@astram/identity 0.15.0 → 0.16.0

package/migrations/1710000000102-CreateAuditChain.cjs

@@ -0,0 +1,71 @@
+/**
+ * Framework audit migration — the durable hash chain over `audit_log` (audit-chain-store SPEC §4.A,
+ * §4.B; Layer 9 reopened, STATUS G3). Both tables live in the audit database (`<ns>_audit`, default
+ * `shield_audit`), created by 1710000000010; this migration owns only the two tables.
+ * `audit_log` is NOT altered.
+ *
+ * `audit_chain` — one row per sealed `audit_log` row: per-tenant dense `ac_sequence` from 0, the
+ * row's content hash, the previous entry hash (`GENESIS` or the prior `ac_entry_hash`) and its own
+ * entry hash. `ac_occurred_at_ms` is an unhashed copy of `al_occurred_at_ms` (sealer window, prune
+ * prefix; `audit:verify` checks it); `ac_sealed_at_ms` is the sealer clock. PK (tenant, sequence) is
+ * the Layer-9 unique key; UNIQUE `ac_al_uuid` seals a row at most once; `idx_ac_occurred` serves the
+ * sealer's window start.
+ *
+ * `audit_chain_checkpoint` — one row per pruned batch (written only by `prune_audit`): the last
+ * pruned sequence and its entry hash, so verification can anchor after a prune.
+ *
+ * Collation: every tenant and uuid column is `utf8mb4_nopad_bin` (binary AND no pad), so `T1`, `t1`
+ * and `T1 ` are three tenants, exactly as in Node and `verifyChain`. Never `utf8mb4_bin` (PAD SPACE).
+ * Hash and run-id columns are `ascii_bin`. The table default collation is also `utf8mb4_nopad_bin`,
+ * so a character column added later without an explicit COLLATE keeps exact-byte semantics instead
+ * of silently folding case or trailing spaces. Comparisons against `audit_log`
+ * (`utf8mb4_unicode_ci`) must write `COLLATE utf8mb4_nopad_bin` on the `audit_log` side.
+ *
+ * Append-only: no code path UPDATEs or DELETEs these tables except `prune_audit` (definer).
+ * Idempotent (CREATE TABLE IF NOT EXISTS); `down` drops both (DROP TABLE IF EXISTS). No FK to
+ * `audit_log` (prune deletes rows in both under its own rules; a chain row whose `audit_log` row is
+ * gone is evidence for `audit:verify`). No seed, no hard-coded ids.
+ */
+
+const { frameworkSchemasForMigration } = require('@astram/core');
+
+// Database names come from `ctx.schemas` (SHIELD_DB_NAMESPACE, ADR-0037); under an older
+// @astram/migrate without it, the default names apply only while the namespace is unset.
+
+async function up(ctx) {
+  const { query } = ctx;
+  const SCHEMA = frameworkSchemasForMigration(ctx, process.env).audit;
+
+  await query(`CREATE TABLE IF NOT EXISTS \`${SCHEMA}\`.\`audit_chain\` (
+    ac_tenant_id      VARCHAR(64)     COLLATE utf8mb4_nopad_bin NOT NULL,
+    ac_sequence       BIGINT UNSIGNED NOT NULL,
+    ac_al_uuid        VARCHAR(36)     COLLATE utf8mb4_nopad_bin NOT NULL,
+    ac_content_hash   CHAR(64)        CHARACTER SET ascii COLLATE ascii_bin NOT NULL,
+    ac_prev_hash      VARCHAR(64)     CHARACTER SET ascii COLLATE ascii_bin NOT NULL,
+    ac_entry_hash     CHAR(64)        CHARACTER SET ascii COLLATE ascii_bin NOT NULL,
+    ac_occurred_at_ms BIGINT          NOT NULL,
+    ac_sealed_at_ms   BIGINT          NOT NULL,
+    PRIMARY KEY (ac_tenant_id, ac_sequence),
+    UNIQUE KEY uq_ac_al_uuid (ac_al_uuid),
+    INDEX idx_ac_occurred (ac_occurred_at_ms)
+  ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_nopad_bin`);
+
+  await query(`CREATE TABLE IF NOT EXISTS \`${SCHEMA}\`.\`audit_chain_checkpoint\` (
+    acc_tenant_id             VARCHAR(64)     COLLATE utf8mb4_nopad_bin NOT NULL,
+    acc_sequence              BIGINT UNSIGNED NOT NULL,
+    acc_entry_hash            CHAR(64)        CHARACTER SET ascii COLLATE ascii_bin NOT NULL,
+    acc_pruned_at_ms          BIGINT          NOT NULL,
+    acc_run_id                VARCHAR(36)     CHARACTER SET ascii COLLATE ascii_bin NOT NULL,
+    acc_acknowledged_sequence BIGINT UNSIGNED NULL,
+    PRIMARY KEY (acc_tenant_id, acc_sequence)
+  ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_nopad_bin`);
+}
+
+async function down(ctx) {
+  const { query } = ctx;
+  const SCHEMA = frameworkSchemasForMigration(ctx, process.env).audit;
+  await query(`DROP TABLE IF EXISTS \`${SCHEMA}\`.\`audit_chain_checkpoint\``);
+  await query(`DROP TABLE IF EXISTS \`${SCHEMA}\`.\`audit_chain\``);
+}
+
+module.exports = { up, down };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@astram/identity",
-  "version": "0.15.0",
+  "version": "0.16.0",
   "license": "MIT",
   "description": "Astram framework — the framework-owned identity + tenancy model. Hosts the identity @ObjectType classes (user, company, membership, posting), framework-authored identity migrations, and the identity resolver. Top of the dependency graph: depends on @astram/engine (for @ObjectType/@Field decorators) + @astram/guard / @astram/core (for the auth ports).",
   "type": "commonjs",
@@ -36,9 +36,9 @@
   },
   "dependencies": {
     "mariadb": "^3.5.4",
-    "@astram/core": "1.9.0",
-    "@astram/guard": "0.18.0",
-    "@astram/engine": "0.10.1"
+    "@astram/core": "1.10.0",
+    "@astram/engine": "0.10.2",
+    "@astram/guard": "0.19.0"
   },
   "peerDependencies": {
     "@nestjs/common": "^11",
@@ -61,6 +61,11 @@
     "unplugin-swc": "^1.5.1",
     "vitest": "^2.1.8"
   },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/ASTRAM-2-0/astram-framework.git",
+    "directory": "packages/identity"
+  },
   "scripts": {
     "build": "tsc -p tsconfig.build.json",
     "lint": "eslint \"src/**/*.ts\" \"test/**/*.ts\"",