// SPDX-License-Identifier: Apache-2.0
// Copyright 2024-2026 Vorion LLC
/**
 * Security Event Type Definitions
 *
 * Comprehensive security event types for SOC 2 compliance audit logging.
 * Every security-relevant action must be categorized and logged with full context.
 *
 * @packageDocumentation
 */
import { z } from 'zod';
// =============================================================================
// SECURITY EVENT CATEGORIES
// =============================================================================
/**
 * Security event categories for SOC 2 compliance
 */
export const SECURITY_EVENT_CATEGORIES = [
    'authentication',
    'authorization',
    'data_access',
    'configuration',
    'incident',
];
// =============================================================================
// SECURITY EVENT SEVERITY
// =============================================================================
/**
 * Security event severity levels aligned with SOC 2 requirements
 */
export const SECURITY_SEVERITIES = ['info', 'low', 'medium', 'high', 'critical'];
// =============================================================================
// SECURITY EVENT OUTCOMES
// =============================================================================
/**
 * Security event outcomes for decision tracking
 */
export const SECURITY_OUTCOMES = ['success', 'failure', 'blocked', 'escalated'];
// =============================================================================
// AUTHENTICATION EVENT TYPES
// =============================================================================
/**
 * Authentication event types
 */
export const AUTHENTICATION_EVENT_TYPES = {
    // Login/Logout
    LOGIN_SUCCESS: {
        category: 'authentication',
        severity: 'info',
        description: 'User successfully authenticated',
        soc2Control: 'CC6.1',
    },
    LOGIN_FAILURE: {
        category: 'authentication',
        severity: 'medium',
        description: 'Authentication attempt failed',
        soc2Control: 'CC6.1',
    },
    LOGOUT: {
        category: 'authentication',
        severity: 'info',
        description: 'User logged out',
        soc2Control: 'CC6.1',
    },
    LOGIN_LOCKED: {
        category: 'authentication',
        severity: 'high',
        description: 'Account locked due to failed attempts',
        soc2Control: 'CC6.1',
    },
    // Session events
    SESSION_CREATED: {
        category: 'authentication',
        severity: 'info',
        description: 'New session established',
        soc2Control: 'CC6.1',
    },
    SESSION_VALIDATED: {
        category: 'authentication',
        severity: 'info',
        description: 'Session validated successfully',
        soc2Control: 'CC6.1',
    },
    SESSION_INVALID: {
        category: 'authentication',
        severity: 'medium',
        description: 'Session validation failed',
        soc2Control: 'CC6.1',
    },
    SESSION_EXPIRED: {
        category: 'authentication',
        severity: 'info',
        description: 'Session expired naturally',
        soc2Control: 'CC6.1',
    },
    SESSION_REVOKED: {
        category: 'authentication',
        severity: 'medium',
        description: 'Session forcibly terminated',
        soc2Control: 'CC6.1',
    },
    SESSIONS_BULK_REVOKED: {
        category: 'authentication',
        severity: 'high',
        description: 'Multiple sessions revoked for user',
        soc2Control: 'CC6.1',
    },
    // Token events
    TOKEN_ISSUED: {
        category: 'authentication',
        severity: 'info',
        description: 'Access token issued',
        soc2Control: 'CC6.1',
    },
    TOKEN_REFRESHED: {
        category: 'authentication',
        severity: 'info',
        description: 'Access token refreshed',
        soc2Control: 'CC6.1',
    },
    TOKEN_REVOKED: {
        category: 'authentication',
        severity: 'medium',
        description: 'Token manually revoked',
        soc2Control: 'CC6.1',
    },
    TOKEN_VALIDATION_FAILED: {
        category: 'authentication',
        severity: 'medium',
        description: 'Token validation failed',
        soc2Control: 'CC6.1',
    },
    // API Key events
    API_KEY_CREATED: {
        category: 'authentication',
        severity: 'medium',
        description: 'API key created',
        soc2Control: 'CC6.1',
    },
    API_KEY_VALIDATED: {
        category: 'authentication',
        severity: 'info',
        description: 'API key validated successfully',
        soc2Control: 'CC6.1',
    },
    API_KEY_VALIDATION_FAILED: {
        category: 'authentication',
        severity: 'medium',
        description: 'API key validation failed',
        soc2Control: 'CC6.1',
    },
    API_KEY_REVOKED: {
        category: 'authentication',
        severity: 'medium',
        description: 'API key revoked',
        soc2Control: 'CC6.1',
    },
    API_KEY_ROTATED: {
        category: 'authentication',
        severity: 'medium',
        description: 'API key rotated',
        soc2Control: 'CC6.1',
    },
    API_KEY_EXPIRED: {
        category: 'authentication',
        severity: 'info',
        description: 'API key expired',
        soc2Control: 'CC6.1',
    },
    API_KEY_DELETED: {
        category: 'authentication',
        severity: 'medium',
        description: 'API key permanently deleted',
        soc2Control: 'CC6.1',
    },
    API_KEY_RATE_LIMITED: {
        category: 'authentication',
        severity: 'medium',
        description: 'API key rate limit exceeded',
        soc2Control: 'CC6.1',
    },
    // MFA events
    MFA_ENROLLED: {
        category: 'authentication',
        severity: 'medium',
        description: 'MFA enrollment completed',
        soc2Control: 'CC6.1',
    },
    MFA_ENROLLMENT_STARTED: {
        category: 'authentication',
        severity: 'info',
        description: 'MFA enrollment initiated',
        soc2Control: 'CC6.1',
    },
    MFA_ENROLLMENT_VERIFIED: {
        category: 'authentication',
        severity: 'info',
        description: 'MFA enrollment code verified',
        soc2Control: 'CC6.1',
    },
    MFA_ENROLLMENT_FAILED: {
        category: 'authentication',
        severity: 'medium',
        description: 'MFA enrollment verification failed',
        soc2Control: 'CC6.1',
    },
    MFA_DISABLED: {
        category: 'authentication',
        severity: 'high',
        description: 'MFA disabled for user',
        soc2Control: 'CC6.1',
    },
    MFA_CHALLENGE_CREATED: {
        category: 'authentication',
        severity: 'info',
        description: 'MFA challenge initiated',
        soc2Control: 'CC6.1',
    },
    MFA_VERIFICATION_SUCCESS: {
        category: 'authentication',
        severity: 'info',
        description: 'MFA verification successful',
        soc2Control: 'CC6.1',
    },
    MFA_VERIFICATION_FAILED: {
        category: 'authentication',
        severity: 'medium',
        description: 'MFA verification failed',
        soc2Control: 'CC6.1',
    },
    MFA_BACKUP_CODE_USED: {
        category: 'authentication',
        severity: 'medium',
        description: 'MFA backup code used',
        soc2Control: 'CC6.1',
    },
    MFA_BACKUP_CODES_REGENERATED: {
        category: 'authentication',
        severity: 'medium',
        description: 'MFA backup codes regenerated',
        soc2Control: 'CC6.1',
    },
    MFA_TOO_MANY_ATTEMPTS: {
        category: 'authentication',
        severity: 'high',
        description: 'MFA verification exceeded maximum attempts',
        soc2Control: 'CC6.1',
    },
    // Password events
    PASSWORD_CHANGED: {
        category: 'authentication',
        severity: 'medium',
        description: 'Password changed',
        soc2Control: 'CC6.1',
    },
    PASSWORD_RESET_REQUESTED: {
        category: 'authentication',
        severity: 'info',
        description: 'Password reset requested',
        soc2Control: 'CC6.1',
    },
    PASSWORD_RESET_COMPLETED: {
        category: 'authentication',
        severity: 'medium',
        description: 'Password reset completed',
        soc2Control: 'CC6.1',
    },
};
// =============================================================================
// AUTHORIZATION EVENT TYPES
// =============================================================================
/**
 * Authorization event types
 */
export const AUTHORIZATION_EVENT_TYPES = {
    ACCESS_GRANTED: {
        category: 'authorization',
        severity: 'info',
        description: 'Access granted to resource',
        soc2Control: 'CC6.2',
    },
    ACCESS_DENIED: {
        category: 'authorization',
        severity: 'medium',
        description: 'Access denied to resource',
        soc2Control: 'CC6.2',
    },
    PERMISSION_GRANTED: {
        category: 'authorization',
        severity: 'medium',
        description: 'Permission granted to user',
        soc2Control: 'CC6.2',
    },
    PERMISSION_REVOKED: {
        category: 'authorization',
        severity: 'medium',
        description: 'Permission revoked from user',
        soc2Control: 'CC6.2',
    },
    ROLE_ASSIGNED: {
        category: 'authorization',
        severity: 'medium',
        description: 'Role assigned to user',
        soc2Control: 'CC6.2',
    },
    ROLE_REMOVED: {
        category: 'authorization',
        severity: 'medium',
        description: 'Role removed from user',
        soc2Control: 'CC6.2',
    },
    PRIVILEGE_ESCALATED: {
        category: 'authorization',
        severity: 'high',
        description: 'Privilege escalation occurred',
        soc2Control: 'CC6.2',
    },
    TRUST_TIER_CHANGED: {
        category: 'authorization',
        severity: 'medium',
        description: 'Entity trust tier changed',
        soc2Control: 'CC6.2',
    },
    POLICY_EVALUATED: {
        category: 'authorization',
        severity: 'info',
        description: 'Authorization policy evaluated',
        soc2Control: 'CC6.2',
    },
    POLICY_VIOLATION: {
        category: 'authorization',
        severity: 'high',
        description: 'Policy violation detected',
        soc2Control: 'CC6.2',
    },
    SCOPE_CHECK_PASSED: {
        category: 'authorization',
        severity: 'info',
        description: 'Scope check passed',
        soc2Control: 'CC6.2',
    },
    SCOPE_CHECK_FAILED: {
        category: 'authorization',
        severity: 'medium',
        description: 'Scope check failed',
        soc2Control: 'CC6.2',
    },
    DPOP_VERIFIED: {
        category: 'authorization',
        severity: 'info',
        description: 'DPoP proof verified successfully',
        soc2Control: 'CC6.2',
    },
    DPOP_FAILED: {
        category: 'authorization',
        severity: 'medium',
        description: 'DPoP proof verification failed',
        soc2Control: 'CC6.2',
    },
    AGENT_REVOKED: {
        category: 'authorization',
        severity: 'high',
        description: 'Agent access revoked',
        soc2Control: 'CC6.2',
    },
};
// =============================================================================
// DATA ACCESS EVENT TYPES
// =============================================================================
/**
 * Data access event types
 */
export const DATA_ACCESS_EVENT_TYPES = {
    DATA_READ: {
        category: 'data_access',
        severity: 'info',
        description: 'Data read operation',
        soc2Control: 'CC6.5',
    },
    DATA_CREATED: {
        category: 'data_access',
        severity: 'info',
        description: 'Data created',
        soc2Control: 'CC6.5',
    },
    DATA_UPDATED: {
        category: 'data_access',
        severity: 'info',
        description: 'Data updated',
        soc2Control: 'CC6.5',
    },
    DATA_DELETED: {
        category: 'data_access',
        severity: 'medium',
        description: 'Data deleted',
        soc2Control: 'CC6.5',
    },
    DATA_EXPORTED: {
        category: 'data_access',
        severity: 'high',
        description: 'Data exported',
        soc2Control: 'CC6.5',
    },
    BULK_DATA_ACCESS: {
        category: 'data_access',
        severity: 'high',
        description: 'Bulk data access operation',
        soc2Control: 'CC6.5',
    },
    SENSITIVE_DATA_ACCESS: {
        category: 'data_access',
        severity: 'high',
        description: 'Sensitive data accessed',
        soc2Control: 'CC6.5',
    },
    PII_ACCESSED: {
        category: 'data_access',
        severity: 'high',
        description: 'Personally identifiable information accessed',
        soc2Control: 'CC6.5',
    },
    AUDIT_LOG_ACCESSED: {
        category: 'data_access',
        severity: 'medium',
        description: 'Audit log accessed',
        soc2Control: 'CC6.5',
    },
    AUDIT_LOG_EXPORTED: {
        category: 'data_access',
        severity: 'high',
        description: 'Audit log exported',
        soc2Control: 'CC6.5',
    },
};
// =============================================================================
// CONFIGURATION EVENT TYPES
// =============================================================================
/**
 * Configuration event types
 */
export const CONFIGURATION_EVENT_TYPES = {
    CONFIG_CHANGED: {
        category: 'configuration',
        severity: 'high',
        description: 'System configuration changed',
        soc2Control: 'CC8.1',
    },
    SECURITY_SETTING_CHANGED: {
        category: 'configuration',
        severity: 'high',
        description: 'Security setting modified',
        soc2Control: 'CC8.1',
    },
    KEY_CREATED: {
        category: 'configuration',
        severity: 'high',
        description: 'Encryption key created',
        soc2Control: 'CC8.1',
    },
    KEY_ROTATED: {
        category: 'configuration',
        severity: 'high',
        description: 'Encryption key rotated',
        soc2Control: 'CC8.1',
    },
    KEY_REVOKED: {
        category: 'configuration',
        severity: 'critical',
        description: 'Encryption key revoked',
        soc2Control: 'CC8.1',
    },
    KEY_ACCESSED: {
        category: 'configuration',
        severity: 'medium',
        description: 'Encryption key accessed',
        soc2Control: 'CC8.1',
    },
    SECRET_ROTATED: {
        category: 'configuration',
        severity: 'high',
        description: 'Secret rotated',
        soc2Control: 'CC8.1',
    },
    SECRET_ACCESSED: {
        category: 'configuration',
        severity: 'medium',
        description: 'Secret accessed',
        soc2Control: 'CC8.1',
    },
    POLICY_CREATED: {
        category: 'configuration',
        severity: 'medium',
        description: 'Security policy created',
        soc2Control: 'CC8.1',
    },
    POLICY_UPDATED: {
        category: 'configuration',
        severity: 'high',
        description: 'Security policy updated',
        soc2Control: 'CC8.1',
    },
    POLICY_DELETED: {
        category: 'configuration',
        severity: 'high',
        description: 'Security policy deleted',
        soc2Control: 'CC8.1',
    },
    TENANT_CREATED: {
        category: 'configuration',
        severity: 'medium',
        description: 'Tenant created',
        soc2Control: 'CC8.1',
    },
    TENANT_UPDATED: {
        category: 'configuration',
        severity: 'medium',
        description: 'Tenant configuration updated',
        soc2Control: 'CC8.1',
    },
    USER_CREATED: {
        category: 'configuration',
        severity: 'medium',
        description: 'User account created',
        soc2Control: 'CC8.1',
    },
    USER_UPDATED: {
        category: 'configuration',
        severity: 'medium',
        description: 'User account updated',
        soc2Control: 'CC8.1',
    },
    USER_DELETED: {
        category: 'configuration',
        severity: 'high',
        description: 'User account deleted',
        soc2Control: 'CC8.1',
    },
    USER_DISABLED: {
        category: 'configuration',
        severity: 'medium',
        description: 'User account disabled',
        soc2Control: 'CC8.1',
    },
    USER_ENABLED: {
        category: 'configuration',
        severity: 'medium',
        description: 'User account enabled',
        soc2Control: 'CC8.1',
    },
};
// =============================================================================
// INCIDENT EVENT TYPES
// =============================================================================
/**
 * Incident and security alert event types
 */
export const INCIDENT_EVENT_TYPES = {
    BRUTE_FORCE_DETECTED: {
        category: 'incident',
        severity: 'critical',
        description: 'Brute force attack detected',
        soc2Control: 'CC7.2',
    },
    INJECTION_ATTEMPT: {
        category: 'incident',
        severity: 'critical',
        description: 'Injection attack attempt detected',
        soc2Control: 'CC7.2',
    },
    ANOMALY_DETECTED: {
        category: 'incident',
        severity: 'high',
        description: 'Anomalous behavior detected',
        soc2Control: 'CC7.2',
    },
    RATE_LIMIT_EXCEEDED: {
        category: 'incident',
        severity: 'medium',
        description: 'Rate limit exceeded',
        soc2Control: 'CC7.2',
    },
    IP_BLOCKED: {
        category: 'incident',
        severity: 'high',
        description: 'IP address blocked',
        soc2Control: 'CC7.2',
    },
    IP_UNBLOCKED: {
        category: 'incident',
        severity: 'medium',
        description: 'IP address unblocked',
        soc2Control: 'CC7.2',
    },
    SUSPICIOUS_ACTIVITY: {
        category: 'incident',
        severity: 'high',
        description: 'Suspicious activity flagged',
        soc2Control: 'CC7.2',
    },
    SECURITY_ALERT: {
        category: 'incident',
        severity: 'high',
        description: 'Security alert triggered',
        soc2Control: 'CC7.2',
    },
    INCIDENT_CREATED: {
        category: 'incident',
        severity: 'critical',
        description: 'Security incident created',
        soc2Control: 'CC7.3',
    },
    INCIDENT_UPDATED: {
        category: 'incident',
        severity: 'high',
        description: 'Security incident updated',
        soc2Control: 'CC7.3',
    },
    INCIDENT_RESOLVED: {
        category: 'incident',
        severity: 'medium',
        description: 'Security incident resolved',
        soc2Control: 'CC7.3',
    },
    GEOGRAPHIC_ANOMALY: {
        category: 'incident',
        severity: 'high',
        description: 'Geographic access anomaly detected',
        soc2Control: 'CC7.2',
    },
    TEMPORAL_ANOMALY: {
        category: 'incident',
        severity: 'medium',
        description: 'Temporal access anomaly detected',
        soc2Control: 'CC7.2',
    },
    VOLUME_ANOMALY: {
        category: 'incident',
        severity: 'high',
        description: 'Access volume anomaly detected',
        soc2Control: 'CC7.2',
    },
    CERTIFICATE_INVALID: {
        category: 'incident',
        severity: 'high',
        description: 'Invalid certificate detected',
        soc2Control: 'CC7.2',
    },
    INTEGRITY_VIOLATION: {
        category: 'incident',
        severity: 'critical',
        description: 'Data integrity violation detected',
        soc2Control: 'CC7.2',
    },
};
// =============================================================================
// ALL SECURITY EVENT TYPES
// =============================================================================
/**
 * Combined security event types for comprehensive logging
 */
export const SECURITY_EVENT_TYPES = {
    ...AUTHENTICATION_EVENT_TYPES,
    ...AUTHORIZATION_EVENT_TYPES,
    ...DATA_ACCESS_EVENT_TYPES,
    ...CONFIGURATION_EVENT_TYPES,
    ...INCIDENT_EVENT_TYPES,
};
/**
 * Zod schema for SecurityActor
 */
export const securityActorSchema = z.object({
    type: z.enum(['user', 'agent', 'service', 'system']),
    id: z.string(),
    name: z.string().optional(),
    email: z.string().email().optional(),
    ip: z.string().optional(),
    userAgent: z.string().optional(),
    sessionId: z.string().optional(),
    tenantId: z.string().optional(),
});
/**
 * Zod schema for SecurityResource
 */
export const securityResourceSchema = z.object({
    type: z.string(),
    id: z.string(),
    name: z.string().optional(),
    path: z.string().optional(),
    attributes: z.record(z.unknown()).optional(),
});
/**
 * Zod schema for SecurityEvent
 */
export const securityEventSchema = z.object({
    id: z.string().uuid(),
    timestamp: z.string().datetime(),
    eventType: z.string(),
    category: z.enum(SECURITY_EVENT_CATEGORIES),
    severity: z.enum(SECURITY_SEVERITIES),
    actor: securityActorSchema,
    action: z.string(),
    resource: securityResourceSchema,
    outcome: z.enum(SECURITY_OUTCOMES),
    metadata: z.record(z.unknown()).default({}),
    requestId: z.string(),
    traceId: z.string().optional(),
    reason: z.string().optional(),
    soc2Control: z.string().optional(),
    recordHash: z.string().optional(),
    previousHash: z.string().optional(),
    sequenceNumber: z.number().int().optional(),
});
/**
 * Zod schema for CreateSecurityEventInput
 */
export const createSecurityEventInputSchema = z.object({
    eventType: z.string(),
    actor: securityActorSchema,
    action: z.string(),
    resource: securityResourceSchema,
    outcome: z.enum(SECURITY_OUTCOMES),
    metadata: z.record(z.unknown()).optional(),
    reason: z.string().optional(),
    timestamp: z.string().datetime().optional(),
    requestId: z.string().optional(),
    traceId: z.string().optional(),
});
// =============================================================================
// HELPER FUNCTIONS
// =============================================================================
/**
 * Get event definition by type
 */
export function getSecurityEventDefinition(eventType) {
    const def = SECURITY_EVENT_TYPES[eventType];
    return {
        category: def.category,
        severity: def.severity,
        description: def.description,
        soc2Control: def.soc2Control,
    };
}
/**
 * Get all event types for a category
 */
export function getSecurityEventsByCategory(category) {
    return Object.entries(SECURITY_EVENT_TYPES)
        .filter(([_, def]) => def.category === category)
        .map(([type]) => type);
}
/**
 * Get all event types for a severity level
 */
export function getSecurityEventsBySeverity(severity) {
    return Object.entries(SECURITY_EVENT_TYPES)
        .filter(([_, def]) => def.severity === severity)
        .map(([type]) => type);
}
/**
 * Validate that a string is a valid security event type
 */
export function isValidSecurityEventType(type) {
    return type in SECURITY_EVENT_TYPES;
}
/**
 * Get all security event types
 */
export function getAllSecurityEventTypes() {
    return Object.keys(SECURITY_EVENT_TYPES);
}
/**
 * Get SOC 2 control for an event type
 */
export function getSoc2Control(eventType) {
    return SECURITY_EVENT_TYPES[eventType].soc2Control;
}
//# sourceMappingURL=security-events.js.map