{"version":3,"sources":["../../src/integrations/audit-log.ts"],"sourcesContent":["import type { RbacAuditEvent, RbacAuditLogger } from '../interfaces';\n\nexport interface AuditLogLike {\n  log(event: Record<string, unknown>): void | Promise<void>;\n}\n\nexport interface AuditLogRbacLoggerOptions {\n  auditLog: AuditLogLike;\n  source?: string | undefined;\n}\n\nconst sensitiveKeyFragments = [\n  'apikeysecret',\n  'authorization',\n  'attributes',\n  'headers',\n  'password',\n  'secret',\n  'token',\n  'body',\n];\n\nfunction isSensitiveKey(key: string): boolean {\n  const normalized = key.toLowerCase().replaceAll(/[^a-z0-9]/g, '');\n\n  return sensitiveKeyFragments.some((fragment) => normalized.includes(fragment));\n}\n\nfunction sanitizeMetadata(value: unknown): unknown {\n  if (Array.isArray(value)) {\n    return value.map(sanitizeMetadata);\n  }\n\n  if (value instanceof Date) {\n    return value;\n  }\n\n  if (value !== null && typeof value === 'object') {\n    const sanitized: Record<string, unknown> = {};\n    for (const [key, nestedValue] of Object.entries(value)) {\n      if (isSensitiveKey(key)) continue;\n      sanitized[key] = sanitizeMetadata(nestedValue);\n    }\n\n    return sanitized;\n  }\n\n  return value;\n}\n\nfunction auditResult(type: RbacAuditEvent['type']): 'success' | 'failure' {\n  return type.endsWith('.denied') ? 'failure' : 'success';\n}\n\nexport function createAuditLogRbacLogger(\n  options: AuditLogRbacLoggerOptions,\n): RbacAuditLogger {\n  return {\n    async log(event) {\n      await options.auditLog.log({\n        action: event.type,\n        source: options.source ?? 'rbac',\n        result: auditResult(event.type),\n        ...(event.subjectType !== undefined ? { actorType: event.subjectType } : {}),\n        ...(event.subjectId !== undefined ? { actorId: event.subjectId } : {}),\n        ...(event.tenantId !== undefined ? { tenantId: event.tenantId } : {}),\n        ...(event.metadata !== undefined ? { metadata: sanitizeMetadata(event.metadata) } : {}),\n      });\n    },\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;AAWA;;;;;AAAA,IAAMA,wBAAwB;EAC5B;EACA;EACA;EACA;EACA;EACA;EACA;EACA;;AAGF,SAASC,eAAeC,KAAW;AACjC,QAAMC,aAAaD,IAAIE,YAAW,EAAGC,WAAW,cAAc,EAAA;AAE9D,SAAOL,sBAAsBM,KAAK,CAACC,aAAaJ,WAAWK,SAASD,QAAAA,CAAAA;AACtE;AAJSN;AAMT,SAASQ,iBAAiBC,OAAc;AACtC,MAAIC,MAAMC,QAAQF,KAAAA,GAAQ;AACxB,WAAOA,MAAMG,IAAIJ,gBAAAA;EACnB;AAEA,MAAIC,iBAAiBI,MAAM;AACzB,WAAOJ;EACT;AAEA,MAAIA,UAAU,QAAQ,OAAOA,UAAU,UAAU;AAC/C,UAAMK,YAAqC,CAAC;AAC5C,eAAW,CAACb,KAAKc,WAAAA,KAAgBC,OAAOC,QAAQR,KAAAA,GAAQ;AACtD,UAAIT,eAAeC,GAAAA,EAAM;AACzBa,gBAAUb,GAAAA,IAAOO,iBAAiBO,WAAAA;IACpC;AAEA,WAAOD;EACT;AAEA,SAAOL;AACT;AApBSD;AAsBT,SAASU,YAAYC,MAA4B;AAC/C,SAAOA,KAAKC,SAAS,SAAA,IAAa,YAAY;AAChD;AAFSF;AAIF,SAASG,yBACdC,SAAkC;AAElC,SAAO;IACL,MAAMC,IAAIC,OAAK;AACb,YAAMF,QAAQG,SAASF,IAAI;QACzBG,QAAQF,MAAML;QACdQ,QAAQL,QAAQK,UAAU;QAC1BC,QAAQV,YAAYM,MAAML,IAAI;QAC9B,GAAIK,MAAMK,gBAAgBC,SAAY;UAAEC,WAAWP,MAAMK;QAAY,IAAI,CAAC;QAC1E,GAAIL,MAAMQ,cAAcF,SAAY;UAAEG,SAAST,MAAMQ;QAAU,IAAI,CAAC;QACpE,GAAIR,MAAMU,aAAaJ,SAAY;UAAEI,UAAUV,MAAMU;QAAS,IAAI,CAAC;QACnE,GAAIV,MAAMW,aAAaL,SAAY;UAAEK,UAAU3B,iBAAiBgB,MAAMW,QAAQ;QAAE,IAAI,CAAC;MACvF,CAAA;IACF;EACF;AACF;AAhBgBd;","names":["sensitiveKeyFragments","isSensitiveKey","key","normalized","toLowerCase","replaceAll","some","fragment","includes","sanitizeMetadata","value","Array","isArray","map","Date","sanitized","nestedValue","Object","entries","auditResult","type","endsWith","createAuditLogRbacLogger","options","log","event","auditLog","action","source","result","subjectType","undefined","actorType","subjectId","actorId","tenantId","metadata"]}