+
- {data.map((_, i) => (
+ {chartData.map((_, i) => (
|
diff --git a/src/hooks/useGroupedEvents.ts b/src/hooks/useGroupedEvents.ts
index bd062cf..f7e2ffa 100644
--- a/src/hooks/useGroupedEvents.ts
+++ b/src/hooks/useGroupedEvents.ts
@@ -6,16 +6,34 @@
import { useQuery } from "@tanstack/react-query";
import { apiFetch } from "../lib/api";
+import { categorizeEventSummary } from "../lib/eventCategories";
-export interface groupedEvents {
+type EventSummaryResponse = {
summary: {
type: string;
count: number;
}[];
+};
+
+export interface GroupedEvents {
+ summary: {
+ type: string;
+ label: string;
+ count: number;
+ }[];
}
+
export function useGroupedEvents() {
return useQuery({
queryKey: ["grouped-events"],
- queryFn: () => apiFetch("/internal/auth-events/grouped"),
+ queryFn: async (): Promise => {
+ const data = await apiFetch(
+ "/internal/auth-events/summary",
+ );
+
+ return {
+ summary: categorizeEventSummary(data.summary),
+ };
+ },
});
}
diff --git a/src/hooks/useSystemConfig.ts b/src/hooks/useSystemConfig.ts
index f51766f..a005de6 100644
--- a/src/hooks/useSystemConfig.ts
+++ b/src/hooks/useSystemConfig.ts
@@ -8,7 +8,29 @@
import { useQuery } from "@tanstack/react-query";
import { apiFetch } from "../lib/api";
-export type LoginMethod = "passkey" | "magic_link" | "email_otp" | "phone_otp";
+export type LoginMethod =
+ | "passkey"
+ | "magic_link"
+ | "email_otp"
+ | "phone_otp"
+ | "oauth";
+
+export type OAuthProviderConfig = {
+ id: string;
+ name: string;
+ enabled: boolean;
+ clientId: string;
+ clientSecretEnv: string;
+ authorizationUrl: string;
+ tokenUrl: string;
+ userInfoUrl: string;
+ scopes: string[];
+ redirectUri?: string;
+ subjectJsonPath: string;
+ emailJsonPath: string;
+ nameJsonPath?: string;
+ allowSignup: boolean;
+};
export type SystemConfig = {
app_name: string;
@@ -20,6 +42,7 @@ export type SystemConfig = {
delay_after: number;
login_methods: LoginMethod[];
passkey_login_fallback_enabled: boolean;
+ oauth_providers: OAuthProviderConfig[];
rpid: string;
origins: string[];
};
diff --git a/src/hooks/useUpdateSystemConfig.ts b/src/hooks/useUpdateSystemConfig.ts
index 255babc..32000d8 100644
--- a/src/hooks/useUpdateSystemConfig.ts
+++ b/src/hooks/useUpdateSystemConfig.ts
@@ -6,7 +6,7 @@
import { useMutation, useQueryClient } from "@tanstack/react-query";
import { apiFetch } from "../lib/api";
-import type { LoginMethod } from "./useSystemConfig";
+import type { LoginMethod, OAuthProviderConfig } from "./useSystemConfig";
export type SystemConfig = {
app_name: string;
@@ -18,6 +18,7 @@ export type SystemConfig = {
delay_after: number;
login_methods: LoginMethod[];
passkey_login_fallback_enabled: boolean;
+ oauth_providers: OAuthProviderConfig[];
rpid: string;
origins: string[];
};
diff --git a/src/lib/eventCategories.test.ts b/src/lib/eventCategories.test.ts
new file mode 100644
index 0000000..e0fb38b
--- /dev/null
+++ b/src/lib/eventCategories.test.ts
@@ -0,0 +1,39 @@
+/*
+ * Copyright © 2026 Fells Code, LLC
+ * Licensed under the GNU Affero General Public License v3.0
+ * See LICENSE file in the project root for full license information
+ */
+
+import { describe, expect, it } from "vitest";
+import { categorizeEventSummary, getEventCategory } from "./eventCategories";
+
+describe("eventCategories", () => {
+ it("classifies concrete API event types into operator categories", () => {
+ expect(getEventCategory("oauth_login_success").value).toBe("oauth");
+ expect(getEventCategory("webauthn_login_success").value).toBe("webauthn");
+ expect(getEventCategory("refresh_token_failed").value).toBe("token");
+ expect(getEventCategory("service_token_success").value).toBe(
+ "serviceToken",
+ );
+ expect(getEventCategory("step_up_challenge").value).toBe("stepUp");
+ expect(getEventCategory("login_suspicious").value).toBe("security");
+ });
+
+ it("groups raw event summaries and only keeps populated categories", () => {
+ expect(
+ categorizeEventSummary([
+ { type: "login_success", count: 8 },
+ { type: "refresh_token_failed", count: 5 },
+ { type: "service_token_success", count: 3 },
+ { type: "oauth_login_failed", count: 4 },
+ { type: "unknown_backend_event", count: 2 },
+ ]),
+ ).toEqual([
+ { type: "login", label: "Login", count: 8 },
+ { type: "token", label: "Session Tokens", count: 5 },
+ { type: "oauth", label: "OAuth", count: 4 },
+ { type: "serviceToken", label: "Service Tokens", count: 3 },
+ { type: "other", label: "Other", count: 2 },
+ ]);
+ });
+});
diff --git a/src/lib/eventCategories.ts b/src/lib/eventCategories.ts
new file mode 100644
index 0000000..81656c5
--- /dev/null
+++ b/src/lib/eventCategories.ts
@@ -0,0 +1,170 @@
+/*
+ * Copyright © 2026 Fells Code, LLC
+ * Licensed under the GNU Affero General Public License v3.0
+ * See LICENSE file in the project root for full license information
+ */
+
+export type EventCategory = {
+ label: string;
+ value: string;
+ match: (type: string) => boolean;
+};
+
+export type EventCount = {
+ type: string;
+ count: number;
+};
+
+export type EventCategoryCount = {
+ type: string;
+ label: string;
+ count: number;
+};
+
+const exact = (types: string[]) => {
+ const values = new Set(types);
+
+ return (type: string) => values.has(type);
+};
+
+const startsWithAny = (prefixes: string[]) => (type: string) =>
+ prefixes.some((prefix) => type.startsWith(prefix));
+
+const isSuspicious = (type: string) => type.includes("suspicious");
+
+export const eventCategories: EventCategory[] = [
+ {
+ label: "Security",
+ value: "security",
+ match: (type) => isSuspicious(type) || type === "request_suspicious",
+ },
+ {
+ label: "Login",
+ value: "login",
+ match: exact(["login_challenge", "login_failed", "login_success"]),
+ },
+ {
+ label: "OAuth",
+ value: "oauth",
+ match: startsWithAny(["oauth_"]),
+ },
+ {
+ label: "Passkeys",
+ value: "webauthn",
+ match: startsWithAny(["webauthn_"]),
+ },
+ {
+ label: "Magic Links",
+ value: "magicLink",
+ match: startsWithAny(["magic_link_"]),
+ },
+ {
+ label: "OTP",
+ value: "otp",
+ match: startsWithAny(["otp_", "recovery_otp_", "verify_otp_"]),
+ },
+ {
+ label: "TOTP / MFA",
+ value: "totp",
+ match: startsWithAny(["mfa_otp_", "totp_"]),
+ },
+ {
+ label: "Step-Up",
+ value: "stepUp",
+ match: startsWithAny(["step_up_"]),
+ },
+ {
+ label: "Registration",
+ value: "registration",
+ match: startsWithAny(["registration_"]),
+ },
+ {
+ label: "Session Tokens",
+ value: "token",
+ match: startsWithAny(["bearer_token_", "cookie_token_", "refresh_token_"]),
+ },
+ {
+ label: "Service Tokens",
+ value: "serviceToken",
+ match: startsWithAny(["service_token_"]),
+ },
+ {
+ label: "Logout",
+ value: "logout",
+ match: startsWithAny(["logout_"]),
+ },
+ {
+ label: "User Admin",
+ value: "user",
+ match: exact([
+ "credentials_deleted",
+ "internal_user_updated_by_owner",
+ "user_created",
+ "user_data_failed",
+ "user_data_success",
+ "user_deleted",
+ ]),
+ },
+ {
+ label: "System Config",
+ value: "system",
+ match: startsWithAny(["system_config_"]),
+ },
+ {
+ label: "Bootstrap",
+ value: "bootstrap",
+ match: startsWithAny(["bootstrap_admin_"]),
+ },
+ {
+ label: "JWKS",
+ value: "jwks",
+ match: startsWithAny(["jwks_"]),
+ },
+ {
+ label: "Notifications",
+ value: "notification",
+ match: exact(["notification_sent", "notication_sent"]),
+ },
+ {
+ label: "Operations",
+ value: "operation",
+ match: exact(["auth_action_incremented", "informational"]),
+ },
+];
+
+export const otherEventCategory: EventCategory = {
+ label: "Other",
+ value: "other",
+ match: () => false,
+};
+
+export function getEventCategory(type: string) {
+ return (
+ eventCategories.find((category) => category.match(type)) ??
+ otherEventCategory
+ );
+}
+
+export function categorizeEventSummary(
+ summary: EventCount[],
+): EventCategoryCount[] {
+ const counts = new Map();
+
+ for (const category of [...eventCategories, otherEventCategory]) {
+ counts.set(category.value, 0);
+ }
+
+ for (const item of summary) {
+ const category = getEventCategory(item.type);
+ counts.set(category.value, (counts.get(category.value) ?? 0) + item.count);
+ }
+
+ return [...eventCategories, otherEventCategory]
+ .map((category) => ({
+ type: category.value,
+ label: category.label,
+ count: counts.get(category.value) ?? 0,
+ }))
+ .filter((item) => item.count > 0)
+ .sort((a, b) => b.count - a.count);
+}
diff --git a/src/lib/eventGroups.test.ts b/src/lib/eventGroups.test.ts
index 6c1027f..e3609e6 100644
--- a/src/lib/eventGroups.test.ts
+++ b/src/lib/eventGroups.test.ts
@@ -11,11 +11,24 @@ describe("eventGroups", () => {
it("includes the expected top-level quick filters", () => {
expect(eventGroups.map((group) => group.value)).toEqual([
"",
+ "security",
"login",
+ "oauth",
"webauthn",
+ "magicLink",
"otp",
+ "totp",
+ "stepUp",
+ "registration",
"token",
- "security",
+ "serviceToken",
+ "logout",
+ "user",
+ "system",
+ "bootstrap",
+ "jwks",
+ "notification",
+ "operation",
]);
});
@@ -24,6 +37,7 @@ describe("eventGroups", () => {
expect(loginGroup?.match("login_success")).toBe(true);
expect(loginGroup?.match("login_suspicious")).toBe(false);
+ expect(loginGroup?.match("oauth_login_success")).toBe(false);
});
it("matches security-only suspicious activity", () => {
@@ -34,4 +48,16 @@ describe("eventGroups", () => {
expect(securityGroup?.match("request_suspicious")).toBe(true);
expect(securityGroup?.match("login_success")).toBe(false);
});
+
+ it("matches infrastructure-specific event families", () => {
+ const tokenGroup = eventGroups.find((group) => group.value === "token");
+ const serviceTokenGroup = eventGroups.find(
+ (group) => group.value === "serviceToken",
+ );
+ const stepUpGroup = eventGroups.find((group) => group.value === "stepUp");
+
+ expect(tokenGroup?.match("refresh_token_failed")).toBe(true);
+ expect(serviceTokenGroup?.match("service_token_success")).toBe(true);
+ expect(stepUpGroup?.match("step_up_challenge")).toBe(true);
+ });
});
diff --git a/src/lib/eventGroups.ts b/src/lib/eventGroups.ts
index bbec8dd..b5aeed5 100644
--- a/src/lib/eventGroups.ts
+++ b/src/lib/eventGroups.ts
@@ -5,8 +5,7 @@
*/
// src/lib/eventGroups.ts
-
-const isSuspicious = (t: string) => t.includes("suspicious");
+import { eventCategories } from "./eventCategories";
export const eventGroups = [
{
@@ -14,34 +13,5 @@ export const eventGroups = [
value: "",
match: () => true,
},
-
- {
- label: "Login",
- value: "login",
- match: (t: string) => t.startsWith("login") && !isSuspicious(t),
- },
-
- {
- label: "WebAuthn",
- value: "webauthn",
- match: (t: string) => t.startsWith("webauthn") && !isSuspicious(t),
- },
-
- {
- label: "OTP",
- value: "otp",
- match: (t: string) => t.includes("otp") && !isSuspicious(t),
- },
-
- {
- label: "Tokens",
- value: "token",
- match: (t: string) => t.includes("token") && !isSuspicious(t),
- },
-
- {
- label: "Security",
- value: "security",
- match: (t: string) => isSuspicious(t) || t === "request_suspicious",
- },
+ ...eventCategories,
];
diff --git a/src/lib/eventMapping.test.ts b/src/lib/eventMapping.test.ts
index e3485ea..1a7c0d9 100644
--- a/src/lib/eventMapping.test.ts
+++ b/src/lib/eventMapping.test.ts
@@ -19,12 +19,19 @@ describe("collapseTypes", () => {
it("collapses magic link and suspicious groups", () => {
expect(collapseTypes(["magic_link_requested"])).toBe("magicLink");
- expect(collapseTypes(["request_suspicious"])).toBe("suspicious");
+ expect(collapseTypes(["request_suspicious"])).toBe("security");
+ });
+
+ it("collapses infrastructure event families", () => {
+ expect(collapseTypes(["refresh_token_success"])).toBe("token");
+ expect(collapseTypes(["service_token_success"])).toBe("serviceToken");
+ expect(collapseTypes(["oauth_login_success"])).toBe("oauth");
+ expect(collapseTypes(["step_up_success"])).toBe("stepUp");
});
it("falls back to the first concrete type", () => {
- expect(collapseTypes(["token_refreshed", "token_issued"])).toBe(
- "token_refreshed",
+ expect(collapseTypes(["unknown_event", "unknown_other"])).toBe(
+ "unknown_event",
);
});
diff --git a/src/lib/eventMapping.ts b/src/lib/eventMapping.ts
index 9910785..0172598 100644
--- a/src/lib/eventMapping.ts
+++ b/src/lib/eventMapping.ts
@@ -5,35 +5,14 @@
*/
// src/lib/eventTypeMapping.ts
+import { getEventCategory } from "./eventCategories";
export function collapseTypes(types: string[]): string {
if (!types || types.length === 0) return "";
- if (types.includes("login_success") || types.includes("login_failed")) {
- return "login";
- }
+ const matchedCategory = types
+ .map((type) => getEventCategory(type))
+ .find((category) => category.value !== "other");
- if (types.includes("otp_success") || types.includes("otp_failed")) {
- return "otp";
- }
-
- if (
- types.includes("webauthn_login_success") ||
- types.includes("webauthn_login_failed")
- ) {
- return "webauthn";
- }
-
- if (
- types.includes("magic_link_success") ||
- types.includes("magic_link_requested")
- ) {
- return "magicLink";
- }
-
- if (types.some((t) => t.includes("suspicious"))) {
- return "suspicious";
- }
-
- return types[0]; // fallback
+ return matchedCategory?.value ?? types[0];
}
diff --git a/src/pages/Overview.tsx b/src/pages/Overview.tsx
index d9157ec..9be6be9 100644
--- a/src/pages/Overview.tsx
+++ b/src/pages/Overview.tsx
@@ -47,11 +47,8 @@ export default function Overview() {
}, grouped.summary[0])
: undefined;
- const securitySignalCount = grouped?.summary.length
- ? grouped.summary
- .filter((item) => item.type.includes("suspicious"))
- .reduce((sum, item) => sum + item.count, 0)
- : 0;
+ const securitySignalCount =
+ grouped?.summary.find((item) => item.type === "security")?.count ?? 0;
return (
@@ -90,7 +87,7 @@ export default function Overview() {
/>
diff --git a/src/pages/SystemConfig.test.tsx b/src/pages/SystemConfig.test.tsx
index 277a87f..81e6748 100644
--- a/src/pages/SystemConfig.test.tsx
+++ b/src/pages/SystemConfig.test.tsx
@@ -32,6 +32,7 @@ const baseConfig = {
delay_after: 10,
login_methods: ["passkey", "magic_link"],
passkey_login_fallback_enabled: true,
+ oauth_providers: [],
rpid: "example.com",
origins: ["https://example.com"],
};
@@ -65,4 +66,53 @@ describe("SystemConfigPage", () => {
}),
);
});
+
+ it("adds OAuth provider configuration without a secret value", () => {
+ render(
);
+
+ fireEvent.change(screen.getByLabelText(/provider id/i), {
+ target: { value: "google" },
+ });
+ fireEvent.change(screen.getByLabelText(/display name/i), {
+ target: { value: "Google" },
+ });
+ fireEvent.change(screen.getByLabelText(/client id/i), {
+ target: { value: "client-id" },
+ });
+ fireEvent.change(screen.getByLabelText(/client secret env/i), {
+ target: { value: "GOOGLE_CLIENT_SECRET" },
+ });
+ fireEvent.change(screen.getByLabelText(/authorization url/i), {
+ target: { value: "https://accounts.google.com/o/oauth2/v2/auth" },
+ });
+ fireEvent.change(screen.getByLabelText(/token url/i), {
+ target: { value: "https://oauth2.googleapis.com/token" },
+ });
+ fireEvent.change(screen.getByLabelText(/user info url/i), {
+ target: { value: "https://openidconnect.googleapis.com/v1/userinfo" },
+ });
+ fireEvent.change(screen.getByLabelText(/redirect uri/i), {
+ target: { value: "https://example.com/oauth/callback" },
+ });
+ fireEvent.change(screen.getByLabelText(/scopes/i), {
+ target: { value: "openid, email, profile" },
+ });
+
+ fireEvent.click(screen.getByRole("button", { name: /add provider/i }));
+ fireEvent.click(screen.getByRole("button", { name: /save changes/i }));
+
+ expect(mocks.mutate).toHaveBeenCalledWith(
+ expect.objectContaining({
+ oauth_providers: [
+ expect.objectContaining({
+ id: "google",
+ name: "Google",
+ clientId: "client-id",
+ clientSecretEnv: "GOOGLE_CLIENT_SECRET",
+ scopes: ["openid", "email", "profile"],
+ }),
+ ],
+ }),
+ );
+ });
});
diff --git a/src/pages/SystemConfig.tsx b/src/pages/SystemConfig.tsx
index 47e91bb..b4dd717 100644
--- a/src/pages/SystemConfig.tsx
+++ b/src/pages/SystemConfig.tsx
@@ -9,6 +9,7 @@ import { KeyRound, ShieldCheck, TimerReset, Waypoints } from "lucide-react";
import {
useSystemConfig,
type LoginMethod,
+ type OAuthProviderConfig,
type SystemConfig,
} from "../hooks/useSystemConfig";
import { useUpdateSystemConfig } from "../hooks/useUpdateSystemConfig";
@@ -43,6 +44,11 @@ const LOGIN_METHOD_OPTIONS: {
label: "SMS OTP",
description: "One-time SMS codes after login initiation.",
},
+ {
+ value: "oauth",
+ label: "OAuth",
+ description: "External identity providers such as Google or GitHub.",
+ },
];
export default function SystemConfigPage() {
@@ -139,6 +145,10 @@ export default function SystemConfigPage() {
label="Login methods"
value={`${form.login_methods.length}`}
/>
+