@ouro.bot/cli 0.1.0-alpha.732 → 0.1.0-alpha.734

package/dist/senses/telegram-audit-ledger.js

@@ -0,0 +1,220 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TELEGRAM_ACCEPTANCE_AUDIT_HEAD_RELATIVE_PATH = exports.TELEGRAM_ACCEPTANCE_AUDIT_RELATIVE_PATH = void 0;
+exports.verifyTelegramAuditLedger = verifyTelegramAuditLedger;
+exports.createTelegramAuditLedger = createTelegramAuditLedger;
+const node_crypto_1 = require("node:crypto");
+const node_fs_1 = require("node:fs");
+const node_path_1 = __importDefault(require("node:path"));
+const redact_1 = require("../nerves/redact");
+const runtime_1 = require("../nerves/runtime");
+const SCHEMA = "sanctuary-telegram-audit-chain-v1";
+const GENESIS_MAC = "0".repeat(64);
+const SHA256 = /^[0-9a-f]{64}$/u;
+const MAX_BYTES = 32 * 1024 * 1024;
+const MAX_ROWS = 100_000;
+const MAX_ROW_BYTES = 64 * 1024;
+const LEVELS = new Set(["debug", "info", "warn", "error"]);
+const ROW_KEYS = ["component", "event", "level", "message", "meta", "previousMac", "rowMac", "schemaVersion", "sequence", "trace_id", "ts"].sort();
+const HEAD_KEYS = ["headMac", "lastMac", "recordCount", "schemaVersion"].sort();
+exports.TELEGRAM_ACCEPTANCE_AUDIT_RELATIVE_PATH = node_path_1.default.join("state", "acceptance", "telegram-audit-chain.ndjson");
+exports.TELEGRAM_ACCEPTANCE_AUDIT_HEAD_RELATIVE_PATH = node_path_1.default.join("state", "acceptance", "telegram-audit-chain.head.json");
+function canonicalJson(value) {
+    if (Array.isArray(value))
+        return `[${value.map(canonicalJson).join(",")}]`;
+    if (value && typeof value === "object") {
+        const record = value;
+        return `{${Object.keys(record).sort().map((key) => `${JSON.stringify(key)}:${canonicalJson(record[key])}`).join(",")}}`;
+    }
+    const rendered = JSON.stringify(value);
+    if (rendered === undefined)
+        throw new Error("Telegram audit ledger contains an unsupported value");
+    return rendered;
+}
+function rowMac(identityKey, row) {
+    return (0, node_crypto_1.createHmac)("sha256", identityKey).update(`ouroboros.telegram.audit-row.v1\0${canonicalJson(row)}`, "utf8").digest("hex");
+}
+function headMac(identityKey, recordCount, lastMac) {
+    return (0, node_crypto_1.createHmac)("sha256", identityKey).update(`ouroboros.telegram.audit-head.v1\0${recordCount}\0${lastMac}`, "utf8").digest("hex");
+}
+function canonicalIso(value) {
+    return typeof value === "string" && value.length <= 30 && Number.isFinite(Date.parse(value)) && new Date(Date.parse(value)).toISOString() === value;
+}
+function object(value, label) {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        throw new Error(`${label} is invalid`);
+    return value;
+}
+function parseJson(raw, label) {
+    try {
+        return JSON.parse(raw);
+    }
+    catch (error) {
+        throw new Error(`${label} JSON is invalid`, { cause: error });
+    }
+}
+function containsPrivateMaterial(raw, privateValues) {
+    return privateValues.some((value) => value.length >= 5 && raw.includes(value))
+        || /\b\d{5,16}:[A-Za-z0-9_-]{20,}\b/u.test(raw)
+        || /"(?:authorized_?user_?id|authorized_?chat_?id|transport_?user_?id|transport_?chat_?id|user_?id|chat_?id|update_?id|message_?id)"\s*:\s*"?\d{1,20}"?/iu.test(raw);
+}
+function parseHead(raw, identityKey) {
+    if (Buffer.byteLength(raw) > 4 * 1024)
+        throw new Error("Telegram audit head exceeds its bound");
+    const value = object(parseJson(raw, "Telegram audit head"), "Telegram audit head");
+    if (JSON.stringify(Object.keys(value).sort()) !== JSON.stringify(HEAD_KEYS)
+        || value.schemaVersion !== SCHEMA
+        || !Number.isSafeInteger(value.recordCount) || Number(value.recordCount) < 0 || Number(value.recordCount) > MAX_ROWS
+        || typeof value.lastMac !== "string" || !SHA256.test(value.lastMac)
+        || typeof value.headMac !== "string" || !SHA256.test(value.headMac)
+        || value.headMac !== headMac(identityKey, Number(value.recordCount), value.lastMac))
+        throw new Error("Telegram audit head MAC is invalid");
+    return value;
+}
+function verifyTelegramAuditLedger(options) {
+    if (Buffer.byteLength(options.ledgerRaw) > MAX_BYTES)
+        throw new Error("Telegram audit ledger exceeds its bound");
+    const lines = options.ledgerRaw.split("\n").filter(Boolean);
+    if (lines.length > MAX_ROWS || lines.some((line) => Buffer.byteLength(line) > MAX_ROW_BYTES))
+        throw new Error("Telegram audit ledger exceeds its bound");
+    const head = parseHead(options.headRaw, options.identityKey);
+    let previousMac = GENESIS_MAC;
+    const events = lines.map((line, index) => {
+        if (containsPrivateMaterial(line, options.privateValues ?? []))
+            throw new Error("Telegram audit ledger contains private material");
+        const value = object(parseJson(line, "Telegram audit ledger row"), "Telegram audit ledger row");
+        if (JSON.stringify(Object.keys(value).sort()) !== JSON.stringify(ROW_KEYS)
+            || value.schemaVersion !== SCHEMA || value.sequence !== index + 1 || value.previousMac !== previousMac
+            || !canonicalIso(value.ts) || typeof value.level !== "string" || !LEVELS.has(value.level)
+            || typeof value.event !== "string" || value.event.length < 1 || value.event.length > 256
+            || typeof value.component !== "string" || value.component.length < 1 || value.component.length > 128
+            || typeof value.trace_id !== "string" || value.trace_id.length < 1 || value.trace_id.length > 256
+            || typeof value.message !== "string" || value.message.length > 4_096
+            || !value.meta || typeof value.meta !== "object" || Array.isArray(value.meta)
+            || typeof value.rowMac !== "string" || !SHA256.test(value.rowMac))
+            throw new Error("Telegram audit ledger row is invalid");
+        const unsigned = Object.fromEntries(Object.entries(value).filter(([key]) => key !== "rowMac"));
+        if (value.rowMac !== rowMac(options.identityKey, unsigned))
+            throw new Error("Telegram audit ledger row MAC is invalid");
+        previousMac = value.rowMac;
+        return { event: value.event, at: Date.parse(value.ts), meta: value.meta };
+    });
+    if (head.recordCount !== lines.length || head.lastMac !== previousMac)
+        throw new Error("Telegram audit head does not match the append-only ledger");
+    return events;
+}
+function writeHead(filePath, directory, head) {
+    const temporary = `${filePath}.tmp-${process.pid}-${(0, node_crypto_1.randomUUID)()}`;
+    (0, node_fs_1.writeFileSync)(temporary, `${JSON.stringify(head)}\n`, { flag: "wx", mode: 0o600 });
+    const file = (0, node_fs_1.openSync)(temporary, "r");
+    try {
+        (0, node_fs_1.fsyncSync)(file);
+    }
+    finally {
+        (0, node_fs_1.closeSync)(file);
+    }
+    (0, node_fs_1.renameSync)(temporary, filePath);
+    const directoryHandle = (0, node_fs_1.openSync)(directory, "r");
+    try {
+        (0, node_fs_1.fsyncSync)(directoryHandle);
+    }
+    finally {
+        (0, node_fs_1.closeSync)(directoryHandle);
+    }
+}
+function createTelegramAuditLedger(options) {
+    const directory = node_path_1.default.join(options.root, "state", "acceptance");
+    const ledgerPath = node_path_1.default.join(options.root, exports.TELEGRAM_ACCEPTANCE_AUDIT_RELATIVE_PATH);
+    const headPath = node_path_1.default.join(options.root, exports.TELEGRAM_ACCEPTANCE_AUDIT_HEAD_RELATIVE_PATH);
+    (0, node_fs_1.mkdirSync)(directory, { recursive: true, mode: 0o700 });
+    if ((0, node_fs_1.existsSync)(ledgerPath) !== (0, node_fs_1.existsSync)(headPath))
+        throw new Error("Telegram audit ledger/head presence mismatch");
+    if (!(0, node_fs_1.existsSync)(ledgerPath)) {
+        (0, node_fs_1.writeFileSync)(ledgerPath, "", { flag: "wx", mode: 0o600 });
+        writeHead(headPath, directory, { schemaVersion: SCHEMA, recordCount: 0, lastMac: GENESIS_MAC, headMac: headMac(options.identityKey, 0, GENESIS_MAC) });
+    }
+    let records = verifyTelegramAuditLedger({ ledgerRaw: (0, node_fs_1.readFileSync)(ledgerPath, "utf8"), headRaw: (0, node_fs_1.readFileSync)(headPath, "utf8"), identityKey: options.identityKey, privateValues: options.privateValues });
+    let currentHead = parseHead((0, node_fs_1.readFileSync)(headPath, "utf8"), options.identityKey);
+    const maxBytes = options._maxBytes ?? MAX_BYTES;
+    let failure;
+    (0, runtime_1.emitNervesEvent)({
+        component: "senses",
+        event: "senses.telegram_audit_ledger_ready",
+        message: "Telegram acceptance audit ledger is verified",
+        meta: { recordCount: currentHead.recordCount },
+    });
+    return {
+        ledgerPath,
+        headPath,
+        append(event) {
+            if (failure)
+                throw failure;
+            try {
+                const original = JSON.stringify(event);
+                if (containsPrivateMaterial(original, options.privateValues ?? []))
+                    throw new Error("Telegram audit event contains private material");
+                const redacted = JSON.parse((0, redact_1.redactString)(JSON.stringify((0, redact_1.redactLogEntry)(event))));
+                const unsigned = {
+                    schemaVersion: SCHEMA,
+                    sequence: currentHead.recordCount + 1,
+                    previousMac: currentHead.lastMac,
+                    ts: redacted.ts,
+                    level: redacted.level,
+                    event: redacted.event,
+                    component: redacted.component,
+                    trace_id: redacted.trace_id,
+                    message: redacted.message,
+                    meta: redacted.meta,
+                };
+                const row = { ...unsigned, rowMac: rowMac(options.identityKey, unsigned) };
+                const serialized = JSON.stringify(row);
+                if (Buffer.byteLength(serialized) > MAX_ROW_BYTES || currentHead.recordCount >= MAX_ROWS
+                    || Buffer.byteLength((0, node_fs_1.readFileSync)(ledgerPath)) + Buffer.byteLength(serialized) + 1 > maxBytes)
+                    throw new Error("Telegram audit ledger exceeds its bound");
+                (0, node_fs_1.appendFileSync)(ledgerPath, `${serialized}\n`, { encoding: "utf8", mode: 0o600 });
+                const ledgerHandle = (0, node_fs_1.openSync)(ledgerPath, "r");
+                try {
+                    (0, node_fs_1.fsyncSync)(ledgerHandle);
+                }
+                finally {
+                    (0, node_fs_1.closeSync)(ledgerHandle);
+                }
+                currentHead = {
+                    schemaVersion: SCHEMA,
+                    recordCount: row.sequence,
+                    lastMac: row.rowMac,
+                    headMac: headMac(options.identityKey, row.sequence, row.rowMac),
+                };
+                writeHead(headPath, directory, currentHead);
+                records = [...records, { event: row.event, at: Date.parse(row.ts), meta: row.meta }];
+            }
+            catch (error) {
+                failure = error instanceof Error ? error : new Error(String(error));
+                throw failure;
+            }
+        },
+        poison(error) {
+            failure ??= error;
+            throw failure;
+        },
+        assertHealthy() {
+            if (failure)
+                throw failure;
+            records = verifyTelegramAuditLedger({ ledgerRaw: (0, node_fs_1.readFileSync)(ledgerPath, "utf8"), headRaw: (0, node_fs_1.readFileSync)(headPath, "utf8"), identityKey: options.identityKey, privateValues: options.privateValues });
+            currentHead = parseHead((0, node_fs_1.readFileSync)(headPath, "utf8"), options.identityKey);
+        },
+        assertCapacity(additionalRows = 1) {
+            if (!Number.isSafeInteger(additionalRows) || additionalRows < 1)
+                throw new Error("Telegram audit capacity reservation is invalid");
+            if (failure)
+                throw failure;
+            if (currentHead.recordCount + additionalRows > MAX_ROWS
+                || Buffer.byteLength((0, node_fs_1.readFileSync)(ledgerPath)) + additionalRows * (MAX_ROW_BYTES + 1) > maxBytes) {
+                throw new Error("Telegram audit ledger lacks reserved capacity");
+            }
+        },
+    };
+}