feat: track 'oauthFailed', 'oauthInitiated' event for audit

[lwin-kyaw]

Jira Link

https://consensyssoftware.atlassian.net/browse/EMBED-226

Description

• Added Citadel audit tracking for oauthInitiated and oauthFailed in the login flow.
• Fixed the redirect flow so a generated recordId is persisted into args.customState before session creation, preventing a second recordId from being generated after getRedirectResult().
• Passed recordId and authConnection through to Torus key retrieval so the same audit context is preserved through completion.
• Added a callCitadelAuditApi() helper to send audit events to the Citadel endpoint.
• Expanded unit tests to cover redirect round-trip behavior and verify recordId reuse.

How has this been tested?

Screenshots (if appropriate)

Types of changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)

Checklist

• My code follows the code style of this project. (run lint)
• My change requires a change to the documentation.
• I have updated the documentation accordingly.
• I have added tests to cover my changes.
• All new and existing tests passed.

---

Note

Medium Risk
Adds new external audit API calls during login flows and propagates a new recordId through redirect and share-retrieval paths, which could affect login reliability if the audit endpoint or new params behave unexpectedly.

Overview
Adds Citadel auditing to CustomAuth.triggerLogin by generating/reusing a recordId and sending best-effort PUT /v1/user/audit events for oauthInitiated (on first login start) and oauthFailed (on login error).

Propagates recordId and authConnection into getTorusKey/torus.retrieveShares, introduces callCitadelAuditApi helper, and extends unit tests to verify recordId persistence across redirect round-trips and audit calls.

Also switches @toruslabs/torus.js to a local tarball dependency and updates .gitignore to include .npmrc.

^{Written by Cursor Bugbot for commit 63109a6. This will update automatically on new commits. Configure here.}

[cursor]

Local tgz file dependency accidentally committed

High Severity

The @toruslabs/torus.js dependency is pointed at file:./toruslabs-torus.js-17.2.2.tgz instead of the npm registry. This local file reference will fail to resolve for other developers, CI pipelines, and consumers of this package. This appears to be a development/testing artifact that needs to be reverted to the registry version before merging.

Additional Locations (1)

• package-lock.json#L19-L20

 

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

There are 2 total unresolved issues (including 1 from previous review).

^{Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}