npm - @wildo-ai/saas-backend-lib - Versions diffs - 1.1.3 → 1.1.4 - Mend

@wildo-ai/saas-backend-lib 1.1.3 → 1.1.4

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (1056) hide show

package/dist/esm/compliance/audit-trails/services/audit-event-dispatcher.backend.service.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"audit-event-dispatcher.backend.service.js","sourceRoot":"","sources":["../../../../../../src/compliance/audit-trails/services/audit-event-dispatcher.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;;;;;;;;;;;;;AAEH,OAAO,kBAAkB,CAAC;AAC1B,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAEzD,OAAO,EAAE,EAAE,IAAI,MAAM,EAAE,MAAM,MAAM,CAAC;AACpC,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,QAAQ,CAAC;AACjE,OAAO,EAAE,kBAAkB,EAAE,MAAM,gDAAgD,CAAC;AACpF,OAAO,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAC7F,OAAO,EAAE,uBAAuB,EAAE,MAAM,sEAAsE,CAAC;AAC/G,OAAO,EAAE,oCAAoC,EAAE,MAAM,2GAA2G,CAAC;AACjK,OAAO,EAAE,yCAAyC,EAAE,MAAM,qGAAqG,CAAC;AAChK,OAAO,EAAE,mBAAmB,EAAE,MAAM,gDAAgD,CAAC;AACrF,OAAO,EAAE,gBAAgB,EAAE,MAAM,4FAA4F,CAAC;AAC9H,OAAO,EAAE,2BAA2B,EAAE,MAAM,8EAA8E,CAAC;AAC3H,OAAO,EAAE,+BAA+B,EAAE,MAAM,gFAAgF,CAAC;AACjI,OAAO,EACL,iBAAiB,EACjB,sBAAsB,EACtB,gBAAgB,EAChB,2BAA2B,EAM3B,aAAa,GACd,MAAM,uBAAuB,CAAC;AAI/B,oDAAoD;AACpD,MAAM,gBAAgB,GAAG,+BAA+B,CAAC;AAEzD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8CG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,EAAE,GAAG,IAAI,CAAC;AACtD,4GAA4G;AAC5G,MAAM,0BAA0B,GAAG,IAAI,CAAC;AAExC;;;;;;;;;GASG;AACH,MAAM,yBAAyB,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AAChD,qGAAqG;AACrG,MAAM,uBAAuB,GAAG,IAAI,CAAC;AAErC;;;;;;;;GAQG;AACH,MAAM,uCAAuC,GAAG,qCAAqC,CAAC;AAEtF,uDAAuD;AACvD,MAAM,cAAc,GAA2B;IAC7C,MAAM,EAAE,CAAC;IACT,SAAS,EAAE,CAAC;IACZ,UAAU,EAAE,CAAC;CACd,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG;IACjC,YAAY,EAAE,cAAc;CACpB,CAAC;AAcJ,IAAM,kCAAkC,GAAxC,MAAM,kCAAkC;IA6CS;IACU;IACoB;IACjB;IACe;IASV;IAzDvD,QAAQ,CAA+D;IAExF;;;;;;;;OAQG;IACc,aAAa,GAAG,IAAI,gBAAgB,CAAqB;QACxE,cAAc,EAAE,yBAAyB;QACzC,UAAU,EAAE,uBAAuB;KACpC,CAAC,CAAC;IAEH,gHAAgH;IAC/F,gBAAgB,GAAG,IAAI,gBAAgB,CAA8B;QACpF,cAAc,EAAE,4BAA4B;QAC5C,UAAU,EAAE,0BAA0B;QACtC,gBAAgB,EAAE,CAAC,cAAc,EAAE,KAAK,EAAE,EAAE;QAC1C,kGAAkG;QAClG,mGAAmG;QACnG,iGAAiG;QACjG,2FAA2F;QAC3F,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,+HAA+H,EAAE;YACnJ,cAAc;YACd,cAAc,EAAE,4BAA4B;YAC5C,GAAG,2BAA2B,CAAC,KAAK,CAAC;SACtC,CAAC;KACL,CAAC,CAAC;IAEH;;;;;;;;OAQG;IACK,6BAA6B,GAAG,KAAK,CAAC;IAE9C,YACsD,MAAqB,EACX,gBAAyC,EACrB,gBAAsD,EACvE,YAAiC,EAClB,oBAA+D,EASzE,YAA2B;QAb7C,WAAM,GAAN,MAAM,CAAe;QACX,qBAAgB,GAAhB,gBAAgB,CAAyB;QACrB,qBAAgB,GAAhB,gBAAgB,CAAsC;QACvE,iBAAY,GAAZ,YAAY,CAAqB;QAClB,yBAAoB,GAApB,oBAAoB,CAA2C;QASzE,iBAAY,GAAZ,YAAY,CAAe;QAEjG,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,oCAAoC,CAAC,CAAC;QAC9E,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,oCAAoC,EAAE,KAAK,CAAC,CAAC;IAC/E,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAgDG;IACI,KAAK,CAAC,gCAAgC,CAC3C,EAAyB,EACzB,UAAmE,EACnE,cAAsB;QAEtB,gEAAgE;QAChE,IAAI,CAAC,cAAc;YAAE,OAAO;QAE5B,mGAAmG;QACnG,+FAA+F;QAC/F,kGAAkG;QAClG,mDAAmD;QACnD,KAAK,IAAI,CAAC,6BAA6B,EAAE,CAAC;QAE1C,IAAI,KAA6B,CAAC;QAClC,IAAI,CAAC;YACH,KAAK,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,EAAE,EAAE,cAAc,CAAC,CAAC;QAC/D,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,sFAAsF;YACtF,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,mCAAmC,EAAE;gBACvD,KAAK;gBACL,SAAS,EAAE,UAAU,CAAC,SAAS;gBAC/B,cAAc;aACf,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAED,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,IAAI,CAAC;gBACH,QAAQ,IAAI,CAAC,IAAI,EAAE,CAAC;oBAClB,KAAK,mBAAmB,CAAC,YAAY;wBACnC,MAAM,IAAI,CAAC,sBAAsB,CAAC,EAAE,EAAE,UAAU,EAAE,cAAc,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;wBACnF,MAAM;oBACR;wBACE,gFAAgF;wBAChF,8EAA8E;wBAC9E,kFAAkF;wBAClF,iFAAiF;wBACjF,4EAA4E;wBAC5E,yEAAyE;wBACzE,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAChB,wHAAwH,EACxH,EAAE,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,UAAU,CAAC,SAAS,EAAE,cAAc,EAAE,CACzE,CAAC;wBACF,MAAM;gBACV,CAAC;YACH,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,0EAA0E;gBAC1E,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,qDAAqD,EAAE;oBACzE,KAAK;oBACL,QAAQ,EAAE,IAAI,CAAC,IAAI;oBACnB,SAAS,EAAE,UAAU,CAAC,SAAS;oBAC/B,cAAc;iBACf,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;OAYG;IACK,KAAK,CAAC,qBAAqB,CACjC,EAAyB,EACzB,cAAsB;QAEtB,MAAM,KAAK,GAA2B,EAAE,CAAC;QAEzC,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,EAAE,EAAE,cAAc,CAAC,CAAC;QACxE,IAAI,UAAU,EAAE,OAAO,EAAE,CAAC;YACxB,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,mBAAmB,CAAC,YAAY,EAAE,UAAU,EAAE,CAAC,CAAC;QACrE,CAAC;QAED,kFAAkF;QAClF,4DAA4D;QAC5D,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;;;;;;;;;;;;;;;;;OAkBG;IACK,KAAK,CAAC,qBAAqB,CACjC,EAAyB,EACzB,cAAsB;QAEtB,OAAO,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,cAAc,EAAE,GAAG,EAAE,CACpD,IAAI,CAAC,gBAAgB,CAAC,oBAAoB,CAAC,EAAE,EAAE,aAAa,CAAC,YAAY,EAAE,cAAc,CAAC,CAC3F,CAAC;IACJ,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAwDG;IACI,oBAAoB,CAAC,cAAsB;QAChD,IAAI,CAAC,gBAAgB,CAAC,UAAU,CAAC,cAAc,CAAC,CAAC;QACjD,IAAI,CAAC,8BAA8B,CAAC,cAAc,CAAC,CAAC;IACtD,CAAC;IAED;;;;;OAKG;IACK,8BAA8B,CAAC,cAAsB;QAC3D,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,EAAE,cAAc,EAAE,CAAC;QACnD,oGAAoG;QACpG,iGAAiG;QACjG,yBAAyB;QACzB,IAAI,CAAC,MAAM;YAAE,OAAO;QAEpB,KAAK,MAAM;aACR,OAAO,CAAC,IAAI,CAAC,oBAAoB,EAAE,EAAE,cAAc,CAAC;aACpD,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE,CACxB,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,sGAAsG,EAAE;YAC1H,cAAc;YACd,cAAc,EAAE,4BAA4B;YAC5C,GAAG,2BAA2B,CAAC,KAAK,CAAC;SACtC,CAAC,CACH,CAAC;IACN,CAAC;IAED,+FAA+F;IACvF,oBAAoB;QAC1B,OAAO,GAAG,IAAI,CAAC,YAAY,EAAE,YAAY,EAAE,IAAI,EAAE,GAAG,uCAAuC,EAAE,CAAC;IAChG,CAAC;IAED;;;;;;;;;;;;;;;;OAgBG;IACK,KAAK,CAAC,6BAA6B;QACzC,IAAI,IAAI,CAAC,6BAA6B;YAAE,OAAO;QAC/C,IAAI,CAAC,6BAA6B,GAAG,IAAI,CAAC;QAE1C,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,EAAE,cAAc,EAAE,CAAC;QACnD,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,+FAA+F;YAC/F,IAAI,CAAC,QAAQ,CAAC,yFAAyF,CAAC,CAAC;YACzG,OAAO;QACT,CAAC;QAED,IAAI,UAAuC,CAAC;QAC5C,IAAI,CAAC;YACH,iGAAiG;YACjG,iCAAiC;YACjC,UAAU,GAAG,MAAM,CAAC,SAAS,EAAqB,CAAC;YACnD,UAAU,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAAc,EAAE,EAAE,CACxC,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,2CAA2C,EAAE,EAAE,GAAG,2BAA2B,CAAC,KAAK,CAAC,EAAE,CAAC,CAC5G,CAAC;YACF,UAAU,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;gBACxB,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,wFAAwF,CAAC,CAAC;gBAC7G,IAAI,CAAC,6BAA6B,GAAG,KAAK,CAAC;YAC7C,CAAC,CAAC,CAAC;YACH,MAAM,UAAU,CAAC,OAAO,EAAE,CAAC;YAC3B,MAAM,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,oBAAoB,EAAE,EAAE,CAAC,cAAsB,EAAE,EAAE;gBACjF,mFAAmF;gBACnF,IAAI,CAAC,gBAAgB,CAAC,UAAU,CAAC,cAAc,CAAC,CAAC;gBACjD,IAAI,CAAC,QAAQ,CAAC,6DAA6D,EAAE,EAAE,cAAc,EAAE,CAAC,CAAC;YACnG,CAAC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,UAAU,EAAE,CAAC;gBACf,IAAI,CAAC;oBACH,MAAM,UAAU,CAAC,OAAO,EAAE,CAAC;gBAC7B,CAAC;gBAAC,MAAM,CAAC;oBACP,uCAAuC;gBACzC,CAAC;YACH,CAAC;YACD,IAAI,CAAC,6BAA6B,GAAG,KAAK,CAAC,CAAC,kCAAkC;YAC9E,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,wGAAwG,EAAE;gBAC5H,cAAc,EAAE,4BAA4B;gBAC5C,GAAG,2BAA2B,CAAC,KAAK,CAAC;aACtC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED;;;;;;OAMG;IACK,KAAK,CAAC,sBAAsB,CAClC,EAAyB,EACzB,UAAmE,EACnE,cAAsB,EACtB,UAAgC;QAEhC,8FAA8F;QAC9F,MAAM,cAAc,GAAG,2BAA2B,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;QAEzE,oCAAoC;QACpC,IAAI,CAAC,IAAI,CAAC,kBAAkB,CAAC,UAAU,CAAC,SAAS,EAAE,cAAc,EAAE,UAAU,CAAC,EAAE,CAAC;YAC/E,IAAI,CAAC,QAAQ,CAAC,mCAAmC,EAAE;gBACjD,SAAS,EAAE,UAAU,CAAC,SAAS;gBAC/B,cAAc;aACf,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAED,oDAAoD;QACpD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,EAAE,EAAE,cAAc,CAAC,CAAC;QAE/D,0DAA0D;QAC1D,MAAM,KAAK,GAAI,UAAU,CAAC,SAAqC,EAAE,aAAmC,CAAC;QACrG,MAAM,OAAO,GAAI,UAAU,CAAC,SAAqC,EAAE,eAAqC,CAAC;QAEzG,8EAA8E;QAC9E,MAAM,QAAQ,GAAG,IAAI,CAAC,cAAc,CAAC,UAAU,EAAE,cAAc,EAAE,cAAc,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;QAE1G,kEAAkE;QAClE,wEAAwE;QACxE,+EAA+E;QAC/E,+CAA+C;QAC/C,MAAM,IAAI,CAAC,0BAA0B,CAAC,EAAE,QAAQ,EAAE,cAAc,EAAE,UAAU,EAAE,CAAC,CAAC;QAEhF,IAAI,CAAC,QAAQ,CAAC,wCAAwC,EAAE;YACtD,OAAO,EAAE,QAAQ,CAAC,OAAO;YACzB,SAAS,EAAE,UAAU,CAAC,SAAS;YAC/B,cAAc;SACf,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA+BG;IACI,KAAK,CAAC,0BAA0B,CAAC,MAMvC;QACC,MAAM,EAAE,QAAQ,EAAE,cAAc,EAAE,UAAU,EAAE,GAAG,MAAM,CAAC;QACxD,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,IAAI,aAAa,CAAC,YAAY,CAAC;QAEjE,gFAAgF;QAChF,sEAAsE;QACtE,MAAM,YAAY,GAAG,IAAI,CAAC,oBAAoB,CAAC,QAAQ,CAAC,CAAC;QAEzD,iFAAiF;QACjF,iFAAiF;QACjF,kFAAkF;QAClF,MAAM,IAAI,CAAC,YAAY,CAAC,kBAAkB,CACxC,+BAA+B,EAC/B;YACE,QAAQ;YACR,YAAY;YACZ,cAAc;YACd,SAAS;YACT,OAAO,EAAE,MAAM,CAAC,OAAO,IAAI,cAAc;YACzC,UAAU,EAAE;gBACV,UAAU,EAAE,UAAU,CAAC,UAAU;gBACjC,UAAU,EAAE,UAAU,CAAC,UAAU;gBACjC,cAAc,EAAE,UAAU,CAAC,cAAc;gBACzC,cAAc,EAAE,UAAU,CAAC,cAAc;gBACzC,WAAW,EAAE,UAAU,CAAC,WAAW;gBACnC,aAAa,EAAE,UAAU,CAAC,aAAa;gBACvC,QAAQ,EAAE,UAAU,CAAC,QAAQ;aAC9B;SACF,CACF,CAAC;IACJ,CAAC;IAED;;OAEG;IACK,kBAAkB,CACxB,SAAiB,EACjB,cAA8E,EAC9E,MAA4B;QAE5B,MAAM,MAAM,GAAG,MAAM,CAAC,WAAW,CAAC;QAElC,wBAAwB;QACxB,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,cAAc,CAAC,QAAQ,CAAC,EAAE,CAAC;YACzD,OAAO,KAAK,CAAC;QACf,CAAC;QAED,yBAAyB;QACzB,MAAM,kBAAkB,GAAG,cAAc,CAAC,cAAc,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QACxE,MAAM,oBAAoB,GAAG,cAAc,CAAC,MAAM,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;QACzE,IAAI,kBAAkB,GAAG,oBAAoB,EAAE,CAAC;YAC9C,OAAO,KAAK,CAAC;QACf,CAAC;QAED,mDAAmD;QACnD,IAAI,MAAM,CAAC,kBAAkB,IAAI,MAAM,CAAC,kBAAkB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtE,IAAI,CAAC,MAAM,CAAC,kBAAkB,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;gBACnD,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;OAEG;IACK,cAAc,CACpB,UAAmE,EACnE,cAAsB,EACtB,cAA8E,EAC9E,gBAAyB,EACzB,aAAsB,EACtB,eAAwB;QAExB,MAAM,SAAS,GAAG,UAAU,CAAC,SAAoC,CAAC;QAElE,OAAO;YACL,OAAO,EAAE,IAAI,CAAC,uBAAuB,CAAC,UAAU,CAAC;YACjD,SAAS,EAAE,UAAU,CAAC,SAAS;YAC/B,aAAa,EAAE,cAAc,CAAC,QAAQ;YACtC,QAAQ,EAAE,cAAc,CAAC,QAAQ;YACjC,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,aAAa,EAAE,UAAU,CAAC,aAAa;YACvC,sGAAsG;YACtG,gBAAgB,EAAE,UAAU,CAAC,gBAAgB;YAC7C,mBAAmB,EAAE,UAAU,CAAC,mBAAmB;YAEnD,cAAc;YACd,gBAAgB,EAAE,mCAAmC;YACrD,aAAa;YACb,eAAe;YACf,MAAM,EAAE,UAAU,CAAC,MAAM;YACzB,SAAS,EAAG,SAAS,CAAC,KAAgB,IAAI,SAAS;YAEnD,aAAa,EAAE,IAAI,CAAC,gBAAgB,CAAC,aAAa;YAClD,aAAa,EAAE,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,OAAO;YACjD,iBAAiB,EAAE,IAAI,CAAC,gBAAgB,CAAC,cAAc;YAEvD,yDAAyD;YACzD,UAAU,EAAG,SAAS,CAAC,UAAqB,IAAI,SAAS;YACzD,UAAU,EAAG,SAAS,CAAC,UAAqB,IAAI,SAAS;YACzD,WAAW,EAAG,SAAS,CAAC,WAAsB,IAAI,SAAS;YAC3D,cAAc,EAAG,SAAS,CAAC,cAAyB,IAAI,SAAS;YACjE,SAAS,EAAG,SAAS,CAAC,SAAoB,IAAI,SAAS;YACvD,SAAS,EAAG,SAAS,CAAC,SAAoB,IAAI,SAAS;YAEvD,SAAS,EAAE,SAAgC;YAE3C,OAAO,EAAE,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC,SAAS,CAAC;YACjD,aAAa,EAAG,SAAS,CAAC,aAAwB,IAAK,SAAS,CAAC,MAAiB,IAAI,SAAS;SAChG,CAAC;IACJ,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAmDG;IACK,uBAAuB,CAAC,UAAmE;QACjG,IAAI,UAAU,CAAC,OAAO,EAAE,CAAC;YACvB,OAAO,UAAU,CAAC,OAAO,CAAC;QAC5B,CAAC;QAED,MAAM,aAAa,GAAG,MAAM,EAAE,CAAC;QAC/B,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAChB,iLAAiL,EACjL,EAAE,SAAS,EAAE,UAAU,CAAC,SAAS,EAAE,aAAa,EAAE,CACnD,CAAC;QACF,OAAO,aAAa,CAAC;IACvB,CAAC;IAED;;OAEG;IACK,aAAa,CAAC,SAAiB;QACrC,MAAM,iBAAiB,GAAG;YACxB,sBAAsB,CAAC,iBAAiB;YACxC,sBAAsB,CAAC,mBAAmB;YAC1C,sBAAsB,CAAC,qBAAqB;YAC5C,sBAAsB,CAAC,4BAA4B;YACnD,sBAAsB,CAAC,iBAAiB;YACxC,sBAAsB,CAAC,8BAA8B;YACrD,sBAAsB,CAAC,mBAAmB;SAC3C,CAAC;QAEF,OAAO,iBAAiB,CAAC,QAAQ,CAAC,SAAmC,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC,CAAC,iBAAiB,CAAC,OAAO,CAAC;IACjI,CAAC;IAED,gEAAgE;IAChE,8BAA8B;IAC9B,gEAAgE;IAEhE;;;;;;;;;;;;;;;;;;;;;OAqBG;IACK,KAAK,CAAC,eAAe,CAAC,EAAyB,EAAE,cAAsB;QAC7E,OAAO,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,cAAc,EAAE,KAAK,IAAI,EAAE;YACvD,IAAI,CAAC;gBACH,MAAM,QAAQ,GAAG,IAAI,CAAC,oBAAoB,CAAC,oBAAoB,CAAC,gBAAgB,CAAC,aAAa,CAAC,CAAC;gBAChG,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAgC,EAAE,EAAE,cAAc,CAAC,CAAC;gBACnF,OAAO,GAAG,EAAE,IAAI,IAAI,SAAS,CAAC;YAChC,CAAC;YAAC,MAAM,CAAC;gBACP,0DAA0D;gBAC1D,OAAO,SAAS,CAAC;YACnB,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;IAED,gEAAgE;IAChE,6BAA6B;IAC7B,gEAAgE;IAEhE;;;OAGG;IACK,oBAAoB,CAAC,QAAoC;QAC/D,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;QACnC,OAAO,UAAU,CAAC,QAAQ,EAAE,OAAO,CAAC;aACjC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;aAChC,MAAM,CAAC,KAAK,CAAC,CAAC;IACnB,CAAC;IAED;;;OAGG;IACK,WAAW;QACjB,OAAO,UAAU,CAAC,QAAQ,CAAC;aACxB,MAAM,CAAC,GAAG,gBAAgB,IAAI,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC;aAC7F,MAAM,EAAE,CAAC;IACd,CAAC;IAED;;;OAGG;IACI,kBAAkB,CAAC,QAAoC,EAAE,YAAoB;QAClF,MAAM,YAAY,GAAG,IAAI,CAAC,oBAAoB,CAAC,QAAQ,CAAC,CAAC;QACzD,oFAAoF;QACpF,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;QACvD,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;QACvD,IAAI,WAAW,CAAC,MAAM,KAAK,WAAW,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC;QAC5D,OAAO,eAAe,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;IACnD,CAAC;CACF,CAAA;AAnuBY,kCAAkC;IAD9C,UAAU,EAAE;IA8CR,WAAA,MAAM,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAA;IACjC,WAAA,MAAM,CAAC,kBAAkB,CAAC,gBAAgB,CAAC,CAAA;IAC3C,WAAA,MAAM,CAAC,kBAAkB,CAAC,oCAAoC,CAAC,CAAA;IAC/D,WAAA,MAAM,CAAC,kBAAkB,CAAC,mBAAmB,CAAC,CAAA;IAC9C,WAAA,MAAM,CAAC,kBAAkB,CAAC,kCAAkC,CAAC,CAAA;IAS7D,WAAA,MAAM,CAAC,kBAAkB,CAAC,YAAY,CAAC,CAAA;IAAE,WAAA,QAAQ,EAAE,CAAA;qCAbQ,aAAa;QACO,uBAAuB;QACH,oCAAoC;QACzD,mBAAmB;QACI,yCAAyC;GAjDtI,kCAAkC,CAmuB9C","sourcesContent":["/*\n Audit Event Dispatcher Backend Service\n \n Layer 2 of the three-layer audit event pipeline (Step 18).\n * Receives audit events after MongoDB write and dispatches them\n * to the organization's SIEM endpoint if configured.\n \n This is fire-and-forget — if dispatch fails, the audit log\n * in MongoDB remains authoritative.\n /\n\nimport 'reflect-metadata';\nimport { inject, injectable, optional } from 'inversify';\nimport type { RedisClientType } from 'redis';\nimport { v4 as uuidv4 } from 'uuid';\nimport { createHmac, createHash, timingSafeEqual } from 'crypto';\nimport { SAAS_SERVICE_TYPES } from '~wildo-backend-lib/inject/models/service-types';\nimport { LoggerService } from '~wildo-backend-lib/monitoring/logger/services/logger.service';\nimport { AppConfigurationService } from '~wildo-backend-lib/config/services/app-configuration.backend.service';\nimport { AuthOrganizationConfigurationService } from '~wildo-backend-lib/security/authentications/services/admin-config/auth-organization-configuration.service';\nimport { RepositoriesRegistryHandlerBackendService } from '~wildo-backend-lib/base-classes/services/repositories/repositories-registry-handler.backend.service';\nimport { QueueBackendService } from '~wildo-backend-lib/queue/queue.backend.service';\nimport { LeasedValueCache } from '~wildo-backend-lib/compliance/audit-trails/services/utils/leased-value-cache.backend.utils';\nimport { projectCaughtErrorLogFields } from '~wildo-backend-lib/errors/utils/error-log-level-classification.backend.utils';\nimport { SIEM_WEBHOOK_DELIVERY_BATCH_REF } from '~wildo-backend-lib/base-classes/services/batches/engine-custom-batch-manifests';\nimport {\n AuditEventOutcome,\n CoreAuditableEventType,\n CoreResourceType,\n getAuditEventClassification,\n type SecurityAuditEventEnvelope,\n type AuditEventCategory,\n type AuditEventSeverity,\n type AuditableEvent,\n type SiemExportConfigBase,\n AuthScopeType,\n} from '@wildo-ai/saas-models';\nimport type { ExecutionContext } from '~wildo-backend-lib/runtime/models/execution-context.backend.schemas';\nimport type { RedisService } from '~wildo-backend-lib/databases/services/redis.service';\n\n/* F6: HMAC domain separator for event integrity /\nconst SIEM_HMAC_DOMAIN = 'wildo:siem:event-integrity:v1';\n\n/\n *A SIEM export configuration change takes effect on EVERY replica within 60 seconds — and within\n milliseconds when the change goes through the engine.*\n \n * That sentence is the guarantee this subsystem makes, and the two halves come from two different\n * mechanisms, so read both before changing either.\n \n ## Why the number is 60 seconds, and why it used to be 300\n \n The lease is the ONLY thing that covers a write no hook can see — a repository-tier write, or a\n * direct database write. There is a live one: `examples/wonder-todos/e2e/adapter.ts` (`case 'siem'`)\n * repoints an organization's export config with `upsertOrganizationSingleton(...)`, straight at the\n * store, bypassing the engine entirely. Its own comment records what the old 300 s cost — \"A freshly\n provisioned org has a cold 5-min config cache, so the first login cold-reads this\"* — i.e. the lane\n * is correct only because it is ORDERED to run before the organization's first audited action. A\n * five-minute convergence bound is not something a scenario, or an operator doing surgery, can wait\n * for; it is something they have to design around. Sixty seconds is something they can wait for.\n \n The old 300 s was never chosen for that job — it was chosen to bound READ AMPLIFICATION, because a\n * miss costs more than a repository read: `AuthOrganizationConfigurationService.loadSiemExportConfig`\n * reads through `readAsSystem`, which emits its own `system_context_read` audit row to the database\n * AND to immudb. So shortening the lease multiplies audit-trail plumbing noise, not just queries.\n * Two properties make 60 s affordable anyway:\n \n - Refreshes are LAZY and STALE-WHILE-REVALIDATE ({@link LeasedValueCache}). A quiet organization\n * costs one read per event, not one per minute; only a continuously busy one reaches the ceiling of\n * one read per lease per replica. At 60 s that ceiling is 60 reads/hour/replica per ACTIVE\n * organization — for an organization emitting 1000 audit events an hour, under 5 % amplification of\n * its own audit volume, against 12/hour before.\n * - Nothing blocks on it. Past the lease the cached value is served immediately and the re-read\n * runs off the emission path, so shortening it costs read volume and never latency.\n \n ## The other half: the engine-routed write converges in milliseconds\n \n {@link AuditEventDispatcherBackendService.invalidateSiemConfig} drops the local entry AND publishes\n * the organization id on {@link SIEM_CONFIG_INVALIDATION_CHANNEL_SUFFIX}, which every replica\n * subscribes to. Before that broadcast the invalidation reached exactly ONE process — the one that\n * happened to handle the write — and every other replica served the stale value for the rest of the\n * lease, which is the defect this constant's neighbours document.\n \n Do not raise this back toward the read-amplification number. If the amplification ever needs to\n * come down, the right lever is the `system_context_read` row on the config read itself:\n * `SystemAccessBackendService.readAsSystem` already takes `suppressSystemAudit`, and its own JSDoc\n * names this exact read — \"the audit pipeline resolving … an org's SIEM config to ROUTE an audit\n event\"* — as the case it exists for. `loadSiemExportConfig` is the one such reader that does not\n * pass it. Fixing that makes a miss cost a single indexed read and removes the constraint entirely.\n /\nexport const SIEM_CONFIG_REFRESH_AFTER_MS = 60 1000;\n/** R2: Max entries in the SIEM-config cache to prevent unbounded growth. Least-recently-used is evicted. /\nconst SIEM_CONFIG_CACHE_MAX_SIZE = 1000;\n\n/\n F3: how long a cached organization NAME is served before a background re-read.\n \n Deliberately NOT the same constant as {@link SIEM_CONFIG_REFRESH_AFTER_MS}, though the mechanism is\n * now shared. A stale name is a stale LABEL on an exported envelope — the `organizationId` beside it\n * is authoritative and unaffected, so a rename showing up late is cosmetic. A stale export config\n * decides whether the event is routed AT ALL. Same defect shape, different consequence class, so they\n * get the same machinery and their own numbers: five minutes buys back the read volume that the\n * config's sixty seconds spends, and nothing depends on a rename propagating faster.\n /\nconst ORG_NAME_REFRESH_AFTER_MS = 5 60 * 1000;\n/** B4: Max entries in org name cache to prevent unbounded growth. Least-recently-used is evicted. /\nconst ORG_NAME_CACHE_MAX_SIZE = 1000;\n\n/\n The Redis channel carrying cross-replica SIEM-config invalidations. App-prefixed at use, so tenants\n * of one Redis never cross — the convention {@link RedisService.getAppPrefix} exists for.\n \n Broadcast rather than a shared cache, and the distinction is the whole design: the emission path\n * never touches Redis, so a Redis outage degrades convergence to the lease instead of degrading\n * ROUTING. A shared-store cache would have put a network round trip on the path an audit event takes\n * and made delivery depend on a store that can be down.\n /\nconst SIEM_CONFIG_INVALIDATION_CHANNEL_SUFFIX = 'audit:siem-export-config:invalidate';\n\n/* Severity ordering for minimum severity filtering /\nconst SEVERITY_ORDER: Record<string, number> = {\n 'info': 0,\n 'warning': 1,\n 'critical': 2,\n};\n\n/\n The per-org audit sink TYPES an organization can route its authenticated audit\n * events to. Today the only type is the SIEM webhook. Adding a per-org destination\n * later (e.g. per-org immudb, per observability §11) is a new member HERE + a branch\n * in `_resolveOrgAuditSinks` + a `case` in `dispatchToOrganizationAuditSinks` — the F4\n * routing (org from the authenticated EC) and the envelope/HMAC contracts do not change.\n /\nexport const PerOrgAuditSinkType = {\n SIEM_WEBHOOK: 'siem_webhook',\n} as const;\nexport type PerOrgAuditSinkType = (typeof PerOrgAuditSinkType)[keyof typeof PerOrgAuditSinkType];\n\n/\n A per-org audit sink RESOLVED for a specific org, carrying exactly the config needed\n * to deliver one event to it. A discriminated union (one member today) — the dispatcher\n * fans out by `type`, so a new sink type extends this union rather than reshaping callers.\n /\ntype ResolvedOrgAuditSink = {\n type: typeof PerOrgAuditSinkType.SIEM_WEBHOOK;\n siemConfig: SiemExportConfigBase;\n};\n\n@injectable()\nexport class AuditEventDispatcherBackendService {\n private readonly logDebug: (message: string, context?: Record<string, unknown>) => void;\n\n /\n F3: org NAME cache — a display label on the envelope. See {@link ORG_NAME_REFRESH_AFTER_MS}.\n \n No `onRefreshFailure`, and it would be dead code if there were one: {@link _resolveOrgName}'s loader\n * swallows its own error and yields `undefined`, so nothing this cache runs can ever reject. That\n * swallow is what makes the negative result CACHEABLE, which is the amplification fix described there;\n * the price is that a persistently unreadable organization row is silent, which is the right trade for\n * an optional label whose authoritative sibling (`organizationId`) is on the envelope regardless.\n /\n private readonly _orgNameCache = new LeasedValueCache<string \| undefined>({\n refreshAfterMs: ORG_NAME_REFRESH_AFTER_MS,\n maxEntries: ORG_NAME_CACHE_MAX_SIZE,\n });\n\n /* R2: per-org SIEM-config cache — the value that decides ROUTING. See {@link SIEM_CONFIG_REFRESH_AFTER_MS}. /\n private readonly _siemConfigCache = new LeasedValueCache<SiemExportConfigBase \| null>({\n refreshAfterMs: SIEM_CONFIG_REFRESH_AFTER_MS,\n maxEntries: SIEM_CONFIG_CACHE_MAX_SIZE,\n onRefreshFailure: (organizationId, error) =>\n // ERROR, not WARN, and the asymmetry with the org-name cache above is the point: while this keeps\n // failing the replica is routing on a configuration nobody can confirm, so the guarantee stated on\n // `SIEM_CONFIG_REFRESH_AFTER_MS` is suspended for this organization. Backed off one lease by the\n // cache, so a persistently unreadable config produces one line a minute, not one an event.\n this.logger.error?.('Background refresh of an organization SIEM export config failed — routing continues on the LAST KNOWN config for this replica', {\n organizationId,\n refreshAfterMs: SIEM_CONFIG_REFRESH_AFTER_MS,\n ...projectCaughtErrorLogFields(error),\n }),\n });\n\n /\n Latch so {@link _ensureInvalidationSubscriber} is idempotent; cleared on `end` so a dropped\n * subscriber re-arms.\n \n Deliberately the ONLY subscriber state kept. `A2ATaskCancellationBackendService` also holds the\n * client itself, because it has a shutdown path that closes it; this service has none, and a field\n * nothing reads is a field the next reader has to reason about for nothing. The socket keeps the\n * subscriber alive on its own, and a connection that emitted `end` is already closed.\n /\n private _invalidationSubscribeStarted = false;\n\n constructor(\n @inject(SAAS_SERVICE_TYPES.Logger) private readonly logger: LoggerService,\n @inject(SAAS_SERVICE_TYPES.AppConfigService) private readonly appConfigService: AppConfigurationService,\n @inject(SAAS_SERVICE_TYPES.AuthOrganizationConfigurationService) private readonly orgConfigService: AuthOrganizationConfigurationService,\n @inject(SAAS_SERVICE_TYPES.QueueBackendService) private readonly queueService: QueueBackendService,\n @inject(SAAS_SERVICE_TYPES.RepositoriesRegistryHandlerService) private readonly repositoriesRegistry: RepositoriesRegistryHandlerBackendService,\n /\n `@optional()` and APPENDED LAST — the constructor-parameter discipline.\n \n Optional because the cross-replica broadcast is an OPTIMISATION over the lease, never a\n * precondition for routing: a container with no Redis binding (several partial test containers, and\n * any single-replica deployment) must still dispatch audit events, converging on the lease alone.\n * Appended last so the five existing construction sites keep compiling unchanged.\n /\n @inject(SAAS_SERVICE_TYPES.RedisService) @optional() private readonly redisService?: RedisService,\n ) {\n this.logDebug = this.logger.debugByType('AuditEventDispatcherBackendService');\n this.logger.setDebugTypeLogging('AuditEventDispatcherBackendService', false);\n }\n\n /\n Dispatch an audit event to the organization's configured per-org audit SINKS.\n \n F4 (tenant segregation): the caller (`AuditLogsBackendService`) passes the\n * AUTHENTICATED org (resolved from the request `ExecutionContext`), NEVER the\n * caller-supplied `auditEvent.organizationId`. Sink config is loaded for THIS org\n * only (`_resolveOrgAuditSinks`), so an event can only reach the sinks of the tenant\n * it is authenticated for.\n \n Layer 2 of the pipeline: called after the MongoDB write (Layer 1), wired directly\n * into `AuditLogsBackendService` (NOT a resource pipeline post-hook). Fire-and-forget\n * — a resolution or per-sink delivery failure is logged but NEVER thrown onto the\n * business op, and per-sink failures are ISOLATED (F7) so one destination never\n * suppresses another.\n \n The seam: `_resolveOrgAuditSinks` returns the 0..N sinks the org has configured\n * (today only a SIEM webhook); this method fans each out by its `type`. Adding a\n * per-org destination later = a new {@link PerOrgAuditSinkType} + a resolver branch +\n * a `case` here.\n \n ── APPLICATION scope is RESERVED / DORMANT — there is NO app-scoped producer ──────\n * This producer is ORGANIZATION-scoped ONLY, on purpose. The F4 model routes on a\n * TRUSTED authenticated tenant (org), and the sole caller (`AuditLogsBackendService`)\n * fans out over the event's verified member orgs. There is deliberately no\n * `dispatchToApplicationAuditSinks` / `_resolveAppAuditSinks`.\n \n The SIEM export-config and delivery-DLQ resources DO each carry an `APPLICATION`\n * polymorphic variant (uniform with SSO/SCIM over `AUTH_SCOPE_VARIANTS`), and every\n * downstream seam is already scope-generic: `loadSiemExportConfig(ec, APPLICATION, appId)`,\n * {@link enqueueSiemWebhookDelivery} (`scopeType`/`scopeId`), the delivery worker's\n * circuit-breaker key, and `_enqueueToDLQ`'s `APPLICATION_SIEM_DELIVERY_DLQ` branch all\n * accept the app scope. But NOTHING emits a first-time app-scoped delivery. The only\n * caller that passes `scopeType: APPLICATION` today is the SIEM-DLQ retry custom-impl,\n * which is itself unreachable in production: an `APPLICATION_SIEM_DELIVERY_DLQ` row can\n * only be born from a FAILED app-scoped delivery — and none is ever produced — so the\n * app config-read, app DLQ, and app retry are mutually reachable only through each other.\n * NOTE the operator-visible trap this leaves: an app super-admin CAN enable\n * `APPLICATION_SIEM_EXPORT_CONFIG` (its own custom-impl + APP_ADMIN_SUPER_ADMIN roles)\n * and it will silently deliver NOTHING until a producer exists.\n \n To make it real — a SCOPED feature, NOT a mechanical mirror; settle the design fork\n * FIRST (which events an app SIEM receives, whether spanning all tenants, and how it\n * composes with per-org delivery so an event is not double-sent) — add a sibling\n * `_resolveAppAuditSinks(ec, appId)` loading the APP config, a\n * `dispatchToApplicationAuditSinks` fanning out identically, and a producer that calls it\n * with an app context, reusing the SAME envelope/HMAC/scope contract via\n * `enqueueSiemWebhookDelivery({ scopeType: AuthScopeType.APPLICATION, scopeId })`. Until\n * then, treat the APP variant as reserved plumbing, not a wired path.\n /\n public async dispatchToOrganizationAuditSinks(\n ec: ExecutionContext<any>,\n auditEvent: Omit<AuditableEvent, '_id' \| 'createdAt' \| 'updatedAt'>,\n organizationId: string,\n ): Promise<void> {\n // No authenticated org → no per-org dispatch (fail-closed, F4).\n if (!organizationId) return;\n\n // Arm the fleet invalidation subscriber on first use, so nothing has to order it at startup. Never\n // awaited: it performs a Redis duplicate + connect + subscribe on the first dispatch, and this\n // event must not wait for it. The window it leaves — one connect — is bounded by the lease, which\n // is what covers every un-broadcast change anyway.\n void this._ensureInvalidationSubscriber();\n\n let sinks: ResolvedOrgAuditSink[];\n try {\n sinks = await this._resolveOrgAuditSinks(ec, organizationId);\n } catch (error) {\n // Fire-and-forget: a config-resolution failure must never throw onto the business op.\n this.logger.error?.('Failed to resolve org audit sinks', {\n error,\n eventType: auditEvent.eventType,\n organizationId,\n });\n return;\n }\n\n for (const sink of sinks) {\n try {\n switch (sink.type) {\n case PerOrgAuditSinkType.SIEM_WEBHOOK:\n await this._dispatchToSiemWebhook(ec, auditEvent, organizationId, sink.siemConfig);\n break;\n default:\n // F-1 safety net: a future `PerOrgAuditSinkType` member with no `case` above is\n // LOGGED, never silently dropped (the original finding was a silent no-op). A\n // single-member discriminated union does NOT narrow this `default` to `never`, so\n // a compile-time `assertNever(sink)` guard only becomes possible once a 2nd sink\n // type exists — convert this branch to it then. Until then the resolver's +\n // switch's JSDoc pointers (\"add a case here\") + this warn are the guard.\n this.logger.warn?.(\n 'Unhandled per-org audit sink type — event NOT delivered to this sink; add a `case` in dispatchToOrganizationAuditSinks',\n { sinkType: sink.type, eventType: auditEvent.eventType, organizationId },\n );\n break;\n }\n } catch (error) {\n // Per-sink isolation (F7): one org sink failing never affects the others.\n this.logger.error?.('Failed to dispatch audit event to an org audit sink', {\n error,\n sinkType: sink.type,\n eventType: auditEvent.eventType,\n organizationId,\n });\n }\n }\n }\n\n /\n Resolve the per-org audit SINKS an org has configured — the 0..N destinations\n * {@link dispatchToOrganizationAuditSinks} fans an event out to. Keyed on the org the\n * caller already validated as authenticated (F4). Today the only per-org sink type is\n * the SIEM webhook; a future per-org destination appends its own descriptor HERE.\n \n Two-level feature gate for `CoreFeature.SECURITY_EVENT_EXPORT`:\n * Level 1 (here): `siemConfig.enabled` — the runtime gate.\n * Level 2 (admin API): `FeatureGateService` checks the org's subscription tier has\n * `SECURITY_EVENT_EXPORT` before allowing `enabled = true`. We cannot use\n * `FeatureResolutionService` here (fire-and-forget context; internal ECs bypass\n * feature resolution), so the pre-validated `enabled` flag IS the per-org gate.\n /\n private async _resolveOrgAuditSinks(\n ec: ExecutionContext<any>,\n organizationId: string,\n ): Promise<ResolvedOrgAuditSink[]> {\n const sinks: ResolvedOrgAuditSink[] = [];\n\n const siemConfig = await this._loadSiemConfigCached(ec, organizationId);\n if (siemConfig?.enabled) {\n sinks.push({ type: PerOrgAuditSinkType.SIEM_WEBHOOK, siemConfig });\n }\n\n // Future per-org sink types (e.g. per-org immudb) resolve here — each appends its\n // own descriptor; the dispatcher switch fans out by `type`.\n return sinks;\n }\n\n /\n R2: load the org's SIEM config through the leased cache.\n \n Without a cache, {@link _resolveOrgAuditSinks} reads the config via a self-elevating `readAsSystem`\n * PER EVENT PER ORG — and `readAsSystem` ALSO emits a `SYSTEM_CONTEXT_READ` audit — so every routed\n * audit event (× N orgs on the multi-org fan-out) doubled the audit-write volume to the DB + immudb.\n * `null` is cached too (an org whose config load failed) so a non-configured org is not re-read every\n * event.\n \n The cache is STALE-WHILE-REVALIDATE ({@link LeasedValueCache}), so only the very first event for an\n * organization waits on a read; every later one is served from memory while the refresh runs off this\n * path. That is what lets {@link SIEM_CONFIG_REFRESH_AFTER_MS} be sixty seconds rather than five\n * minutes — read the guarantee stated there before changing it.\n \n The loader closes over `ec`, which is the audit service's synthesised super-admin APPLICATION-scoped\n * temp context (`audit-logs.backend.service.ts:284`, handed here at `:349`) and is therefore equally\n * privileged on every call — the precondition {@link LeasedValueCache} states for joining an in-flight\n * load. `loadSiemExportConfig` in fact ignores `ec` entirely (`void ec`) and reads system-context.\n /\n private async _loadSiemConfigCached(\n ec: ExecutionContext<any>,\n organizationId: string,\n ): Promise<SiemExportConfigBase \| null> {\n return this._siemConfigCache.get(organizationId, () =>\n this.orgConfigService.loadSiemExportConfig(ec, AuthScopeType.ORGANIZATION, organizationId),\n );\n }\n\n /\n Drop one organization's cached SIEM config so the NEXT event re-reads it.\n \n ## Why this exists\n \n Without it the cache had no invalidation at all — only the 5-minute TTL and the size-1000\n * FIFO — so enabling a sink left the organization's events unrouted for up to that window, and\n * audit events are not replayed. The ENABLE direction is the sharp one: `null` is cached\n * deliberately (see {@link _loadSiemConfigCached}) and `null` is exactly the state an\n * organization is in the moment before it first configures a sink, so the first five minutes of\n * a newly-pointed SIEM were silently empty.\n \n ## Where it is called from, and why not from the config service\n \n From a postfix hook on the SIEM-export-config RESOURCE\n * (`siem-export-config-cache-invalidation.custom-impl.backend.service.ts`), not from\n * `AuthOrganizationConfigurationService.saveSiemExportConfig`.\n \n That service was the obvious call site and it is the WRONG one: it is only one of the writers.\n * The config is an ordinary resource, so an update also lands through\n * `ServicesRegistryHandler.update` on `organizationSiemExportConfig` directly. Hooking the\n * service would have applied the invariant at one of two call sites, which is the defect shape\n * `.claude/rules/invariant-call-site-enumeration.md` exists to stop. The resource operation is\n * the chokepoint BOTH writers pass through — `saveSiemExportConfig` itself dispatches its write\n * via `ServicesRegistryHandler`, so covering the resource covers it for free.\n \n Note `saveSiemExportConfig` separately refreshes its OWN `siemExportConfigs` map. That is a\n * different cache in a different service and was never the one deciding routing.\n \n ## Semantics\n \n Deleting the entry rather than overwriting it: the next read goes to the repository, so this\n * cannot install a wrong value, only force a re-read. Idempotent, and a no-op for an\n * organization with no entry — which is the common case, since only organizations that have\n * raised an audit event since the last eviction are in the map at all. Synchronous and\n * infallible on purpose, so the caller needs no error handling.\n \n ## It reaches EVERY replica, which it did not before\n \n The local drop above is only ever correct for ONE process — the one that happened to handle the\n * write. With N replicas behind a load balancer, the other N-1 went on serving the pre-write config\n * for the rest of the lease, so \"the invalidation covers engine-routed writes\" was true of a single\n * instance and false of every real deployment. The broadcast closes that: the organization id goes\n * out on {@link SIEM_CONFIG_INVALIDATION_CHANNEL_SUFFIX} and every replica's subscriber drops its own\n * entry within milliseconds.\n \n The publish is fire-and-forget and cannot fail this call: a broadcast that does not go out degrades\n * the OTHER replicas to the lease, which is exactly where they were before, and refusing a\n * configuration write to protect a cache would invert the priority. This method's synchronous,\n * infallible contract therefore still holds for its caller.\n \n What it still does NOT cover, and cannot. A write that never reaches the service tier — a\n * repository-tier write, or a direct database write like `examples/wonder-todos/e2e/adapter.ts`'s\n * `upsertOrganizationSingleton('organizationSiemExportConfig', …)` — raises no postfix hook, so\n * nothing calls this and nothing is broadcast. For those the lease is the entire guarantee; that is\n * why it is chosen and argued at {@link SIEM_CONFIG_REFRESH_AFTER_MS} rather than left incidental.\n /\n public invalidateSiemConfig(organizationId: string): void {\n this._siemConfigCache.invalidate(organizationId);\n this._publishSiemConfigInvalidation(organizationId);\n }\n\n /\n Tell the rest of the fleet to drop this organization's cached SIEM config.\n \n Returns nothing and awaits nothing — the caller is a postfix write hook whose contract is that it\n * cannot fail the write it follows.\n /\n private _publishSiemConfigInvalidation(organizationId: string): void {\n const client = this.redisService?.getReadyClient();\n // A not-ready client is the normal state wherever Redis is unconfigured (single-replica, local dev,\n // several test containers). It is not an error: the local drop already happened, and there is no\n // other replica to tell.\n if (!client) return;\n\n void client\n .publish(this._invalidationChannel(), organizationId)\n .catch((error: unknown) =>\n this.logger.error?.('Failed to broadcast a SIEM export config invalidation — other replicas converge on the lease instead', {\n organizationId,\n refreshAfterMs: SIEM_CONFIG_REFRESH_AFTER_MS,\n ...projectCaughtErrorLogFields(error),\n }),\n );\n }\n\n /* App-prefixed so two applications sharing one Redis never invalidate each other's caches. /\n private _invalidationChannel(): string {\n return `${this.redisService?.getAppPrefix() ?? ''}${SIEM_CONFIG_INVALIDATION_CHANNEL_SUFFIX}`;\n }\n\n /\n Arm this replica's single subscriber to the invalidation channel. Idempotent.\n \n Called (never awaited) from {@link dispatchToOrganizationAuditSinks}, so no startup ordering is\n * required and nothing has to be wired in `start-application` — the same lazy-arm pattern\n * `A2ATaskCancellationBackendService.ensureSubscriber` uses, for the same reason.\n \n Fails OPEN by design: a replica that cannot subscribe still routes audit events, converging on the\n * lease instead of on the broadcast. The failure is logged at ERROR because a persistent one silently\n * returns that replica to the per-process behaviour this mechanism exists to remove.\n \n Two details are copied deliberately rather than reinvented, because each was a recorded defect in\n * the A2A original: the `end` handler RE-ARMS (a subscriber that connected and then dropped — a Redis\n * restart, a failover, an idle reap — otherwise stayed dead for the life of the process while every\n * other signal looked healthy), and the catch DESTROYS a half-built connection (`connect()` can\n * succeed while `subscribe()` throws, and retrying without destroying leaks one socket per attempt).\n /\n private async _ensureInvalidationSubscriber(): Promise<void> {\n if (this._invalidationSubscribeStarted) return;\n this._invalidationSubscribeStarted = true;\n\n const client = this.redisService?.getReadyClient();\n if (!client) {\n // Not an error: no Redis means no other replica to hear from. Latched so this is decided once.\n this.logDebug('Redis unavailable — cross-replica SIEM-config invalidation is disabled for this replica');\n return;\n }\n\n let subscriber: RedisClientType \| undefined;\n try {\n // `node-redis` forbids ordinary commands on a subscribed connection, so this MUST be a duplicate\n // rather than the shared client.\n subscriber = client.duplicate() as RedisClientType;\n subscriber.on('error', (error: unknown) =>\n this.logger.error?.('SIEM-config invalidation subscriber error', { ...projectCaughtErrorLogFields(error) }),\n );\n subscriber.on('end', () => {\n this.logger.warn?.('SIEM-config invalidation subscriber closed; re-arming so the next dispatch rebuilds it');\n this._invalidationSubscribeStarted = false;\n });\n await subscriber.connect();\n await subscriber.subscribe(this._invalidationChannel(), (organizationId: string) => {\n // Local drop only — never a re-publish, or one write would loop the fleet forever.\n this._siemConfigCache.invalidate(organizationId);\n this.logDebug('Dropped a cached SIEM export config on a fleet invalidation', { organizationId });\n });\n } catch (error) {\n if (subscriber) {\n try {\n await subscriber.destroy();\n } catch {\n / already dead — nothing to reclaim /\n }\n }\n this._invalidationSubscribeStarted = false; // allow a later dispatch to retry\n this.logger.error?.('Failed to subscribe to the SIEM-config invalidation channel — this replica converges on the lease only', {\n refreshAfterMs: SIEM_CONFIG_REFRESH_AFTER_MS,\n ...projectCaughtErrorLogFields(error),\n });\n }\n }\n\n /\n Deliver one event to an org's SIEM webhook sink: apply the sink's per-event filter,\n * build + HMAC the envelope, and enqueue for async delivery via the SIEM webhook\n * delivery worker (`siemWebhookDeliveryBatchService`, registered under\n * `SIEM_WEBHOOK_DELIVERY_BATCH_REF` in `start-application`). May throw; the caller\n * isolates per-sink failures.\n /\n private async _dispatchToSiemWebhook(\n ec: ExecutionContext<any>,\n auditEvent: Omit<AuditableEvent, '_id' \| 'createdAt' \| 'updatedAt'>,\n organizationId: string,\n siemConfig: SiemExportConfigBase,\n ): Promise<void> {\n // Classify the event (always returns a value; defaults to data_access/info for unknown types)\n const classification = getAuditEventClassification(auditEvent.eventType);\n\n // Apply the sink's per-event filter\n if (!this._passesEventFilter(auditEvent.eventType, classification, siemConfig)) {\n this.logDebug('Event filtered out by SIEM config', {\n eventType: auditEvent.eventType,\n organizationId,\n });\n return;\n }\n\n // F3: Resolve org name for SIEM analyst readability\n const orgName = await this._resolveOrgName(ec, organizationId);\n\n // Extract application context from eventData if available\n const appId = (auditEvent.eventData as Record<string, unknown>)?.applicationId as string \| undefined;\n const appName = (auditEvent.eventData as Record<string, unknown>)?.applicationName as string \| undefined;\n\n // Build the envelope (F3: includes orgName, Task 3.12c: includes app context)\n const envelope = this._buildEnvelope(auditEvent, organizationId, classification, orgName, appId, appName);\n\n // Enqueue for async delivery through the single job-contract seam\n // (payload shape + F6 envelope HMAC + batch ref). This dispatch path is\n // org-scoped; {@link enqueueSiemWebhookDelivery} defaults scopeType/scopeId to\n // the organization, so behaviour is unchanged.\n await this.enqueueSiemWebhookDelivery({ envelope, organizationId, siemConfig });\n\n this.logDebug('Audit event enqueued for SIEM delivery', {\n eventId: envelope.eventId,\n eventType: auditEvent.eventType,\n organizationId,\n });\n }\n\n /\n Enqueue ONE already-built envelope for async SIEM webhook delivery.\n \n The SINGLE authority for the SIEM delivery-job contract — the\n * {@link SIEMDeliveryJobPayload} shape, the F6 envelope HMAC, and the\n * `SIEM_WEBHOOK_DELIVERY_BATCH_REF` batch ref — shared by two producers:\n * 1. first-time dispatch ({@link _dispatchToSiemWebhook}, org scope), and\n * 2. manual DLQ drain (the `siem-delivery-dlq` RETRY_SINGLE / RETRY_ALL\n * custom impls), which re-enqueue a dead-lettered row's STORED envelope\n * for either the ORG or APP scope.\n \n Keeping this in one place is not cosmetic: the delivery worker has no\n * back-reference to a DLQ row, so a retry that fails is re-captured as a\n * brand-new DLQ row. If the retry path built a subtly different payload (a\n * dropped `siemConfig` field, a stale HMAC domain), the mismatch would surface\n * only as a silently looping dead-letter — never a compile error. One seam\n * makes that class of drift impossible.\n \n @param params.scopeType Defaults to {@link AuthScopeType.ORGANIZATION} (the\n * first-time dispatch path is org-only). The DLQ APP variant passes\n * {@link AuthScopeType.APPLICATION} so the worker's circuit-breaker key and\n * any re-DLQ capture resolve to the application scope, not the org. NOTE: the\n * SIEM-DLQ retry custom-impl is the ONLY caller that passes `APPLICATION` today —\n * there is NO first-time app-scoped producer (the APPLICATION variant is reserved /\n * dormant; see {@link dispatchToOrganizationAuditSinks} for the full rationale and\n * the wiring a future app producer would add).\n * @param params.scopeId Defaults to `organizationId`.\n \n May throw on enqueue failure — the CALLER decides isolation: the dispatch\n * path swallows it per-sink (fire-and-forget, F7); the DLQ retry surfaces it to\n * the operator so the row is left intact for another attempt.\n /\n public async enqueueSiemWebhookDelivery(params: {\n envelope: SecurityAuditEventEnvelope;\n organizationId: string;\n siemConfig: SiemExportConfigBase;\n scopeType?: AuthScopeType;\n scopeId?: string;\n }): Promise<void> {\n const { envelope, organizationId, siemConfig } = params;\n const scopeType = params.scopeType ?? AuthScopeType.ORGANIZATION;\n\n // F6: HMAC integrity signature over the envelope payload — computed HERE so the\n // key/domain never diverges between the dispatch and retry producers.\n const envelopeHmac = this._computeEnvelopeHmac(envelope);\n\n // Using the shared constant keeps enqueue ↔ registration ↔ spec cross-validation\n // on one literal. The `siemConfig` projection strips the config to the transport\n // fields the worker needs (no eventFilter — filtering already happened upstream).\n await this.queueService.enqueueCustomBatch(\n SIEM_WEBHOOK_DELIVERY_BATCH_REF,\n {\n envelope,\n envelopeHmac,\n organizationId,\n scopeType,\n scopeId: params.scopeId ?? organizationId,\n siemConfig: {\n webhookUrl: siemConfig.webhookUrl,\n authMethod: siemConfig.authMethod,\n authCredential: siemConfig.authCredential,\n authHeaderName: siemConfig.authHeaderName,\n eventFormat: siemConfig.eventFormat,\n customHeaders: siemConfig.customHeaders,\n delivery: siemConfig.delivery,\n },\n },\n );\n }\n\n /\n Check if an event passes the org's SIEM event filter.\n /\n private _passesEventFilter(\n eventType: string,\n classification: { category: AuditEventCategory; severity: AuditEventSeverity },\n config: SiemExportConfigBase,\n ): boolean {\n const filter = config.eventFilter;\n\n // Check category filter\n if (!filter.categories.includes(classification.category)) {\n return false;\n }\n\n // Check severity minimum\n const eventSeverityOrder = SEVERITY_ORDER[classification.severity] ?? 0;\n const minimumSeverityOrder = SEVERITY_ORDER[filter.severityMinimum] ?? 0;\n if (eventSeverityOrder < minimumSeverityOrder) {\n return false;\n }\n\n // Check specific event type filter (if configured)\n if (filter.specificEventTypes && filter.specificEventTypes.length > 0) {\n if (!filter.specificEventTypes.includes(eventType)) {\n return false;\n }\n }\n\n return true;\n }\n\n /\n Build a SecurityAuditEventEnvelope from an audit event.\n /\n private _buildEnvelope(\n auditEvent: Omit<AuditableEvent, '_id' \| 'createdAt' \| 'updatedAt'>,\n organizationId: string,\n classification: { category: AuditEventCategory; severity: AuditEventSeverity },\n organizationName?: string,\n applicationId?: string,\n applicationName?: string,\n ): SecurityAuditEventEnvelope {\n const eventData = auditEvent.eventData as Record<string, unknown>;\n\n return {\n eventId: this._resolveEnvelopeEventId(auditEvent),\n eventType: auditEvent.eventType,\n eventCategory: classification.category,\n severity: classification.severity,\n timestamp: new Date().toISOString(),\n correlationId: auditEvent.correlationId,\n // Undefined unless the application opted in — the row itself is only ever populated under the policy.\n clientInstanceId: auditEvent.clientInstanceId,\n frontendServiceName: auditEvent.frontendServiceName,\n\n organizationId,\n organizationName, // F3: Populated via org name cache\n applicationId,\n applicationName,\n userId: auditEvent.userId,\n userEmail: (eventData.email as string) \|\| undefined,\n\n sourceService: this.appConfigService.applicationId,\n sourceVersion: process.env.APP_VERSION \|\| '0.0.0',\n sourceEnvironment: this.appConfigService.applicationEnv,\n\n // Auth-specific context from eventData (when applicable)\n authMethod: (eventData.authMethod as string) \|\| undefined,\n authSource: (eventData.authSource as string) \|\| undefined,\n providerRef: (eventData.providerRef as string) \|\| undefined,\n connectionType: (eventData.connectionType as string) \|\| undefined,\n ipAddress: (eventData.ipAddress as string) \|\| undefined,\n userAgent: (eventData.userAgent as string) \|\| undefined,\n\n eventData: eventData as Record<string, any>,\n\n outcome: this._inferOutcome(auditEvent.eventType),\n outcomeReason: (eventData.failureReason as string) \|\| (eventData.reason as string) \|\| undefined,\n };\n }\n\n /\n The id the DELIVERED envelope carries — the audit row's OWN `eventId`, never a freshly minted one.\n \n ## Why it must be the audit event's id\n \n `SecurityAuditEventEnvelope.eventId` is the only identifier that leaves the application on a SIEM\n * delivery, and it is doing two jobs at once:\n \n 1. it is what a RECEIVER deduplicates on — the delivery service's own header says \"Idempotency via\n * eventId\", and every wire format carries this one field through to the receiver's dedup key\n * (CEF `externalId`, LEEF `eventId`, OCSF `metadata.uid`, and the verbatim `json_structured` body's\n * top-level `eventId`); and\n * 2. it is the only handle an analyst has for joining a record in the customer's SIEM back to the\n * audit row it was projected from.\n \n Minting a fresh uuid here satisfied (1) and silently destroyed (2). The id was ALREADY on the value\n * being projected: `AuditableEvent.eventId` is minted in `AuditLogsBackendService._createAuditLog`\n * BEFORE the DB write, is documented on the schema as the \"store-agnostic, server-minted correlation\n * key\", and already joins the DB row to its immudb record and to `verifyAuditEvent(eventId)`. It\n * survives the `Omit` on this method's parameter type, so it was in hand and thrown away — the\n * envelope replaced it with an id that exists nowhere else in the system, making a delivered SIEM\n * event deduplicable but unexplainable.\n \n ## Why the cutover is safe — the risk this looks like it carries, it does not\n \n Changing what a receiver deduplicates on normally risks re-accepting events at the switch. Not here:\n * the OLD value was a per-delivery random uuid, never reused and not re-derivable from anything, so\n * every id crossing the cutover is still one no receiver has ever seen. Nothing is re-delivered and\n * nothing is newly deduped away.\n \n What genuinely changes is the FAN-OUT. `AuditLogsBackendService` dispatches one audit event to each\n * of the user's verified member orgs, so those N deliveries now carry ONE id instead of N. They go to\n * N different tenants' sinks, so there is no cross-receiver dedup interaction — and one id is the\n * truthful statement, because it is one event. (The DLQ row records this id too, so a dead letter is\n * now joinable to its audit row as well; `SiemDeliveryDlqBaseSchema.eventId` carries no unique index,\n * so the shared id cannot collide there.)\n \n Per-attempt idempotency is untouched: the envelope is built ONCE, and both the in-process retry loop\n * in `SIEMWebhookDeliveryBackendService.processDelivery` and the DLQ drain re-send that same stored\n * object — so one delivery keeps one id across every attempt, which is exactly what a receiver's dedup\n * needs.\n \n ## The fallback, and why it is not a hedge\n \n `eventId` is required on `AuditableEvent` and the sole production caller always sets it, so this\n * branch should be unreachable. It exists because the two failures are ASYMMETRIC: an absent id is not\n * merely an unjoinable delivery, it is a delivery with NO dedup key at all — every projection renders\n * the field only `if (e.eventId)`, so the receiver stores `dedupKey: null` and answers `deduped: false`\n * forever against a service that retries and drains a DLQ. Losing the join degrades an investigation;\n * losing idempotency duplicates events inside a customer's SIEM. So an absent id still gets a minted\n * one, and is logged loudly rather than shipping a blank.\n /\n private _resolveEnvelopeEventId(auditEvent: Omit<AuditableEvent, '_id' \| 'createdAt' \| 'updatedAt'>): string {\n if (auditEvent.eventId) {\n return auditEvent.eventId;\n }\n\n const mintedEventId = uuidv4();\n this.logger.warn?.(\n 'Audit event reached SIEM dispatch with no eventId — the delivered envelope cannot be joined back to its audit row; minting a delivery-local id so receiver idempotency survives',\n { eventType: auditEvent.eventType, mintedEventId },\n );\n return mintedEventId;\n }\n\n /\n Infer success/failure outcome from event type.\n /\n private _inferOutcome(eventType: string): AuditEventOutcome {\n const failureEventTypes = [\n CoreAuditableEventType.USER_LOGIN_FAILED,\n CoreAuditableEventType.USER_ACCOUNT_LOCKED,\n CoreAuditableEventType.USER_SSO_LOGIN_FAILED,\n CoreAuditableEventType.USER_SSO_ENFORCEMENT_BLOCKED,\n CoreAuditableEventType.SAML_LOGIN_FAILED,\n CoreAuditableEventType.SAML_ASSERTION_REPLAY_DETECTED,\n CoreAuditableEventType.MACHINE_AUTH_FAILED,\n ];\n\n return failureEventTypes.includes(eventType as CoreAuditableEventType) ? AuditEventOutcome.FAILURE : AuditEventOutcome.SUCCESS;\n }\n\n // ─────────────────────────────────────────────────────────────\n // F3: Organization Name Cache\n // ─────────────────────────────────────────────────────────────\n\n /\n F3: resolve an organization NAME for SIEM-analyst readability, through the leased cache.\n \n Renames are picked up within {@link ORG_NAME_REFRESH_AFTER_MS} — read that constant for why this\n * lease is five minutes while the routing config's is sixty seconds. There is no invalidation hook on\n * this one, deliberately: a stale label costs a reader nothing (the `organizationId` beside it in the\n * envelope is authoritative and always current), so the lease alone is a proportionate answer.\n \n Never throws — a missing name is optional in the envelope, and this runs on a fire-and-forget path.\n * The loader therefore swallows its own failure and yields `undefined`, which means the COLD path of\n * {@link LeasedValueCache} can never reject here.\n \n `undefined` IS cached, and that is a fix rather than an oversight. Before this, a lookup that\n * failed or returned a nameless row cached nothing, so an organization whose read kept failing was\n * re-read on EVERY exported event — the read amplification a cache exists to prevent, arriving\n * precisely when the repository is already unhealthy. Caching the negative bounds it to one read per\n * lease, and a rename or a repaired read still lands within that lease.\n \n The loader closes over `ec` — the audit service's synthesised super-admin APPLICATION-scoped temp\n * context (`audit-logs.backend.service.ts:284` → `:349`), identical in privilege on every dispatch —\n * which is the precondition {@link LeasedValueCache} states for joining an in-flight load.\n /\n private async _resolveOrgName(ec: ExecutionContext<any>, organizationId: string): Promise<string \| undefined> {\n return this._orgNameCache.get(organizationId, async () => {\n try {\n const orgsRepo = this.repositoriesRegistry.getRepositoryOrThrow(CoreResourceType.ORGANIZATIONS);\n const org = await orgsRepo.read<{ _id: string; name: string }>(ec, organizationId);\n return org?.name \|\| undefined;\n } catch {\n // Fire-and-forget — org name is optional in the envelope.\n return undefined;\n }\n });\n }\n\n // ─────────────────────────────────────────────────────────────\n // F6: Event Integrity (HMAC)\n // ─────────────────────────────────────────────────────────────\n\n /\n F6: Compute HMAC-SHA256 over the serialized envelope for integrity protection.\n * The delivery service verifies this HMAC before processing, detecting queue tampering.\n /\n private _computeEnvelopeHmac(envelope: SecurityAuditEventEnvelope): string {\n const hmacKey = this._getHmacKey();\n return createHmac('sha256', hmacKey)\n .update(JSON.stringify(envelope))\n .digest('hex');\n }\n\n /\n Derive a 256-bit HMAC key from the app's session encryption key\n * using SHA-256 with a domain separator (consistent with SIEM encryption key derivation).\n /\n private _getHmacKey(): Buffer {\n return createHash('sha256')\n .update(`${SIEM_HMAC_DOMAIN}:${this.appConfigService.secrets.security.session.encryptionKey}`)\n .digest();\n }\n\n /\n F6: Public static-like method to verify envelope HMAC on the delivery side.\n * Returns true if the HMAC matches, false otherwise.\n */\n public verifyEnvelopeHmac(envelope: SecurityAuditEventEnvelope, expectedHmac: string): boolean {\n const computedHmac = this._computeEnvelopeHmac(envelope);\n // Use crypto.timingSafeEqual for constant-time comparison (prevents timing attacks)\n const computedBuf = Buffer.from(computedHmac, 'utf-8');\n const expectedBuf = Buffer.from(expectedHmac, 'utf-8');\n if (computedBuf.length !== expectedBuf.length) return false;\n return timingSafeEqual(computedBuf, expectedBuf);\n }\n}\n"]}
1	+ {"version":3,"file":"audit-event-dispatcher.backend.service.js","sourceRoot":"","sources":["../../../../../src/compliance/audit-trails/services/audit-event-dispatcher.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;;;;;;;;;;;;;AAEH,OAAO,kBAAkB,CAAC;AAC1B,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAEzD,OAAO,EAAE,EAAE,IAAI,MAAM,EAAE,MAAM,MAAM,CAAC;AACpC,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,QAAQ,CAAC;AACjE,OAAO,EAAE,kBAAkB,EAAE,MAAM,gDAAgD,CAAC;AACpF,OAAO,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAC7F,OAAO,EAAE,uBAAuB,EAAE,MAAM,sEAAsE,CAAC;AAC/G,OAAO,EAAE,oCAAoC,EAAE,MAAM,2GAA2G,CAAC;AACjK,OAAO,EAAE,yCAAyC,EAAE,MAAM,qGAAqG,CAAC;AAChK,OAAO,EAAE,mBAAmB,EAAE,MAAM,gDAAgD,CAAC;AACrF,OAAO,EAAE,gBAAgB,EAAE,MAAM,4FAA4F,CAAC;AAC9H,OAAO,EAAE,2BAA2B,EAAE,MAAM,8EAA8E,CAAC;AAC3H,OAAO,EAAE,+BAA+B,EAAE,MAAM,gFAAgF,CAAC;AACjI,OAAO,EACL,iBAAiB,EACjB,sBAAsB,EACtB,gBAAgB,EAChB,2BAA2B,EAM3B,aAAa,GACd,MAAM,uBAAuB,CAAC;AAI/B,oDAAoD;AACpD,MAAM,gBAAgB,GAAG,+BAA+B,CAAC;AAEzD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8CG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,EAAE,GAAG,IAAI,CAAC;AACtD,4GAA4G;AAC5G,MAAM,0BAA0B,GAAG,IAAI,CAAC;AAExC;;;;;;;;;GASG;AACH,MAAM,yBAAyB,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AAChD,qGAAqG;AACrG,MAAM,uBAAuB,GAAG,IAAI,CAAC;AAErC;;;;;;;;GAQG;AACH,MAAM,uCAAuC,GAAG,qCAAqC,CAAC;AAEtF,uDAAuD;AACvD,MAAM,cAAc,GAA2B;IAC7C,MAAM,EAAE,CAAC;IACT,SAAS,EAAE,CAAC;IACZ,UAAU,EAAE,CAAC;CACd,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG;IACjC,YAAY,EAAE,cAAc;CACpB,CAAC;AAcJ,IAAM,kCAAkC,GAAxC,MAAM,kCAAkC;IA6CS;IACU;IACoB;IACjB;IACe;IASV;IAzDvD,QAAQ,CAA+D;IAExF;;;;;;;;OAQG;IACc,aAAa,GAAG,IAAI,gBAAgB,CAAqB;QACxE,cAAc,EAAE,yBAAyB;QACzC,UAAU,EAAE,uBAAuB;KACpC,CAAC,CAAC;IAEH,gHAAgH;IAC/F,gBAAgB,GAAG,IAAI,gBAAgB,CAA8B;QACpF,cAAc,EAAE,4BAA4B;QAC5C,UAAU,EAAE,0BAA0B;QACtC,gBAAgB,EAAE,CAAC,cAAc,EAAE,KAAK,EAAE,EAAE;QAC1C,kGAAkG;QAClG,mGAAmG;QACnG,iGAAiG;QACjG,2FAA2F;QAC3F,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,+HAA+H,EAAE;YACnJ,cAAc;YACd,cAAc,EAAE,4BAA4B;YAC5C,GAAG,2BAA2B,CAAC,KAAK,CAAC;SACtC,CAAC;KACL,CAAC,CAAC;IAEH;;;;;;;;OAQG;IACK,6BAA6B,GAAG,KAAK,CAAC;IAE9C,YACsD,MAAqB,EACX,gBAAyC,EACrB,gBAAsD,EACvE,YAAiC,EAClB,oBAA+D,EASzE,YAA2B;QAb7C,WAAM,GAAN,MAAM,CAAe;QACX,qBAAgB,GAAhB,gBAAgB,CAAyB;QACrB,qBAAgB,GAAhB,gBAAgB,CAAsC;QACvE,iBAAY,GAAZ,YAAY,CAAqB;QAClB,yBAAoB,GAApB,oBAAoB,CAA2C;QASzE,iBAAY,GAAZ,YAAY,CAAe;QAEjG,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,oCAAoC,CAAC,CAAC;QAC9E,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,oCAAoC,EAAE,KAAK,CAAC,CAAC;IAC/E,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAgDG;IACI,KAAK,CAAC,gCAAgC,CAC3C,EAAyB,EACzB,UAAmE,EACnE,cAAsB;QAEtB,gEAAgE;QAChE,IAAI,CAAC,cAAc;YAAE,OAAO;QAE5B,mGAAmG;QACnG,+FAA+F;QAC/F,kGAAkG;QAClG,mDAAmD;QACnD,KAAK,IAAI,CAAC,6BAA6B,EAAE,CAAC;QAE1C,IAAI,KAA6B,CAAC;QAClC,IAAI,CAAC;YACH,KAAK,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,EAAE,EAAE,cAAc,CAAC,CAAC;QAC/D,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,sFAAsF;YACtF,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,mCAAmC,EAAE;gBACvD,KAAK;gBACL,SAAS,EAAE,UAAU,CAAC,SAAS;gBAC/B,cAAc;aACf,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAED,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,IAAI,CAAC;gBACH,QAAQ,IAAI,CAAC,IAAI,EAAE,CAAC;oBAClB,KAAK,mBAAmB,CAAC,YAAY;wBACnC,MAAM,IAAI,CAAC,sBAAsB,CAAC,EAAE,EAAE,UAAU,EAAE,cAAc,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;wBACnF,MAAM;oBACR;wBACE,gFAAgF;wBAChF,8EAA8E;wBAC9E,kFAAkF;wBAClF,iFAAiF;wBACjF,4EAA4E;wBAC5E,yEAAyE;wBACzE,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAChB,wHAAwH,EACxH,EAAE,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,UAAU,CAAC,SAAS,EAAE,cAAc,EAAE,CACzE,CAAC;wBACF,MAAM;gBACV,CAAC;YACH,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,0EAA0E;gBAC1E,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,qDAAqD,EAAE;oBACzE,KAAK;oBACL,QAAQ,EAAE,IAAI,CAAC,IAAI;oBACnB,SAAS,EAAE,UAAU,CAAC,SAAS;oBAC/B,cAAc;iBACf,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;OAYG;IACK,KAAK,CAAC,qBAAqB,CACjC,EAAyB,EACzB,cAAsB;QAEtB,MAAM,KAAK,GAA2B,EAAE,CAAC;QAEzC,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,EAAE,EAAE,cAAc,CAAC,CAAC;QACxE,IAAI,UAAU,EAAE,OAAO,EAAE,CAAC;YACxB,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,mBAAmB,CAAC,YAAY,EAAE,UAAU,EAAE,CAAC,CAAC;QACrE,CAAC;QAED,kFAAkF;QAClF,4DAA4D;QAC5D,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;;;;;;;;;;;;;;;;;OAkBG;IACK,KAAK,CAAC,qBAAqB,CACjC,EAAyB,EACzB,cAAsB;QAEtB,OAAO,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,cAAc,EAAE,GAAG,EAAE,CACpD,IAAI,CAAC,gBAAgB,CAAC,oBAAoB,CAAC,EAAE,EAAE,aAAa,CAAC,YAAY,EAAE,cAAc,CAAC,CAC3F,CAAC;IACJ,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAwDG;IACI,oBAAoB,CAAC,cAAsB;QAChD,IAAI,CAAC,gBAAgB,CAAC,UAAU,CAAC,cAAc,CAAC,CAAC;QACjD,IAAI,CAAC,8BAA8B,CAAC,cAAc,CAAC,CAAC;IACtD,CAAC;IAED;;;;;OAKG;IACK,8BAA8B,CAAC,cAAsB;QAC3D,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,EAAE,cAAc,EAAE,CAAC;QACnD,oGAAoG;QACpG,iGAAiG;QACjG,yBAAyB;QACzB,IAAI,CAAC,MAAM;YAAE,OAAO;QAEpB,KAAK,MAAM;aACR,OAAO,CAAC,IAAI,CAAC,oBAAoB,EAAE,EAAE,cAAc,CAAC;aACpD,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE,CACxB,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,sGAAsG,EAAE;YAC1H,cAAc;YACd,cAAc,EAAE,4BAA4B;YAC5C,GAAG,2BAA2B,CAAC,KAAK,CAAC;SACtC,CAAC,CACH,CAAC;IACN,CAAC;IAED,+FAA+F;IACvF,oBAAoB;QAC1B,OAAO,GAAG,IAAI,CAAC,YAAY,EAAE,YAAY,EAAE,IAAI,EAAE,GAAG,uCAAuC,EAAE,CAAC;IAChG,CAAC;IAED;;;;;;;;;;;;;;;;OAgBG;IACK,KAAK,CAAC,6BAA6B;QACzC,IAAI,IAAI,CAAC,6BAA6B;YAAE,OAAO;QAC/C,IAAI,CAAC,6BAA6B,GAAG,IAAI,CAAC;QAE1C,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,EAAE,cAAc,EAAE,CAAC;QACnD,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,+FAA+F;YAC/F,IAAI,CAAC,QAAQ,CAAC,yFAAyF,CAAC,CAAC;YACzG,OAAO;QACT,CAAC;QAED,IAAI,UAAuC,CAAC;QAC5C,IAAI,CAAC;YACH,iGAAiG;YACjG,iCAAiC;YACjC,UAAU,GAAG,MAAM,CAAC,SAAS,EAAqB,CAAC;YACnD,UAAU,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAAc,EAAE,EAAE,CACxC,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,2CAA2C,EAAE,EAAE,GAAG,2BAA2B,CAAC,KAAK,CAAC,EAAE,CAAC,CAC5G,CAAC;YACF,UAAU,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;gBACxB,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,wFAAwF,CAAC,CAAC;gBAC7G,IAAI,CAAC,6BAA6B,GAAG,KAAK,CAAC;YAC7C,CAAC,CAAC,CAAC;YACH,MAAM,UAAU,CAAC,OAAO,EAAE,CAAC;YAC3B,MAAM,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,oBAAoB,EAAE,EAAE,CAAC,cAAsB,EAAE,EAAE;gBACjF,mFAAmF;gBACnF,IAAI,CAAC,gBAAgB,CAAC,UAAU,CAAC,cAAc,CAAC,CAAC;gBACjD,IAAI,CAAC,QAAQ,CAAC,6DAA6D,EAAE,EAAE,cAAc,EAAE,CAAC,CAAC;YACnG,CAAC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,UAAU,EAAE,CAAC;gBACf,IAAI,CAAC;oBACH,MAAM,UAAU,CAAC,OAAO,EAAE,CAAC;gBAC7B,CAAC;gBAAC,MAAM,CAAC;oBACP,uCAAuC;gBACzC,CAAC;YACH,CAAC;YACD,IAAI,CAAC,6BAA6B,GAAG,KAAK,CAAC,CAAC,kCAAkC;YAC9E,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,wGAAwG,EAAE;gBAC5H,cAAc,EAAE,4BAA4B;gBAC5C,GAAG,2BAA2B,CAAC,KAAK,CAAC;aACtC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED;;;;;;OAMG;IACK,KAAK,CAAC,sBAAsB,CAClC,EAAyB,EACzB,UAAmE,EACnE,cAAsB,EACtB,UAAgC;QAEhC,8FAA8F;QAC9F,MAAM,cAAc,GAAG,2BAA2B,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;QAEzE,oCAAoC;QACpC,IAAI,CAAC,IAAI,CAAC,kBAAkB,CAAC,UAAU,CAAC,SAAS,EAAE,cAAc,EAAE,UAAU,CAAC,EAAE,CAAC;YAC/E,IAAI,CAAC,QAAQ,CAAC,mCAAmC,EAAE;gBACjD,SAAS,EAAE,UAAU,CAAC,SAAS;gBAC/B,cAAc;aACf,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAED,oDAAoD;QACpD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,EAAE,EAAE,cAAc,CAAC,CAAC;QAE/D,0DAA0D;QAC1D,MAAM,KAAK,GAAI,UAAU,CAAC,SAAqC,EAAE,aAAmC,CAAC;QACrG,MAAM,OAAO,GAAI,UAAU,CAAC,SAAqC,EAAE,eAAqC,CAAC;QAEzG,8EAA8E;QAC9E,MAAM,QAAQ,GAAG,IAAI,CAAC,cAAc,CAAC,UAAU,EAAE,cAAc,EAAE,cAAc,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;QAE1G,kEAAkE;QAClE,wEAAwE;QACxE,+EAA+E;QAC/E,+CAA+C;QAC/C,MAAM,IAAI,CAAC,0BAA0B,CAAC,EAAE,QAAQ,EAAE,cAAc,EAAE,UAAU,EAAE,CAAC,CAAC;QAEhF,IAAI,CAAC,QAAQ,CAAC,wCAAwC,EAAE;YACtD,OAAO,EAAE,QAAQ,CAAC,OAAO;YACzB,SAAS,EAAE,UAAU,CAAC,SAAS;YAC/B,cAAc;SACf,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA+BG;IACI,KAAK,CAAC,0BAA0B,CAAC,MAMvC;QACC,MAAM,EAAE,QAAQ,EAAE,cAAc,EAAE,UAAU,EAAE,GAAG,MAAM,CAAC;QACxD,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,IAAI,aAAa,CAAC,YAAY,CAAC;QAEjE,gFAAgF;QAChF,sEAAsE;QACtE,MAAM,YAAY,GAAG,IAAI,CAAC,oBAAoB,CAAC,QAAQ,CAAC,CAAC;QAEzD,iFAAiF;QACjF,iFAAiF;QACjF,kFAAkF;QAClF,MAAM,IAAI,CAAC,YAAY,CAAC,kBAAkB,CACxC,+BAA+B,EAC/B;YACE,QAAQ;YACR,YAAY;YACZ,cAAc;YACd,SAAS;YACT,OAAO,EAAE,MAAM,CAAC,OAAO,IAAI,cAAc;YACzC,UAAU,EAAE;gBACV,UAAU,EAAE,UAAU,CAAC,UAAU;gBACjC,UAAU,EAAE,UAAU,CAAC,UAAU;gBACjC,cAAc,EAAE,UAAU,CAAC,cAAc;gBACzC,cAAc,EAAE,UAAU,CAAC,cAAc;gBACzC,WAAW,EAAE,UAAU,CAAC,WAAW;gBACnC,aAAa,EAAE,UAAU,CAAC,aAAa;gBACvC,QAAQ,EAAE,UAAU,CAAC,QAAQ;aAC9B;SACF,CACF,CAAC;IACJ,CAAC;IAED;;OAEG;IACK,kBAAkB,CACxB,SAAiB,EACjB,cAA8E,EAC9E,MAA4B;QAE5B,MAAM,MAAM,GAAG,MAAM,CAAC,WAAW,CAAC;QAElC,wBAAwB;QACxB,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,cAAc,CAAC,QAAQ,CAAC,EAAE,CAAC;YACzD,OAAO,KAAK,CAAC;QACf,CAAC;QAED,yBAAyB;QACzB,MAAM,kBAAkB,GAAG,cAAc,CAAC,cAAc,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QACxE,MAAM,oBAAoB,GAAG,cAAc,CAAC,MAAM,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;QACzE,IAAI,kBAAkB,GAAG,oBAAoB,EAAE,CAAC;YAC9C,OAAO,KAAK,CAAC;QACf,CAAC;QAED,mDAAmD;QACnD,IAAI,MAAM,CAAC,kBAAkB,IAAI,MAAM,CAAC,kBAAkB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtE,IAAI,CAAC,MAAM,CAAC,kBAAkB,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;gBACnD,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;OAEG;IACK,cAAc,CACpB,UAAmE,EACnE,cAAsB,EACtB,cAA8E,EAC9E,gBAAyB,EACzB,aAAsB,EACtB,eAAwB;QAExB,MAAM,SAAS,GAAG,UAAU,CAAC,SAAoC,CAAC;QAElE,OAAO;YACL,OAAO,EAAE,IAAI,CAAC,uBAAuB,CAAC,UAAU,CAAC;YACjD,SAAS,EAAE,UAAU,CAAC,SAAS;YAC/B,aAAa,EAAE,cAAc,CAAC,QAAQ;YACtC,QAAQ,EAAE,cAAc,CAAC,QAAQ;YACjC,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,aAAa,EAAE,UAAU,CAAC,aAAa;YACvC,sGAAsG;YACtG,gBAAgB,EAAE,UAAU,CAAC,gBAAgB;YAC7C,mBAAmB,EAAE,UAAU,CAAC,mBAAmB;YAEnD,cAAc;YACd,gBAAgB,EAAE,mCAAmC;YACrD,aAAa;YACb,eAAe;YACf,MAAM,EAAE,UAAU,CAAC,MAAM;YACzB,SAAS,EAAG,SAAS,CAAC,KAAgB,IAAI,SAAS;YAEnD,aAAa,EAAE,IAAI,CAAC,gBAAgB,CAAC,aAAa;YAClD,aAAa,EAAE,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,OAAO;YACjD,iBAAiB,EAAE,IAAI,CAAC,gBAAgB,CAAC,cAAc;YAEvD,yDAAyD;YACzD,UAAU,EAAG,SAAS,CAAC,UAAqB,IAAI,SAAS;YACzD,UAAU,EAAG,SAAS,CAAC,UAAqB,IAAI,SAAS;YACzD,WAAW,EAAG,SAAS,CAAC,WAAsB,IAAI,SAAS;YAC3D,cAAc,EAAG,SAAS,CAAC,cAAyB,IAAI,SAAS;YACjE,SAAS,EAAG,SAAS,CAAC,SAAoB,IAAI,SAAS;YACvD,SAAS,EAAG,SAAS,CAAC,SAAoB,IAAI,SAAS;YAEvD,SAAS,EAAE,SAAgC;YAE3C,OAAO,EAAE,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC,SAAS,CAAC;YACjD,aAAa,EAAG,SAAS,CAAC,aAAwB,IAAK,SAAS,CAAC,MAAiB,IAAI,SAAS;SAChG,CAAC;IACJ,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAmDG;IACK,uBAAuB,CAAC,UAAmE;QACjG,IAAI,UAAU,CAAC,OAAO,EAAE,CAAC;YACvB,OAAO,UAAU,CAAC,OAAO,CAAC;QAC5B,CAAC;QAED,MAAM,aAAa,GAAG,MAAM,EAAE,CAAC;QAC/B,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAChB,iLAAiL,EACjL,EAAE,SAAS,EAAE,UAAU,CAAC,SAAS,EAAE,aAAa,EAAE,CACnD,CAAC;QACF,OAAO,aAAa,CAAC;IACvB,CAAC;IAED;;OAEG;IACK,aAAa,CAAC,SAAiB;QACrC,MAAM,iBAAiB,GAAG;YACxB,sBAAsB,CAAC,iBAAiB;YACxC,sBAAsB,CAAC,mBAAmB;YAC1C,sBAAsB,CAAC,qBAAqB;YAC5C,sBAAsB,CAAC,4BAA4B;YACnD,sBAAsB,CAAC,iBAAiB;YACxC,sBAAsB,CAAC,8BAA8B;YACrD,sBAAsB,CAAC,mBAAmB;SAC3C,CAAC;QAEF,OAAO,iBAAiB,CAAC,QAAQ,CAAC,SAAmC,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC,CAAC,iBAAiB,CAAC,OAAO,CAAC;IACjI,CAAC;IAED,gEAAgE;IAChE,8BAA8B;IAC9B,gEAAgE;IAEhE;;;;;;;;;;;;;;;;;;;;;OAqBG;IACK,KAAK,CAAC,eAAe,CAAC,EAAyB,EAAE,cAAsB;QAC7E,OAAO,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,cAAc,EAAE,KAAK,IAAI,EAAE;YACvD,IAAI,CAAC;gBACH,MAAM,QAAQ,GAAG,IAAI,CAAC,oBAAoB,CAAC,oBAAoB,CAAC,gBAAgB,CAAC,aAAa,CAAC,CAAC;gBAChG,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAgC,EAAE,EAAE,cAAc,CAAC,CAAC;gBACnF,OAAO,GAAG,EAAE,IAAI,IAAI,SAAS,CAAC;YAChC,CAAC;YAAC,MAAM,CAAC;gBACP,0DAA0D;gBAC1D,OAAO,SAAS,CAAC;YACnB,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;IAED,gEAAgE;IAChE,6BAA6B;IAC7B,gEAAgE;IAEhE;;;OAGG;IACK,oBAAoB,CAAC,QAAoC;QAC/D,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;QACnC,OAAO,UAAU,CAAC,QAAQ,EAAE,OAAO,CAAC;aACjC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;aAChC,MAAM,CAAC,KAAK,CAAC,CAAC;IACnB,CAAC;IAED;;;OAGG;IACK,WAAW;QACjB,OAAO,UAAU,CAAC,QAAQ,CAAC;aACxB,MAAM,CAAC,GAAG,gBAAgB,IAAI,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC;aAC7F,MAAM,EAAE,CAAC;IACd,CAAC;IAED;;;OAGG;IACI,kBAAkB,CAAC,QAAoC,EAAE,YAAoB;QAClF,MAAM,YAAY,GAAG,IAAI,CAAC,oBAAoB,CAAC,QAAQ,CAAC,CAAC;QACzD,oFAAoF;QACpF,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;QACvD,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;QACvD,IAAI,WAAW,CAAC,MAAM,KAAK,WAAW,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC;QAC5D,OAAO,eAAe,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;IACnD,CAAC;CACF,CAAA;AAnuBY,kCAAkC;IAD9C,UAAU,EAAE;IA8CR,WAAA,MAAM,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAA;IACjC,WAAA,MAAM,CAAC,kBAAkB,CAAC,gBAAgB,CAAC,CAAA;IAC3C,WAAA,MAAM,CAAC,kBAAkB,CAAC,oCAAoC,CAAC,CAAA;IAC/D,WAAA,MAAM,CAAC,kBAAkB,CAAC,mBAAmB,CAAC,CAAA;IAC9C,WAAA,MAAM,CAAC,kBAAkB,CAAC,kCAAkC,CAAC,CAAA;IAS7D,WAAA,MAAM,CAAC,kBAAkB,CAAC,YAAY,CAAC,CAAA;IAAE,WAAA,QAAQ,EAAE,CAAA;qCAbQ,aAAa;QACO,uBAAuB;QACH,oCAAoC;QACzD,mBAAmB;QACI,yCAAyC;GAjDtI,kCAAkC,CAmuB9C","sourcesContent":["/*\n Audit Event Dispatcher Backend Service\n \n Layer 2 of the three-layer audit event pipeline (Step 18).\n * Receives audit events after MongoDB write and dispatches them\n * to the organization's SIEM endpoint if configured.\n \n This is fire-and-forget — if dispatch fails, the audit log\n * in MongoDB remains authoritative.\n /\n\nimport 'reflect-metadata';\nimport { inject, injectable, optional } from 'inversify';\nimport type { RedisClientType } from 'redis';\nimport { v4 as uuidv4 } from 'uuid';\nimport { createHmac, createHash, timingSafeEqual } from 'crypto';\nimport { SAAS_SERVICE_TYPES } from '~wildo-backend-lib/inject/models/service-types';\nimport { LoggerService } from '~wildo-backend-lib/monitoring/logger/services/logger.service';\nimport { AppConfigurationService } from '~wildo-backend-lib/config/services/app-configuration.backend.service';\nimport { AuthOrganizationConfigurationService } from '~wildo-backend-lib/security/authentications/services/admin-config/auth-organization-configuration.service';\nimport { RepositoriesRegistryHandlerBackendService } from '~wildo-backend-lib/base-classes/services/repositories/repositories-registry-handler.backend.service';\nimport { QueueBackendService } from '~wildo-backend-lib/queue/queue.backend.service';\nimport { LeasedValueCache } from '~wildo-backend-lib/compliance/audit-trails/services/utils/leased-value-cache.backend.utils';\nimport { projectCaughtErrorLogFields } from '~wildo-backend-lib/errors/utils/error-log-level-classification.backend.utils';\nimport { SIEM_WEBHOOK_DELIVERY_BATCH_REF } from '~wildo-backend-lib/base-classes/services/batches/engine-custom-batch-manifests';\nimport {\n AuditEventOutcome,\n CoreAuditableEventType,\n CoreResourceType,\n getAuditEventClassification,\n type SecurityAuditEventEnvelope,\n type AuditEventCategory,\n type AuditEventSeverity,\n type AuditableEvent,\n type SiemExportConfigBase,\n AuthScopeType,\n} from '@wildo-ai/saas-models';\nimport type { ExecutionContext } from '~wildo-backend-lib/runtime/models/execution-context.backend.schemas';\nimport type { RedisService } from '~wildo-backend-lib/databases/services/redis.service';\n\n/* F6: HMAC domain separator for event integrity /\nconst SIEM_HMAC_DOMAIN = 'wildo:siem:event-integrity:v1';\n\n/\n *A SIEM export configuration change takes effect on EVERY replica within 60 seconds — and within\n milliseconds when the change goes through the engine.*\n \n * That sentence is the guarantee this subsystem makes, and the two halves come from two different\n * mechanisms, so read both before changing either.\n \n ## Why the number is 60 seconds, and why it used to be 300\n \n The lease is the ONLY thing that covers a write no hook can see — a repository-tier write, or a\n * direct database write. There is a live one: `examples/wonder-todos/e2e/adapter.ts` (`case 'siem'`)\n * repoints an organization's export config with `upsertOrganizationSingleton(...)`, straight at the\n * store, bypassing the engine entirely. Its own comment records what the old 300 s cost — \"A freshly\n provisioned org has a cold 5-min config cache, so the first login cold-reads this\"* — i.e. the lane\n * is correct only because it is ORDERED to run before the organization's first audited action. A\n * five-minute convergence bound is not something a scenario, or an operator doing surgery, can wait\n * for; it is something they have to design around. Sixty seconds is something they can wait for.\n \n The old 300 s was never chosen for that job — it was chosen to bound READ AMPLIFICATION, because a\n * miss costs more than a repository read: `AuthOrganizationConfigurationService.loadSiemExportConfig`\n * reads through `readAsSystem`, which emits its own `system_context_read` audit row to the database\n * AND to immudb. So shortening the lease multiplies audit-trail plumbing noise, not just queries.\n * Two properties make 60 s affordable anyway:\n \n - Refreshes are LAZY and STALE-WHILE-REVALIDATE ({@link LeasedValueCache}). A quiet organization\n * costs one read per event, not one per minute; only a continuously busy one reaches the ceiling of\n * one read per lease per replica. At 60 s that ceiling is 60 reads/hour/replica per ACTIVE\n * organization — for an organization emitting 1000 audit events an hour, under 5 % amplification of\n * its own audit volume, against 12/hour before.\n * - Nothing blocks on it. Past the lease the cached value is served immediately and the re-read\n * runs off the emission path, so shortening it costs read volume and never latency.\n \n ## The other half: the engine-routed write converges in milliseconds\n \n {@link AuditEventDispatcherBackendService.invalidateSiemConfig} drops the local entry AND publishes\n * the organization id on {@link SIEM_CONFIG_INVALIDATION_CHANNEL_SUFFIX}, which every replica\n * subscribes to. Before that broadcast the invalidation reached exactly ONE process — the one that\n * happened to handle the write — and every other replica served the stale value for the rest of the\n * lease, which is the defect this constant's neighbours document.\n \n Do not raise this back toward the read-amplification number. If the amplification ever needs to\n * come down, the right lever is the `system_context_read` row on the config read itself:\n * `SystemAccessBackendService.readAsSystem` already takes `suppressSystemAudit`, and its own JSDoc\n * names this exact read — \"the audit pipeline resolving … an org's SIEM config to ROUTE an audit\n event\"* — as the case it exists for. `loadSiemExportConfig` is the one such reader that does not\n * pass it. Fixing that makes a miss cost a single indexed read and removes the constraint entirely.\n /\nexport const SIEM_CONFIG_REFRESH_AFTER_MS = 60 1000;\n/** R2: Max entries in the SIEM-config cache to prevent unbounded growth. Least-recently-used is evicted. /\nconst SIEM_CONFIG_CACHE_MAX_SIZE = 1000;\n\n/\n F3: how long a cached organization NAME is served before a background re-read.\n \n Deliberately NOT the same constant as {@link SIEM_CONFIG_REFRESH_AFTER_MS}, though the mechanism is\n * now shared. A stale name is a stale LABEL on an exported envelope — the `organizationId` beside it\n * is authoritative and unaffected, so a rename showing up late is cosmetic. A stale export config\n * decides whether the event is routed AT ALL. Same defect shape, different consequence class, so they\n * get the same machinery and their own numbers: five minutes buys back the read volume that the\n * config's sixty seconds spends, and nothing depends on a rename propagating faster.\n /\nconst ORG_NAME_REFRESH_AFTER_MS = 5 60 * 1000;\n/** B4: Max entries in org name cache to prevent unbounded growth. Least-recently-used is evicted. /\nconst ORG_NAME_CACHE_MAX_SIZE = 1000;\n\n/\n The Redis channel carrying cross-replica SIEM-config invalidations. App-prefixed at use, so tenants\n * of one Redis never cross — the convention {@link RedisService.getAppPrefix} exists for.\n \n Broadcast rather than a shared cache, and the distinction is the whole design: the emission path\n * never touches Redis, so a Redis outage degrades convergence to the lease instead of degrading\n * ROUTING. A shared-store cache would have put a network round trip on the path an audit event takes\n * and made delivery depend on a store that can be down.\n /\nconst SIEM_CONFIG_INVALIDATION_CHANNEL_SUFFIX = 'audit:siem-export-config:invalidate';\n\n/* Severity ordering for minimum severity filtering /\nconst SEVERITY_ORDER: Record<string, number> = {\n 'info': 0,\n 'warning': 1,\n 'critical': 2,\n};\n\n/\n The per-org audit sink TYPES an organization can route its authenticated audit\n * events to. Today the only type is the SIEM webhook. Adding a per-org destination\n * later (e.g. per-org immudb, per observability §11) is a new member HERE + a branch\n * in `_resolveOrgAuditSinks` + a `case` in `dispatchToOrganizationAuditSinks` — the F4\n * routing (org from the authenticated EC) and the envelope/HMAC contracts do not change.\n /\nexport const PerOrgAuditSinkType = {\n SIEM_WEBHOOK: 'siem_webhook',\n} as const;\nexport type PerOrgAuditSinkType = (typeof PerOrgAuditSinkType)[keyof typeof PerOrgAuditSinkType];\n\n/\n A per-org audit sink RESOLVED for a specific org, carrying exactly the config needed\n * to deliver one event to it. A discriminated union (one member today) — the dispatcher\n * fans out by `type`, so a new sink type extends this union rather than reshaping callers.\n /\ntype ResolvedOrgAuditSink = {\n type: typeof PerOrgAuditSinkType.SIEM_WEBHOOK;\n siemConfig: SiemExportConfigBase;\n};\n\n@injectable()\nexport class AuditEventDispatcherBackendService {\n private readonly logDebug: (message: string, context?: Record<string, unknown>) => void;\n\n /\n F3: org NAME cache — a display label on the envelope. See {@link ORG_NAME_REFRESH_AFTER_MS}.\n \n No `onRefreshFailure`, and it would be dead code if there were one: {@link _resolveOrgName}'s loader\n * swallows its own error and yields `undefined`, so nothing this cache runs can ever reject. That\n * swallow is what makes the negative result CACHEABLE, which is the amplification fix described there;\n * the price is that a persistently unreadable organization row is silent, which is the right trade for\n * an optional label whose authoritative sibling (`organizationId`) is on the envelope regardless.\n /\n private readonly _orgNameCache = new LeasedValueCache<string \| undefined>({\n refreshAfterMs: ORG_NAME_REFRESH_AFTER_MS,\n maxEntries: ORG_NAME_CACHE_MAX_SIZE,\n });\n\n /* R2: per-org SIEM-config cache — the value that decides ROUTING. See {@link SIEM_CONFIG_REFRESH_AFTER_MS}. /\n private readonly _siemConfigCache = new LeasedValueCache<SiemExportConfigBase \| null>({\n refreshAfterMs: SIEM_CONFIG_REFRESH_AFTER_MS,\n maxEntries: SIEM_CONFIG_CACHE_MAX_SIZE,\n onRefreshFailure: (organizationId, error) =>\n // ERROR, not WARN, and the asymmetry with the org-name cache above is the point: while this keeps\n // failing the replica is routing on a configuration nobody can confirm, so the guarantee stated on\n // `SIEM_CONFIG_REFRESH_AFTER_MS` is suspended for this organization. Backed off one lease by the\n // cache, so a persistently unreadable config produces one line a minute, not one an event.\n this.logger.error?.('Background refresh of an organization SIEM export config failed — routing continues on the LAST KNOWN config for this replica', {\n organizationId,\n refreshAfterMs: SIEM_CONFIG_REFRESH_AFTER_MS,\n ...projectCaughtErrorLogFields(error),\n }),\n });\n\n /\n Latch so {@link _ensureInvalidationSubscriber} is idempotent; cleared on `end` so a dropped\n * subscriber re-arms.\n \n Deliberately the ONLY subscriber state kept. `A2ATaskCancellationBackendService` also holds the\n * client itself, because it has a shutdown path that closes it; this service has none, and a field\n * nothing reads is a field the next reader has to reason about for nothing. The socket keeps the\n * subscriber alive on its own, and a connection that emitted `end` is already closed.\n /\n private _invalidationSubscribeStarted = false;\n\n constructor(\n @inject(SAAS_SERVICE_TYPES.Logger) private readonly logger: LoggerService,\n @inject(SAAS_SERVICE_TYPES.AppConfigService) private readonly appConfigService: AppConfigurationService,\n @inject(SAAS_SERVICE_TYPES.AuthOrganizationConfigurationService) private readonly orgConfigService: AuthOrganizationConfigurationService,\n @inject(SAAS_SERVICE_TYPES.QueueBackendService) private readonly queueService: QueueBackendService,\n @inject(SAAS_SERVICE_TYPES.RepositoriesRegistryHandlerService) private readonly repositoriesRegistry: RepositoriesRegistryHandlerBackendService,\n /\n `@optional()` and APPENDED LAST — the constructor-parameter discipline.\n \n Optional because the cross-replica broadcast is an OPTIMISATION over the lease, never a\n * precondition for routing: a container with no Redis binding (several partial test containers, and\n * any single-replica deployment) must still dispatch audit events, converging on the lease alone.\n * Appended last so the five existing construction sites keep compiling unchanged.\n /\n @inject(SAAS_SERVICE_TYPES.RedisService) @optional() private readonly redisService?: RedisService,\n ) {\n this.logDebug = this.logger.debugByType('AuditEventDispatcherBackendService');\n this.logger.setDebugTypeLogging('AuditEventDispatcherBackendService', false);\n }\n\n /\n Dispatch an audit event to the organization's configured per-org audit SINKS.\n \n F4 (tenant segregation): the caller (`AuditLogsBackendService`) passes the\n * AUTHENTICATED org (resolved from the request `ExecutionContext`), NEVER the\n * caller-supplied `auditEvent.organizationId`. Sink config is loaded for THIS org\n * only (`_resolveOrgAuditSinks`), so an event can only reach the sinks of the tenant\n * it is authenticated for.\n \n Layer 2 of the pipeline: called after the MongoDB write (Layer 1), wired directly\n * into `AuditLogsBackendService` (NOT a resource pipeline post-hook). Fire-and-forget\n * — a resolution or per-sink delivery failure is logged but NEVER thrown onto the\n * business op, and per-sink failures are ISOLATED (F7) so one destination never\n * suppresses another.\n \n The seam: `_resolveOrgAuditSinks` returns the 0..N sinks the org has configured\n * (today only a SIEM webhook); this method fans each out by its `type`. Adding a\n * per-org destination later = a new {@link PerOrgAuditSinkType} + a resolver branch +\n * a `case` here.\n \n ── APPLICATION scope is RESERVED / DORMANT — there is NO app-scoped producer ──────\n * This producer is ORGANIZATION-scoped ONLY, on purpose. The F4 model routes on a\n * TRUSTED authenticated tenant (org), and the sole caller (`AuditLogsBackendService`)\n * fans out over the event's verified member orgs. There is deliberately no\n * `dispatchToApplicationAuditSinks` / `_resolveAppAuditSinks`.\n \n The SIEM export-config and delivery-DLQ resources DO each carry an `APPLICATION`\n * polymorphic variant (uniform with SSO/SCIM over `AUTH_SCOPE_VARIANTS`), and every\n * downstream seam is already scope-generic: `loadSiemExportConfig(ec, APPLICATION, appId)`,\n * {@link enqueueSiemWebhookDelivery} (`scopeType`/`scopeId`), the delivery worker's\n * circuit-breaker key, and `_enqueueToDLQ`'s `APPLICATION_SIEM_DELIVERY_DLQ` branch all\n * accept the app scope. But NOTHING emits a first-time app-scoped delivery. The only\n * caller that passes `scopeType: APPLICATION` today is the SIEM-DLQ retry custom-impl,\n * which is itself unreachable in production: an `APPLICATION_SIEM_DELIVERY_DLQ` row can\n * only be born from a FAILED app-scoped delivery — and none is ever produced — so the\n * app config-read, app DLQ, and app retry are mutually reachable only through each other.\n * NOTE the operator-visible trap this leaves: an app super-admin CAN enable\n * `APPLICATION_SIEM_EXPORT_CONFIG` (its own custom-impl + APP_ADMIN_SUPER_ADMIN roles)\n * and it will silently deliver NOTHING until a producer exists.\n \n To make it real — a SCOPED feature, NOT a mechanical mirror; settle the design fork\n * FIRST (which events an app SIEM receives, whether spanning all tenants, and how it\n * composes with per-org delivery so an event is not double-sent) — add a sibling\n * `_resolveAppAuditSinks(ec, appId)` loading the APP config, a\n * `dispatchToApplicationAuditSinks` fanning out identically, and a producer that calls it\n * with an app context, reusing the SAME envelope/HMAC/scope contract via\n * `enqueueSiemWebhookDelivery({ scopeType: AuthScopeType.APPLICATION, scopeId })`. Until\n * then, treat the APP variant as reserved plumbing, not a wired path.\n /\n public async dispatchToOrganizationAuditSinks(\n ec: ExecutionContext<any>,\n auditEvent: Omit<AuditableEvent, '_id' \| 'createdAt' \| 'updatedAt'>,\n organizationId: string,\n ): Promise<void> {\n // No authenticated org → no per-org dispatch (fail-closed, F4).\n if (!organizationId) return;\n\n // Arm the fleet invalidation subscriber on first use, so nothing has to order it at startup. Never\n // awaited: it performs a Redis duplicate + connect + subscribe on the first dispatch, and this\n // event must not wait for it. The window it leaves — one connect — is bounded by the lease, which\n // is what covers every un-broadcast change anyway.\n void this._ensureInvalidationSubscriber();\n\n let sinks: ResolvedOrgAuditSink[];\n try {\n sinks = await this._resolveOrgAuditSinks(ec, organizationId);\n } catch (error) {\n // Fire-and-forget: a config-resolution failure must never throw onto the business op.\n this.logger.error?.('Failed to resolve org audit sinks', {\n error,\n eventType: auditEvent.eventType,\n organizationId,\n });\n return;\n }\n\n for (const sink of sinks) {\n try {\n switch (sink.type) {\n case PerOrgAuditSinkType.SIEM_WEBHOOK:\n await this._dispatchToSiemWebhook(ec, auditEvent, organizationId, sink.siemConfig);\n break;\n default:\n // F-1 safety net: a future `PerOrgAuditSinkType` member with no `case` above is\n // LOGGED, never silently dropped (the original finding was a silent no-op). A\n // single-member discriminated union does NOT narrow this `default` to `never`, so\n // a compile-time `assertNever(sink)` guard only becomes possible once a 2nd sink\n // type exists — convert this branch to it then. Until then the resolver's +\n // switch's JSDoc pointers (\"add a case here\") + this warn are the guard.\n this.logger.warn?.(\n 'Unhandled per-org audit sink type — event NOT delivered to this sink; add a `case` in dispatchToOrganizationAuditSinks',\n { sinkType: sink.type, eventType: auditEvent.eventType, organizationId },\n );\n break;\n }\n } catch (error) {\n // Per-sink isolation (F7): one org sink failing never affects the others.\n this.logger.error?.('Failed to dispatch audit event to an org audit sink', {\n error,\n sinkType: sink.type,\n eventType: auditEvent.eventType,\n organizationId,\n });\n }\n }\n }\n\n /\n Resolve the per-org audit SINKS an org has configured — the 0..N destinations\n * {@link dispatchToOrganizationAuditSinks} fans an event out to. Keyed on the org the\n * caller already validated as authenticated (F4). Today the only per-org sink type is\n * the SIEM webhook; a future per-org destination appends its own descriptor HERE.\n \n Two-level feature gate for `CoreFeature.SECURITY_EVENT_EXPORT`:\n * Level 1 (here): `siemConfig.enabled` — the runtime gate.\n * Level 2 (admin API): `FeatureGateService` checks the org's subscription tier has\n * `SECURITY_EVENT_EXPORT` before allowing `enabled = true`. We cannot use\n * `FeatureResolutionService` here (fire-and-forget context; internal ECs bypass\n * feature resolution), so the pre-validated `enabled` flag IS the per-org gate.\n /\n private async _resolveOrgAuditSinks(\n ec: ExecutionContext<any>,\n organizationId: string,\n ): Promise<ResolvedOrgAuditSink[]> {\n const sinks: ResolvedOrgAuditSink[] = [];\n\n const siemConfig = await this._loadSiemConfigCached(ec, organizationId);\n if (siemConfig?.enabled) {\n sinks.push({ type: PerOrgAuditSinkType.SIEM_WEBHOOK, siemConfig });\n }\n\n // Future per-org sink types (e.g. per-org immudb) resolve here — each appends its\n // own descriptor; the dispatcher switch fans out by `type`.\n return sinks;\n }\n\n /\n R2: load the org's SIEM config through the leased cache.\n \n Without a cache, {@link _resolveOrgAuditSinks} reads the config via a self-elevating `readAsSystem`\n * PER EVENT PER ORG — and `readAsSystem` ALSO emits a `SYSTEM_CONTEXT_READ` audit — so every routed\n * audit event (× N orgs on the multi-org fan-out) doubled the audit-write volume to the DB + immudb.\n * `null` is cached too (an org whose config load failed) so a non-configured org is not re-read every\n * event.\n \n The cache is STALE-WHILE-REVALIDATE ({@link LeasedValueCache}), so only the very first event for an\n * organization waits on a read; every later one is served from memory while the refresh runs off this\n * path. That is what lets {@link SIEM_CONFIG_REFRESH_AFTER_MS} be sixty seconds rather than five\n * minutes — read the guarantee stated there before changing it.\n \n The loader closes over `ec`, which is the audit service's synthesised super-admin APPLICATION-scoped\n * temp context (`audit-logs.backend.service.ts:284`, handed here at `:349`) and is therefore equally\n * privileged on every call — the precondition {@link LeasedValueCache} states for joining an in-flight\n * load. `loadSiemExportConfig` in fact ignores `ec` entirely (`void ec`) and reads system-context.\n /\n private async _loadSiemConfigCached(\n ec: ExecutionContext<any>,\n organizationId: string,\n ): Promise<SiemExportConfigBase \| null> {\n return this._siemConfigCache.get(organizationId, () =>\n this.orgConfigService.loadSiemExportConfig(ec, AuthScopeType.ORGANIZATION, organizationId),\n );\n }\n\n /\n Drop one organization's cached SIEM config so the NEXT event re-reads it.\n \n ## Why this exists\n \n Without it the cache had no invalidation at all — only the 5-minute TTL and the size-1000\n * FIFO — so enabling a sink left the organization's events unrouted for up to that window, and\n * audit events are not replayed. The ENABLE direction is the sharp one: `null` is cached\n * deliberately (see {@link _loadSiemConfigCached}) and `null` is exactly the state an\n * organization is in the moment before it first configures a sink, so the first five minutes of\n * a newly-pointed SIEM were silently empty.\n \n ## Where it is called from, and why not from the config service\n \n From a postfix hook on the SIEM-export-config RESOURCE\n * (`siem-export-config-cache-invalidation.custom-impl.backend.service.ts`), not from\n * `AuthOrganizationConfigurationService.saveSiemExportConfig`.\n \n That service was the obvious call site and it is the WRONG one: it is only one of the writers.\n * The config is an ordinary resource, so an update also lands through\n * `ServicesRegistryHandler.update` on `organizationSiemExportConfig` directly. Hooking the\n * service would have applied the invariant at one of two call sites, which is the defect shape\n * `.claude/rules/invariant-call-site-enumeration.md` exists to stop. The resource operation is\n * the chokepoint BOTH writers pass through — `saveSiemExportConfig` itself dispatches its write\n * via `ServicesRegistryHandler`, so covering the resource covers it for free.\n \n Note `saveSiemExportConfig` separately refreshes its OWN `siemExportConfigs` map. That is a\n * different cache in a different service and was never the one deciding routing.\n \n ## Semantics\n \n Deleting the entry rather than overwriting it: the next read goes to the repository, so this\n * cannot install a wrong value, only force a re-read. Idempotent, and a no-op for an\n * organization with no entry — which is the common case, since only organizations that have\n * raised an audit event since the last eviction are in the map at all. Synchronous and\n * infallible on purpose, so the caller needs no error handling.\n \n ## It reaches EVERY replica, which it did not before\n \n The local drop above is only ever correct for ONE process — the one that happened to handle the\n * write. With N replicas behind a load balancer, the other N-1 went on serving the pre-write config\n * for the rest of the lease, so \"the invalidation covers engine-routed writes\" was true of a single\n * instance and false of every real deployment. The broadcast closes that: the organization id goes\n * out on {@link SIEM_CONFIG_INVALIDATION_CHANNEL_SUFFIX} and every replica's subscriber drops its own\n * entry within milliseconds.\n \n The publish is fire-and-forget and cannot fail this call: a broadcast that does not go out degrades\n * the OTHER replicas to the lease, which is exactly where they were before, and refusing a\n * configuration write to protect a cache would invert the priority. This method's synchronous,\n * infallible contract therefore still holds for its caller.\n \n What it still does NOT cover, and cannot. A write that never reaches the service tier — a\n * repository-tier write, or a direct database write like `examples/wonder-todos/e2e/adapter.ts`'s\n * `upsertOrganizationSingleton('organizationSiemExportConfig', …)` — raises no postfix hook, so\n * nothing calls this and nothing is broadcast. For those the lease is the entire guarantee; that is\n * why it is chosen and argued at {@link SIEM_CONFIG_REFRESH_AFTER_MS} rather than left incidental.\n /\n public invalidateSiemConfig(organizationId: string): void {\n this._siemConfigCache.invalidate(organizationId);\n this._publishSiemConfigInvalidation(organizationId);\n }\n\n /\n Tell the rest of the fleet to drop this organization's cached SIEM config.\n \n Returns nothing and awaits nothing — the caller is a postfix write hook whose contract is that it\n * cannot fail the write it follows.\n /\n private _publishSiemConfigInvalidation(organizationId: string): void {\n const client = this.redisService?.getReadyClient();\n // A not-ready client is the normal state wherever Redis is unconfigured (single-replica, local dev,\n // several test containers). It is not an error: the local drop already happened, and there is no\n // other replica to tell.\n if (!client) return;\n\n void client\n .publish(this._invalidationChannel(), organizationId)\n .catch((error: unknown) =>\n this.logger.error?.('Failed to broadcast a SIEM export config invalidation — other replicas converge on the lease instead', {\n organizationId,\n refreshAfterMs: SIEM_CONFIG_REFRESH_AFTER_MS,\n ...projectCaughtErrorLogFields(error),\n }),\n );\n }\n\n /* App-prefixed so two applications sharing one Redis never invalidate each other's caches. /\n private _invalidationChannel(): string {\n return `${this.redisService?.getAppPrefix() ?? ''}${SIEM_CONFIG_INVALIDATION_CHANNEL_SUFFIX}`;\n }\n\n /\n Arm this replica's single subscriber to the invalidation channel. Idempotent.\n \n Called (never awaited) from {@link dispatchToOrganizationAuditSinks}, so no startup ordering is\n * required and nothing has to be wired in `start-application` — the same lazy-arm pattern\n * `A2ATaskCancellationBackendService.ensureSubscriber` uses, for the same reason.\n \n Fails OPEN by design: a replica that cannot subscribe still routes audit events, converging on the\n * lease instead of on the broadcast. The failure is logged at ERROR because a persistent one silently\n * returns that replica to the per-process behaviour this mechanism exists to remove.\n \n Two details are copied deliberately rather than reinvented, because each was a recorded defect in\n * the A2A original: the `end` handler RE-ARMS (a subscriber that connected and then dropped — a Redis\n * restart, a failover, an idle reap — otherwise stayed dead for the life of the process while every\n * other signal looked healthy), and the catch DESTROYS a half-built connection (`connect()` can\n * succeed while `subscribe()` throws, and retrying without destroying leaks one socket per attempt).\n /\n private async _ensureInvalidationSubscriber(): Promise<void> {\n if (this._invalidationSubscribeStarted) return;\n this._invalidationSubscribeStarted = true;\n\n const client = this.redisService?.getReadyClient();\n if (!client) {\n // Not an error: no Redis means no other replica to hear from. Latched so this is decided once.\n this.logDebug('Redis unavailable — cross-replica SIEM-config invalidation is disabled for this replica');\n return;\n }\n\n let subscriber: RedisClientType \| undefined;\n try {\n // `node-redis` forbids ordinary commands on a subscribed connection, so this MUST be a duplicate\n // rather than the shared client.\n subscriber = client.duplicate() as RedisClientType;\n subscriber.on('error', (error: unknown) =>\n this.logger.error?.('SIEM-config invalidation subscriber error', { ...projectCaughtErrorLogFields(error) }),\n );\n subscriber.on('end', () => {\n this.logger.warn?.('SIEM-config invalidation subscriber closed; re-arming so the next dispatch rebuilds it');\n this._invalidationSubscribeStarted = false;\n });\n await subscriber.connect();\n await subscriber.subscribe(this._invalidationChannel(), (organizationId: string) => {\n // Local drop only — never a re-publish, or one write would loop the fleet forever.\n this._siemConfigCache.invalidate(organizationId);\n this.logDebug('Dropped a cached SIEM export config on a fleet invalidation', { organizationId });\n });\n } catch (error) {\n if (subscriber) {\n try {\n await subscriber.destroy();\n } catch {\n / already dead — nothing to reclaim /\n }\n }\n this._invalidationSubscribeStarted = false; // allow a later dispatch to retry\n this.logger.error?.('Failed to subscribe to the SIEM-config invalidation channel — this replica converges on the lease only', {\n refreshAfterMs: SIEM_CONFIG_REFRESH_AFTER_MS,\n ...projectCaughtErrorLogFields(error),\n });\n }\n }\n\n /\n Deliver one event to an org's SIEM webhook sink: apply the sink's per-event filter,\n * build + HMAC the envelope, and enqueue for async delivery via the SIEM webhook\n * delivery worker (`siemWebhookDeliveryBatchService`, registered under\n * `SIEM_WEBHOOK_DELIVERY_BATCH_REF` in `start-application`). May throw; the caller\n * isolates per-sink failures.\n /\n private async _dispatchToSiemWebhook(\n ec: ExecutionContext<any>,\n auditEvent: Omit<AuditableEvent, '_id' \| 'createdAt' \| 'updatedAt'>,\n organizationId: string,\n siemConfig: SiemExportConfigBase,\n ): Promise<void> {\n // Classify the event (always returns a value; defaults to data_access/info for unknown types)\n const classification = getAuditEventClassification(auditEvent.eventType);\n\n // Apply the sink's per-event filter\n if (!this._passesEventFilter(auditEvent.eventType, classification, siemConfig)) {\n this.logDebug('Event filtered out by SIEM config', {\n eventType: auditEvent.eventType,\n organizationId,\n });\n return;\n }\n\n // F3: Resolve org name for SIEM analyst readability\n const orgName = await this._resolveOrgName(ec, organizationId);\n\n // Extract application context from eventData if available\n const appId = (auditEvent.eventData as Record<string, unknown>)?.applicationId as string \| undefined;\n const appName = (auditEvent.eventData as Record<string, unknown>)?.applicationName as string \| undefined;\n\n // Build the envelope (F3: includes orgName, Task 3.12c: includes app context)\n const envelope = this._buildEnvelope(auditEvent, organizationId, classification, orgName, appId, appName);\n\n // Enqueue for async delivery through the single job-contract seam\n // (payload shape + F6 envelope HMAC + batch ref). This dispatch path is\n // org-scoped; {@link enqueueSiemWebhookDelivery} defaults scopeType/scopeId to\n // the organization, so behaviour is unchanged.\n await this.enqueueSiemWebhookDelivery({ envelope, organizationId, siemConfig });\n\n this.logDebug('Audit event enqueued for SIEM delivery', {\n eventId: envelope.eventId,\n eventType: auditEvent.eventType,\n organizationId,\n });\n }\n\n /\n Enqueue ONE already-built envelope for async SIEM webhook delivery.\n \n The SINGLE authority for the SIEM delivery-job contract — the\n * {@link SIEMDeliveryJobPayload} shape, the F6 envelope HMAC, and the\n * `SIEM_WEBHOOK_DELIVERY_BATCH_REF` batch ref — shared by two producers:\n * 1. first-time dispatch ({@link _dispatchToSiemWebhook}, org scope), and\n * 2. manual DLQ drain (the `siem-delivery-dlq` RETRY_SINGLE / RETRY_ALL\n * custom impls), which re-enqueue a dead-lettered row's STORED envelope\n * for either the ORG or APP scope.\n \n Keeping this in one place is not cosmetic: the delivery worker has no\n * back-reference to a DLQ row, so a retry that fails is re-captured as a\n * brand-new DLQ row. If the retry path built a subtly different payload (a\n * dropped `siemConfig` field, a stale HMAC domain), the mismatch would surface\n * only as a silently looping dead-letter — never a compile error. One seam\n * makes that class of drift impossible.\n \n @param params.scopeType Defaults to {@link AuthScopeType.ORGANIZATION} (the\n * first-time dispatch path is org-only). The DLQ APP variant passes\n * {@link AuthScopeType.APPLICATION} so the worker's circuit-breaker key and\n * any re-DLQ capture resolve to the application scope, not the org. NOTE: the\n * SIEM-DLQ retry custom-impl is the ONLY caller that passes `APPLICATION` today —\n * there is NO first-time app-scoped producer (the APPLICATION variant is reserved /\n * dormant; see {@link dispatchToOrganizationAuditSinks} for the full rationale and\n * the wiring a future app producer would add).\n * @param params.scopeId Defaults to `organizationId`.\n \n May throw on enqueue failure — the CALLER decides isolation: the dispatch\n * path swallows it per-sink (fire-and-forget, F7); the DLQ retry surfaces it to\n * the operator so the row is left intact for another attempt.\n /\n public async enqueueSiemWebhookDelivery(params: {\n envelope: SecurityAuditEventEnvelope;\n organizationId: string;\n siemConfig: SiemExportConfigBase;\n scopeType?: AuthScopeType;\n scopeId?: string;\n }): Promise<void> {\n const { envelope, organizationId, siemConfig } = params;\n const scopeType = params.scopeType ?? AuthScopeType.ORGANIZATION;\n\n // F6: HMAC integrity signature over the envelope payload — computed HERE so the\n // key/domain never diverges between the dispatch and retry producers.\n const envelopeHmac = this._computeEnvelopeHmac(envelope);\n\n // Using the shared constant keeps enqueue ↔ registration ↔ spec cross-validation\n // on one literal. The `siemConfig` projection strips the config to the transport\n // fields the worker needs (no eventFilter — filtering already happened upstream).\n await this.queueService.enqueueCustomBatch(\n SIEM_WEBHOOK_DELIVERY_BATCH_REF,\n {\n envelope,\n envelopeHmac,\n organizationId,\n scopeType,\n scopeId: params.scopeId ?? organizationId,\n siemConfig: {\n webhookUrl: siemConfig.webhookUrl,\n authMethod: siemConfig.authMethod,\n authCredential: siemConfig.authCredential,\n authHeaderName: siemConfig.authHeaderName,\n eventFormat: siemConfig.eventFormat,\n customHeaders: siemConfig.customHeaders,\n delivery: siemConfig.delivery,\n },\n },\n );\n }\n\n /\n Check if an event passes the org's SIEM event filter.\n /\n private _passesEventFilter(\n eventType: string,\n classification: { category: AuditEventCategory; severity: AuditEventSeverity },\n config: SiemExportConfigBase,\n ): boolean {\n const filter = config.eventFilter;\n\n // Check category filter\n if (!filter.categories.includes(classification.category)) {\n return false;\n }\n\n // Check severity minimum\n const eventSeverityOrder = SEVERITY_ORDER[classification.severity] ?? 0;\n const minimumSeverityOrder = SEVERITY_ORDER[filter.severityMinimum] ?? 0;\n if (eventSeverityOrder < minimumSeverityOrder) {\n return false;\n }\n\n // Check specific event type filter (if configured)\n if (filter.specificEventTypes && filter.specificEventTypes.length > 0) {\n if (!filter.specificEventTypes.includes(eventType)) {\n return false;\n }\n }\n\n return true;\n }\n\n /\n Build a SecurityAuditEventEnvelope from an audit event.\n /\n private _buildEnvelope(\n auditEvent: Omit<AuditableEvent, '_id' \| 'createdAt' \| 'updatedAt'>,\n organizationId: string,\n classification: { category: AuditEventCategory; severity: AuditEventSeverity },\n organizationName?: string,\n applicationId?: string,\n applicationName?: string,\n ): SecurityAuditEventEnvelope {\n const eventData = auditEvent.eventData as Record<string, unknown>;\n\n return {\n eventId: this._resolveEnvelopeEventId(auditEvent),\n eventType: auditEvent.eventType,\n eventCategory: classification.category,\n severity: classification.severity,\n timestamp: new Date().toISOString(),\n correlationId: auditEvent.correlationId,\n // Undefined unless the application opted in — the row itself is only ever populated under the policy.\n clientInstanceId: auditEvent.clientInstanceId,\n frontendServiceName: auditEvent.frontendServiceName,\n\n organizationId,\n organizationName, // F3: Populated via org name cache\n applicationId,\n applicationName,\n userId: auditEvent.userId,\n userEmail: (eventData.email as string) \|\| undefined,\n\n sourceService: this.appConfigService.applicationId,\n sourceVersion: process.env.APP_VERSION \|\| '0.0.0',\n sourceEnvironment: this.appConfigService.applicationEnv,\n\n // Auth-specific context from eventData (when applicable)\n authMethod: (eventData.authMethod as string) \|\| undefined,\n authSource: (eventData.authSource as string) \|\| undefined,\n providerRef: (eventData.providerRef as string) \|\| undefined,\n connectionType: (eventData.connectionType as string) \|\| undefined,\n ipAddress: (eventData.ipAddress as string) \|\| undefined,\n userAgent: (eventData.userAgent as string) \|\| undefined,\n\n eventData: eventData as Record<string, any>,\n\n outcome: this._inferOutcome(auditEvent.eventType),\n outcomeReason: (eventData.failureReason as string) \|\| (eventData.reason as string) \|\| undefined,\n };\n }\n\n /\n The id the DELIVERED envelope carries — the audit row's OWN `eventId`, never a freshly minted one.\n \n ## Why it must be the audit event's id\n \n `SecurityAuditEventEnvelope.eventId` is the only identifier that leaves the application on a SIEM\n * delivery, and it is doing two jobs at once:\n \n 1. it is what a RECEIVER deduplicates on — the delivery service's own header says \"Idempotency via\n * eventId\", and every wire format carries this one field through to the receiver's dedup key\n * (CEF `externalId`, LEEF `eventId`, OCSF `metadata.uid`, and the verbatim `json_structured` body's\n * top-level `eventId`); and\n * 2. it is the only handle an analyst has for joining a record in the customer's SIEM back to the\n * audit row it was projected from.\n \n Minting a fresh uuid here satisfied (1) and silently destroyed (2). The id was ALREADY on the value\n * being projected: `AuditableEvent.eventId` is minted in `AuditLogsBackendService._createAuditLog`\n * BEFORE the DB write, is documented on the schema as the \"store-agnostic, server-minted correlation\n * key\", and already joins the DB row to its immudb record and to `verifyAuditEvent(eventId)`. It\n * survives the `Omit` on this method's parameter type, so it was in hand and thrown away — the\n * envelope replaced it with an id that exists nowhere else in the system, making a delivered SIEM\n * event deduplicable but unexplainable.\n \n ## Why the cutover is safe — the risk this looks like it carries, it does not\n \n Changing what a receiver deduplicates on normally risks re-accepting events at the switch. Not here:\n * the OLD value was a per-delivery random uuid, never reused and not re-derivable from anything, so\n * every id crossing the cutover is still one no receiver has ever seen. Nothing is re-delivered and\n * nothing is newly deduped away.\n \n What genuinely changes is the FAN-OUT. `AuditLogsBackendService` dispatches one audit event to each\n * of the user's verified member orgs, so those N deliveries now carry ONE id instead of N. They go to\n * N different tenants' sinks, so there is no cross-receiver dedup interaction — and one id is the\n * truthful statement, because it is one event. (The DLQ row records this id too, so a dead letter is\n * now joinable to its audit row as well; `SiemDeliveryDlqBaseSchema.eventId` carries no unique index,\n * so the shared id cannot collide there.)\n \n Per-attempt idempotency is untouched: the envelope is built ONCE, and both the in-process retry loop\n * in `SIEMWebhookDeliveryBackendService.processDelivery` and the DLQ drain re-send that same stored\n * object — so one delivery keeps one id across every attempt, which is exactly what a receiver's dedup\n * needs.\n \n ## The fallback, and why it is not a hedge\n \n `eventId` is required on `AuditableEvent` and the sole production caller always sets it, so this\n * branch should be unreachable. It exists because the two failures are ASYMMETRIC: an absent id is not\n * merely an unjoinable delivery, it is a delivery with NO dedup key at all — every projection renders\n * the field only `if (e.eventId)`, so the receiver stores `dedupKey: null` and answers `deduped: false`\n * forever against a service that retries and drains a DLQ. Losing the join degrades an investigation;\n * losing idempotency duplicates events inside a customer's SIEM. So an absent id still gets a minted\n * one, and is logged loudly rather than shipping a blank.\n /\n private _resolveEnvelopeEventId(auditEvent: Omit<AuditableEvent, '_id' \| 'createdAt' \| 'updatedAt'>): string {\n if (auditEvent.eventId) {\n return auditEvent.eventId;\n }\n\n const mintedEventId = uuidv4();\n this.logger.warn?.(\n 'Audit event reached SIEM dispatch with no eventId — the delivered envelope cannot be joined back to its audit row; minting a delivery-local id so receiver idempotency survives',\n { eventType: auditEvent.eventType, mintedEventId },\n );\n return mintedEventId;\n }\n\n /\n Infer success/failure outcome from event type.\n /\n private _inferOutcome(eventType: string): AuditEventOutcome {\n const failureEventTypes = [\n CoreAuditableEventType.USER_LOGIN_FAILED,\n CoreAuditableEventType.USER_ACCOUNT_LOCKED,\n CoreAuditableEventType.USER_SSO_LOGIN_FAILED,\n CoreAuditableEventType.USER_SSO_ENFORCEMENT_BLOCKED,\n CoreAuditableEventType.SAML_LOGIN_FAILED,\n CoreAuditableEventType.SAML_ASSERTION_REPLAY_DETECTED,\n CoreAuditableEventType.MACHINE_AUTH_FAILED,\n ];\n\n return failureEventTypes.includes(eventType as CoreAuditableEventType) ? AuditEventOutcome.FAILURE : AuditEventOutcome.SUCCESS;\n }\n\n // ─────────────────────────────────────────────────────────────\n // F3: Organization Name Cache\n // ─────────────────────────────────────────────────────────────\n\n /\n F3: resolve an organization NAME for SIEM-analyst readability, through the leased cache.\n \n Renames are picked up within {@link ORG_NAME_REFRESH_AFTER_MS} — read that constant for why this\n * lease is five minutes while the routing config's is sixty seconds. There is no invalidation hook on\n * this one, deliberately: a stale label costs a reader nothing (the `organizationId` beside it in the\n * envelope is authoritative and always current), so the lease alone is a proportionate answer.\n \n Never throws — a missing name is optional in the envelope, and this runs on a fire-and-forget path.\n * The loader therefore swallows its own failure and yields `undefined`, which means the COLD path of\n * {@link LeasedValueCache} can never reject here.\n \n `undefined` IS cached, and that is a fix rather than an oversight. Before this, a lookup that\n * failed or returned a nameless row cached nothing, so an organization whose read kept failing was\n * re-read on EVERY exported event — the read amplification a cache exists to prevent, arriving\n * precisely when the repository is already unhealthy. Caching the negative bounds it to one read per\n * lease, and a rename or a repaired read still lands within that lease.\n \n The loader closes over `ec` — the audit service's synthesised super-admin APPLICATION-scoped temp\n * context (`audit-logs.backend.service.ts:284` → `:349`), identical in privilege on every dispatch —\n * which is the precondition {@link LeasedValueCache} states for joining an in-flight load.\n /\n private async _resolveOrgName(ec: ExecutionContext<any>, organizationId: string): Promise<string \| undefined> {\n return this._orgNameCache.get(organizationId, async () => {\n try {\n const orgsRepo = this.repositoriesRegistry.getRepositoryOrThrow(CoreResourceType.ORGANIZATIONS);\n const org = await orgsRepo.read<{ _id: string; name: string }>(ec, organizationId);\n return org?.name \|\| undefined;\n } catch {\n // Fire-and-forget — org name is optional in the envelope.\n return undefined;\n }\n });\n }\n\n // ─────────────────────────────────────────────────────────────\n // F6: Event Integrity (HMAC)\n // ─────────────────────────────────────────────────────────────\n\n /\n F6: Compute HMAC-SHA256 over the serialized envelope for integrity protection.\n * The delivery service verifies this HMAC before processing, detecting queue tampering.\n /\n private _computeEnvelopeHmac(envelope: SecurityAuditEventEnvelope): string {\n const hmacKey = this._getHmacKey();\n return createHmac('sha256', hmacKey)\n .update(JSON.stringify(envelope))\n .digest('hex');\n }\n\n /\n Derive a 256-bit HMAC key from the app's session encryption key\n * using SHA-256 with a domain separator (consistent with SIEM encryption key derivation).\n /\n private _getHmacKey(): Buffer {\n return createHash('sha256')\n .update(`${SIEM_HMAC_DOMAIN}:${this.appConfigService.secrets.security.session.encryptionKey}`)\n .digest();\n }\n\n /\n F6: Public static-like method to verify envelope HMAC on the delivery side.\n * Returns true if the HMAC matches, false otherwise.\n */\n public verifyEnvelopeHmac(envelope: SecurityAuditEventEnvelope, expectedHmac: string): boolean {\n const computedHmac = this._computeEnvelopeHmac(envelope);\n // Use crypto.timingSafeEqual for constant-time comparison (prevents timing attacks)\n const computedBuf = Buffer.from(computedHmac, 'utf-8');\n const expectedBuf = Buffer.from(expectedHmac, 'utf-8');\n if (computedBuf.length !== expectedBuf.length) return false;\n return timingSafeEqual(computedBuf, expectedBuf);\n }\n}\n"]}

package/dist/esm/compliance/audit-trails/services/audit-logs.backend.service.d.ts CHANGED Viewed

@@ -5,7 +5,7 @@ import { RepositoriesRegistryHandlerBackendService } from '../../../base-classes
 import { AuditEventDispatcherBackendService } from './audit-event-dispatcher.backend.service';
 import type { MetricsService } from '../../../monitoring/observability/services/metrics.service';
 import type { AuditLogSink, UserTypesConfig } from '@wildo-ai/saas-models';
-import { SiemExportChangeType, SsoConfigChangeType, SsoConnectionType, AuditableEvent, AccountLockoutReason, AdministrativeContinuityBreachDetection, ApplicationAuthPolicySnapshot, AuditableEvent_ResourceOperationPerformed_EventData, AuditableEvent_HttpApiReadThroughAccess_EventData, AuditableEvent_HttpApiExternalErasure_EventData, AuditableEvent_HttpApiNonErasureAcknowledged_EventData, AuditableEvent_PlatformDirectoryAccess_EventData, AuditableEvent_ResourceOperationDenied_EventData, ProviderCredentialDeletionReason, ProviderCredentialResolutionSource, OAuthCodeExchangeFailureReason, CoreAuditableEventType, ExecutionContext_ExecutionType, MachineAccessOperation, ResourceServerKind, ResourceOperationRiskLevel, ResourceOperationVariantType, ResourceType, AuthScopeType, PlatformAccessGrantAutoApprovalReason, PlatformAccessGrantLifecycleTransition, PlatformAccessGrantStatus } from '@wildo-ai/saas-models';
+import { SiemExportChangeType, SsoConfigChangeType, SsoConnectionType, AuditableEvent, AccountLockoutReason, AdministrativeContinuityBreachDetection, ApplicationAuthPolicySnapshot, AuditableEvent_ResourceOperationPerformed_EventData, AuditableEvent_HttpApiReadThroughAccess_EventData, AuditableEvent_McpToolCall_EventData, AuditableEvent_AgentToolApprovalModified_EventData, AuditableEvent_ProviderOperationCall_EventData, AuditableEvent_HttpApiExternalErasure_EventData, AuditableEvent_HttpApiNonErasureAcknowledged_EventData, AuditableEvent_PlatformDirectoryAccess_EventData, AuditableEvent_ResourceOperationDenied_EventData, ProviderCredentialDeletionReason, ProviderCredentialResolutionSource, OAuthCodeExchangeFailureReason, CoreAuditableEventType, ExecutionContext_ExecutionType, MachineAccessOperation, ResourceServerKind, ResourceOperationRiskLevel, ResourceOperationVariantType, ResourceType, AuthScopeType, PlatformAccessGrantAutoApprovalReason, PlatformAccessGrantScope, PlatformAccessGrantLifecycleTransition, PlatformAccessGrantStatus } from '@wildo-ai/saas-models';
 import type { VerifiedOrgId } from '@wildo-ai/saas-models';
 import { CoreResourceOperation } from '@wildo-ai/saas-models';
 import { ExecutionContext, type SocketAuthResult } from '../../../runtime/models/execution-context.backend.schemas';
@@ -231,10 +231,27 @@ export declare class AuditLogsBackendService {
      *
      * assurance-control: WILDO.ACCESS.PRIVILEGE_EVIDENCE
      */
+    /**
+     * Record one access-grant transition — TENANT or APPLICATION-WIDE, on the same event.
+     *
+     * ONE method for both scopes, deliberately. The lifecycle really is the same lifecycle (requested,
+     * decided, revoked, expired), and a reviewer's question is *"what elevated access was granted, to
+     * whom, by whom?"* — a question that must be answerable with one query, not by remembering to union
+     * two event types. `grantScope` is what separates them within the answer, and it is a field rather
+     * than an inference from `targetOrganizationId`'s absence: a scrubbed or lost tenant id would
+     * otherwise read as an application-wide elevation, which is the more alarming of the two.
+     *
+     * The application-wide row is HIGH by default. It is not an exception path like
+     * `TENANT_CANNOT_APPROVE`; it is the ordinary shape of the widest elevation the system issues, and
+     * a reviewer who filters to HIGH should see every one of them.
+     */
     logPlatformAccessGrantLifecycle(data: {
         transition: PlatformAccessGrantLifecycleTransition;
         grantId: string;
-        targetOrganizationId: string;
+        /** Absent exactly when `grantScope` is APPLICATION_WIDE — that elevation names no tenant. */
+        targetOrganizationId?: string;
+        /** Defaults to TENANT so an existing caller keeps its meaning without restating it. */
+        grantScope?: PlatformAccessGrantScope;
         operatorUserId: string;
         justification?: string;
         resultingStatus: PlatformAccessGrantStatus;
@@ -252,6 +269,8 @@ export declare class AuditLogsBackendService {
         variantKey?: string;
         targetResourceIds?: string[];
         authorizingGrantId?: string;
+        /** WHICH collection `authorizingGrantId` names — the two grant resources are two collections. */
+        authorizingGrantScope?: PlatformAccessGrantScope;
         admissionDeclared: boolean;
         initiatorRoles: string[];
         executionType: ExecutionContext_ExecutionType;
@@ -686,6 +705,72 @@ export declare class AuditLogsBackendService {
      * real initiating user carried through the shared service principal.
      */
     logHttpApiReadThroughAccess(data: Omit<AuditableEvent_HttpApiReadThroughAccess_EventData, 'eventType'>, requestExecutionContext?: ExecutionContext<any>): Promise<void>;
+    /**
+     * Record ONE outbound call to a third-party provider — the trail behind
+     * {@link CoreAuditableEventType.PROVIDER_OPERATION_CALL}, emitted by the provider-operation
+     * executor on both the success and the failure path.
+     *
+     * The top-level `userId` is the REAL initiating user, and `organizationId` is the tenant the
+     * REQUEST was scoped to — NOT the tenant whose account was spent. Those two differ exactly where
+     * it matters: one user action fanning out to every organization that user belongs to spends N
+     * accounts under one initiating scope, and the account actually spent rides
+     * `eventData.connectionOwnerScope` / `connectionOwnerId`. Writing the connection owner into the
+     * row's `organizationId` would make the fan-out's calls read as if each had been requested by the
+     * tenant it reached.
+     *
+     * `riskLevel` is per-emission because the static severity cannot be: an outbound WRITE to a third
+     * party is a materially different act from a read, and the operation catalogue's own
+     * classification vocabulary says so ("a caller decides retry-safety, an audit decides severity").
+     * MEDIUM for a WRITE, LOW for a READ — the same shape `COLLECTION_DATA_EXPORT` uses to separate a
+     * page download from a whole-table dump without splitting the event type.
+     *
+     * assurance-control: WILDO.AUDIT.ATTRIBUTION — an outbound provider call made on a user's behalf
+     * is recorded with the real initiating user beside the account it spent.
+     */
+    logProviderOperationCall(data: Omit<AuditableEvent_ProviderOperationCall_EventData, 'eventType'>, requestExecutionContext?: ExecutionContext<any>): Promise<void>;
+    /**
+     * Record that an AGENT reached an MCP server on somebody's behalf (#491) — the outbound trail for
+     * a tool call that leaves the trust boundary.
+     *
+     * One row per ATTEMPT, whatever the outcome. Recording only what worked would hide precisely what
+     * a reviewer looks for first: the refused targets, the calls that timed out, and the tools that
+     * answered with their own error. `outcome` carries the client's own vocabulary so the trail and
+     * the logs use the same words for the same thing.
+     *
+     * The top-level `userId` is the REAL initiating user and `organizationId` the tenant the TURN was
+     * scoped to — never the tenant whose credential was spent, which rides
+     * `eventData.connectionOwnerScope`. Same separation as the provider-call sibling above, for the
+     * same reason.
+     *
+     * `riskLevel` is per-emission and keys on the OUTCOME rather than on a declared verb, because an
+     * MCP tool has no declared verb: the tool list is discovered from the server at turn start and
+     * nothing says whether a tool reads or writes. MEDIUM for a refused target — an attempted egress a
+     * guard blocked is the row a reviewer wants raised — and LOW for everything else, including
+     * ordinary failures, which are noise until somebody is looking for them.
+     *
+     * assurance-control: WILDO.AUDIT.ATTRIBUTION — an agent's outbound tool call is recorded with the
+     * real initiating user beside the account it spent.
+     */
+    logMcpToolCall(data: Omit<AuditableEvent_McpToolCall_EventData, 'eventType'>, requestExecutionContext?: ExecutionContext<any>): Promise<void>;
+    /**
+     * Record that a human approver AUTHORED the arguments an approval-gated tool then ran with (#566).
+     *
+     * One row per MODIFIED approval. An approval that ran the call as proposed writes nothing here —
+     * this event answers "who wrote the arguments", and an approval that changed none did not.
+     *
+     * The top-level `userId` is the APPROVER, which on this plane is the only identity that can exist:
+     * a turn whose principal cannot answer a decision is denied rather than suspended, so nobody but a
+     * present, accountable human ever reaches this method.
+     *
+     * `riskLevel` is HIGH and does not vary. Every other per-emission risk level in this service keys
+     * on something the act might or might not have been; there is no such axis here, because the act
+     * itself is the whole finding — a person substituted their own arguments for the model's on a tool
+     * an author gated precisely because it was dangerous enough to need a human.
+     *
+     * assurance-control: WILDO.ACCESS.AUTHORIZATION_DECISION_AUDIT — an authorization decision that
+     * REWROTE the act it authorized is recorded with the person who wrote it.
+     */
+    logAgentToolApprovalModified(data: Omit<AuditableEvent_AgentToolApprovalModified_EventData, 'eventType'>, requestExecutionContext?: ExecutionContext<any>): Promise<void>;
     /**
      * Record that a subject erasure invoked an HTTP_API binding's DECLARED external-erasure
      * operation (ETL D6 stance 6b) — remote rows linked to the erased subject were deleted in a
@@ -1178,7 +1263,6 @@ export declare class AuditLogsBackendService {
      * policy is recorded as an attributable, durable audit event.
      */
     logApplicationAuthPolicyChanged(data: {
-        applicationId: string;
         changedUserTypes: string[];
         snapshotDigest: string;
         before: Record<string, ApplicationAuthPolicySnapshot> | null;
@@ -1205,7 +1289,6 @@ export declare class AuditLogsBackendService {
      * detected at startup and evidenced in the audit trail, once per genuine change.
      */
     emitApplicationAuthPolicyChangeIfChanged(data: {
-        applicationId: string;
         userTypes: UserTypesConfig;
     }): Promise<void>;
     /**
@@ -1620,6 +1703,26 @@ export declare class AuditLogsBackendService {
         ipAddress: string;
         userAgent: string;
     }): Promise<void>;
+    /**
+     * An enterprise OIDC login refused because the provider did not report the demanded authentication
+     * context (issue #444).
+     *
+     * NO tenant scope on the payload, and that is deliberate rather than an omission: the refusal
+     * happens during the callback, before the claimant is provisioned or linked, so there is no
+     * verified organization to attribute it to. Inventing one from an unverified email domain would
+     * put an attacker-chosen tenant id on a security event.
+     *
+     * HIGH risk, unlike its `OAUTH2_PROVIDER_BLOCKED` neighbour at MEDIUM. That one records a policy
+     * that worked; this one records a step-up demand the identity provider did NOT satisfy, which is
+     * either a misconfiguration leaving an operator's strongest control inert or a provider behaving
+     * differently from what was agreed. Both want a reader.
+     */
+    logOidcAcrDemandUnsatisfied(data: {
+        providerRef: string;
+        demandedAcrValues: string[];
+        receivedAcr?: string;
+        failureReason?: string;
+    }): Promise<void>;
     logUserPasswordChanged(data: {
         userId: string;
         ipAddress: string;