@wtfalch/foundry 0.5.0 → 0.7.1

package/dist/migrations/0024_audit_events.sql

@@ -0,0 +1,211 @@
+-- Cutover from foundry_audit_events (0012_audit.sql): it stops receiving writes
+-- from this migration on, and its old rows are left in place.
+-- Copied verbatim from @wtfalch/audit 0.6.0's own migrations/ (#232), the
+-- same way that package's own audit-migrations CLI copies them into a host's
+-- drizzle/ directory -- foundry has no drizzle/ journal, so this file is
+-- that copy, hand-placed at the next free number instead. Never edit the
+-- copied SQL below; a fix ships as a new numbered file, same as upstream.
+--
+-- @wtfalch/audit: the append-only audit ledger. Mirrors src/tables.ts.
+--
+-- Every statement is idempotent. Applied by the host's own migrate script
+-- after the host copies this file into its drizzle/ directory as the next
+-- number (audit-migrations); never edited there.
+--
+-- What this file enforces is the ledger's SHAPE and its WALLS: bounded
+-- columns, JSON under 64 KB, the pairs that must appear together, the
+-- break-glass rule that a session row carries its session, reason and
+-- reference, and the three triggers plus the runtime-role revoke that make
+-- "append-only" true for a role that is not a superuser. The CLOSED SETS
+-- (which event names, actor classes, contexts, outcomes and reason codes a
+-- host admits) are the host's own vocabulary: enforced in TypeScript by the
+-- ledger at write time, and in the database by the host's own CHECKs when it
+-- has them (wtfalch/app-template's 0003 and 0007 do). A host with only this
+-- file gets the shape and the walls.
+--
+-- Estate-shaped: the DO block assumes a runtime role named <database>_rt that
+-- owns nothing and serves the app. Without it, the tables and the function
+-- exist and no revoke takes effect.
+--
+-- No foreign keys, on purpose: the trail outlives the tenant, the person and
+-- the credential it describes. `tenant_id` is a uuid because the estate's
+-- tenants are; a host with other ids alters the column in its own migration.
+
+create table if not exists audit_events (
+  id              bigint generated always as identity primary key,
+  occurred_at     timestamptz not null default now(),
+  tenant_id       uuid,
+  actor_class     text not null,
+  actor_id        text not null,
+  actor_display   text not null,
+  action          text not null,
+  target_type     text not null,
+  target_id       text not null,
+  outcome         text not null,
+  context         text not null,
+  session_id      text,
+  reason          text,
+  reference       text,
+  request_id      text,
+  ip              text,
+  user_agent      text,
+  tenant_visible  boolean not null,
+  before          jsonb,
+  after           jsonb,
+  -- Set by audit_erase_person. The row and actor_id survive; who that was
+  -- does not, once this is set.
+  erased_at       timestamptz,
+  schema_version  smallint not null default 1,
+  -- The principal the event was ABOUT, when that is not the actor: an
+  -- invitation's invitee, a membership's holder. What lets "events affecting
+  -- me" be answered without guessing from payloads.
+  subject_class   text,
+  subject_id      text,
+  constraint audit_events_actor_class_check check (length(actor_class) between 1 and 64),
+  constraint audit_events_actor_id_check check (length(actor_id) between 1 and 256),
+  constraint audit_events_actor_display_check check (length(actor_display) between 1 and 256),
+  constraint audit_events_action_shape_check check (action ~ '^[a-z][a-z0-9_]*\.[a-z][a-z0-9_]*$'),
+  constraint audit_events_target_type_check check (length(target_type) between 1 and 64),
+  constraint audit_events_target_id_check check (length(target_id) between 1 and 256),
+  constraint audit_events_outcome_check check (length(outcome) between 1 and 32),
+  constraint audit_events_context_check check (length(context) between 1 and 32),
+  constraint audit_events_session_id_check check (session_id is null or length(session_id) <= 256),
+  constraint audit_events_reason_check check (reason is null or length(reason) <= 512),
+  constraint audit_events_reference_check check (reference is null or length(reference) <= 512),
+  constraint audit_events_request_id_check check (request_id is null or length(request_id) <= 128),
+  constraint audit_events_ip_check check (ip is null or length(ip) <= 64),
+  constraint audit_events_user_agent_check check (user_agent is null or length(user_agent) <= 1024),
+  constraint audit_events_before_check check (before is null or octet_length(before::text) <= 65536),
+  constraint audit_events_after_check check (after is null or octet_length(after::text) <= 65536),
+  -- A support-session row names its session, its reason and its reference.
+  -- Which reasons are admissible is the host's closed set.
+  constraint audit_events_break_glass_shape_check check (
+    context <> 'break_glass'
+    or (session_id is not null and reason is not null and reference is not null)
+  ),
+  constraint audit_events_subject_pair_check check ((subject_id is null) = (subject_class is null)),
+  constraint audit_events_subject_class_check check (subject_class is null or length(subject_class) between 1 and 64),
+  constraint audit_events_subject_id_check check (subject_id is null or length(subject_id) between 1 and 256)
+);
+
+-- (occurred_at, id) is the ordering; every reader pages on it.
+create index if not exists audit_events_tenant_time_idx
+  on audit_events (tenant_id, occurred_at desc, id desc);
+create index if not exists audit_events_actor_time_idx
+  on audit_events (actor_id, occurred_at desc);
+create index if not exists audit_events_action_time_idx
+  on audit_events (action, occurred_at desc);
+create index if not exists audit_events_subject_time_idx
+  on audit_events (subject_class, subject_id, occurred_at desc, id desc) where subject_id is not null;
+create index if not exists audit_events_request_idx
+  on audit_events (request_id, occurred_at desc) where request_id is not null;
+
+-- The second wall. The first is the revoke below, which stops the server; this
+-- stops the owner's own mistakes at a psql prompt. An UPDATE may change only
+-- the four columns erasure touches, and DELETE and TRUNCATE are refused
+-- outright. audit_erase_person passes through this trigger, not around it.
+create or replace function audit_events_guard() returns trigger
+language plpgsql as $$
+begin
+  if tg_op = 'DELETE' then
+    raise exception 'audit_events is append-only: delete refused';
+  elsif tg_op = 'TRUNCATE' then
+    raise exception 'audit_events is append-only: truncate refused';
+  elsif tg_op = 'UPDATE' then
+    if new.id is distinct from old.id
+      or new.occurred_at is distinct from old.occurred_at
+      or new.tenant_id is distinct from old.tenant_id
+      or new.actor_class is distinct from old.actor_class
+      or new.actor_id is distinct from old.actor_id
+      or new.action is distinct from old.action
+      or new.target_type is distinct from old.target_type
+      or new.target_id is distinct from old.target_id
+      or new.outcome is distinct from old.outcome
+      or new.context is distinct from old.context
+      or new.session_id is distinct from old.session_id
+      or new.reason is distinct from old.reason
+      or new.reference is distinct from old.reference
+      or new.request_id is distinct from old.request_id
+      or new.ip is distinct from old.ip
+      or new.user_agent is distinct from old.user_agent
+      or new.tenant_visible is distinct from old.tenant_visible
+      or new.schema_version is distinct from old.schema_version
+      or new.subject_class is distinct from old.subject_class
+      or new.subject_id is distinct from old.subject_id
+    then
+      raise exception 'audit_events is append-only: only actor_display, before, after and erased_at may change';
+    end if;
+  end if;
+  return new;
+end
+$$;
+drop trigger if exists audit_events_guarded_update on audit_events;
+create trigger audit_events_guarded_update
+  before update on audit_events
+  for each row execute function audit_events_guard();
+drop trigger if exists audit_events_no_delete on audit_events;
+create trigger audit_events_no_delete
+  before delete on audit_events
+  for each row execute function audit_events_guard();
+drop trigger if exists audit_events_no_truncate on audit_events;
+create trigger audit_events_no_truncate
+  before truncate on audit_events
+  for each statement execute function audit_events_guard();
+
+-- The one sanctioned write. Rows the person wrote (actor_id), rows written
+-- about them (subject_id), and rows whose payload carries their address:
+-- actor_display becomes the pseudonym on their own rows, before and after
+-- are replaced wholesale on every matched row, erased_at is set. actor_id
+-- and subject_id stay, so "somebody with this id did this" survives and
+-- "who that was" does not. Row counts never change. Ledger-only: a host's
+-- own tables (a profile, an invitation) are the host's to clean, in the same
+-- transaction, and its final `person.erased` row is written after this.
+create or replace function audit_erase_person(subject text, pseudonym text, subject_email text)
+returns integer
+language plpgsql
+security definer
+set search_path = pg_catalog, public
+as $$
+declare
+  touched integer;
+begin
+  if subject is null or length(subject) = 0 then
+    raise exception 'audit_erase_person: a subject id is required';
+  end if;
+  if pseudonym is null or length(pseudonym) = 0 or length(pseudonym) > 256 then
+    raise exception 'audit_erase_person: a pseudonym of 1 to 256 characters is required';
+  end if;
+  update audit_events
+     set actor_display = case when actor_id = subject then pseudonym else actor_display end,
+         before = case when before is null then null else '{"erased":true}'::jsonb end,
+         after = case when after is null then null else '{"erased":true}'::jsonb end,
+         erased_at = now()
+   where erased_at is null
+     and (
+       actor_id = subject
+       or subject_id = subject
+       or (
+         subject_email is not null
+         and length(subject_email) > 0
+         and (
+           lower(coalesce(before::text, '')) like '%' || lower(subject_email) || '%'
+           or lower(coalesce(after::text, '')) like '%' || lower(subject_email) || '%'
+         )
+       )
+     );
+  get diagnostics touched = row_count;
+  return touched;
+end
+$$;
+revoke all on function audit_erase_person(text, text, text) from public;
+
+do $$
+declare
+  rt text := current_database() || '_rt';
+begin
+  if exists (select 1 from pg_roles where rolname = rt) then
+    execute format('revoke update, delete, truncate on audit_events from %I', rt);
+    execute format('grant execute on function audit_erase_person(text, text, text) to %I', rt);
+  end if;
+end
+$$;

package/dist/migrations/0025_audit_display.sql

@@ -0,0 +1,147 @@
+-- Copied verbatim from @wtfalch/audit 0.6.0's own migrations/ (#232), the
+-- same way that package's own audit-migrations CLI copies them into a host's
+-- drizzle/ directory -- foundry has no drizzle/ journal, so this file is
+-- that copy, hand-placed at the next free number instead. Never edit the
+-- copied SQL below; a fix ships as a new numbered file, same as upstream.
+--
+-- @wtfalch/audit 0.4.0: what the target and the tenant were CALLED.
+--
+-- Mirrors src/tables.ts. Every statement is idempotent. Applied by the host's
+-- own migrate script after the host copies this file into its drizzle/
+-- directory as the next number (audit-migrations); never edited there.
+--
+-- WHY THE NAME LIVES ON THE ROW
+-- -----------------------------
+-- A reader of the trail wants to know what happened to WHAT. Looking the name
+-- up when the page renders answers that exactly until it matters: the file was
+-- deleted, the organisation was closed, the key was revoked -- and those are
+-- the rows a trail exists for. So the name is written with the row and never
+-- read from anywhere else afterwards.
+--
+-- Both columns are nullable and stay nullable: every row written before this
+-- migration has no name, and a writer that holds only an id is not made to
+-- invent one. A reader shows the id when the name is null.
+--
+-- These are NOT a rename of target_id or tenant_id. The ids stay the identity;
+-- the names are what they were called at the time, and a later rename does not
+-- reach back.
+--
+-- ERASURE
+-- -------
+-- A target can be a person: an invitation's invitee, a membership's holder.
+-- Its name is then personal data sitting in a row that outlives the account,
+-- so audit_erase_person pseudonymises target_display exactly as it already
+-- pseudonymises actor_display: on the rows it already erases, and only where
+-- target_id is the subject. Which rows those are is unchanged on purpose. A
+-- row whose target is a person is expected to carry subject_id, which is what
+-- the match already looks at; a row that sets neither subject_id nor an email
+-- in its payload was already outside erasure's reach before this file, and
+-- widening the match here would erase rows 0001 deliberately did not.
+-- tenant_display names an organisation, not a person, and is left alone; it is
+-- therefore added to the guard's immutable list, so nothing can edit it after
+-- the fact the way a correction would.
+
+alter table audit_events add column if not exists target_display text;
+alter table audit_events add column if not exists tenant_display text;
+
+do $$ begin
+  alter table audit_events
+    add constraint audit_events_target_display_check
+    check (target_display is null or length(target_display) between 1 and 256);
+exception when duplicate_object then null; end $$;
+
+do $$ begin
+  alter table audit_events
+    add constraint audit_events_tenant_display_check
+    check (tenant_display is null or length(tenant_display) between 1 and 256);
+exception when duplicate_object then null; end $$;
+
+-- 0001's guard, with tenant_display added to the columns an update may not
+-- change. target_display is absent from the list for the same reason
+-- actor_display is: erasure rewrites it.
+create or replace function audit_events_guard() returns trigger
+language plpgsql as $$
+begin
+  if tg_op = 'DELETE' then
+    raise exception 'audit_events is append-only: delete refused';
+  elsif tg_op = 'TRUNCATE' then
+    raise exception 'audit_events is append-only: truncate refused';
+  elsif tg_op = 'UPDATE' then
+    if new.id is distinct from old.id
+      or new.occurred_at is distinct from old.occurred_at
+      or new.tenant_id is distinct from old.tenant_id
+      or new.tenant_display is distinct from old.tenant_display
+      or new.actor_class is distinct from old.actor_class
+      or new.actor_id is distinct from old.actor_id
+      or new.action is distinct from old.action
+      or new.target_type is distinct from old.target_type
+      or new.target_id is distinct from old.target_id
+      or new.outcome is distinct from old.outcome
+      or new.context is distinct from old.context
+      or new.session_id is distinct from old.session_id
+      or new.reason is distinct from old.reason
+      or new.reference is distinct from old.reference
+      or new.request_id is distinct from old.request_id
+      or new.ip is distinct from old.ip
+      or new.user_agent is distinct from old.user_agent
+      or new.tenant_visible is distinct from old.tenant_visible
+      or new.schema_version is distinct from old.schema_version
+      or new.subject_class is distinct from old.subject_class
+      or new.subject_id is distinct from old.subject_id
+    then
+      raise exception 'audit_events is append-only: only actor_display, target_display, before, after and erased_at may change';
+    end if;
+  end if;
+  return new;
+end
+$$;
+
+-- 0001's erasure function, extended to the target's name. Everything else is
+-- unchanged: same subject match, same pseudonym bounds, same return.
+create or replace function audit_erase_person(subject text, pseudonym text, subject_email text)
+returns integer
+language plpgsql
+security definer
+set search_path = pg_catalog, public
+as $$
+declare
+  touched integer;
+begin
+  if subject is null or length(subject) = 0 then
+    raise exception 'audit_erase_person: a subject id is required';
+  end if;
+  if pseudonym is null or length(pseudonym) = 0 or length(pseudonym) > 256 then
+    raise exception 'audit_erase_person: a pseudonym of 1 to 256 characters is required';
+  end if;
+  update audit_events
+     set actor_display = case when actor_id = subject then pseudonym else actor_display end,
+         target_display = case when target_id = subject then pseudonym else target_display end,
+         before = case when before is null then null else '{"erased":true}'::jsonb end,
+         after = case when after is null then null else '{"erased":true}'::jsonb end,
+         erased_at = now()
+   where erased_at is null
+     and (
+       actor_id = subject
+       or subject_id = subject
+       or (
+         subject_email is not null
+         and (before::text like '%' || subject_email || '%' or after::text like '%' || subject_email || '%')
+       )
+     );
+  get diagnostics touched = row_count;
+  return touched;
+end
+$$;
+
+revoke all on function audit_erase_person(text, text, text) from public;
+
+do $$
+declare
+  rt text := current_database() || '_rt';
+begin
+  if exists (select 1 from pg_roles where rolname = rt) then
+    execute format('revoke update, delete, truncate on audit_events from %I', rt);
+    execute format('grant execute on function audit_erase_person(text, text, text) to %I', rt);
+  end if;
+end
+$$;

package/dist/migrations/0026_audit_erase_email_guard.sql

@@ -0,0 +1,78 @@
+-- Copied verbatim from @wtfalch/audit 0.6.0's own migrations/ (#232), the
+-- same way that package's own audit-migrations CLI copies them into a host's
+-- drizzle/ directory -- foundry has no drizzle/ journal, so this file is
+-- that copy, hand-placed at the next free number instead. Never edit the
+-- copied SQL below; a fix ships as a new numbered file, same as upstream.
+--
+-- @wtfalch/audit: restore audit_erase_person's empty-email guard.
+--
+-- Mirrors src/ledger.ts's erase(). Every statement is idempotent. Applied by
+-- the host's own migrate script after the host copies this file into its
+-- drizzle/ directory as the next number (audit-migrations); never edited
+-- there.
+--
+-- REGRESSION
+-- ----------
+-- 0002_display.sql's audit_erase_person dropped two things 0001_audit.sql
+-- had: the `length(subject_email) > 0` guard and the lower() case-fold on
+-- both the column and the match value. Without the length guard, an empty
+-- string reaches the SQL LIKE match as `like '%%'`, which matches every
+-- row's before/after text -- on every tenant, not just the subject's. This
+-- file cannot edit 0002 (shipped migrations don't change); it re-defines
+-- the function, which `create or replace` makes safe to apply on top.
+--
+-- Everything else about the function is unchanged from 0002: same subject
+-- and subject_id match, same pseudonym bounds, same target_display and
+-- actor_display pseudonymisation, same return.
+
+create or replace function audit_erase_person(subject text, pseudonym text, subject_email text)
+returns integer
+language plpgsql
+security definer
+set search_path = pg_catalog, public
+as $$
+declare
+  touched integer;
+begin
+  if subject is null or length(subject) = 0 then
+    raise exception 'audit_erase_person: a subject id is required';
+  end if;
+  if pseudonym is null or length(pseudonym) = 0 or length(pseudonym) > 256 then
+    raise exception 'audit_erase_person: a pseudonym of 1 to 256 characters is required';
+  end if;
+  update audit_events
+     set actor_display = case when actor_id = subject then pseudonym else actor_display end,
+         target_display = case when target_id = subject then pseudonym else target_display end,
+         before = case when before is null then null else '{"erased":true}'::jsonb end,
+         after = case when after is null then null else '{"erased":true}'::jsonb end,
+         erased_at = now()
+   where erased_at is null
+     and (
+       actor_id = subject
+       or subject_id = subject
+       or (
+         subject_email is not null
+         and length(subject_email) > 0
+         and (
+           lower(coalesce(before::text, '')) like '%' || lower(subject_email) || '%'
+           or lower(coalesce(after::text, '')) like '%' || lower(subject_email) || '%'
+         )
+       )
+     );
+  get diagnostics touched = row_count;
+  return touched;
+end
+$$;
+
+revoke all on function audit_erase_person(text, text, text) from public;
+
+do $$
+declare
+  rt text := current_database() || '_rt';
+begin
+  if exists (select 1 from pg_roles where rolname = rt) then
+    execute format('revoke update, delete, truncate on audit_events from %I', rt);
+    execute format('grant execute on function audit_erase_person(text, text, text) to %I', rt);
+  end if;
+end
+$$;

package/dist/migrations/0027_audit_chain.sql

@@ -0,0 +1,170 @@
+-- Copied verbatim from @wtfalch/audit 0.6.0's own migrations/ (#232), the
+-- same way that package's own audit-migrations CLI copies them into a host's
+-- drizzle/ directory -- foundry has no drizzle/ journal, so this file is
+-- that copy, hand-placed at the next free number instead. Never edit the
+-- copied SQL below; a fix ships as a new numbered file, same as upstream.
+--
+-- @wtfalch/audit: hash chaining, opt in.
+--
+-- Mirrors src/chain.ts and src/tables.ts. Every statement is idempotent.
+-- Applied by the host's own migrate script after the host copies this file
+-- into its drizzle/ directory as the next number (audit-migrations); never
+-- edited there.
+--
+-- Nothing here forces chaining. Five nullable columns, computed and
+-- verified entirely in TypeScript (src/chain.ts), the same design
+-- `@wtfalch/authz`'s audit-chain.ts already shipped: no pgcrypto, no
+-- trigger, because PGlite -- this package's own default test database --
+-- has no pgcrypto, and a trigger cannot see the previous row's hash without
+-- a race between concurrent inserts that only a lock (below) closes.
+--
+--   prev_hash     -- the previous row's row_hash, in whatever order rows
+--                     were sealed at write time. null for the chain's first
+--                     row, and forever on a row nothing ever sealed.
+--   row_hash      -- sha256 over this row's own fields (chain.ts's
+--                     ROW_HASH_KEYS) plus prev_hash and content_hash. Never
+--                     changes once set; the append-only guard below still
+--                     refuses to.
+--   content_hash  -- sha256 over the row's erasable content (actor_display,
+--                     target_display, before, after), salted.
+--   content_salt  -- the salt content_hash was taken over. Set at seal
+--                     time, nulled by erasure: once it is gone nobody --
+--                     including this package -- can reproduce content_hash
+--                     from a guessed payload, which is what erasure means
+--                     here. Unlike row_hash, an erasure IS allowed to null
+--                     this, so the guard's allowed list grows to include it.
+--   erasure_hash  -- set only once content_salt is nulled: sha256 over
+--                     { row_hash, erased_at }, so the fact and the instant
+--                     of erasure stay checkable forever even though the
+--                     erased content no longer is.
+--
+-- A row written before this migration applies has row_hash null forever --
+-- nothing recorded its hash at write time, so computing one now would only
+-- hash what the row happens to contain today, proving nothing about
+-- whether it changed since. verifyChain reports it 'unsealed', not
+-- verified, the same stance 0002's target_display took on the rows before
+-- it and worker_log_chain took on the rows before T255.
+--
+-- audit_seal_erasure(row_id, erasure_hash_value): the runtime role has no
+-- UPDATE on audit_events at all (0001's revoke), so ledger.erase()'s
+-- pending-erasure sweep -- setting content_salt to null and erasure_hash
+-- once a chain-sealed row has been erased -- needs its own security
+-- definer door back in, the same shape as audit_erase_person's.
+
+alter table audit_events add column if not exists prev_hash text;
+alter table audit_events add column if not exists row_hash text;
+alter table audit_events add column if not exists content_hash text;
+alter table audit_events add column if not exists content_salt text;
+alter table audit_events add column if not exists erasure_hash text;
+
+do $$ begin
+  alter table audit_events
+    add constraint audit_events_prev_hash_check
+    check (prev_hash is null or prev_hash ~ '^[0-9a-f]{64}$');
+exception when duplicate_object then null; end $$;
+
+do $$ begin
+  alter table audit_events
+    add constraint audit_events_row_hash_check
+    check (row_hash is null or row_hash ~ '^[0-9a-f]{64}$');
+exception when duplicate_object then null; end $$;
+
+do $$ begin
+  alter table audit_events
+    add constraint audit_events_content_hash_check
+    check (content_hash is null or content_hash ~ '^[0-9a-f]{64}$');
+exception when duplicate_object then null; end $$;
+
+do $$ begin
+  alter table audit_events
+    add constraint audit_events_erasure_hash_check
+    check (erasure_hash is null or erasure_hash ~ '^[0-9a-f]{64}$');
+exception when duplicate_object then null; end $$;
+
+-- A chain-sealed row not yet erased, so ledger.erase()'s pending-erasure
+-- sweep finds it in an index scan rather than a table scan. Empty on a
+-- host that never turns chaining on.
+create index if not exists audit_events_chain_pending_idx
+  on audit_events (id)
+  where row_hash is not null and erased_at is not null and erasure_hash is null;
+
+-- 0002's guard, with content_salt and erasure_hash added to the columns an
+-- update may change: erasure nulls the first and sets the second, on a row
+-- that was already erased by the same audit_erase_person call this
+-- migration does not touch. prev_hash, row_hash and content_hash are
+-- absent from the list on purpose -- once set, never.
+create or replace function audit_events_guard() returns trigger
+language plpgsql as $$
+begin
+  if tg_op = 'DELETE' then
+    raise exception 'audit_events is append-only: delete refused';
+  elsif tg_op = 'TRUNCATE' then
+    raise exception 'audit_events is append-only: truncate refused';
+  elsif tg_op = 'UPDATE' then
+    if new.id is distinct from old.id
+      or new.occurred_at is distinct from old.occurred_at
+      or new.tenant_id is distinct from old.tenant_id
+      or new.tenant_display is distinct from old.tenant_display
+      or new.actor_class is distinct from old.actor_class
+      or new.actor_id is distinct from old.actor_id
+      or new.action is distinct from old.action
+      or new.target_type is distinct from old.target_type
+      or new.target_id is distinct from old.target_id
+      or new.outcome is distinct from old.outcome
+      or new.context is distinct from old.context
+      or new.session_id is distinct from old.session_id
+      or new.reason is distinct from old.reason
+      or new.reference is distinct from old.reference
+      or new.request_id is distinct from old.request_id
+      or new.ip is distinct from old.ip
+      or new.user_agent is distinct from old.user_agent
+      or new.tenant_visible is distinct from old.tenant_visible
+      or new.schema_version is distinct from old.schema_version
+      or new.subject_class is distinct from old.subject_class
+      or new.subject_id is distinct from old.subject_id
+      or new.prev_hash is distinct from old.prev_hash
+      or new.row_hash is distinct from old.row_hash
+      or new.content_hash is distinct from old.content_hash
+    then
+      raise exception 'audit_events is append-only: only actor_display, target_display, before, after, erased_at, content_salt and erasure_hash may change';
+    end if;
+  end if;
+  return new;
+end
+$$;
+
+-- 0001's revoke took update off the runtime role entirely, on purpose:
+-- audit_erase_person (security definer) is the one door back in. This is
+-- the second one, for exactly one thing: chain-sealing a row
+-- audit_erase_person already erased. It never computes a hash itself --
+-- the caller does, in TypeScript (chain.ts's computeErasureHash), the same
+-- design choice audit_erase_person's own absence of a hash column made
+-- before this file existed -- it only writes the value it is given, and
+-- only onto a row that is erased, chain-sealed, and not already sealed.
+create or replace function audit_seal_erasure(row_id bigint, erasure_hash_value text)
+returns void
+language plpgsql
+security definer
+set search_path = pg_catalog, public
+as $$
+begin
+  update audit_events
+     set content_salt = null,
+         erasure_hash = erasure_hash_value
+   where id = row_id
+     and row_hash is not null
+     and erased_at is not null
+     and erasure_hash is null;
+end
+$$;
+revoke all on function audit_seal_erasure(bigint, text) from public;
+
+do $$
+declare
+  rt text := current_database() || '_rt';
+begin
+  if exists (select 1 from pg_roles where rolname = rt) then
+    execute format('grant execute on function audit_seal_erasure(bigint, text) to %I', rt);
+  end if;
+end
+$$;