@goodandready/dsh-approval-gate 0.1.15 → 0.1.17

package/lib/audit-log.js

@@ -1,7 +1,10 @@
 // lib/audit-log.js
-// Isolated append-only audit logger for dsh-approval-gate (#56).
+// Isolated append-only audit logger for dsh-approval-gate (#56, #53, #54, #55).
 // Logs gate decisions to ~/.dsh/approval-gate-audit.jsonl out-of-band to prevent prompt injection.
+// Features: fail-closed write verification (#53), single-pass reverse rotation up to 5MB (#54),
+// and non-erasable tombstones for tamper resistance (#55).
 
+import crypto from "node:crypto";
 import fs from "node:fs";
 import os from "node:os";
 import path from "node:path";
@@ -9,13 +12,89 @@ import { computeFingerprint } from "./fingerprint.js";
 import { redactCredentials } from "./redact.js";
 
 export const DEFAULT_AUDIT_LOG_RELATIVE = path.join(".dsh", "approval-gate-audit.jsonl");
+export const DEFAULT_MAX_AUDIT_BYTES = 5 * 1024 * 1024; // 5 MB (#54)
+export const DEFAULT_MAX_AUDIT_LINES = 5000;
+export const DEFAULT_RETAIN_LINES = 2500;
+export const SCAN_CHUNK_SIZE = 64 * 1024; // 64 KB single-pass chunk
+
+/**
+ * Pure function: single-pass reverse scan rotation for string or buffer content (#54).
+ * Scans from the tail backwards to avoid write amplification and full array allocation.
+ *
+ * @param {string} content
+ * @param {number} [maxBytes=DEFAULT_MAX_AUDIT_BYTES]
+ * @param {number} [maxLines=DEFAULT_MAX_AUDIT_LINES]
+ * @param {number} [retainLines=DEFAULT_RETAIN_LINES]
+ * @returns {{ rotated: boolean, content: string, previousBytes: number, previousLinesCount: number, retainedLinesCount: number }}
+ */
+export function auditRotateContent(
+  content,
+  maxBytes = DEFAULT_MAX_AUDIT_BYTES,
+  maxLines = DEFAULT_MAX_AUDIT_LINES,
+  retainLines = DEFAULT_RETAIN_LINES
+) {
+  if (typeof content !== "string" || content.length === 0) {
+    return { rotated: false, content: "", previousBytes: 0, previousLinesCount: 0, retainedLinesCount: 0 };
+  }
+
+  const byteLength = Buffer.byteLength(content, "utf8");
+  const allLines = content.split("\n");
+  const nonEmptyLines = allLines[allLines.length - 1] === "" ? allLines.slice(0, -1) : allLines;
+  const lineCount = nonEmptyLines.length;
+
+  if (byteLength < maxBytes && lineCount < maxLines) {
+    return { rotated: false, content, previousBytes: byteLength, previousLinesCount: lineCount, retainedLinesCount: lineCount };
+  }
+
+  let end = content.length;
+  if (end > 0 && content.charCodeAt(end - 1) === 10) {
+    end--; // skip trailing newline for line scanning
+  }
+
+  let targetCutoff = 0;
+  let linesSeen = 0;
+  for (let i = end - 1; i >= 0; i--) {
+    if (content.charCodeAt(i) === 10) {
+      linesSeen++;
+      if (linesSeen === retainLines) {
+        targetCutoff = i + 1;
+        break;
+      }
+    }
+  }
+  if (linesSeen < retainLines) {
+    targetCutoff = 0;
+  }
+
+  const retained = content.slice(targetCutoff);
+  return {
+    rotated: true,
+    content: retained,
+    previousBytes: byteLength,
+    previousLinesCount: lineCount,
+    retainedLinesCount: Math.min(lineCount, retainLines),
+  };
+}
 
 export class AuditLogger {
   /**
-   * @param {{ logPath?: string, disabled?: boolean }} [options]
+   * @param {{
+   *   logPath?: string,
+   *   disabled?: boolean,
+   *   failClosed?: boolean,
+   *   maxBytes?: number,
+   *   maxLines?: number,
+   *   retainLines?: number
+   * }} [options]
    */
   constructor(options = {}) {
     this.disabled = options.disabled === true;
+    this.failClosed = options.failClosed === true;
+    this.maxBytes = typeof options.maxBytes === "number" && options.maxBytes > 0 ? options.maxBytes : DEFAULT_MAX_AUDIT_BYTES;
+    this.maxLines = typeof options.maxLines === "number" && options.maxLines > 0 ? options.maxLines : DEFAULT_MAX_AUDIT_LINES;
+    this.retainLines = typeof options.retainLines === "number" && options.retainLines > 0 ? options.retainLines : DEFAULT_RETAIN_LINES;
+    this.lastError = null;
+
     if (options.logPath) {
       this.logPath = options.logPath;
     } else {
@@ -25,17 +104,18 @@ export class AuditLogger {
   }
 
   /**
-   * Write an audit record to the isolated log file.
+   * Write an audit record to the isolated log file. Returns boolean (#53).
    *
    * @param {{
    *   sessionId?: string,
    *   execution?: any,
-   *   decision: { verdict: string, stage?: string, reason?: string, detail?: string, dryRun?: boolean },
+   *   decision: { verdict: string, stage?: string, reason?: string, detail?: string, dryRun?: boolean, ruleId?: string },
    *   dryRun?: boolean
    * }} record
+   * @returns {boolean} True if append succeeded or disabled, false if write failed
    */
-  log(record) {
-    if (this.disabled || !this.logPath) return;
+  appendAuditLine(record) {
+    if (this.disabled || !this.logPath) return true;
 
     try {
       const now = Date.now();
@@ -57,6 +137,7 @@ export class AuditLogger {
         verdict: decision.verdict,
         stage: decision.stage,
         reason: decision.reason,
+        ruleId: decision.ruleId,
         detail: decision.detail,
         fingerprint: fp,
         dryRun: Boolean(record.dryRun || decision.dryRun),
@@ -67,10 +148,198 @@ export class AuditLogger {
       if (!fs.existsSync(dir)) {
         fs.mkdirSync(dir, { recursive: true });
       }
+
       fs.appendFileSync(this.logPath, line, "utf8");
+      this.lastError = null;
+
+      // Check if rotation is needed (#54)
+      this._checkRotation();
+      return true;
+    } catch (err) {
+      this.lastError = err;
+      if (this.failClosed) {
+        return false;
+      }
+      return false;
+    }
+  }
+
+  /**
+   * Alias for backward compatibility.
+   * @param {any} record
+   * @returns {boolean}
+   */
+  log(record) {
+    return this.appendAuditLine(record);
+  }
+
+  /**
+   * Single-pass reverse scan rotation (#54).
+   * @private
+   */
+  _checkRotation() {
+    if (!this.logPath || !fs.existsSync(this.logPath)) return;
+    try {
+      const stat = fs.statSync(this.logPath);
+      if (stat.size >= this.maxBytes) {
+        this.rotate();
+      }
+    } catch {
+      // Rotation check failure must not crash logger
+    }
+  }
+
+  /**
+   * Explicitly rotate audit log using single-pass reverse scan and tombstone (#54, #55).
+   * @returns {boolean}
+   */
+  rotate() {
+    if (!this.logPath || !fs.existsSync(this.logPath)) return false;
+
+    try {
+      const raw = fs.readFileSync(this.logPath, "utf8");
+      const prevSha256 = crypto.createHash("sha256").update(raw, "utf8").digest("hex");
+      // Force rotation to retainLines
+      const rot = auditRotateContent(raw, 0, 0, this.retainLines);
+
+      const now = Date.now();
+      const tombstone = {
+        tombstone: true,
+        timestamp: now,
+        iso: new Date(now).toISOString(),
+        reason: "rotation",
+        clearedBy: "system:rotator",
+        previousSha256: prevSha256,
+        previousBytes: rot.previousBytes,
+        previousLinesCount: rot.previousLinesCount,
+        retainedLinesCount: rot.retainedLinesCount,
+      };
+
+      const tombstoneLine = JSON.stringify(tombstone) + "\n";
+      const newContent = tombstoneLine + rot.content;
+
+      const tmpPath = this.logPath + ".tmp." + now;
+      fs.writeFileSync(tmpPath, newContent, "utf8");
+      fs.renameSync(tmpPath, this.logPath);
+      return true;
+    } catch (err) {
+      this.lastError = err;
+      return false;
+    }
+  }
+
+  /**
+   * Clear the audit log with a non-erasable tombstone (#55).
+   * Instead of silent deletion, creates an immutable tombstone record preserving hash and event chain.
+   *
+   * @param {{ reason?: string, clearedBy?: string }} [options]
+   * @returns {{
+   *   tombstone: boolean,
+   *   timestamp: number,
+   *   iso: string,
+   *   reason: string,
+   *   clearedBy: string,
+   *   previousSha256: string,
+   *   previousBytes: number,
+   *   previousLinesCount: number
+   * }}
+   */
+  clear(options = {}) {
+    const reason = options.reason || "manual_clear";
+    const clearedBy = options.clearedBy || "admin";
+    let prevSha256 = "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855";
+    let prevBytes = 0;
+    let prevLines = 0;
+
+    if (this.logPath && fs.existsSync(this.logPath)) {
+      try {
+        const raw = fs.readFileSync(this.logPath, "utf8");
+        prevBytes = Buffer.byteLength(raw, "utf8");
+        prevSha256 = crypto.createHash("sha256").update(raw, "utf8").digest("hex");
+        prevLines = raw.split("\n").filter((l) => l.trim().length > 0).length;
+      } catch {
+        // Read error
+      }
+    }
+
+    const now = Date.now();
+    const tombstone = {
+      tombstone: true,
+      timestamp: now,
+      iso: new Date(now).toISOString(),
+      reason,
+      clearedBy,
+      previousSha256: prevSha256,
+      previousBytes: prevBytes,
+      previousLinesCount: prevLines,
+    };
+
+    if (this.logPath) {
+      const dir = path.dirname(this.logPath);
+      if (!fs.existsSync(dir)) {
+        fs.mkdirSync(dir, { recursive: true });
+      }
+      const line = JSON.stringify(tombstone) + "\n";
+      fs.writeFileSync(this.logPath, line, "utf8");
+    }
+
+    return tombstone;
+  }
+
+  /**
+   * Read all tombstones from the log file (#55).
+   * @returns {Array<any>}
+   */
+  getTombstones() {
+    if (!this.logPath || !fs.existsSync(this.logPath)) return [];
+    try {
+      const raw = fs.readFileSync(this.logPath, "utf8");
+      const lines = raw.split("\n").filter((l) => l.trim().length > 0);
+      const tombstones = [];
+      for (const line of lines) {
+        try {
+          const parsed = JSON.parse(line);
+          if (parsed && parsed.tombstone === true) {
+            tombstones.push(parsed);
+          }
+        } catch {
+          // ignore corrupted lines
+        }
+      }
+      return tombstones;
+    } catch {
+      return [];
+    }
+  }
+
+  /**
+   * Read recent entries from the audit log.
+   * @param {{ includeTombstones?: boolean, limit?: number }} [options]
+   * @returns {Array<any>}
+   */
+  readEntries(options = {}) {
+    if (!this.logPath || !fs.existsSync(this.logPath)) return [];
+    const includeTombstones = options.includeTombstones !== false;
+    const limit = typeof options.limit === "number" && options.limit > 0 ? options.limit : 100;
+
+    try {
+      const raw = fs.readFileSync(this.logPath, "utf8");
+      const lines = raw.split("\n").filter((l) => l.trim().length > 0);
+      const entries = [];
+      for (let i = lines.length - 1; i >= 0 && entries.length < limit; i--) {
+        try {
+          const parsed = JSON.parse(lines[i]);
+          if (!includeTombstones && parsed.tombstone === true) {
+            continue;
+          }
+          entries.push(parsed);
+        } catch {
+          // ignore
+        }
+      }
+      return entries.reverse();
     } catch {
-      // Security audit failures fail open to prevent DoS,
-      // but never leak errors into agent prompt.
+      return [];
     }
   }
 }