isolates per-sink failures.\n /\n private async _dispatchToSiemWebhook(\n ec: ExecutionContext<any>,\n auditEvent: Omit<AuditableEvent, '_id' \| 'createdAt' \| 'updatedAt'>,\n organizationId: string,\n siemConfig: SiemExportConfigBase,\n ): Promise<void> {\n // Classify the event (always returns a value; defaults to data_access/info for unknown types)\n const classification = getAuditEventClassification(auditEvent.eventType);\n\n // Apply the sink's per-event filter\n if (!this._passesEventFilter(auditEvent.eventType, classification, siemConfig)) {\n this.logDebug('Event filtered out by SIEM config', {\n eventType: auditEvent.eventType,\n organizationId,\n });\n return;\n }\n\n // F3: Resolve org name for SIEM analyst readability\n const orgName = await this._resolveOrgName(ec, organizationId);\n\n // Extract application context from eventData if available\n const appId = (auditEvent.eventData as Record<string, unknown>)?.applicationId as string \| undefined;\n const appName = (auditEvent.eventData as Record<string, unknown>)?.applicationName as string \| undefined;\n\n // Build the envelope (F3: includes orgName, Task 3.12c: includes app context)\n const envelope = this._buildEnvelope(auditEvent, organizationId, classification, orgName, appId, appName);\n\n // Enqueue for async delivery through the single job-contract seam\n // (payload shape + F6 envelope HMAC + batch ref). This dispatch path is\n // org-scoped; {@link enqueueSiemWebhookDelivery} defaults scopeType/scopeId to\n // the organization, so behaviour is unchanged.\n await this.enqueueSiemWebhookDelivery({ envelope, organizationId, siemConfig });\n\n this.logDebug('Audit event enqueued for SIEM delivery', {\n eventId: envelope.eventId,\n eventType: auditEvent.eventType,\n organizationId,\n });\n }\n\n /\n Enqueue ONE already-built envelope for async SIEM webhook delivery.\n \n The SINGLE authority for the SIEM delivery-job contract — the\n * {@link SIEMDeliveryJobPayload} shape, the F6 envelope HMAC, and the\n * `SIEM_WEBHOOK_DELIVERY_BATCH_REF` batch ref — shared by two producers:\n * 1. first-time dispatch ({@link _dispatchToSiemWebhook}, org scope), and\n * 2. manual DLQ drain (the `siem-delivery-dlq` RETRY_SINGLE / RETRY_ALL\n * custom impls), which re-enqueue a dead-lettered row's STORED envelope\n * for either the ORG or APP scope.\n \n Keeping this in one place is not cosmetic: the delivery worker has no\n * back-reference to a DLQ row, so a retry that fails is re-captured as a\n * brand-new DLQ row. If the retry path built a subtly different payload (a\n * dropped `siemConfig` field, a stale HMAC domain), the mismatch would surface\n * only as a silently looping dead-letter — never a compile error. One seam\n * makes that class of drift impossible.\n \n @param params.scopeType Defaults to {@link AuthScopeType.ORGANIZATION} (the\n * first-time dispatch path is org-only). The DLQ APP variant passes\n * {@link AuthScopeType.APPLICATION} so the worker's circuit-breaker key and\n * any re-DLQ capture resolve to the application scope, not the org. NOTE: the\n * SIEM-DLQ retry custom-impl is the ONLY caller that passes `APPLICATION` today —\n * there is NO first-time app-scoped producer (the APPLICATION variant is reserved /\n * dormant; see {@link dispatchToOrganizationAuditSinks} for the full rationale and\n * the wiring a future app producer would add).\n * @param params.scopeId Defaults to `organizationId`.\n \n May throw on enqueue failure — the CALLER decides isolation: the dispatch\n * path swallows it per-sink (fire-and-forget, F7); the DLQ retry surfaces it to\n * the operator so the row is left intact for another attempt.\n /\n public async enqueueSiemWebhookDelivery(params: {\n envelope: SecurityAuditEventEnvelope;\n organizationId: string;\n siemConfig: SiemExportConfigBase;\n scopeType?: AuthScopeType;\n scopeId?: string;\n }): Promise<void> {\n const { envelope, organizationId, siemConfig } = params;\n const scopeType = params.scopeType ?? AuthScopeType.ORGANIZATION;\n\n // F6: HMAC integrity signature over the envelope payload — computed HERE so the\n // key/domain never diverges between the dispatch and retry producers.\n const envelopeHmac = this._computeEnvelopeHmac(envelope);\n\n // Using the shared constant keeps enqueue ↔ registration ↔ spec cross-validation\n // on one literal. The `siemConfig` projection strips the config to the transport\n // fields the worker needs (no eventFilter — filtering already happened upstream).\n await this.queueService.enqueueCustomBatch(\n SIEM_WEBHOOK_DELIVERY_BATCH_REF,\n {\n envelope,\n envelopeHmac,\n organizationId,\n scopeType,\n scopeId: params.scopeId ?? organizationId,\n siemConfig: {\n webhookUrl: siemConfig.webhookUrl,\n authMethod: siemConfig.authMethod,\n authCredential: siemConfig.authCredential,\n authHeaderName: siemConfig.authHeaderName,\n eventFormat: siemConfig.eventFormat,\n customHeaders: siemConfig.customHeaders,\n delivery: siemConfig.delivery,\n },\n },\n );\n }\n\n /\n Check if an event passes the org's SIEM event filter.\n /\n private _passesEventFilter(\n eventType: string,\n classification: { category: AuditEventCategory; severity: AuditEventSeverity },\n config: SiemExportConfigBase,\n ): boolean {\n const filter = config.eventFilter;\n\n // Check category filter\n if (!filter.categories.includes(classification.category)) {\n return false;\n }\n\n // Check severity minimum\n const eventSeverityOrder = SEVERITY_ORDER[classification.severity] ?? 0;\n const minimumSeverityOrder = SEVERITY_ORDER[filter.severityMinimum] ?? 0;\n if (eventSeverityOrder < minimumSeverityOrder) {\n return false;\n }\n\n // Check specific event type filter (if configured)\n if (filter.specificEventTypes && filter.specificEventTypes.length > 0) {\n if (!filter.specificEventTypes.includes(eventType)) {\n return false;\n }\n }\n\n return true;\n }\n\n /\n Build a SecurityAuditEventEnvelope from an audit event.\n /\n private _buildEnvelope(\n auditEvent: Omit<AuditableEvent, '_id' \| 'createdAt' \| 'updatedAt'>,\n organizationId: string,\n classification: { category: AuditEventCategory; severity: AuditEventSeverity },\n organizationName?: string,\n applicationId?: string,\n applicationName?: string,\n ): SecurityAuditEventEnvelope {\n const eventData = auditEvent.eventData as Record<string, unknown>;\n\n return {\n eventId: this._resolveEnvelopeEventId(auditEvent),\n eventType: auditEvent.eventType,\n eventCategory: classification.category,\n severity: classification.severity,\n timestamp: new Date().toISOString(),\n correlationId: auditEvent.correlationId,\n // Undefined unless the application opted in — the row itself is only ever populated under the policy.\n clientInstanceId: auditEvent.clientInstanceId,\n frontendServiceName: auditEvent.frontendServiceName,\n\n organizationId,\n organizationName, // F3: Populated via org name cache\n applicationId,\n applicationName,\n userId: auditEvent.userId,\n userEmail: (eventData.email as string) \|\| undefined,\n\n sourceService: this.appConfigService.applicationId,\n sourceVersion: process.env.APP_VERSION \|\| '0.0.0',\n sourceEnvironment: this.appConfigService.applicationEnv,\n\n // Auth-specific context from eventData (when applicable)\n authMethod: (eventData.authMethod as string) \|\| undefined,\n authSource: (eventData.authSource as string) \|\| undefined,\n providerRef: (eventData.providerRef as string) \|\| undefined,\n connectionType: (eventData.connectionType as string) \|\| undefined,\n ipAddress: (eventData.ipAddress as string) \|\| undefined,\n userAgent: (eventData.userAgent as string) \|\| undefined,\n\n eventData: eventData as Record<string, any>,\n\n outcome: this._inferOutcome(auditEvent.eventType),\n outcomeReason: (eventData.failureReason as string) \|\| (eventData.reason as string) \|\| undefined,\n };\n }\n\n /\n The id the DELIVERED envelope carries — the audit row's OWN `eventId`, never a freshly minted one.\n \n ## Why it must be the audit event's id\n \n `SecurityAuditEventEnvelope.eventId` is the only identifier that leaves the application on a SIEM\n * delivery, and it is doing two jobs at once:\n \n 1. it is what a RECEIVER deduplicates on — the delivery service's own header says \"Idempotency via\n * eventId\", and every wire format carries this one field through to the receiver's dedup key\n * (CEF `externalId`, LEEF `eventId`, OCSF `metadata.uid`, and the verbatim `json_structured` body's\n * top-level `eventId`); and\n * 2. it is the only handle an analyst has for joining a record in the customer's SIEM back to the\n * audit row it was projected from.\n \n Minting a fresh uuid here satisfied (1) and silently destroyed (2). The id was ALREADY on the value\n * being projected: `AuditableEvent.eventId` is minted in `AuditLogsBackendService._createAuditLog`\n * BEFORE the DB write, is documented on the schema as the \"store-agnostic, server-minted correlation\n * key\", and already joins the DB row to its immudb record and to `verifyAuditEvent(eventId)`. It\n * survives the `Omit` on this method's parameter type, so it was in hand and thrown away — the\n * envelope replaced it with an id that exists nowhere else in the system, making a delivered SIEM\n * event deduplicable but unexplainable.\n \n ## Why the cutover is safe — the risk this looks like it carries, it does not\n \n Changing what a receiver deduplicates on normally risks re-accepting events at the switch. Not here:\n * the OLD value was a per-delivery random uuid, never reused and not re-derivable from anything, so\n * every id crossing the cutover is still one no receiver has ever seen. Nothing is re-delivered and\n * nothing is newly deduped away.\n \n What genuinely changes is the FAN-OUT. `AuditLogsBackendService` dispatches one audit event to each\n * of the user's verified member orgs, so those N deliveries now carry ONE id instead of N. They go to\n * N different tenants' sinks, so there is no cross-receiver dedup interaction — and one id is the\n * truthful statement, because it is one event. (The DLQ row records this id too, so a dead letter is\n * now joinable to its audit row as well; `SiemDeliveryDlqBaseSchema.eventId` carries no unique index,\n * so the shared id cannot collide there.)\n \n Per-attempt idempotency is untouched: the envelope is built ONCE, and both the in-process retry loop\n * in `SIEMWebhookDeliveryBackendService.processDelivery` and the DLQ drain re-send that same stored\n * object — so one delivery keeps one id across every attempt, which is exactly what a receiver's dedup\n * needs.\n \n ## The fallback, and why it is not a hedge\n \n `eventId` is required on `AuditableEvent` and the sole production caller always sets it, so this\n * branch should be unreachable. It exists because the two failures are ASYMMETRIC: an absent id is not\n * merely an unjoinable delivery, it is a delivery with NO dedup key at all — every projection renders\n * the field only `if (e.eventId)`, so the receiver stores `dedupKey: null` and answers `deduped: false`\n * forever against a service that retries and drains a DLQ. Losing the join degrades an investigation;\n * losing idempotency duplicates events inside a customer's SIEM. So an absent id still gets a minted\n * one, and is logged loudly rather than shipping a blank.\n /\n private _resolveEnvelopeEventId(auditEvent: Omit<AuditableEvent, '_id' \| 'createdAt' \| 'updatedAt'>): string {\n if (auditEvent.eventId) {\n return auditEvent.eventId;\n }\n\n const mintedEventId = uuidv4();\n this.logger.warn?.(\n 'Audit event reached SIEM dispatch with no eventId — the delivered envelope cannot be joined back to its audit row; minting a delivery-local id so receiver idempotency survives',\n { eventType: auditEvent.eventType, mintedEventId },\n );\n return mintedEventId;\n }\n\n /\n Infer success/failure outcome from event type.\n /\n private _inferOutcome(eventType: string): AuditEventOutcome {\n const failureEventTypes = [\n CoreAuditableEventType.USER_LOGIN_FAILED,\n CoreAuditableEventType.USER_ACCOUNT_LOCKED,\n CoreAuditableEventType.USER_SSO_LOGIN_FAILED,\n CoreAuditableEventType.USER_SSO_ENFORCEMENT_BLOCKED,\n CoreAuditableEventType.SAML_LOGIN_FAILED,\n CoreAuditableEventType.SAML_ASSERTION_REPLAY_DETECTED,\n CoreAuditableEventType.MACHINE_AUTH_FAILED,\n ];\n\n return failureEventTypes.includes(eventType as CoreAuditableEventType) ? AuditEventOutcome.FAILURE : AuditEventOutcome.SUCCESS;\n }\n\n // ─────────────────────────────────────────────────────────────\n // F3: Organization Name Cache\n // ─────────────────────────────────────────────────────────────\n\n /\n F3: resolve an organization NAME for SIEM-analyst readability, through the leased cache.\n \n Renames are picked up within {@link ORG_NAME_REFRESH_AFTER_MS} — read that constant for why this\n * lease is five minutes while the routing config's is sixty seconds. There is no invalidation hook on\n * this one, deliberately: a stale label costs a reader nothing (the `organizationId` beside it in the\n * envelope is authoritative and always current), so the lease alone is a proportionate answer.\n \n Never throws — a missing name is optional in the envelope, and this runs on a fire-and-forget path.\n * The loader therefore swallows its own failure and yields `undefined`, which means the COLD path of\n * {@link LeasedValueCache} can never reject here.\n \n `undefined` IS cached, and that is a fix rather than an oversight. Before this, a lookup that\n * failed or returned a nameless row cached nothing, so an organization whose read kept failing was\n * re-read on EVERY exported event — the read amplification a cache exists to prevent, arriving\n * precisely when the repository is already unhealthy. Caching the negative bounds it to one read per\n * lease, and a rename or a repaired read still lands within that lease.\n \n The loader closes over `ec` — the audit service's synthesised super-admin APPLICATION-scoped temp\n * context (`audit-logs.backend.service.ts:284` → `:349`), identical in privilege on every dispatch —\n * which is the precondition {@link LeasedValueCache} states for joining an in-flight load.\n /\n private async _resolveOrgName(ec: ExecutionContext<any>, organizationId: string): Promise<string \| undefined> {\n return this._orgNameCache.get(organizationId, async () => {\n try {\n const orgsRepo = this.repositoriesRegistry.getRepositoryOrThrow(CoreResourceType.ORGANIZATIONS);\n const org = await orgsRepo.read<{ _id: string; name: string }>(ec, organizationId);\n return org?.name \|\| undefined;\n } catch {\n // Fire-and-forget — org name is optional in the envelope.\n return undefined;\n }\n });\n }\n\n // ─────────────────────────────────────────────────────────────\n // F6: Event Integrity (HMAC)\n // ─────────────────────────────────────────────────────────────\n\n /\n F6: Compute HMAC-SHA256 over the serialized envelope for integrity protection.\n * The delivery service verifies this HMAC before processing, detecting queue tampering.\n /\n private _computeEnvelopeHmac(envelope: SecurityAuditEventEnvelope): string {\n const hmacKey = this._getHmacKey();\n return createHmac('sha256', hmacKey)\n .update(JSON.stringify(envelope))\n .digest('hex');\n }\n\n /\n Derive a 256-bit HMAC key from the app's session encryption key\n * using SHA-256 with a domain separator (consistent with SIEM encryption key derivation).\n /\n private _getHmacKey(): Buffer {\n return createHash('sha256')\n .update(`${SIEM_HMAC_DOMAIN}:${this.appConfigService.secrets.security.session.encryptionKey}`)\n .digest();\n }\n\n /\n F6: Public static-like method to verify envelope HMAC on the delivery side.\n * Returns true if the HMAC matches, false otherwise.\n */\n public verifyEnvelopeHmac(envelope: SecurityAuditEventEnvelope, expectedHmac: string): boolean {\n const computedHmac = this._computeEnvelopeHmac(envelope);\n // Use crypto.timingSafeEqual for constant-time comparison (prevents timing attacks)\n const computedBuf = Buffer.from(computedHmac, 'utf-8');\n const expectedBuf = Buffer.from(expectedHmac, 'utf-8');\n if (computedBuf.length !== expectedBuf.length) return false;\n return timingSafeEqual(computedBuf, expectedBuf);\n }\n}\n"]}

package/dist/esm/compliance/audit-trails/services/audit-logs.backend.service.d.ts CHANGED Viewed

@@ -5,7 +5,7 @@ import { RepositoriesRegistryHandlerBackendService } from '../../../base-classes
 import { AuditEventDispatcherBackendService } from './audit-event-dispatcher.backend.service';
 import type { MetricsService } from '../../../monitoring/observability/services/metrics.service';
 import type { AuditLogSink, UserTypesConfig } from '@wildo-ai/saas-models';
-import { SiemExportChangeType, SsoConfigChangeType, SsoConnectionType, AuditableEvent, AccountLockoutReason, ApplicationAuthPolicySnapshot, AuditableEvent_ResourceOperationPerformed_EventData, AuditableEvent_HttpApiReadThroughAccess_EventData, AuditableEvent_HttpApiExternalErasure_EventData, AuditableEvent_HttpApiNonErasureAcknowledged_EventData, AuditableEvent_PlatformDirectoryAccess_EventData, AuditableEvent_ResourceOperationDenied_EventData, OAuthCodeExchangeFailureReason, CoreAuditableEventType, ExecutionContext_ExecutionType, MachineAccessOperation, ResourceServerKind, ResourceOperationRiskLevel, ResourceOperationVariantType, ResourceType, AuthScopeType, PlatformAccessGrantAutoApprovalReason, PlatformAccessGrantLifecycleTransition, PlatformAccessGrantStatus } from '@wildo-ai/saas-models';
+import { SiemExportChangeType, SsoConfigChangeType, SsoConnectionType, AuditableEvent, AccountLockoutReason, AdministrativeContinuityBreachDetection, ApplicationAuthPolicySnapshot, AuditableEvent_ResourceOperationPerformed_EventData, AuditableEvent_HttpApiReadThroughAccess_EventData, AuditableEvent_HttpApiExternalErasure_EventData, AuditableEvent_HttpApiNonErasureAcknowledged_EventData, AuditableEvent_PlatformDirectoryAccess_EventData, AuditableEvent_ResourceOperationDenied_EventData, ProviderCredentialDeletionReason, ProviderCredentialResolutionSource, OAuthCodeExchangeFailureReason, CoreAuditableEventType, ExecutionContext_ExecutionType, MachineAccessOperation, ResourceServerKind, ResourceOperationRiskLevel, ResourceOperationVariantType, ResourceType, AuthScopeType, PlatformAccessGrantAutoApprovalReason, PlatformAccessGrantLifecycleTransition, PlatformAccessGrantStatus } from '@wildo-ai/saas-models';
 import type { VerifiedOrgId } from '@wildo-ai/saas-models';
 import { CoreResourceOperation } from '@wildo-ai/saas-models';
 import { ExecutionContext, type SocketAuthResult } from '../../../runtime/models/execution-context.backend.schemas';
@@ -135,6 +135,26 @@ export declare class AuditLogsBackendService {
         isFullResultSet: boolean;
         organizationId?: string;
     }): Promise<void>;
+    /**
+     * A refresh chain was retired to keep a principal within its concurrent-session cap.
+     *
+     * Best-effort like every other emit here: the eviction has already happened when this is called,
+     * and losing the record must never cost the enforcement.
+     *
+     * `evictedIssuedAt` is optional because the stored ordering score can be unreadable (a legacy
+     * whole-second score, a corrupted member). Absent means "we could not say when it was issued",
+     * which is honest; a synthesised instant would make the first-in-first-out claim unfalsifiable.
+     *
+     * assurance-control: WILDO.IDENTITY.SESSION_CONCURRENCY_LIMIT — evidence that the bound was
+     * enforced and WHICH chain it retired.
+     */
+    logUserSessionEvicted(data: {
+        userId: string;
+        evictedJti: string;
+        evictedIssuedAt?: Date;
+        configuredMaximum: number;
+        retainedCount: number;
+    }): Promise<void>;
     logSystemContextAccess(data: {
         resourceType: string;
         operation: CoreResourceOperation.READ | CoreResourceOperation.LIST;
@@ -812,16 +832,24 @@ export declare class AuditLogsBackendService {
      * one per stranded tenant: a single deactivation can strand several, and an operator who learns
      * about them one at a time cannot plan the remediation.
      *
+     * ALSO emitted by the BOOT report, under `detectedBy: BOOT_REPORT` — see
+     * {@link AdministrativeContinuityBreachDetection}. The boot report used to write log lines and
+     * nothing else, so a tenant stranded by a route no guard ever saw (a direct database edit, a
+     * restore taken mid-erasure, a role-table change) produced no queryable evidence and reached no
+     * SIEM, while its APPLICATION twin `logApplicationSuperAdminFloorBreached` had been audited from
+     * the start. The action fields are absent on that path because there is no action to name.
+     *
      * assurance-control: WILDO.ACCESS.ADMINISTRATIVE_CONTINUITY — evidence that a tenant has no
      * accountable administrative principal, and which allowed action caused it.
      */
     logOrganizationOwnerFloorBreached(data: {
         organizationId: string;
-        reducedMemberIds: string[];
+        detectedBy: AdministrativeContinuityBreachDetection;
         remainingUsableOwners: number;
-        operationIdentifier: string;
-        subjectUserId: string;
-        subjectNextStatus: string;
+        reducedMemberIds?: string[];
+        operationIdentifier?: string;
+        subjectUserId?: string;
+        subjectNextStatus?: string;
     }, requestExecutionContext?: ExecutionContext<any>): Promise<void>;
     /**
      * Log an application-role grant or revocation on a `USERS` row.
@@ -1266,12 +1294,27 @@ export declare class AuditLogsBackendService {
         eventFormatConfigured?: string;
     }): Promise<void>;
     /**
-     * Log emergency access used (break-glass account used)
+     * A named break-glass account signed in past its tenant's own SSO requirement (#423).
+     *
+     * Scoped to an ORGANIZATION or an APPLICATION, never both — the caller says which.
+     *
+     * `emergencyAccess` lives on the POLYMORPHIC SSO config, so an application-scope policy carries
+     * break-glass accounts for the application itself and has no organization id. This method was
+     * organization-only for one release and the gate REFUSED the other case rather than emit without
+     * a record; that was the right fail-closed answer while the event contract could not express it,
+     * and it is no longer needed. The schema admits either scope and refuses anything but exactly
+     * one, so an unscoped call cannot be written.
+     *
+     * `riskLevel` is HIGH — the risk band of the resource operation. The event's own severity is
+     * CRITICAL, set once in `SECURITY_AUDIT_EVENT_ENVELOPE` where every consumer reads it; the two
+     * are different axes and the envelope is what a SIEM rule keys on.
      */
     logEmergencyAccessUsed(data: {
         userId: string;
         email: string;
-        organizationId: string;
+        scopeType: AuthScopeType;
+        organizationId?: string;
+        applicationId?: string;
         reason?: string;
         ipAddress: string;
         userAgent: string;
@@ -1413,6 +1456,63 @@ export declare class AuditLogsBackendService {
         sessionId: string;
         organizationId?: string;
     }): Promise<void>;
+    /**
+     * Log a passkey assertion whose signature VERIFIED and whose counter did not advance.
+     *
+     * Emitted only AFTER signature verification, which is what makes it worth alerting on: an
+     * unauthenticated caller who knows a credential id cannot forge this row. Risk level HIGH and
+     * severity CRITICAL — it is the one authentication signal that means a private key may exist in
+     * two places, and it used to be indistinguishable from a typo'd credential in the trail.
+     */
+    logUserPasskeyCloneSuspected(data: {
+        userId: string;
+        credentialId: string;
+        storedCounter: number;
+        receivedCounter: number;
+        credentialDeviceType: string;
+        credentialBackedUp: boolean;
+        aaguid?: string;
+        ceremony: string;
+        ipAddress: string;
+        userAgent: string;
+        organizationId?: string;
+    }, requestExecutionContext?: ExecutionContext<any>, routingOrgIds?: VerifiedOrgId[]): Promise<void>;
+    /**
+     * Record that a scanner found an uploaded file INFECTED (#506).
+     *
+     * Called AFTER the file's terminal transition, so `fileStatus` describes a state the record
+     * actually holds rather than one the caller intends. `HIGH` risk — the same level the passkey
+     * clone suspicion carries, and for the same reason: a security mechanism reached a conclusion
+     * about a real threat.
+     */
+    logFileMalwareDetected(data: {
+        fileId: string;
+        scannerRef: string;
+        threatName?: string;
+        resourceType?: string;
+        resourceId?: string;
+        organizationId?: string;
+        fileStatus: string;
+        userId?: string;
+    }, requestExecutionContext?: ExecutionContext<any>, routingOrgIds?: VerifiedOrgId[]): Promise<void>;
+    /**
+     * Record that a scan could NOT be completed (#506).
+     *
+     * A different story from a detection and therefore a different event: the control did not run.
+     * `failureReason` is TRUNCATED here rather than at the call site, so every caller gets the bound
+     * — a scanner error routinely embeds a host, a socket path or a temporary file path, and this row
+     * is replicated to the organisation's SIEM and to the immutable store.
+     */
+    logFileMalwareScanFailed(data: {
+        fileId: string;
+        scannerRef: string;
+        failureReason?: string;
+        resourceType?: string;
+        resourceId?: string;
+        organizationId?: string;
+        fileStatus: string;
+        userId?: string;
+    }, requestExecutionContext?: ExecutionContext<any>, routingOrgIds?: VerifiedOrgId[]): Promise<void>;
     /**
      * Log passkey removed
      */
@@ -1611,6 +1711,163 @@ export declare class AuditLogsBackendService {
         userAgent: string;
         organizationId?: string;
     }, requestExecutionContext?: ExecutionContext<any>, routingOrgIds?: VerifiedOrgId[]): Promise<void>;
+    /**
+     * A tenant granted this application authority to act as it toward a named third party.
+     *
+     * MEDIUM rather than HIGH: the act is an administrator deliberately configuring an integration,
+     * which is ordinary tenant administration. What makes it worth recording is that it is the moment
+     * the application's outbound identity for this tenant STOPS being the deployment's shared one.
+     *
+     * assurance-control: WILDO.IDENTITY.DELEGATED_AUTHORIZATION — organization authorizes delegated
+     * access to a named third party.
+     */
+    logOrganizationProviderCredentialSet(data: {
+        organizationId: string;
+        providerRef: string;
+        secretSlug: string;
+        credentialId: string;
+        setBy?: string;
+    }, requestExecutionContext?: ExecutionContext<any>, routingOrgIds?: VerifiedOrgId[]): Promise<void>;
+    /**
+     * The stored VALUE changed for a credential that already existed.
+     *
+     * HIGH, unlike its `_SET` sibling, and the difference is the incident question. Rotation is what a
+     * tenant does after a suspected compromise — and it is also what an ATTACKER does to lock a tenant
+     * out of its own integration while keeping the application acting on their behalf. A first
+     * configuration cannot be either of those.
+     *
+     * assurance-control: WILDO.IDENTITY.DELEGATED_AUTHORIZATION — the delegated authority's secret is
+     * replaced.
+     */
+    logOrganizationProviderCredentialRotated(data: {
+        organizationId: string;
+        providerRef: string;
+        secretSlug: string;
+        credentialId: string;
+        rotatedBy?: string;
+        previousSecretSetAt?: string;
+    }, requestExecutionContext?: ExecutionContext<any>, routingOrgIds?: VerifiedOrgId[]): Promise<void>;
+    /**
+     * The credential was RESOLVED for an outbound call — the application acted as the tenant.
+     *
+     * LOW, and high-volume by design. This is the only event that can show a leaked credential being
+     * EXERCISED; without it the trail records how an integration was configured and nothing about how
+     * it was used. `resolvedFrom` is the field that makes it worth the volume: it distinguishes a
+     * tenant acting as itself from a tenant silently falling back to the deployment's shared
+     * principal, which is the exact condition this whole subsystem exists to make visible.
+     *
+     * assurance-control: WILDO.IDENTITY.DELEGATED_AUTHORIZATION — delegated authority is exercised.
+     */
+    logOrganizationProviderCredentialUsed(data: {
+        organizationId: string;
+        providerRef: string;
+        secretSlug: string;
+        resolvedFrom: ProviderCredentialResolutionSource;
+        credentialId?: string;
+    }, requestExecutionContext?: ExecutionContext<any>, routingOrgIds?: VerifiedOrgId[]): Promise<void>;
+    /**
+     * The grant ended — by an administrator revoking it, or by the tenant itself being purged.
+     *
+     * HIGH: a credential disappearing is how a tenant's integration stops working, and the first
+     * question afterwards is always whether a human did it. `reason` answers that without the reader
+     * having to correlate against the organization lifecycle trail.
+     *
+     * assurance-control: WILDO.IDENTITY.DELEGATED_AUTHORIZATION — evidence that delegated authority
+     * was withdrawn.
+     */
+    logOrganizationProviderCredentialDeleted(data: {
+        organizationId: string;
+        providerRef: string;
+        secretSlug: string;
+        credentialId: string;
+        reason: ProviderCredentialDeletionReason;
+        deletedBy?: string;
+    }, requestExecutionContext?: ExecutionContext<any>, routingOrgIds?: VerifiedOrgId[]): Promise<void>;
+    /**
+     * A person connected their own account at a third party.
+     *
+     * No `organizationId` on any of these four, and that is the substantive difference from the
+     * organization siblings rather than an omission. A person's credential belongs to the person, not
+     * to whichever tenant they happened to be looking at when they authored it — passing an
+     * organization would route the event into that tenant's SIEM stream and tell its administrators
+     * about an individual's personal vendor account. `userId` is both the subject and the actor,
+     * because the resource admits no administrative variant and nobody else can write the row.
+     *
+     * assurance-control: WILDO.IDENTITY.DELEGATED_AUTHORIZATION — user authorizes delegated access.
+     */
+    logUserProviderCredentialSet(data: {
+        userId: string;
+        providerRef: string;
+        secretSlug: string;
+        credentialId: string;
+    }, requestExecutionContext?: ExecutionContext<any>, routingOrgIds?: VerifiedOrgId[]): Promise<void>;
+    /** The stored value changed for a person's credential that already existed. */
+    logUserProviderCredentialRotated(data: {
+        userId: string;
+        providerRef: string;
+        secretSlug: string;
+        credentialId: string;
+        previousSecretSetAt?: string;
+    }, requestExecutionContext?: ExecutionContext<any>, routingOrgIds?: VerifiedOrgId[]): Promise<void>;
+    /**
+     * The application acted as that person toward the provider.
+     *
+     * `credentialId` is REQUIRED here where the organization sibling makes it optional, and the
+     * difference is the point: the organization event can describe a deployment-environment fallback,
+     * which has no row to name. A person's credential has no fallback at all, so an event without a
+     * row would describe something that must never happen.
+     */
+    logUserProviderCredentialUsed(data: {
+        userId: string;
+        providerRef: string;
+        secretSlug: string;
+        resolvedFrom: ProviderCredentialResolutionSource;
+        credentialId: string;
+    }, requestExecutionContext?: ExecutionContext<any>, routingOrgIds?: VerifiedOrgId[]): Promise<void>;
+    /**
+     * The person's grant ended — by them removing it, or by their own erasure.
+     *
+     * HIGH, matching the organization sibling, and carrying a second reason here: when `reason` names
+     * an erasure cascade, this event is the ONLY remaining evidence that the subject's third-party
+     * credentials were destroyed. The row it describes no longer exists.
+     *
+     * assurance-control: WILDO.PRIVACY.ERASURE — evidence that erasure reached this store.
+     */
+    logUserProviderCredentialDeleted(data: {
+        userId: string;
+        providerRef: string;
+        secretSlug: string;
+        credentialId: string;
+        reason: ProviderCredentialDeletionReason;
+    }, requestExecutionContext?: ExecutionContext<any>, routingOrgIds?: VerifiedOrgId[]): Promise<void>;
+    /**
+     * A PERSON completed a consent ceremony at a vendor and their grant is now stored.
+     *
+     * HIGH risk, matching the deletion beside it rather than the routine `_SET`: what is recorded here
+     * is a third party gaining the ability to act as somebody, which is the same magnitude of change
+     * as that ability being taken away. The severity an operator sees is the envelope's, which reads
+     * this as ordinary user lifecycle; the risk level is the framework's own view of the write.
+     */
+    logUserProviderConnectionGranted(data: {
+        userId: string;
+        providerRef: string;
+        secretSlug: string;
+        credentialId: string;
+        grantedScopes?: readonly string[];
+        accountRef?: string;
+        replacedExistingConnection: boolean;
+    }, requestExecutionContext?: ExecutionContext<any>, routingOrgIds?: VerifiedOrgId[]): Promise<void>;
+    /** An ORGANIZATION's delegated authorization toward a vendor was granted. See the user sibling. */
+    logOrganizationProviderConnectionGranted(data: {
+        organizationId: string;
+        providerRef: string;
+        secretSlug: string;
+        credentialId: string;
+        grantedByUserId?: string;
+        grantedScopes?: readonly string[];
+        accountRef?: string;
+        replacedExistingConnection: boolean;
+    }, requestExecutionContext?: ExecutionContext<any>, routingOrgIds?: VerifiedOrgId[]): Promise<void>;
     logGenericEvent(data: {
         userId?: string;
         organizationId?: string;