clawmatrix 0.4.2 → 0.5.1

package/src/audit.ts

@@ -1,5 +1,8 @@
 /** Structured audit logger for security events. */
 
+import type { Store } from "./store.ts";
+import type { LogReplicator } from "./log-replication.ts";
+
 export type AuditEvent =
   | "conn_open"        // New inbound WS connection
   | "conn_rate_limited" // Connection rejected by rate limiter
@@ -27,6 +30,19 @@ const defaultSink: AuditSink = (entry) => {
 
 let sink: AuditSink = defaultSink;
 
+// ── SQLite persistence (set after Store is initialized) ─────────
+
+let storeRef: Store | null = null;
+let replicatorRef: LogReplicator | null = null;
+let localNodeId = "";
+
+/** Wire audit to SQLite store for persistence + cross-node replication. */
+export function setAuditStore(store: Store, nodeId: string, replicator?: LogReplicator) {
+  storeRef = store;
+  localNodeId = nodeId;
+  replicatorRef = replicator ?? null;
+}
+
 /** Replace the audit sink (e.g. to write to a file or external service). */
 export function setAuditSink(s: AuditSink) {
   sink = s;
@@ -34,9 +50,28 @@ export function setAuditSink(s: AuditSink) {
 
 /** Emit an audit event. */
 export function audit(event: AuditEvent, fields?: Omit<AuditEntry, "ts" | "event">) {
-  sink({
+  const entry: AuditEntry = {
     ts: new Date().toISOString(),
     event,
     ...fields,
-  });
+  };
+
+  // Always emit to sink (console.warn by default)
+  sink(entry);
+
+  // Persist to SQLite + notify replication
+  if (storeRef) {
+    try {
+      storeRef.insertAudit({
+        nodeId: localNodeId,
+        ts: Date.now(),
+        event,
+        ip: fields?.ip,
+        detail: fields?.detail,
+      });
+      replicatorRef?.notifyLocalInsert("audit_log");
+    } catch {
+      // Non-fatal: don't let store errors break audit logging
+    }
+  }
 }

package/src/auth.ts

@@ -1,4 +1,5 @@
 import { createHash, timingSafeEqual as nodeTimingSafeEqual } from "node:crypto";
+import { LRUCache } from "lru-cache";
 
 export function generateNonce(): string {
   const bytes = crypto.getRandomValues(new Uint8Array(32));
@@ -6,8 +7,7 @@ export function generateNonce(): string {
 }
 
 /** Cache imported CryptoKey keyed by a hash of the secret (avoid storing plaintext). Max 8 entries. */
-const KEY_CACHE_MAX = 8;
-const keyCache = new Map<string, CryptoKey>();
+const keyCache = new LRUCache<string, CryptoKey>({ max: 8 });
 
 function cacheKeyFor(secret: string): string {
   return createHash("sha256").update(secret).digest("hex");
@@ -15,20 +15,15 @@ function cacheKeyFor(secret: string): string {
 
 async function getHmacKey(secret: string): Promise<CryptoKey> {
   const cacheKey = cacheKeyFor(secret);
-  let key = keyCache.get(cacheKey);
-  if (key) return key;
-  key = await crypto.subtle.importKey(
+  const cached = keyCache.get(cacheKey);
+  if (cached) return cached;
+  const key = await crypto.subtle.importKey(
     "raw",
     new TextEncoder().encode(secret),
     { name: "HMAC", hash: "SHA-256" },
     false,
     ["sign"],
   );
-  if (keyCache.size >= KEY_CACHE_MAX) {
-    // Evict oldest entry
-    const oldest = keyCache.keys().next().value!;
-    keyCache.delete(oldest);
-  }
   keyCache.set(cacheKey, key);
   return key;
 }