@absolutejs/auth 0.27.0-beta.7 → 0.27.0-beta.8

package/dist/audit/integrity.d.ts

@@ -2,14 +2,18 @@ import type { AuditEvent, AuditSink } from './types';
 export type AuditIntegrity = {
     hash: string;
     previousHash: string;
+    writerId?: string;
 };
 export type AuditChainResult = {
     brokenAt?: number;
     ok: boolean;
 };
-export declare const createTamperEvidentSink: ({ secret, sink }: {
+export declare const createTamperEvidentSink: ({ loadWriterHead, secret, seedScanLimit, sink, writerId }: {
+    loadWriterHead?: (writerId: string) => Promise<string | undefined> | string | undefined;
     secret?: string;
+    seedScanLimit?: number;
     sink: AuditSink;
+    writerId?: string;
 }) => AuditSink;
 export declare const hashAuditEvent: (event: AuditEvent, previousHash: string, secret?: string) => Promise<string>;
 export declare const verifyAuditChain: (events: AuditEvent[], secret?: string) => Promise<AuditChainResult>;

package/dist/index.js

@@ -18710,6 +18710,7 @@ var INTEGRITY_KEY = "__integrity";
 var GENESIS = "";
 var HEX_RADIX2 = 16;
 var HEX_PAD = 2;
+var DEFAULT_SEED_SCAN_LIMIT = 1000;
 var encoder = new TextEncoder;
 var toHex = (buffer) => [...new Uint8Array(buffer)].map((byte) => byte.toString(HEX_RADIX2).padStart(HEX_PAD, "0")).join("");
 var sha256Hex = async (message) => toHex(await crypto.subtle.digest("SHA-256", encoder.encode(message)));
@@ -18740,15 +18741,31 @@ var brokenAt = (index) => {
   return result;
 };
 var createTamperEvidentSink = ({
+  loadWriterHead,
   secret,
-  sink
+  seedScanLimit = DEFAULT_SEED_SCAN_LIMIT,
+  sink,
+  writerId
 }) => {
+  const chainWriterId = writerId ?? crypto.randomUUID();
+  const isResuming = writerId !== undefined;
   let lastHash;
+  let seeded = false;
   const seed = async () => {
-    if (lastHash !== undefined)
+    if (seeded)
       return;
-    const [recent] = await sink.list?.({ limit: 1 }) ?? [];
-    lastHash = recent ? readIntegrity(recent)?.hash ?? GENESIS : GENESIS;
+    seeded = true;
+    if (!isResuming) {
+      lastHash = GENESIS;
+      return;
+    }
+    if (loadWriterHead) {
+      lastHash = await loadWriterHead(chainWriterId) ?? GENESIS;
+      return;
+    }
+    const recent = await sink.list?.({ limit: seedScanLimit }) ?? [];
+    const head = recent.find((event) => readIntegrity(event)?.writerId === chainWriterId);
+    lastHash = head ? readIntegrity(head)?.hash ?? GENESIS : GENESIS;
   };
   return {
     list: sink.list,
@@ -18757,7 +18774,11 @@ var createTamperEvidentSink = ({
       const previousHash = lastHash ?? GENESIS;
       const hash = await hashAuditEvent(event, previousHash, secret);
       lastHash = hash;
-      const integrity = { hash, previousHash };
+      const integrity = {
+        hash,
+        previousHash,
+        writerId: chainWriterId
+      };
       await sink.append({
         ...event,
         metadata: { ...event.metadata, [INTEGRITY_KEY]: integrity }
@@ -18773,17 +18794,19 @@ var hashAuditEvent = async (event, previousHash, secret) => {
   return secret === undefined ? sha256Hex(message) : hmacSha256Hex(secret, message);
 };
 var verifyAuditChain = async (events, secret) => {
-  let previousHash = GENESIS;
+  const heads = new Map;
   for (let index = 0;index < events.length; index += 1) {
     const event = events[index];
     if (event === undefined)
       return brokenAt(index);
     const integrity = readIntegrity(event);
+    const chain = integrity?.writerId ?? GENESIS;
+    const previousHash = heads.get(chain) ?? GENESIS;
     const expected = await hashAuditEvent(event, previousHash, secret);
     if (integrity === undefined || integrity.previousHash !== previousHash || integrity.hash !== expected) {
       return brokenAt(index);
     }
-    previousHash = integrity.hash;
+    heads.set(chain, integrity.hash);
   }
   const valid = { ok: true };
   return valid;
@@ -20976,5 +20999,5 @@ export {
   AuthIdentityConflictError
 };
 
-//# debugId=580D3E8ACE9EF4E864756E2164756E21
+//# debugId=B234E4311897F15C64756E2164756E21
 //# sourceMappingURL=index.js.map