feat: operationalize SecurityAuditService across core auth flows

.github/workflows/test.yml

@@ -5,6 +5,7 @@ on:
     branches: [main, master, develop]
   pull_request:
     branches: [main, master, develop]
+  workflow_dispatch:
 
 env:
   NODE_VERSION: '20'

apps/web/src/app/api/auth/__tests__/login-redirect.test.ts

@@ -59,6 +59,18 @@ vi.mock('@pagespace/lib/server', () => ({
   logSecurityEvent: vi.fn(),
 }));
 
+vi.mock('@pagespace/lib/audit', () => ({
+  securityAudit: {
+    logEvent: vi.fn().mockResolvedValue(undefined),
+  },
+  maskEmail: vi.fn((email: string) => {
+    const [local, domain] = email.split('@');
+    if (!local || !domain) return '***@***';
+    const visibleChars = Math.min(2, local.length);
+    return `${local.slice(0, visibleChars)}***@${domain}`;
+  }),
+}));
+
 vi.mock('@pagespace/lib/security', () => ({
   checkDistributedRateLimit: vi.fn(),
   resetDistributedRateLimit: vi.fn(),

apps/web/src/app/api/auth/__tests__/login.test.ts

@@ -73,6 +73,12 @@ vi.mock('@pagespace/lib/server', () => ({
   },
   logAuthEvent: vi.fn(),
   logSecurityEvent: vi.fn(),
+  securityAudit: {
+    logAuthSuccess: vi.fn().mockResolvedValue(undefined),
+    logAuthFailure: vi.fn().mockResolvedValue(undefined),
+    logTokenCreated: vi.fn().mockResolvedValue(undefined),
+    logAccessDenied: vi.fn().mockResolvedValue(undefined),
+  },
 }));
 
 // Mock distributed rate limiting (P1-T5)

apps/web/src/app/api/auth/__tests__/logout.test.ts

@@ -53,6 +53,10 @@ vi.mock('@pagespace/lib/server', () => ({
     },
   },
   logAuthEvent: vi.fn(),
+  securityAudit: {
+    logLogout: vi.fn().mockResolvedValue(undefined),
+    logTokenRevoked: vi.fn().mockResolvedValue(undefined),
+  },
 }));
 
 vi.mock('@pagespace/lib/activity-tracker', () => ({

apps/web/src/app/api/auth/login/route.ts

@@ -162,6 +162,7 @@ export async function POST(req: Request) {
       const reason = !user ? 'invalid_email' : 'invalid_password';
       logAuthEvent('failed', user?.id, email, clientIP, reason === 'invalid_email' ? 'Invalid email' : 'Invalid password');
       trackAuthEvent(user?.id, 'failed_login', { reason, email, ip: clientIP });
+      securityAudit.logAuthFailure(email, clientIP, reason).catch(() => {});
 
       // Record failed attempt for lockout tracking (only for existing users to avoid info leakage)
       if (user) {
@@ -217,6 +218,13 @@ export async function POST(req: Request) {
       ip: clientIP,
       userAgent: req.headers.get('user-agent')
     });
+    securityAudit.logAuthSuccess(
+      user.id,
+      sessionClaims.sessionId,
+      clientIP,
+      req.headers.get('user-agent') || 'unknown'
+    ).catch(() => {});
+    securityAudit.logTokenCreated(user.id, 'session', clientIP).catch(() => {});
 
     const headers = new Headers();
     appendSessionCookie(headers, sessionToken);

apps/web/src/app/api/auth/logout/route.ts

@@ -1,5 +1,5 @@
 import { sessionService } from '@pagespace/lib/auth';
-import { loggers, logAuthEvent } from '@pagespace/lib/server';
+import { loggers, logAuthEvent, securityAudit } from '@pagespace/lib/server';
 import { trackAuthEvent } from '@pagespace/lib/activity-tracker';
 import { getClientIP } from '@/lib/auth';
 import { getSessionFromCookies, appendClearCookies } from '@/lib/auth/cookie-config';
@@ -38,6 +38,8 @@ export async function POST(req: Request) {
       ip: clientIP,
       userAgent: req.headers.get('user-agent')
     });
+    securityAudit.logLogout(userId, sessionClaims?.sessionId ?? 'unknown', clientIP).catch(() => {});
+    securityAudit.logTokenRevoked(userId, 'session', 'user_logout').catch(() => {});
   }
 
   const headers = new Headers();

apps/web/src/lib/auth/__tests__/auth.test.ts

@@ -22,6 +22,9 @@ vi.mock('../csrf-validation', () => ({
 // Mock security event logging
 vi.mock('@pagespace/lib/server', () => ({
   logSecurityEvent: vi.fn(),
+  securityAudit: {
+    logAccessDenied: vi.fn().mockResolvedValue(undefined),
+  },
 }));
 
 import { authenticateSessionRequest } from '../index';

apps/web/src/lib/auth/auth.ts

@@ -2,8 +2,7 @@ import { NextResponse } from 'next/server';
 import { authenticateSessionRequest, isAuthError } from './index';
 import { validateAdminAccess, type AdminValidationResult } from './admin-role';
 import { validateCSRF } from './csrf-validation';
-import { logSecurityEvent } from '@pagespace/lib/server';
-import { securityAudit } from '@pagespace/lib/audit/security-audit';
+import { logSecurityEvent, securityAudit } from '@pagespace/lib/server';
 
 export interface VerifiedUser {
   id: string;
@@ -131,6 +130,7 @@ export async function verifyAdminAuth(request: Request): Promise<VerifiedUser |
         authType: 'session',
         action: 'deny_access',
       });
+      securityAudit.logAccessDenied(user.id, 'admin_route', method, 'csrf_validation_failed').catch(() => {});
       // Return the CSRF error response directly to preserve error codes
       return csrfError;
     }
@@ -152,6 +152,12 @@ export async function verifyAdminAuth(request: Request): Promise<VerifiedUser |
       authType: 'session',
       action: 'deny_access',
     });
+    securityAudit.logAccessDenied(
+      user.id,
+      'admin_route',
+      'admin_access',
+      validationResult.reason ?? 'admin_role_version_validation_failed'
+    ).catch(() => {});
     return NextResponse.json(
       { error: 'Forbidden: Admin access required' },
       { status: 403 }

packages/lib/src/audit/__tests__/security-audit-adapter.test.ts

@@ -0,0 +1,160 @@
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+
+vi.mock('../security-audit', () => ({
+  securityAudit: {
+    logEvent: vi.fn().mockResolvedValue(undefined),
+    logAuthSuccess: vi.fn().mockResolvedValue(undefined),
+    logAuthFailure: vi.fn().mockResolvedValue(undefined),
+    logAccessDenied: vi.fn().mockResolvedValue(undefined),
+    logTokenCreated: vi.fn().mockResolvedValue(undefined),
+    logTokenRevoked: vi.fn().mockResolvedValue(undefined),
+  },
+}));
+
+vi.mock('@pagespace/db', () => ({
+  securityAuditLog: {},
+}));
+
+import { auditAuthEvent, auditSecurityEvent } from '../security-audit-adapter';
+import { securityAudit } from '../security-audit';
+
+describe('Security Audit Adapter', () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+  });
+
+  describe('auditAuthEvent', () => {
+    it('dispatches login success to securityAudit.logEvent', () => {
+      auditAuthEvent('login', 'user-1', 'test@example.com', '1.2.3.4');
+
+      expect(securityAudit.logEvent).toHaveBeenCalledWith(
+        expect.objectContaining({
+          eventType: 'auth.login.success',
+          userId: 'user-1',
+          ipAddress: '1.2.3.4',
+        })
+      );
+    });
+
+    it('dispatches login failure with risk score', () => {
+      auditAuthEvent('failed', undefined, 'bad@example.com', '1.2.3.4', 'invalid_password');
+
+      expect(securityAudit.logEvent).toHaveBeenCalledWith(
+        expect.objectContaining({
+          eventType: 'auth.login.failure',
+          riskScore: 0.3,
+          details: expect.objectContaining({
+            reason: 'invalid_password',
+          }),
+        })
+      );
+    });
+
+    it('dispatches logout event', () => {
+      auditAuthEvent('logout', 'user-1', undefined, '1.2.3.4');
+
+      expect(securityAudit.logEvent).toHaveBeenCalledWith(
+        expect.objectContaining({
+          eventType: 'auth.logout',
+          userId: 'user-1',
+        })
+      );
+    });
+
+    it('dispatches token refresh event', () => {
+      auditAuthEvent('refresh', 'user-1', undefined, '1.2.3.4');
+
+      expect(securityAudit.logEvent).toHaveBeenCalledWith(
+        expect.objectContaining({
+          eventType: 'auth.token.created',
+          userId: 'user-1',
+        })
+      );
+    });
+
+    it('masks email in audit details', () => {
+      auditAuthEvent('login', 'user-1', 'longuser@example.com', '1.2.3.4');
+
+      expect(securityAudit.logEvent).toHaveBeenCalledWith(
+        expect.objectContaining({
+          details: expect.objectContaining({
+            email: 'lo***@example.com',
+          }),
+        })
+      );
+    });
+
+    it('does not throw when securityAudit.logEvent rejects', () => {
+      vi.mocked(securityAudit.logEvent).mockRejectedValueOnce(new Error('DB down'));
+
+      expect(() => {
+        auditAuthEvent('login', 'user-1', 'test@example.com', '1.2.3.4');
+      }).not.toThrow();
+    });
+  });
+
+  describe('auditSecurityEvent', () => {
+    it('dispatches unauthorized as access denied', () => {
+      auditSecurityEvent('unauthorized', {
+        userId: 'user-1',
+        ip: '1.2.3.4',
+        reason: 'csrf_failed',
+      });
+
+      expect(securityAudit.logEvent).toHaveBeenCalledWith(
+        expect.objectContaining({
+          eventType: 'authz.access.denied',
+          userId: 'user-1',
+          ipAddress: '1.2.3.4',
+          details: expect.objectContaining({
+            reason: 'csrf_failed',
+            originalEvent: 'unauthorized',
+          }),
+        })
+      );
+    });
+
+    it('dispatches rate_limit event', () => {
+      auditSecurityEvent('rate_limit', {
+        ip: '1.2.3.4',
+        endpoint: '/api/auth/login',
+      });
+
+      expect(securityAudit.logEvent).toHaveBeenCalledWith(
+        expect.objectContaining({
+          eventType: 'security.rate.limited',
+          ipAddress: '1.2.3.4',
+          riskScore: 0.4,
+        })
+      );
+    });
+
+    it('dispatches account_locked_login_attempt with high risk score', () => {
+      auditSecurityEvent('account_locked_login_attempt', {
+        email: 'locked@test.com',
+        ip: '1.2.3.4',
+      });
+
+      expect(securityAudit.logEvent).toHaveBeenCalledWith(
+        expect.objectContaining({
+          eventType: 'security.brute.force.detected',
+          riskScore: 0.8,
+        })
+      );
+    });
+
+    it('skips unmapped security events without calling logEvent', () => {
+      auditSecurityEvent('login_csrf_missing', { ip: '1.2.3.4' });
+
+      expect(securityAudit.logEvent).not.toHaveBeenCalled();
+    });
+
+    it('does not throw when securityAudit.logEvent rejects', () => {
+      vi.mocked(securityAudit.logEvent).mockRejectedValueOnce(new Error('DB down'));
+
+      expect(() => {
+        auditSecurityEvent('unauthorized', { userId: 'user-1' });
+      }).not.toThrow();
+    });
+  });
+});

packages/lib/src/audit/index.ts

@@ -12,6 +12,11 @@ export {
   type QueryEventsOptions,
 } from './security-audit';
 
+export {
+  auditAuthEvent,
+  auditSecurityEvent,
+} from './security-audit-adapter';
+
 /** Mask email to prevent PII in audit logs (e.g., john@example.com -> jo***@example.com) */
 export function maskEmail(email: string): string {
   const [local, domain] = email.split('@');