@parmanasystems/audit-db 1.4.0 → 1.5.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/index.d.ts +2 -0
- package/dist/index.js +40 -0
- package/dist/index.js.map +1 -1
- package/package.json +3 -3
package/dist/index.d.ts
CHANGED
|
@@ -116,6 +116,8 @@ declare class AuditDb {
|
|
|
116
116
|
getDecisionById(executionId: string): Promise<AuditDecision | null>;
|
|
117
117
|
getVerificationsByExecution(executionId: string): Promise<AuditVerification[]>;
|
|
118
118
|
getSecurityDashboard(): Promise<SecurityDashboardRow[]>;
|
|
119
|
+
hasExecution(executionId: string): Promise<boolean>;
|
|
120
|
+
storePendingExecution(attestation: ExecutionAttestation): Promise<void>;
|
|
119
121
|
close(): Promise<void>;
|
|
120
122
|
}
|
|
121
123
|
|
package/dist/index.js
CHANGED
|
@@ -271,6 +271,46 @@ var AuditDb = class {
|
|
|
271
271
|
);
|
|
272
272
|
return rows;
|
|
273
273
|
}
|
|
274
|
+
async hasExecution(executionId) {
|
|
275
|
+
const { rows } = await this.pool.query(
|
|
276
|
+
`
|
|
277
|
+
SELECT execution_id
|
|
278
|
+
FROM audit_decisions
|
|
279
|
+
WHERE execution_id = $1
|
|
280
|
+
LIMIT 1
|
|
281
|
+
`,
|
|
282
|
+
[executionId]
|
|
283
|
+
);
|
|
284
|
+
return rows.length > 0;
|
|
285
|
+
}
|
|
286
|
+
async storePendingExecution(attestation) {
|
|
287
|
+
await this.pool.query(
|
|
288
|
+
`
|
|
289
|
+
INSERT INTO audit_decisions
|
|
290
|
+
(
|
|
291
|
+
execution_id,
|
|
292
|
+
decision,
|
|
293
|
+
execution_state,
|
|
294
|
+
runtime_hash,
|
|
295
|
+
signature,
|
|
296
|
+
attestation,
|
|
297
|
+
executed_at
|
|
298
|
+
)
|
|
299
|
+
VALUES ($1,$2,$3,$4,$5,$6,$7)
|
|
300
|
+
ON CONFLICT (execution_id)
|
|
301
|
+
DO NOTHING
|
|
302
|
+
`,
|
|
303
|
+
[
|
|
304
|
+
attestation.execution_id,
|
|
305
|
+
attestation.decision,
|
|
306
|
+
"pending_override",
|
|
307
|
+
attestation.runtime_hash,
|
|
308
|
+
attestation.signature,
|
|
309
|
+
JSON.stringify(attestation),
|
|
310
|
+
(/* @__PURE__ */ new Date()).toISOString()
|
|
311
|
+
]
|
|
312
|
+
);
|
|
313
|
+
}
|
|
274
314
|
async close() {
|
|
275
315
|
await this.pool.end();
|
|
276
316
|
}
|
package/dist/index.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"sources":["../src/client.ts","../src/migrations.ts"],"sourcesContent":["import { Pool } from \"pg\";\r\nimport type { PoolClient } from \"pg\";\r\n\r\nimport type { ExecutionAttestation } from \"@parmanasystems/execution\";\r\nimport type { VerificationResult } from \"@parmanasystems/verifier\";\r\n\r\nimport type {\r\n AuditDecision,\r\n AuditVerification,\r\n SecurityEventInput,\r\n ApiAccessInput,\r\n DecisionTimelineRow,\r\n DecisionFilter,\r\n SecurityDashboardRow,\r\n AuditStats,\r\n} from \"./types.js\";\r\nimport { runMigrations } from \"./migrations.js\";\r\n\r\nexport class AuditDb {\r\n private readonly pool: InstanceType<typeof Pool>;\r\n\r\n constructor(connectionString: string) {\r\n this.pool = new Pool({ connectionString });\r\n }\r\n\r\n async ping(): Promise<void> {\r\n await this.pool.query(\"SELECT 1\");\r\n }\r\n\r\n async disconnect(): Promise<void> {\r\n await this.pool.end();\r\n }\r\n\r\n async migrate(): Promise<void> {\r\n const client: PoolClient = await this.pool.connect();\r\n try {\r\n await runMigrations(client);\r\n } finally {\r\n client.release();\r\n }\r\n }\r\n\r\n /** Fire-and-forget — never throws, never delays the caller. */\r\n recordDecision(attestation: ExecutionAttestation): void {\r\n this.pool\r\n .query(\r\n `INSERT INTO audit_decisions\r\n (execution_id, decision, execution_state,\r\n runtime_hash, signature, attestation, executed_at)\r\n VALUES ($1,$2,$3,$4,$5,$6,$7)\r\n ON CONFLICT (execution_id) DO NOTHING`,\r\n [\r\n attestation.execution_id,\r\n attestation.decision,\r\n attestation.execution_state,\r\n attestation.runtime_hash,\r\n attestation.signature,\r\n JSON.stringify(attestation),\r\n new Date().toISOString(),\r\n ],\r\n )\r\n .catch(() => undefined);\r\n }\r\n\r\n /** Fire-and-forget — never throws, never delays the caller. */\r\n recordVerification(executionId: string, result: VerificationResult): void {\r\n this.pool\r\n .query(\r\n `INSERT INTO audit_verifications\r\n (execution_id, valid, signature_verified, runtime_verified, schema_compatible)\r\n VALUES ($1,$2,$3,$4,$5)`,\r\n [\r\n executionId,\r\n result.valid,\r\n result.checks.signature_verified,\r\n result.checks.runtime_verified,\r\n result.checks.schema_compatible,\r\n ],\r\n )\r\n .catch(() => undefined);\r\n }\r\n\r\n /** Fire-and-forget — never throws, never delays the caller. */\r\n recordSecurityEvent(event: SecurityEventInput): void {\r\n this.pool\r\n .query(\r\n `INSERT INTO audit_security_events\r\n (event_type, severity, ip_address, path, method, user_agent, details)\r\n VALUES ($1,$2,$3,$4,$5,$6,$7)`,\r\n [\r\n event.event_type,\r\n event.severity,\r\n event.ip_address ?? null,\r\n event.path ?? null,\r\n event.method ?? null,\r\n event.user_agent ?? null,\r\n event.details != null ? JSON.stringify(event.details) : null,\r\n ],\r\n )\r\n .catch(() => undefined);\r\n }\r\n\r\n /** Fire-and-forget — never throws, never delays the caller. */\r\n recordApiAccess(access: ApiAccessInput): void {\r\n this.pool\r\n .query(\r\n `INSERT INTO audit_api_access\r\n (method, path, status_code, response_time_ms, ip_address, user_agent, execution_id)\r\n VALUES ($1,$2,$3,$4,$5,$6,$7)`,\r\n [\r\n access.method,\r\n access.path,\r\n access.status_code,\r\n access.response_time_ms ?? null,\r\n access.ip_address ?? null,\r\n access.user_agent ?? null,\r\n access.execution_id ?? null,\r\n ],\r\n )\r\n .catch(() => undefined);\r\n }\r\n\r\n async getDecisionTimeline(limit = 100, filter?: DecisionFilter): Promise<DecisionTimelineRow[]> {\r\n const conditions: string[] = [];\r\n const values: unknown[] = [];\r\n\r\n if (filter?.policy_id) {\r\n values.push(filter.policy_id);\r\n conditions.push(`policy_id = $${values.length}`);\r\n }\r\n if (filter?.decision) {\r\n values.push(filter.decision);\r\n conditions.push(`decision = $${values.length}`);\r\n }\r\n if (filter?.from_date) {\r\n values.push(filter.from_date);\r\n conditions.push(`executed_at >= $${values.length}`);\r\n }\r\n if (filter?.to_date) {\r\n values.push(filter.to_date);\r\n conditions.push(`executed_at <= $${values.length}`);\r\n }\r\n\r\n values.push(limit);\r\n const limitParam = `$${values.length}`;\r\n const where = conditions.length ? `WHERE ${conditions.join(\" AND \")}` : \"\";\r\n\r\n const { rows } = await this.pool.query<DecisionTimelineRow>(\r\n `SELECT * FROM view_decision_timeline ${where} ORDER BY executed_at DESC LIMIT ${limitParam}`,\r\n values,\r\n );\r\n return rows;\r\n }\r\n\r\n async getStats(): Promise<AuditStats> {\r\n const { rows } = await this.pool.query<AuditStats>(`\r\n SELECT\r\n (SELECT COUNT(*) FROM audit_decisions)::text AS total_decisions,\r\n (SELECT COUNT(*) FROM audit_decisions WHERE executed_at >= CURRENT_DATE)::text AS decisions_today,\r\n (SELECT COUNT(*) FROM audit_verifications)::text AS total_verifications,\r\n (SELECT COUNT(*) FROM audit_verifications WHERE valid = true)::text AS valid_verifications,\r\n (SELECT COUNT(*) FROM audit_verifications WHERE valid = false)::text AS invalid_verifications,\r\n (SELECT COUNT(*) FROM audit_security_events)::text AS total_security_events,\r\n (SELECT COUNT(*) FROM audit_api_access)::text AS total_api_calls\r\n `);\r\n return rows[0]!;\r\n }\r\n\r\n async getDecisionById(executionId: string): Promise<AuditDecision | null> {\r\n const { rows } = await this.pool.query<AuditDecision>(\r\n `SELECT * FROM audit_decisions WHERE execution_id = $1`,\r\n [executionId],\r\n );\r\n return rows[0] ?? null;\r\n }\r\n\r\n async getVerificationsByExecution(executionId: string): Promise<AuditVerification[]> {\r\n const { rows } = await this.pool.query<AuditVerification>(\r\n `SELECT * FROM audit_verifications\r\n WHERE execution_id = $1\r\n ORDER BY verified_at DESC`,\r\n [executionId],\r\n );\r\n return rows;\r\n }\r\n\r\n async getSecurityDashboard(): Promise<SecurityDashboardRow[]> {\r\n const { rows } = await this.pool.query<SecurityDashboardRow>(\r\n `SELECT * FROM view_security_dashboard ORDER BY event_count DESC`,\r\n );\r\n return rows;\r\n }\r\n\r\n async close(): Promise<void> {\r\n await this.pool.end();\r\n }\r\n}\r\n","import type { PoolClient } from \"pg\";\r\n\r\n// Inlined so the bundle has no runtime fs dependency.\r\n// The canonical reference lives in schema.sql alongside this file.\r\nconst SCHEMA_SQL = `\r\nCREATE TABLE IF NOT EXISTS audit_decisions (\r\n id BIGSERIAL PRIMARY KEY,\r\n execution_id UUID NOT NULL UNIQUE,\r\n policy_id TEXT NOT NULL,\r\n policy_version TEXT NOT NULL,\r\n schema_version TEXT NOT NULL,\r\n runtime_version TEXT NOT NULL,\r\n runtime_hash TEXT NOT NULL,\r\n decision TEXT NOT NULL,\r\n signals_hash TEXT NOT NULL,\r\n signature TEXT NOT NULL,\r\n attestation JSONB NOT NULL,\r\n executed_at TIMESTAMPTZ NOT NULL,\r\n recorded_at TIMESTAMPTZ NOT NULL DEFAULT NOW()\r\n);\r\n\r\nCREATE INDEX IF NOT EXISTS idx_audit_decisions_policy_id\r\n ON audit_decisions (policy_id);\r\nCREATE INDEX IF NOT EXISTS idx_audit_decisions_executed_at\r\n ON audit_decisions (executed_at DESC);\r\nCREATE INDEX IF NOT EXISTS idx_audit_decisions_decision\r\n ON audit_decisions (decision);\r\n\r\nCREATE TABLE IF NOT EXISTS audit_verifications (\r\n id BIGSERIAL PRIMARY KEY,\r\n execution_id UUID NOT NULL,\r\n valid BOOLEAN NOT NULL,\r\n signature_verified BOOLEAN NOT NULL,\r\n runtime_verified BOOLEAN NOT NULL,\r\n schema_compatible BOOLEAN NOT NULL,\r\n verified_at TIMESTAMPTZ NOT NULL DEFAULT NOW()\r\n);\r\n\r\nCREATE INDEX IF NOT EXISTS idx_audit_verifications_execution_id\r\n ON audit_verifications (execution_id);\r\nCREATE INDEX IF NOT EXISTS idx_audit_verifications_valid\r\n ON audit_verifications (valid);\r\nCREATE INDEX IF NOT EXISTS idx_audit_verifications_verified_at\r\n ON audit_verifications (verified_at DESC);\r\n\r\nCREATE TABLE IF NOT EXISTS audit_security_events (\r\n id BIGSERIAL PRIMARY KEY,\r\n event_type TEXT NOT NULL,\r\n severity TEXT NOT NULL CHECK (severity IN ('low','medium','high','critical')),\r\n ip_address TEXT,\r\n path TEXT,\r\n method TEXT,\r\n user_agent TEXT,\r\n details JSONB,\r\n occurred_at TIMESTAMPTZ NOT NULL DEFAULT NOW()\r\n);\r\n\r\nCREATE INDEX IF NOT EXISTS idx_audit_security_events_event_type\r\n ON audit_security_events (event_type);\r\nCREATE INDEX IF NOT EXISTS idx_audit_security_events_severity\r\n ON audit_security_events (severity);\r\nCREATE INDEX IF NOT EXISTS idx_audit_security_events_occurred_at\r\n ON audit_security_events (occurred_at DESC);\r\n\r\nCREATE TABLE IF NOT EXISTS audit_api_access (\r\n id BIGSERIAL PRIMARY KEY,\r\n method TEXT NOT NULL,\r\n path TEXT NOT NULL,\r\n status_code INTEGER NOT NULL,\r\n response_time_ms INTEGER,\r\n ip_address TEXT,\r\n user_agent TEXT,\r\n execution_id UUID,\r\n accessed_at TIMESTAMPTZ NOT NULL DEFAULT NOW()\r\n);\r\n\r\nCREATE INDEX IF NOT EXISTS idx_audit_api_access_path\r\n ON audit_api_access (path);\r\nCREATE INDEX IF NOT EXISTS idx_audit_api_access_status_code\r\n ON audit_api_access (status_code);\r\nCREATE INDEX IF NOT EXISTS idx_audit_api_access_accessed_at\r\n ON audit_api_access (accessed_at DESC);\r\n\r\nCREATE OR REPLACE VIEW view_decision_timeline AS\r\nSELECT\r\n d.execution_id,\r\n d.policy_id,\r\n d.policy_version,\r\n d.decision,\r\n d.runtime_version,\r\n d.runtime_hash,\r\n d.executed_at,\r\n d.recorded_at,\r\n v.valid AS verification_valid,\r\n v.signature_verified,\r\n v.runtime_verified,\r\n v.schema_compatible,\r\n v.verified_at\r\nFROM audit_decisions d\r\nLEFT JOIN audit_verifications v ON d.execution_id = v.execution_id;\r\n\r\nCREATE OR REPLACE VIEW view_security_dashboard AS\r\nSELECT\r\n event_type,\r\n severity,\r\n COUNT(*) AS event_count,\r\n MAX(occurred_at) AS last_occurrence,\r\n MIN(occurred_at) AS first_occurrence\r\nFROM audit_security_events\r\nGROUP BY event_type, severity;\r\n`;\r\n\r\nexport async function runMigrations(client: PoolClient): Promise<void> {\r\n await client.query(\"BEGIN\");\r\n try {\r\n await client.query(SCHEMA_SQL);\r\n await client.query(\"COMMIT\");\r\n } catch (err) {\r\n await client.query(\"ROLLBACK\");\r\n throw err;\r\n }\r\n}\r\n"],"mappings":";AAAA,SAAS,YAAY;;;ACIrB,IAAM,aAAa;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AA4GnB,eAAsB,cAAc,QAAmC;AACrE,QAAM,OAAO,MAAM,OAAO;AAC1B,MAAI;AACF,UAAM,OAAO,MAAM,UAAU;AAC7B,UAAM,OAAO,MAAM,QAAQ;AAAA,EAC7B,SAAS,KAAK;AACZ,UAAM,OAAO,MAAM,UAAU;AAC7B,UAAM;AAAA,EACR;AACF;;;ADvGO,IAAM,UAAN,MAAc;AAAA,EACF;AAAA,EAEjB,YAAY,kBAA0B;AACpC,SAAK,OAAO,IAAI,KAAK,EAAE,iBAAiB,CAAC;AAAA,EAC3C;AAAA,EAEA,MAAM,OAAsB;AAC1B,UAAM,KAAK,KAAK,MAAM,UAAU;AAAA,EAClC;AAAA,EAEA,MAAM,aAA4B;AAChC,UAAM,KAAK,KAAK,IAAI;AAAA,EACtB;AAAA,EAEA,MAAM,UAAyB;AAC7B,UAAM,SAAqB,MAAM,KAAK,KAAK,QAAQ;AACnD,QAAI;AACF,YAAM,cAAc,MAAM;AAAA,IAC5B,UAAE;AACA,aAAO,QAAQ;AAAA,IACjB;AAAA,EACF;AAAA;AAAA,EAGA,eAAe,aAAyC;AACtD,SAAK,KACF;AAAA,MACC;AAAA;AAAA;AAAA;AAAA;AAAA,MAKA;AAAA,QACE,YAAY;AAAA,QACZ,YAAY;AAAA,QACZ,YAAY;AAAA,QACZ,YAAY;AAAA,QACZ,YAAY;AAAA,QACZ,KAAK,UAAU,WAAW;AAAA,SAC1B,oBAAI,KAAK,GAAE,YAAY;AAAA,MACzB;AAAA,IACF,EACC,MAAM,MAAM,MAAS;AAAA,EAC1B;AAAA;AAAA,EAGA,mBAAmB,aAAqB,QAAkC;AACxE,SAAK,KACF;AAAA,MACC;AAAA;AAAA;AAAA,MAGA;AAAA,QACE;AAAA,QACA,OAAO;AAAA,QACP,OAAO,OAAO;AAAA,QACd,OAAO,OAAO;AAAA,QACd,OAAO,OAAO;AAAA,MAChB;AAAA,IACF,EACC,MAAM,MAAM,MAAS;AAAA,EAC1B;AAAA;AAAA,EAGA,oBAAoB,OAAiC;AACnD,SAAK,KACF;AAAA,MACC;AAAA;AAAA;AAAA,MAGA;AAAA,QACE,MAAM;AAAA,QACN,MAAM;AAAA,QACN,MAAM,cAAc;AAAA,QACpB,MAAM,QAAQ;AAAA,QACd,MAAM,UAAU;AAAA,QAChB,MAAM,cAAc;AAAA,QACpB,MAAM,WAAW,OAAO,KAAK,UAAU,MAAM,OAAO,IAAI;AAAA,MAC1D;AAAA,IACF,EACC,MAAM,MAAM,MAAS;AAAA,EAC1B;AAAA;AAAA,EAGA,gBAAgB,QAA8B;AAC5C,SAAK,KACF;AAAA,MACC;AAAA;AAAA;AAAA,MAGA;AAAA,QACE,OAAO;AAAA,QACP,OAAO;AAAA,QACP,OAAO;AAAA,QACP,OAAO,oBAAoB;AAAA,QAC3B,OAAO,cAAc;AAAA,QACrB,OAAO,cAAc;AAAA,QACrB,OAAO,gBAAgB;AAAA,MACzB;AAAA,IACF,EACC,MAAM,MAAM,MAAS;AAAA,EAC1B;AAAA,EAEA,MAAM,oBAAoB,QAAQ,KAAK,QAAyD;AAC9F,UAAM,aAAuB,CAAC;AAC9B,UAAM,SAAoB,CAAC;AAE3B,QAAI,QAAQ,WAAW;AACrB,aAAO,KAAK,OAAO,SAAS;AAC5B,iBAAW,KAAK,gBAAgB,OAAO,MAAM,EAAE;AAAA,IACjD;AACA,QAAI,QAAQ,UAAU;AACpB,aAAO,KAAK,OAAO,QAAQ;AAC3B,iBAAW,KAAK,eAAe,OAAO,MAAM,EAAE;AAAA,IAChD;AACA,QAAI,QAAQ,WAAW;AACrB,aAAO,KAAK,OAAO,SAAS;AAC5B,iBAAW,KAAK,mBAAmB,OAAO,MAAM,EAAE;AAAA,IACpD;AACA,QAAI,QAAQ,SAAS;AACnB,aAAO,KAAK,OAAO,OAAO;AAC1B,iBAAW,KAAK,mBAAmB,OAAO,MAAM,EAAE;AAAA,IACpD;AAEA,WAAO,KAAK,KAAK;AACjB,UAAM,aAAa,IAAI,OAAO,MAAM;AACpC,UAAM,QAAQ,WAAW,SAAS,SAAS,WAAW,KAAK,OAAO,CAAC,KAAK;AAExE,UAAM,EAAE,KAAK,IAAI,MAAM,KAAK,KAAK;AAAA,MAC/B,wCAAwC,KAAK,oCAAoC,UAAU;AAAA,MAC3F;AAAA,IACF;AACA,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,WAAgC;AACpC,UAAM,EAAE,KAAK,IAAI,MAAM,KAAK,KAAK,MAAkB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,KASlD;AACD,WAAO,KAAK,CAAC;AAAA,EACf;AAAA,EAEA,MAAM,gBAAgB,aAAoD;AACxE,UAAM,EAAE,KAAK,IAAI,MAAM,KAAK,KAAK;AAAA,MAC/B;AAAA,MACA,CAAC,WAAW;AAAA,IACd;AACA,WAAO,KAAK,CAAC,KAAK;AAAA,EACpB;AAAA,EAEA,MAAM,4BAA4B,aAAmD;AACnF,UAAM,EAAE,KAAK,IAAI,MAAM,KAAK,KAAK;AAAA,MAC/B;AAAA;AAAA;AAAA,MAGA,CAAC,WAAW;AAAA,IACd;AACA,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,uBAAwD;AAC5D,UAAM,EAAE,KAAK,IAAI,MAAM,KAAK,KAAK;AAAA,MAC/B;AAAA,IACF;AACA,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,QAAuB;AAC3B,UAAM,KAAK,KAAK,IAAI;AAAA,EACtB;AACF;","names":[]}
|
|
1
|
+
{"version":3,"sources":["../src/client.ts","../src/migrations.ts"],"sourcesContent":["import { Pool } from \"pg\";\r\nimport type { PoolClient } from \"pg\";\r\n\r\nimport type { ExecutionAttestation } from \"@parmanasystems/execution\";\r\nimport type { VerificationResult } from \"@parmanasystems/verifier\";\r\n\r\nimport type {\r\n AuditDecision,\r\n AuditVerification,\r\n SecurityEventInput,\r\n ApiAccessInput,\r\n DecisionTimelineRow,\r\n DecisionFilter,\r\n SecurityDashboardRow,\r\n AuditStats,\r\n} from \"./types.js\";\r\nimport { runMigrations } from \"./migrations.js\";\r\n\r\nexport class AuditDb {\r\n private readonly pool: InstanceType<typeof Pool>;\r\n\r\n constructor(connectionString: string) {\r\n this.pool = new Pool({ connectionString });\r\n }\r\n\r\n async ping(): Promise<void> {\r\n await this.pool.query(\"SELECT 1\");\r\n }\r\n\r\n async disconnect(): Promise<void> {\r\n await this.pool.end();\r\n }\r\n\r\n async migrate(): Promise<void> {\r\n const client: PoolClient = await this.pool.connect();\r\n try {\r\n await runMigrations(client);\r\n } finally {\r\n client.release();\r\n }\r\n }\r\n\r\n /** Fire-and-forget — never throws, never delays the caller. */\r\n recordDecision(attestation: ExecutionAttestation): void {\r\n this.pool\r\n .query(\r\n `INSERT INTO audit_decisions\r\n (execution_id, decision, execution_state,\r\n runtime_hash, signature, attestation, executed_at)\r\n VALUES ($1,$2,$3,$4,$5,$6,$7)\r\n ON CONFLICT (execution_id) DO NOTHING`,\r\n [\r\n attestation.execution_id,\r\n attestation.decision,\r\n attestation.execution_state,\r\n attestation.runtime_hash,\r\n attestation.signature,\r\n JSON.stringify(attestation),\r\n new Date().toISOString(),\r\n ],\r\n )\r\n .catch(() => undefined);\r\n }\r\n\r\n /** Fire-and-forget — never throws, never delays the caller. */\r\n recordVerification(executionId: string, result: VerificationResult): void {\r\n this.pool\r\n .query(\r\n `INSERT INTO audit_verifications\r\n (execution_id, valid, signature_verified, runtime_verified, schema_compatible)\r\n VALUES ($1,$2,$3,$4,$5)`,\r\n [\r\n executionId,\r\n result.valid,\r\n result.checks.signature_verified,\r\n result.checks.runtime_verified,\r\n result.checks.schema_compatible,\r\n ],\r\n )\r\n .catch(() => undefined);\r\n }\r\n\r\n /** Fire-and-forget — never throws, never delays the caller. */\r\n recordSecurityEvent(event: SecurityEventInput): void {\r\n this.pool\r\n .query(\r\n `INSERT INTO audit_security_events\r\n (event_type, severity, ip_address, path, method, user_agent, details)\r\n VALUES ($1,$2,$3,$4,$5,$6,$7)`,\r\n [\r\n event.event_type,\r\n event.severity,\r\n event.ip_address ?? null,\r\n event.path ?? null,\r\n event.method ?? null,\r\n event.user_agent ?? null,\r\n event.details != null ? JSON.stringify(event.details) : null,\r\n ],\r\n )\r\n .catch(() => undefined);\r\n }\r\n\r\n /** Fire-and-forget — never throws, never delays the caller. */\r\n recordApiAccess(access: ApiAccessInput): void {\r\n this.pool\r\n .query(\r\n `INSERT INTO audit_api_access\r\n (method, path, status_code, response_time_ms, ip_address, user_agent, execution_id)\r\n VALUES ($1,$2,$3,$4,$5,$6,$7)`,\r\n [\r\n access.method,\r\n access.path,\r\n access.status_code,\r\n access.response_time_ms ?? null,\r\n access.ip_address ?? null,\r\n access.user_agent ?? null,\r\n access.execution_id ?? null,\r\n ],\r\n )\r\n .catch(() => undefined);\r\n }\r\n\r\n async getDecisionTimeline(limit = 100, filter?: DecisionFilter): Promise<DecisionTimelineRow[]> {\r\n const conditions: string[] = [];\r\n const values: unknown[] = [];\r\n\r\n if (filter?.policy_id) {\r\n values.push(filter.policy_id);\r\n conditions.push(`policy_id = $${values.length}`);\r\n }\r\n if (filter?.decision) {\r\n values.push(filter.decision);\r\n conditions.push(`decision = $${values.length}`);\r\n }\r\n if (filter?.from_date) {\r\n values.push(filter.from_date);\r\n conditions.push(`executed_at >= $${values.length}`);\r\n }\r\n if (filter?.to_date) {\r\n values.push(filter.to_date);\r\n conditions.push(`executed_at <= $${values.length}`);\r\n }\r\n\r\n values.push(limit);\r\n const limitParam = `$${values.length}`;\r\n const where = conditions.length ? `WHERE ${conditions.join(\" AND \")}` : \"\";\r\n\r\n const { rows } = await this.pool.query<DecisionTimelineRow>(\r\n `SELECT * FROM view_decision_timeline ${where} ORDER BY executed_at DESC LIMIT ${limitParam}`,\r\n values,\r\n );\r\n return rows;\r\n }\r\n\r\n async getStats(): Promise<AuditStats> {\r\n const { rows } = await this.pool.query<AuditStats>(`\r\n SELECT\r\n (SELECT COUNT(*) FROM audit_decisions)::text AS total_decisions,\r\n (SELECT COUNT(*) FROM audit_decisions WHERE executed_at >= CURRENT_DATE)::text AS decisions_today,\r\n (SELECT COUNT(*) FROM audit_verifications)::text AS total_verifications,\r\n (SELECT COUNT(*) FROM audit_verifications WHERE valid = true)::text AS valid_verifications,\r\n (SELECT COUNT(*) FROM audit_verifications WHERE valid = false)::text AS invalid_verifications,\r\n (SELECT COUNT(*) FROM audit_security_events)::text AS total_security_events,\r\n (SELECT COUNT(*) FROM audit_api_access)::text AS total_api_calls\r\n `);\r\n return rows[0]!;\r\n }\r\n\r\n async getDecisionById(executionId: string): Promise<AuditDecision | null> {\r\n const { rows } = await this.pool.query<AuditDecision>(\r\n `SELECT * FROM audit_decisions WHERE execution_id = $1`,\r\n [executionId],\r\n );\r\n return rows[0] ?? null;\r\n }\r\n\r\n async getVerificationsByExecution(executionId: string): Promise<AuditVerification[]> {\r\n const { rows } = await this.pool.query<AuditVerification>(\r\n `SELECT * FROM audit_verifications\r\n WHERE execution_id = $1\r\n ORDER BY verified_at DESC`,\r\n [executionId],\r\n );\r\n return rows;\r\n }\r\n\r\n async getSecurityDashboard(): Promise<SecurityDashboardRow[]> {\r\n const { rows } = await this.pool.query<SecurityDashboardRow>(\r\n `SELECT * FROM view_security_dashboard ORDER BY event_count DESC`,\r\n );\r\n return rows;\r\n }\r\n async hasExecution(\r\n executionId: string\r\n): Promise<boolean> {\r\n\r\n const { rows } =\r\n await this.pool.query(\r\n `\r\n SELECT execution_id\r\n FROM audit_decisions\r\n WHERE execution_id = $1\r\n LIMIT 1\r\n `,\r\n [executionId]\r\n );\r\n\r\n return rows.length > 0;\r\n}\r\n\r\nasync storePendingExecution(\r\n attestation: ExecutionAttestation\r\n): Promise<void> {\r\n\r\n await this.pool.query(\r\n `\r\n INSERT INTO audit_decisions\r\n (\r\n execution_id,\r\n decision,\r\n execution_state,\r\n runtime_hash,\r\n signature,\r\n attestation,\r\n executed_at\r\n )\r\n VALUES ($1,$2,$3,$4,$5,$6,$7)\r\n ON CONFLICT (execution_id)\r\n DO NOTHING\r\n `,\r\n [\r\n attestation.execution_id,\r\n attestation.decision,\r\n \"pending_override\",\r\n attestation.runtime_hash,\r\n attestation.signature,\r\n JSON.stringify(attestation),\r\n new Date().toISOString()\r\n ]\r\n );\r\n}\r\n async close(): Promise<void> {\r\n await this.pool.end();\r\n }\r\n}\r\n","import type { PoolClient } from \"pg\";\r\n\r\n// Inlined so the bundle has no runtime fs dependency.\r\n// The canonical reference lives in schema.sql alongside this file.\r\nconst SCHEMA_SQL = `\r\nCREATE TABLE IF NOT EXISTS audit_decisions (\r\n id BIGSERIAL PRIMARY KEY,\r\n execution_id UUID NOT NULL UNIQUE,\r\n policy_id TEXT NOT NULL,\r\n policy_version TEXT NOT NULL,\r\n schema_version TEXT NOT NULL,\r\n runtime_version TEXT NOT NULL,\r\n runtime_hash TEXT NOT NULL,\r\n decision TEXT NOT NULL,\r\n signals_hash TEXT NOT NULL,\r\n signature TEXT NOT NULL,\r\n attestation JSONB NOT NULL,\r\n executed_at TIMESTAMPTZ NOT NULL,\r\n recorded_at TIMESTAMPTZ NOT NULL DEFAULT NOW()\r\n);\r\n\r\nCREATE INDEX IF NOT EXISTS idx_audit_decisions_policy_id\r\n ON audit_decisions (policy_id);\r\nCREATE INDEX IF NOT EXISTS idx_audit_decisions_executed_at\r\n ON audit_decisions (executed_at DESC);\r\nCREATE INDEX IF NOT EXISTS idx_audit_decisions_decision\r\n ON audit_decisions (decision);\r\n\r\nCREATE TABLE IF NOT EXISTS audit_verifications (\r\n id BIGSERIAL PRIMARY KEY,\r\n execution_id UUID NOT NULL,\r\n valid BOOLEAN NOT NULL,\r\n signature_verified BOOLEAN NOT NULL,\r\n runtime_verified BOOLEAN NOT NULL,\r\n schema_compatible BOOLEAN NOT NULL,\r\n verified_at TIMESTAMPTZ NOT NULL DEFAULT NOW()\r\n);\r\n\r\nCREATE INDEX IF NOT EXISTS idx_audit_verifications_execution_id\r\n ON audit_verifications (execution_id);\r\nCREATE INDEX IF NOT EXISTS idx_audit_verifications_valid\r\n ON audit_verifications (valid);\r\nCREATE INDEX IF NOT EXISTS idx_audit_verifications_verified_at\r\n ON audit_verifications (verified_at DESC);\r\n\r\nCREATE TABLE IF NOT EXISTS audit_security_events (\r\n id BIGSERIAL PRIMARY KEY,\r\n event_type TEXT NOT NULL,\r\n severity TEXT NOT NULL CHECK (severity IN ('low','medium','high','critical')),\r\n ip_address TEXT,\r\n path TEXT,\r\n method TEXT,\r\n user_agent TEXT,\r\n details JSONB,\r\n occurred_at TIMESTAMPTZ NOT NULL DEFAULT NOW()\r\n);\r\n\r\nCREATE INDEX IF NOT EXISTS idx_audit_security_events_event_type\r\n ON audit_security_events (event_type);\r\nCREATE INDEX IF NOT EXISTS idx_audit_security_events_severity\r\n ON audit_security_events (severity);\r\nCREATE INDEX IF NOT EXISTS idx_audit_security_events_occurred_at\r\n ON audit_security_events (occurred_at DESC);\r\n\r\nCREATE TABLE IF NOT EXISTS audit_api_access (\r\n id BIGSERIAL PRIMARY KEY,\r\n method TEXT NOT NULL,\r\n path TEXT NOT NULL,\r\n status_code INTEGER NOT NULL,\r\n response_time_ms INTEGER,\r\n ip_address TEXT,\r\n user_agent TEXT,\r\n execution_id UUID,\r\n accessed_at TIMESTAMPTZ NOT NULL DEFAULT NOW()\r\n);\r\n\r\nCREATE INDEX IF NOT EXISTS idx_audit_api_access_path\r\n ON audit_api_access (path);\r\nCREATE INDEX IF NOT EXISTS idx_audit_api_access_status_code\r\n ON audit_api_access (status_code);\r\nCREATE INDEX IF NOT EXISTS idx_audit_api_access_accessed_at\r\n ON audit_api_access (accessed_at DESC);\r\n\r\nCREATE OR REPLACE VIEW view_decision_timeline AS\r\nSELECT\r\n d.execution_id,\r\n d.policy_id,\r\n d.policy_version,\r\n d.decision,\r\n d.runtime_version,\r\n d.runtime_hash,\r\n d.executed_at,\r\n d.recorded_at,\r\n v.valid AS verification_valid,\r\n v.signature_verified,\r\n v.runtime_verified,\r\n v.schema_compatible,\r\n v.verified_at\r\nFROM audit_decisions d\r\nLEFT JOIN audit_verifications v ON d.execution_id = v.execution_id;\r\n\r\nCREATE OR REPLACE VIEW view_security_dashboard AS\r\nSELECT\r\n event_type,\r\n severity,\r\n COUNT(*) AS event_count,\r\n MAX(occurred_at) AS last_occurrence,\r\n MIN(occurred_at) AS first_occurrence\r\nFROM audit_security_events\r\nGROUP BY event_type, severity;\r\n`;\r\n\r\nexport async function runMigrations(client: PoolClient): Promise<void> {\r\n await client.query(\"BEGIN\");\r\n try {\r\n await client.query(SCHEMA_SQL);\r\n await client.query(\"COMMIT\");\r\n } catch (err) {\r\n await client.query(\"ROLLBACK\");\r\n throw err;\r\n }\r\n}\r\n"],"mappings":";AAAA,SAAS,YAAY;;;ACIrB,IAAM,aAAa;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AA4GnB,eAAsB,cAAc,QAAmC;AACrE,QAAM,OAAO,MAAM,OAAO;AAC1B,MAAI;AACF,UAAM,OAAO,MAAM,UAAU;AAC7B,UAAM,OAAO,MAAM,QAAQ;AAAA,EAC7B,SAAS,KAAK;AACZ,UAAM,OAAO,MAAM,UAAU;AAC7B,UAAM;AAAA,EACR;AACF;;;ADvGO,IAAM,UAAN,MAAc;AAAA,EACF;AAAA,EAEjB,YAAY,kBAA0B;AACpC,SAAK,OAAO,IAAI,KAAK,EAAE,iBAAiB,CAAC;AAAA,EAC3C;AAAA,EAEA,MAAM,OAAsB;AAC1B,UAAM,KAAK,KAAK,MAAM,UAAU;AAAA,EAClC;AAAA,EAEA,MAAM,aAA4B;AAChC,UAAM,KAAK,KAAK,IAAI;AAAA,EACtB;AAAA,EAEA,MAAM,UAAyB;AAC7B,UAAM,SAAqB,MAAM,KAAK,KAAK,QAAQ;AACnD,QAAI;AACF,YAAM,cAAc,MAAM;AAAA,IAC5B,UAAE;AACA,aAAO,QAAQ;AAAA,IACjB;AAAA,EACF;AAAA;AAAA,EAGA,eAAe,aAAyC;AACtD,SAAK,KACF;AAAA,MACC;AAAA;AAAA;AAAA;AAAA;AAAA,MAKA;AAAA,QACE,YAAY;AAAA,QACZ,YAAY;AAAA,QACZ,YAAY;AAAA,QACZ,YAAY;AAAA,QACZ,YAAY;AAAA,QACZ,KAAK,UAAU,WAAW;AAAA,SAC1B,oBAAI,KAAK,GAAE,YAAY;AAAA,MACzB;AAAA,IACF,EACC,MAAM,MAAM,MAAS;AAAA,EAC1B;AAAA;AAAA,EAGA,mBAAmB,aAAqB,QAAkC;AACxE,SAAK,KACF;AAAA,MACC;AAAA;AAAA;AAAA,MAGA;AAAA,QACE;AAAA,QACA,OAAO;AAAA,QACP,OAAO,OAAO;AAAA,QACd,OAAO,OAAO;AAAA,QACd,OAAO,OAAO;AAAA,MAChB;AAAA,IACF,EACC,MAAM,MAAM,MAAS;AAAA,EAC1B;AAAA;AAAA,EAGA,oBAAoB,OAAiC;AACnD,SAAK,KACF;AAAA,MACC;AAAA;AAAA;AAAA,MAGA;AAAA,QACE,MAAM;AAAA,QACN,MAAM;AAAA,QACN,MAAM,cAAc;AAAA,QACpB,MAAM,QAAQ;AAAA,QACd,MAAM,UAAU;AAAA,QAChB,MAAM,cAAc;AAAA,QACpB,MAAM,WAAW,OAAO,KAAK,UAAU,MAAM,OAAO,IAAI;AAAA,MAC1D;AAAA,IACF,EACC,MAAM,MAAM,MAAS;AAAA,EAC1B;AAAA;AAAA,EAGA,gBAAgB,QAA8B;AAC5C,SAAK,KACF;AAAA,MACC;AAAA;AAAA;AAAA,MAGA;AAAA,QACE,OAAO;AAAA,QACP,OAAO;AAAA,QACP,OAAO;AAAA,QACP,OAAO,oBAAoB;AAAA,QAC3B,OAAO,cAAc;AAAA,QACrB,OAAO,cAAc;AAAA,QACrB,OAAO,gBAAgB;AAAA,MACzB;AAAA,IACF,EACC,MAAM,MAAM,MAAS;AAAA,EAC1B;AAAA,EAEA,MAAM,oBAAoB,QAAQ,KAAK,QAAyD;AAC9F,UAAM,aAAuB,CAAC;AAC9B,UAAM,SAAoB,CAAC;AAE3B,QAAI,QAAQ,WAAW;AACrB,aAAO,KAAK,OAAO,SAAS;AAC5B,iBAAW,KAAK,gBAAgB,OAAO,MAAM,EAAE;AAAA,IACjD;AACA,QAAI,QAAQ,UAAU;AACpB,aAAO,KAAK,OAAO,QAAQ;AAC3B,iBAAW,KAAK,eAAe,OAAO,MAAM,EAAE;AAAA,IAChD;AACA,QAAI,QAAQ,WAAW;AACrB,aAAO,KAAK,OAAO,SAAS;AAC5B,iBAAW,KAAK,mBAAmB,OAAO,MAAM,EAAE;AAAA,IACpD;AACA,QAAI,QAAQ,SAAS;AACnB,aAAO,KAAK,OAAO,OAAO;AAC1B,iBAAW,KAAK,mBAAmB,OAAO,MAAM,EAAE;AAAA,IACpD;AAEA,WAAO,KAAK,KAAK;AACjB,UAAM,aAAa,IAAI,OAAO,MAAM;AACpC,UAAM,QAAQ,WAAW,SAAS,SAAS,WAAW,KAAK,OAAO,CAAC,KAAK;AAExE,UAAM,EAAE,KAAK,IAAI,MAAM,KAAK,KAAK;AAAA,MAC/B,wCAAwC,KAAK,oCAAoC,UAAU;AAAA,MAC3F;AAAA,IACF;AACA,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,WAAgC;AACpC,UAAM,EAAE,KAAK,IAAI,MAAM,KAAK,KAAK,MAAkB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,KASlD;AACD,WAAO,KAAK,CAAC;AAAA,EACf;AAAA,EAEA,MAAM,gBAAgB,aAAoD;AACxE,UAAM,EAAE,KAAK,IAAI,MAAM,KAAK,KAAK;AAAA,MAC/B;AAAA,MACA,CAAC,WAAW;AAAA,IACd;AACA,WAAO,KAAK,CAAC,KAAK;AAAA,EACpB;AAAA,EAEA,MAAM,4BAA4B,aAAmD;AACnF,UAAM,EAAE,KAAK,IAAI,MAAM,KAAK,KAAK;AAAA,MAC/B;AAAA;AAAA;AAAA,MAGA,CAAC,WAAW;AAAA,IACd;AACA,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,uBAAwD;AAC5D,UAAM,EAAE,KAAK,IAAI,MAAM,KAAK,KAAK;AAAA,MAC/B;AAAA,IACF;AACA,WAAO;AAAA,EACT;AAAA,EACA,MAAM,aACN,aACkB;AAElB,UAAM,EAAE,KAAK,IACX,MAAM,KAAK,KAAK;AAAA,MACd;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAMA,CAAC,WAAW;AAAA,IACd;AAEF,WAAO,KAAK,SAAS;AAAA,EACvB;AAAA,EAEA,MAAM,sBACJ,aACe;AAEf,UAAM,KAAK,KAAK;AAAA,MACd;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAeA;AAAA,QACE,YAAY;AAAA,QACZ,YAAY;AAAA,QACZ;AAAA,QACA,YAAY;AAAA,QACZ,YAAY;AAAA,QACZ,KAAK,UAAU,WAAW;AAAA,SAC1B,oBAAI,KAAK,GAAE,YAAY;AAAA,MACzB;AAAA,IACF;AAAA,EACF;AAAA,EACE,MAAM,QAAuB;AAC3B,UAAM,KAAK,KAAK,IAAI;AAAA,EACtB;AACF;","names":[]}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@parmanasystems/audit-db",
|
|
3
|
-
"version": "1.
|
|
3
|
+
"version": "1.5.0",
|
|
4
4
|
"private": false,
|
|
5
5
|
"type": "module",
|
|
6
6
|
"description": "PostgreSQL audit database client for parmanasystems governance decisions, verifications, and security events.",
|
|
@@ -19,8 +19,8 @@
|
|
|
19
19
|
],
|
|
20
20
|
"sideEffects": false,
|
|
21
21
|
"dependencies": {
|
|
22
|
-
"@parmanasystems/execution": "^1.
|
|
23
|
-
"@parmanasystems/verifier": "^1.
|
|
22
|
+
"@parmanasystems/execution": "^1.5.0",
|
|
23
|
+
"@parmanasystems/verifier": "^1.5.0",
|
|
24
24
|
"pg": "^8.13.3"
|
|
25
25
|
},
|
|
26
26
|
"devDependencies": {
|