audit-ledger-mcp 0.1.1 → 0.2.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +45 -8
- package/dist/index.js +31 -16
- package/dist/index.js.map +1 -1
- package/dist/sandbox.d.ts +46 -0
- package/dist/sandbox.d.ts.map +1 -0
- package/dist/sandbox.js +67 -0
- package/dist/sandbox.js.map +1 -0
- package/package.json +1 -1
package/README.md
CHANGED
|
@@ -30,26 +30,63 @@ Each call ends up as a regulator-grade audit record in your deployed ledger —
|
|
|
30
30
|
|
|
31
31
|
---
|
|
32
32
|
|
|
33
|
-
##
|
|
33
|
+
## Quick start — zero configuration
|
|
34
34
|
|
|
35
35
|
```bash
|
|
36
|
-
|
|
36
|
+
npx -y audit-ledger-mcp
|
|
37
37
|
```
|
|
38
38
|
|
|
39
|
-
|
|
39
|
+
That's it. With no environment variables, the server boots into **sandbox mode** and writes records to a shared public tenant on a hosted ledger. You can try every tool — `record_decision`, `verify_decision`, `list_decisions` — without provisioning anything.
|
|
40
40
|
|
|
41
|
-
|
|
42
|
-
|
|
41
|
+
When sandbox mode is active, you'll see a banner on stderr:
|
|
42
|
+
|
|
43
|
+
```
|
|
44
|
+
[audit-ledger-mcp] ─────────────── SANDBOX MODE ───────────────
|
|
45
|
+
[audit-ledger-mcp] No AUDIT_API_URL configured.
|
|
46
|
+
[audit-ledger-mcp] Using the public sandbox at sandbox-public.
|
|
47
|
+
[audit-ledger-mcp] View: https://d2pfirb2397ixy.cloudfront.net
|
|
48
|
+
[audit-ledger-mcp] Do NOT write real personal data...
|
|
43
49
|
```
|
|
44
50
|
|
|
51
|
+
### Sandbox properties
|
|
52
|
+
|
|
53
|
+
| | |
|
|
54
|
+
|---|---|
|
|
55
|
+
| **Hosted by** | github.com/shahidh68/audit-ledger (same AWS deployment) |
|
|
56
|
+
| **Tenant** | `sandbox-public` (shared, public) |
|
|
57
|
+
| **Rate limit** | 100 requests/minute per IP |
|
|
58
|
+
| **Retention** | 7 years (records cannot be deleted) |
|
|
59
|
+
| **Audience** | Tyre-kickers, integration tests, framework demos |
|
|
60
|
+
| **NOT for** | Production data, customer PII, real compliance records |
|
|
61
|
+
|
|
62
|
+
### Wire it into Claude Desktop with zero config
|
|
63
|
+
|
|
64
|
+
```json
|
|
65
|
+
{
|
|
66
|
+
"mcpServers": {
|
|
67
|
+
"audit-ledger-sandbox": {
|
|
68
|
+
"command": "npx",
|
|
69
|
+
"args": ["-y", "audit-ledger-mcp"]
|
|
70
|
+
}
|
|
71
|
+
}
|
|
72
|
+
}
|
|
73
|
+
```
|
|
74
|
+
|
|
75
|
+
Restart Claude Desktop. The three tools appear in the MCP menu immediately. Try asking Claude to "record this decision: should X be approved?" and watch a record land in the sandbox dashboard.
|
|
76
|
+
|
|
45
77
|
---
|
|
46
78
|
|
|
47
|
-
##
|
|
79
|
+
## Production install
|
|
80
|
+
|
|
81
|
+
For real workloads, deploy your own audit ledger and point the MCP server at it:
|
|
82
|
+
|
|
83
|
+
```bash
|
|
84
|
+
npm install -g audit-ledger-mcp
|
|
85
|
+
```
|
|
48
86
|
|
|
49
|
-
|
|
87
|
+
Configure with **all three** env vars (any of them being set switches off sandbox mode):
|
|
50
88
|
|
|
51
89
|
```bash
|
|
52
|
-
# Required
|
|
53
90
|
export AUDIT_API_URL="https://<api-id>.execute-api.<region>.amazonaws.com/prod"
|
|
54
91
|
export AUDIT_WRITE_KEY="<your-tenant-write-key>"
|
|
55
92
|
export AUDIT_READ_KEY="<your-tenant-read-key>"
|
package/dist/index.js
CHANGED
|
@@ -10,37 +10,52 @@
|
|
|
10
10
|
* reads them at startup and refuses to start if AUDIT_API_URL is missing,
|
|
11
11
|
* since no tool can do anything useful without it.
|
|
12
12
|
*/
|
|
13
|
+
import { readFileSync } from "node:fs";
|
|
14
|
+
import { fileURLToPath } from "node:url";
|
|
15
|
+
import { dirname, join } from "node:path";
|
|
13
16
|
import { Server } from "@modelcontextprotocol/sdk/server/index.js";
|
|
14
17
|
import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
|
|
15
18
|
import { CallToolRequestSchema, ListToolsRequestSchema, } from "@modelcontextprotocol/sdk/types.js";
|
|
16
19
|
import { AuditLedgerClient, AuditLedgerError } from "./client.js";
|
|
20
|
+
import { SANDBOX_CONFIG, isSandboxMode, sandboxBanner } from "./sandbox.js";
|
|
17
21
|
import { executeRecordDecision, recordDecisionToolDefinition, } from "./tools/record_decision.js";
|
|
18
22
|
import { executeVerifyDecision, verifyDecisionToolDefinition, } from "./tools/verify_decision.js";
|
|
19
23
|
import { executeListDecisions, listDecisionsToolDefinition, } from "./tools/list_decisions.js";
|
|
20
|
-
|
|
21
|
-
|
|
22
|
-
|
|
23
|
-
|
|
24
|
-
|
|
25
|
-
|
|
26
|
-
|
|
27
|
-
process.exit(1);
|
|
28
|
-
}
|
|
29
|
-
return value;
|
|
30
|
-
}
|
|
24
|
+
// Read package.json at startup so PKG_NAME and PKG_VERSION cannot drift from
|
|
25
|
+
// the published package version. dist/index.js lives one level below the
|
|
26
|
+
// package root, so package.json is at "../package.json" relative to here.
|
|
27
|
+
const __dirname = dirname(fileURLToPath(import.meta.url));
|
|
28
|
+
const PKG = JSON.parse(readFileSync(join(__dirname, "..", "package.json"), "utf8"));
|
|
29
|
+
const PKG_NAME = PKG.name;
|
|
30
|
+
const PKG_VERSION = PKG.version;
|
|
31
31
|
function buildClient() {
|
|
32
|
-
const apiUrl = requireEnv("AUDIT_API_URL");
|
|
33
|
-
const writeKey = process.env.AUDIT_WRITE_KEY;
|
|
34
|
-
const readKey = process.env.AUDIT_READ_KEY;
|
|
35
32
|
const timeoutMs = process.env.AUDIT_TIMEOUT_MS
|
|
36
33
|
? Number(process.env.AUDIT_TIMEOUT_MS)
|
|
37
34
|
: undefined;
|
|
38
35
|
const retryAttempts = process.env.AUDIT_RETRY_ATTEMPTS
|
|
39
36
|
? Number(process.env.AUDIT_RETRY_ATTEMPTS)
|
|
40
37
|
: undefined;
|
|
38
|
+
// Sandbox mode: no AUDIT_API_URL configured. Fall back to the public
|
|
39
|
+
// sandbox so the package works zero-config. Records go to a shared
|
|
40
|
+
// public tenant that anyone can read — do NOT write real data.
|
|
41
|
+
if (isSandboxMode()) {
|
|
42
|
+
process.stderr.write(sandboxBanner(PKG_NAME, PKG_VERSION) + "\n");
|
|
43
|
+
return new AuditLedgerClient({
|
|
44
|
+
apiUrl: SANDBOX_CONFIG.apiUrl,
|
|
45
|
+
writeKey: SANDBOX_CONFIG.writeKey,
|
|
46
|
+
readKey: SANDBOX_CONFIG.readKey,
|
|
47
|
+
timeoutMs,
|
|
48
|
+
retryAttempts,
|
|
49
|
+
});
|
|
50
|
+
}
|
|
51
|
+
// Production mode: developer has explicitly configured an endpoint.
|
|
52
|
+
const apiUrl = process.env.AUDIT_API_URL;
|
|
53
|
+
const writeKey = process.env.AUDIT_WRITE_KEY;
|
|
54
|
+
const readKey = process.env.AUDIT_READ_KEY;
|
|
41
55
|
if (!writeKey && !readKey) {
|
|
42
|
-
process.stderr.write(`[${PKG_NAME}]
|
|
43
|
-
`all tools will fail. Set at
|
|
56
|
+
process.stderr.write(`[${PKG_NAME}] AUDIT_API_URL is set but neither AUDIT_WRITE_KEY nor\n` +
|
|
57
|
+
`[${PKG_NAME}] AUDIT_READ_KEY is set — all tools will fail. Set at\n` +
|
|
58
|
+
`[${PKG_NAME}] least one. See .env.example.\n`);
|
|
44
59
|
}
|
|
45
60
|
return new AuditLedgerClient({ apiUrl, writeKey, readKey, timeoutMs, retryAttempts });
|
|
46
61
|
}
|
package/dist/index.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AACA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AACnE,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AACjF,OAAO,EACL,qBAAqB,EACrB,sBAAsB,GACvB,MAAM,oCAAoC,CAAC;AAE5C,OAAO,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAClE,OAAO,EACL,qBAAqB,EACrB,4BAA4B,GAC7B,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,qBAAqB,EACrB,4BAA4B,GAC7B,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,oBAAoB,EACpB,2BAA2B,GAC5B,MAAM,2BAA2B,CAAC;AAEnC,
|
|
1
|
+
{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AACA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAE1C,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AACnE,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AACjF,OAAO,EACL,qBAAqB,EACrB,sBAAsB,GACvB,MAAM,oCAAoC,CAAC;AAE5C,OAAO,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAClE,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC5E,OAAO,EACL,qBAAqB,EACrB,4BAA4B,GAC7B,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,qBAAqB,EACrB,4BAA4B,GAC7B,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,oBAAoB,EACpB,2BAA2B,GAC5B,MAAM,2BAA2B,CAAC;AAEnC,6EAA6E;AAC7E,yEAAyE;AACzE,0EAA0E;AAC1E,MAAM,SAAS,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAC1D,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CACpB,YAAY,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,EAAE,cAAc,CAAC,EAAE,MAAM,CAAC,CACvB,CAAC;AACvC,MAAM,QAAQ,GAAG,GAAG,CAAC,IAAI,CAAC;AAC1B,MAAM,WAAW,GAAG,GAAG,CAAC,OAAO,CAAC;AAEhC,SAAS,WAAW;IAClB,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB;QAC5C,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC;QACtC,CAAC,CAAC,SAAS,CAAC;IACd,MAAM,aAAa,GAAG,OAAO,CAAC,GAAG,CAAC,oBAAoB;QACpD,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC;QAC1C,CAAC,CAAC,SAAS,CAAC;IAEd,qEAAqE;IACrE,mEAAmE;IACnE,+DAA+D;IAC/D,IAAI,aAAa,EAAE,EAAE,CAAC;QACpB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,QAAQ,EAAE,WAAW,CAAC,GAAG,IAAI,CAAC,CAAC;QAClE,OAAO,IAAI,iBAAiB,CAAC;YAC3B,MAAM,EAAE,cAAc,CAAC,MAAM;YAC7B,QAAQ,EAAE,cAAc,CAAC,QAAQ;YACjC,OAAO,EAAE,cAAc,CAAC,OAAO;YAC/B,SAAS;YACT,aAAa;SACd,CAAC,CAAC;IACL,CAAC;IAED,oEAAoE;IACpE,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,aAAc,CAAC;IAC1C,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC;IAC7C,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC;IAE3C,IAAI,CAAC,QAAQ,IAAI,CAAC,OAAO,EAAE,CAAC;QAC1B,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,IAAI,QAAQ,0DAA0D;YACpE,IAAI,QAAQ,yDAAyD;YACrE,IAAI,QAAQ,kCAAkC,CACjD,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,iBAAiB,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,CAAC,CAAC;AACxF,CAAC;AAED,KAAK,UAAU,IAAI;IACjB,MAAM,MAAM,GAAG,WAAW,EAAE,CAAC;IAC7B,MAAM,MAAM,GAAG,IAAI,MAAM,CACvB,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,WAAW,EAAE,EACxC,EAAE,YAAY,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,CAChC,CAAC;IAEF,MAAM,CAAC,iBAAiB,CAAC,sBAAsB,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC;QAC5D,KAAK,EAAE;YACL,4BAA4B;YAC5B,4BAA4B;YAC5B,2BAA2B;SAC5B;KACF,CAAC,CAAC,CAAC;IAEJ,MAAM,CAAC,iBAAiB,CAAC,qBAAqB,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QAC5D,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC;QAC7C,IAAI,CAAC;YACH,IAAI,MAAe,CAAC;YACpB,QAAQ,IAAI,EAAE,CAAC;gBACb,KAAK,iBAAiB;oBACpB,MAAM,GAAG,MAAM,qBAAqB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;oBACnD,MAAM;gBACR,KAAK,iBAAiB;oBACpB,MAAM,GAAG,MAAM,qBAAqB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;oBACnD,MAAM;gBACR,KAAK,gBAAgB;oBACnB,MAAM,GAAG,MAAM,oBAAoB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;oBAClD,MAAM;gBACR;oBACE,MAAM,IAAI,KAAK,CAAC,iBAAiB,IAAI,EAAE,CAAC,CAAC;YAC7C,CAAC;YACD,OAAO;gBACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;aACnE,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,OAAO,GACX,GAAG,YAAY,gBAAgB;gBAC7B,CAAC,CAAC,GAAG,GAAG,CAAC,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE;gBAChG,CAAC,CAAC,GAAG,YAAY,KAAK;oBACpB,CAAC,CAAC,GAAG,CAAC,OAAO;oBACb,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACpB,OAAO;gBACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,OAAO,EAAE,EAAE,CAAC;gBACtD,OAAO,EAAE,IAAI;aACd,CAAC;QACJ,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,MAAM,SAAS,GAAG,IAAI,oBAAoB,EAAE,CAAC;IAC7C,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAChC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,QAAQ,KAAK,WAAW,uBAAuB,CAAC,CAAC;AAC5E,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;IACnB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,QAAQ,YAAY,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACnG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}
|
|
@@ -0,0 +1,46 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* Public sandbox configuration.
|
|
3
|
+
*
|
|
4
|
+
* When a developer runs `npx audit-ledger-mcp` with no environment variables,
|
|
5
|
+
* the server falls back to this configuration. Records are written to a
|
|
6
|
+
* shared `sandbox-public` tenant on a hosted audit ledger.
|
|
7
|
+
*
|
|
8
|
+
* Important properties of sandbox mode:
|
|
9
|
+
*
|
|
10
|
+
* 1. The two keys below are baked into the published npm package and are
|
|
11
|
+
* therefore PUBLIC. They grant access only to the `sandbox-public` tenant
|
|
12
|
+
* and cannot be used to read or write to any other tenant's records.
|
|
13
|
+
*
|
|
14
|
+
* 2. Records written in sandbox mode persist in the ledger's S3 Object Lock
|
|
15
|
+
* in COMPLIANCE mode and cannot be deleted before their retention date.
|
|
16
|
+
* This is intentional — visitors should be able to verify their own
|
|
17
|
+
* sandbox records later. Do not write real customer data to the sandbox.
|
|
18
|
+
*
|
|
19
|
+
* 3. The sandbox is rate-limited per-tenant at the ledger level (currently
|
|
20
|
+
* 100 requests per minute). Heavy users should provision their own
|
|
21
|
+
* deployment.
|
|
22
|
+
*
|
|
23
|
+
* 4. The sandbox runs on the same AWS infrastructure as the production
|
|
24
|
+
* deployment for github.com/shahidh68/audit-ledger. Uptime and durability
|
|
25
|
+
* are best-effort. If you need an SLA, deploy your own.
|
|
26
|
+
*/
|
|
27
|
+
export declare const SANDBOX_CONFIG: {
|
|
28
|
+
readonly apiUrl: "https://m3csva3l3h.execute-api.eu-west-1.amazonaws.com/prod";
|
|
29
|
+
readonly writeKey: "wk-sandbox-public-0NoHiHBSUUBoan21NWkCMLU5G2d1ijX8";
|
|
30
|
+
readonly readKey: "rk-sandbox-public-XaV3aHdmKH1ZbQl7LswUkTJYJLyGmLh8";
|
|
31
|
+
readonly tenantId: "sandbox-public";
|
|
32
|
+
readonly dashboardUrl: "https://d2pfirb2397ixy.cloudfront.net";
|
|
33
|
+
};
|
|
34
|
+
/**
|
|
35
|
+
* Sandbox mode is triggered when the developer has not configured an audit
|
|
36
|
+
* ledger endpoint. Any explicit AUDIT_API_URL switches off sandbox mode —
|
|
37
|
+
* the server then operates against the configured deployment using whichever
|
|
38
|
+
* keys are present.
|
|
39
|
+
*/
|
|
40
|
+
export declare function isSandboxMode(): boolean;
|
|
41
|
+
/**
|
|
42
|
+
* Banner shown on stderr when sandbox mode is active. Designed to make it
|
|
43
|
+
* obvious to a developer that they are using shared infrastructure.
|
|
44
|
+
*/
|
|
45
|
+
export declare function sandboxBanner(packageName: string, packageVersion: string): string;
|
|
46
|
+
//# sourceMappingURL=sandbox.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"sandbox.d.ts","sourceRoot":"","sources":["../src/sandbox.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,eAAO,MAAM,cAAc;;;;;;CASjB,CAAC;AAEX;;;;;GAKG;AACH,wBAAgB,aAAa,IAAI,OAAO,CAEvC;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAAC,WAAW,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,GAAG,MAAM,CAmBjF"}
|
package/dist/sandbox.js
ADDED
|
@@ -0,0 +1,67 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* Public sandbox configuration.
|
|
3
|
+
*
|
|
4
|
+
* When a developer runs `npx audit-ledger-mcp` with no environment variables,
|
|
5
|
+
* the server falls back to this configuration. Records are written to a
|
|
6
|
+
* shared `sandbox-public` tenant on a hosted audit ledger.
|
|
7
|
+
*
|
|
8
|
+
* Important properties of sandbox mode:
|
|
9
|
+
*
|
|
10
|
+
* 1. The two keys below are baked into the published npm package and are
|
|
11
|
+
* therefore PUBLIC. They grant access only to the `sandbox-public` tenant
|
|
12
|
+
* and cannot be used to read or write to any other tenant's records.
|
|
13
|
+
*
|
|
14
|
+
* 2. Records written in sandbox mode persist in the ledger's S3 Object Lock
|
|
15
|
+
* in COMPLIANCE mode and cannot be deleted before their retention date.
|
|
16
|
+
* This is intentional — visitors should be able to verify their own
|
|
17
|
+
* sandbox records later. Do not write real customer data to the sandbox.
|
|
18
|
+
*
|
|
19
|
+
* 3. The sandbox is rate-limited per-tenant at the ledger level (currently
|
|
20
|
+
* 100 requests per minute). Heavy users should provision their own
|
|
21
|
+
* deployment.
|
|
22
|
+
*
|
|
23
|
+
* 4. The sandbox runs on the same AWS infrastructure as the production
|
|
24
|
+
* deployment for github.com/shahidh68/audit-ledger. Uptime and durability
|
|
25
|
+
* are best-effort. If you need an SLA, deploy your own.
|
|
26
|
+
*/
|
|
27
|
+
export const SANDBOX_CONFIG = {
|
|
28
|
+
apiUrl: "https://m3csva3l3h.execute-api.eu-west-1.amazonaws.com/prod",
|
|
29
|
+
writeKey: "wk-sandbox-public-0NoHiHBSUUBoan21NWkCMLU5G2d1ijX8",
|
|
30
|
+
readKey: "rk-sandbox-public-XaV3aHdmKH1ZbQl7LswUkTJYJLyGmLh8",
|
|
31
|
+
tenantId: "sandbox-public",
|
|
32
|
+
dashboardUrl: "https://d2pfirb2397ixy.cloudfront.net",
|
|
33
|
+
};
|
|
34
|
+
/**
|
|
35
|
+
* Sandbox mode is triggered when the developer has not configured an audit
|
|
36
|
+
* ledger endpoint. Any explicit AUDIT_API_URL switches off sandbox mode —
|
|
37
|
+
* the server then operates against the configured deployment using whichever
|
|
38
|
+
* keys are present.
|
|
39
|
+
*/
|
|
40
|
+
export function isSandboxMode() {
|
|
41
|
+
return !process.env.AUDIT_API_URL;
|
|
42
|
+
}
|
|
43
|
+
/**
|
|
44
|
+
* Banner shown on stderr when sandbox mode is active. Designed to make it
|
|
45
|
+
* obvious to a developer that they are using shared infrastructure.
|
|
46
|
+
*/
|
|
47
|
+
export function sandboxBanner(packageName, packageVersion) {
|
|
48
|
+
return [
|
|
49
|
+
`[${packageName}] ─────────────── SANDBOX MODE ───────────────`,
|
|
50
|
+
`[${packageName}] No AUDIT_API_URL configured.`,
|
|
51
|
+
`[${packageName}] Using the public sandbox at ${SANDBOX_CONFIG.tenantId}.`,
|
|
52
|
+
``,
|
|
53
|
+
`[${packageName}] Records: hosted by github.com/shahidh68/audit-ledger`,
|
|
54
|
+
`[${packageName}] Tenant: ${SANDBOX_CONFIG.tenantId}`,
|
|
55
|
+
`[${packageName}] View: ${SANDBOX_CONFIG.dashboardUrl}`,
|
|
56
|
+
``,
|
|
57
|
+
`[${packageName}] Do NOT write real personal data — sandbox keys are`,
|
|
58
|
+
`[${packageName}] public and records are visible to anyone with the`,
|
|
59
|
+
`[${packageName}] sandbox read key. For production use, set:`,
|
|
60
|
+
`[${packageName}] AUDIT_API_URL your-deployed-ledger-endpoint`,
|
|
61
|
+
`[${packageName}] AUDIT_WRITE_KEY your-tenant-write-key`,
|
|
62
|
+
`[${packageName}] AUDIT_READ_KEY your-tenant-read-key`,
|
|
63
|
+
`[${packageName}] Deploy your own from https://github.com/shahidh68/audit-ledger`,
|
|
64
|
+
`[${packageName}] ${packageVersion} ───────────────────────────────────`,
|
|
65
|
+
].join("\n");
|
|
66
|
+
}
|
|
67
|
+
//# sourceMappingURL=sandbox.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"sandbox.js","sourceRoot":"","sources":["../src/sandbox.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,MAAM,CAAC,MAAM,cAAc,GAAG;IAC5B,MAAM,EACJ,6DAA6D;IAC/D,QAAQ,EACN,oDAAoD;IACtD,OAAO,EACL,oDAAoD;IACtD,QAAQ,EAAE,gBAAgB;IAC1B,YAAY,EAAE,uCAAuC;CAC7C,CAAC;AAEX;;;;;GAKG;AACH,MAAM,UAAU,aAAa;IAC3B,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC;AACpC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,WAAmB,EAAE,cAAsB;IACvE,OAAO;QACL,IAAI,WAAW,gDAAgD;QAC/D,IAAI,WAAW,gCAAgC;QAC/C,IAAI,WAAW,iCAAiC,cAAc,CAAC,QAAQ,GAAG;QAC1E,EAAE;QACF,IAAI,WAAW,0DAA0D;QACzE,IAAI,WAAW,gBAAgB,cAAc,CAAC,QAAQ,EAAE;QACxD,IAAI,WAAW,gBAAgB,cAAc,CAAC,YAAY,EAAE;QAC5D,EAAE;QACF,IAAI,WAAW,sDAAsD;QACrE,IAAI,WAAW,qDAAqD;QACpE,IAAI,WAAW,8CAA8C;QAC7D,IAAI,WAAW,oDAAoD;QACnE,IAAI,WAAW,4CAA4C;QAC3D,IAAI,WAAW,2CAA2C;QAC1D,IAAI,WAAW,kEAAkE;QACjF,IAAI,WAAW,KAAK,cAAc,sCAAsC;KACzE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC"}
|
package/package.json
CHANGED