Enumeration: AuthEventType
Defined in: src/auth/events.ts:9
The security-relevant event types this library emits via @rapidrest/core's EventUtils.record().
Enumeration Members
ACCOUNT_DELETED
ACCOUNT_DELETED:
"auth.account.deleted"
Defined in: src/auth/events.ts:23
An account and all of its associated data was deleted.
ELEVATED
ELEVATED:
"auth.elevated"
Defined in: src/auth/events.ts:19
A caller successfully re-verified their identity to obtain an elevated (trusted-role-bearing) token.
MFA_ENROLLED
MFA_ENROLLED:
"auth.mfa.enrolled"
Defined in: src/auth/events.ts:25
A secondary-auth-capable secret (FIDO2/passkey/TOTP/recovery codes - not a plain password) was created.
MFA_REMOVED
MFA_REMOVED:
"auth.mfa.removed"
Defined in: src/auth/events.ts:27
A secondary-auth-capable secret was deleted.
RATELIMIT_EXCEEDED
RATELIMIT_EXCEEDED:
"auth.ratelimit.exceeded"
Defined in: src/auth/events.ts:33
A rate limit was exceeded (either the per-identifier or the per-source-IP layer - see layer on the
event). A brute-force/abuse signal covering every rate-limited route from one call site, rather than
instrumenting each strategy's individual "wrong password"/"invalid code" branches.
REGISTRATION_COMPLETED
REGISTRATION_COMPLETED:
"auth.registration.completed"
Defined in: src/auth/events.ts:17
A new account finished self-registration (OTP-verified email/phone).
SESSION_CREATED
SESSION_CREATED:
"auth.session.created"
Defined in: src/auth/events.ts:15
A JWT access token was issued for a user. This covers every successful login (any strategy), token refresh,
self-registration, and elevation. Fired from TokenUtils.createAuthResult(), the single chokepoint
every one of those flows already calls through.
SESSIONS_REVOKED
SESSIONS_REVOKED:
"auth.sessions.revoked"
Defined in: src/auth/events.ts:21
Every outstanding refresh token for an account was revoked ("log out everywhere").