strapi-cms-audit-log 1.1.0 → 1.2.1

package/dist/server/index.mjs

@@ -1,10 +1,10 @@
 import { AsyncLocalStorage } from "node:async_hooks";
+import { randomUUID, createHash } from "node:crypto";
 const PLUGIN_ID = "audit-log";
 const AUDIT_LOG_UID = "plugin::audit-log.audit-log";
 const ALL_ACTIONS = ["create", "update", "delete", "publish", "unpublish"];
 const PERMISSIONS = {
   read: `plugin::${PLUGIN_ID}.read`,
-  delete: `plugin::${PLUGIN_ID}.delete`,
   settings: `plugin::${PLUGIN_ID}.settings`
 };
 const DEFAULT_IGNORED_FIELDS = [
@@ -31,6 +31,8 @@ const SKIPPED_ATTRIBUTES = /* @__PURE__ */ new Set([
   "createdBy",
   "updatedBy"
 ]);
+const REQUEST_ID_RESPONSE_HEADER = "X-Request-Id";
+const CHAIN_LOCK_KEY = 1874206233;
 const REQUEST_ID_HEADERS = ["x-request-id", "request-id", "x-correlation-id", "x-amzn-trace-id"];
 const RETENTION_JOB_NAME = "auditLogRetention";
 const CONTENT_ACTIONS = ALL_ACTIONS;
@@ -55,6 +57,7 @@ const ALL_SECURITY_ACTIONS = [
   "media-folder.update",
   "media-folder.delete"
 ];
+const ALL_MAINTENANCE_ACTIONS = ["retention.purge"];
 const SUBJECTS = {
   auth: "admin::auth",
   access: "admin::access",
@@ -62,7 +65,9 @@ const SUBJECTS = {
   role: "admin::role",
   permission: "admin::permission",
   file: "plugin::upload.file",
-  folder: "plugin::upload.folder"
+  folder: "plugin::upload.folder",
+  /** The audit log itself, for records about its own maintenance. */
+  auditLog: "admin::audit-log"
 };
 const SUBJECT_DISPLAY_NAMES = {
   [SUBJECTS.auth]: "Authentication",
@@ -71,7 +76,8 @@ const SUBJECT_DISPLAY_NAMES = {
   [SUBJECTS.role]: "Admin role",
   [SUBJECTS.permission]: "Permission",
   [SUBJECTS.file]: "Media file",
-  [SUBJECTS.folder]: "Media folder"
+  [SUBJECTS.folder]: "Media folder",
+  [SUBJECTS.auditLog]: "Audit log"
 };
 const SECURITY_EVENT_MAP = {
   "admin.auth.success": { action: "login.success", subject: SUBJECTS.auth },
@@ -141,7 +147,8 @@ const config = {
     // see the note above on `defaultsDeep` splicing arrays element-wise.
     securityEvents: null,
     forwardToLogger: false,
-    forwardLogLevel: "info"
+    forwardLogLevel: "info",
+    correlationId: true
   },
   /**
    * Runs once at boot, before anything else touches the config. Throwing here
@@ -205,6 +212,9 @@ const config = {
     if (config2.forwardToLogger != null && typeof config2.forwardToLogger !== "boolean") {
       fail('"forwardToLogger" must be a boolean');
     }
+    if (config2.correlationId != null && typeof config2.correlationId !== "boolean") {
+      fail('"correlationId" must be a boolean');
+    }
     if (config2.forwardLogLevel != null && !["debug", "info", "warn", "error"].includes(config2.forwardLogLevel)) {
       fail('"forwardLogLevel" must be one of: debug, info, warn, error');
     }
@@ -287,7 +297,22 @@ const schema = {
     ipAddress: { type: "string" },
     userAgent: { type: "text" },
     source: { type: "string" },
-    requestId: { type: "string" }
+    requestId: { type: "string" },
+    /**
+     * Hash chain, for tamper-evidence (ASVS V7.3.3).
+     *
+     * `hash` is SHA-256 over this record's content fields plus `prevHash`, and
+     * `prevHash` is the `hash` of the row written immediately before. Editing any
+     * hashed field, or removing a row from the middle, breaks the link that the
+     * next row asserts — and `services/integrity.ts` can say exactly which row.
+     *
+     * Both are nullable: rows written before 1.2.0 have no hash and are never
+     * backfilled. Hashing them now would vouch for content whose integrity in
+     * the interval cannot be known, which is the opposite of what a hash is for.
+     * 64 lowercase hex characters when present.
+     */
+    hash: { type: "string", maxLength: 64 },
+    prevHash: { type: "string", maxLength: 64 }
   },
   /**
    * Secondary indexes, declared here so Strapi's schema sync owns them and they
@@ -374,16 +399,6 @@ const auditLogController = ({ strapi }) => {
       if (!log) return ctx.notFound("Audit log not found.");
       ctx.body = { data: log };
     },
-    async delete(ctx) {
-      const id = parseId(ctx.params.id);
-      if (id === null) return ctx.badRequest("Invalid audit log id.");
-      const deleted = await service("audit").deleteOne(id);
-      if (!deleted) return ctx.notFound("Audit log not found.");
-      strapi.log.info(
-        `[audit-log] record #${id} deleted by ${service("context").resolve().userEmail ?? "an admin user"}.`
-      );
-      ctx.body = { data: deleted };
-    },
     /** Filter dropdown options, derived from the rows that actually exist. */
     async filters(ctx) {
       ctx.body = { data: await service("audit").getFilterOptions() };
@@ -391,6 +406,10 @@ const auditLogController = ({ strapi }) => {
     /** The effective configuration, so the UI can hide controls for disabled features. */
     async config(ctx) {
       ctx.body = { data: service("config").getPublicConfig() };
+    },
+    /** Verifies the hash chain end to end. See `services/integrity.ts`. */
+    async integrity(ctx) {
+      ctx.body = { data: await service("integrity").verify() };
     }
   };
 };
@@ -422,12 +441,6 @@ const ACTIONS = [
     uid: "read",
     pluginName: PLUGIN_ID
   },
-  {
-    section: "plugins",
-    displayName: "Delete audit logs",
-    uid: "delete",
-    pluginName: PLUGIN_ID
-  },
   {
     section: "plugins",
     displayName: "Read audit log settings",
@@ -437,6 +450,7 @@ const ACTIONS = [
 ];
 const register = async ({ strapi }) => {
   await strapi.service("admin::permission").actionProvider.registerMany(ACTIONS);
+  strapi.plugin(PLUGIN_ID).service("correlation").register();
   strapi.plugin(PLUGIN_ID).service("access").register();
 };
 const protectedBy = (action) => ({
@@ -466,6 +480,14 @@ const admin = {
       handler: "audit-log.config",
       config: protectedBy(PERMISSIONS.read)
     },
+    {
+      // Walks the whole hash chain. Read-only, and behind `read` — being able
+      // to see the log is the right bar for being able to check it.
+      method: "GET",
+      path: "/integrity",
+      handler: "audit-log.integrity",
+      config: protectedBy(PERMISSIONS.read)
+    },
     {
       // Declared after the two static paths above so `/logs/filters` can never
       // be swallowed by `:id`.
@@ -473,14 +495,6 @@ const admin = {
       path: "/logs/:id",
       handler: "audit-log.findOne",
       config: protectedBy(PERMISSIONS.read)
-    },
-    {
-      method: "DELETE",
-      path: "/logs/:id",
-      handler: "audit-log.delete",
-      // A separate permission from `read`: being allowed to investigate an
-      // incident must not imply being allowed to erase the evidence.
-      config: protectedBy(PERMISSIONS.delete)
     }
   ]
 };
@@ -488,7 +502,7 @@ const routes = {
   admin
 };
 const MAX_PATH_LENGTH = 512;
-const asString$2 = (value, maxLength = 256) => {
+const asString$3 = (value, maxLength = 256) => {
   if (value === null || value === void 0) return null;
   const text = String(value).trim();
   return text.length === 0 ? null : text.slice(0, maxLength);
@@ -500,19 +514,19 @@ const accessService = ({ strapi }) => {
   const actorOf = (ctx) => {
     const user = ctx.state?.user ?? null;
     if (!user) return { userId: null, userEmail: null, userName: null };
-    const firstname = asString$2(user.firstname);
-    const lastname = asString$2(user.lastname);
+    const firstname = asString$3(user.firstname);
+    const lastname = asString$3(user.lastname);
     return {
-      userId: asString$2(user.id),
-      userEmail: asString$2(user.email),
-      userName: firstname && lastname ? `${firstname} ${lastname}` : asString$2(user.username) ?? firstname ?? lastname ?? asString$2(user.email)
+      userId: asString$3(user.id),
+      userEmail: asString$3(user.email),
+      userName: firstname && lastname ? `${firstname} ${lastname}` : asString$3(user.username) ?? firstname ?? lastname ?? asString$3(user.email)
     };
   };
   const sourceOf = (ctx) => {
-    const routeType = asString$2(ctx.state?.route?.info?.type);
+    const routeType = asString$3(ctx.state?.route?.info?.type);
     if (routeType === "admin") return "admin";
     if (routeType === "content-api") return "api";
-    const strategy = asString$2(ctx.state?.auth?.strategy?.name);
+    const strategy = asString$3(ctx.state?.auth?.strategy?.name);
     if (strategy === "admin") return "admin";
     if (strategy === "api-token" || strategy === "users-permissions") return "api";
     return "unknown";
@@ -531,20 +545,20 @@ const accessService = ({ strapi }) => {
       after: null,
       outcome: "failure",
       metadata: {
-        method: asString$2(ctx.request?.method, 16),
-        path: asString$2(ctx.request?.path, MAX_PATH_LENGTH),
+        method: asString$3(ctx.request?.method, 16),
+        path: asString$3(ctx.request?.path, MAX_PATH_LENGTH),
         statusCode: ctx.status,
         // Strapi's error handler puts a reason in the body. It is the difference
         // between "no session" and "your role lacks this permission", which is
         // the first thing anyone reading the row wants to know.
-        reason: asString$2(ctx.body?.error?.message) ?? null,
-        routeType: asString$2(ctx.state?.route?.info?.type)
+        reason: asString$3(ctx.body?.error?.message) ?? null,
+        routeType: asString$3(ctx.state?.route?.info?.type)
       },
       source: sourceOf(ctx),
       ...actorOf(ctx),
-      ipAddress: asString$2(ctx.request?.ip ?? ctx.ip, 64),
-      userAgent: asString$2(headers["user-agent"], 512),
-      requestId: asString$2(ctx.state?.requestId ?? headers["x-request-id"])
+      ipAddress: asString$3(ctx.request?.ip ?? ctx.ip, 64),
+      userAgent: asString$3(headers["user-agent"], 512),
+      requestId: asString$3(ctx.state?.requestId ?? headers["x-request-id"])
     });
   };
   const createMiddleware = () => {
@@ -644,38 +658,83 @@ const auditService = ({ strapi }) => {
     );
     return { __omitted__: `Snapshot omitted: ~${bytes} bytes exceeds maxSnapshotBytes (${maxBytes}).` };
   };
+  let chainQueue = Promise.resolve();
+  const serialised = (task) => {
+    const run = chainQueue.then(task, task);
+    chainQueue = run.catch(() => void 0);
+    return run;
+  };
+  const withChainLock = (task) => (
+    // `transaction` types its result as the callback's own return, which for an
+    // async callback is a Promise of a Promise; at runtime it is flattened.
+    strapi.db.transaction(async ({ trx }) => {
+      const client = String(strapi.db.dialect?.client ?? "");
+      if (client === "postgres") {
+        await trx.raw("select pg_advisory_xact_lock(?)", [CHAIN_LOCK_KEY]);
+      } else if (client === "mysql") {
+        await trx.raw("select get_lock(?, 10)", [`audit-log-chain-${CHAIN_LOCK_KEY}`]);
+        try {
+          return await task();
+        } finally {
+          await trx.raw("select release_lock(?)", [`audit-log-chain-${CHAIN_LOCK_KEY}`]);
+        }
+      }
+      return task();
+    })
+  );
   const write = async (entry) => {
     const config2 = getConfig();
-    await strapi.db.query(AUDIT_LOG_UID).create({
-      data: {
-        action: entry.action,
-        contentType: entry.contentType,
-        contentTypeDisplayName: entry.contentTypeDisplayName,
-        contentDocumentId: entry.contentDocumentId,
-        contentId: entry.contentId,
-        locale: entry.locale,
-        userId: entry.userId,
-        userEmail: entry.userEmail,
-        userName: entry.userName,
-        changes: config2.storeChanges ? entry.changes : null,
-        before: capSnapshot(config2.storeBefore ? entry.before : null, config2.maxSnapshotBytes, "before"),
-        after: capSnapshot(config2.storeAfter ? entry.after : null, config2.maxSnapshotBytes, "after"),
-        ipAddress: entry.ipAddress,
-        userAgent: entry.userAgent,
-        source: entry.source,
-        requestId: entry.requestId,
-        // A content write only ever reaches the tracker once it has succeeded,
-        // so the default is the honest value rather than a placeholder.
-        outcome: entry.outcome ?? "success",
-        metadata: entry.metadata ?? null
-      }
-    });
-    if (config2.forwardToLogger) forwardToLogger(entry, config2);
+    const integrity = strapi.plugin(PLUGIN_ID).service("integrity");
+    const data = {
+      action: entry.action,
+      contentType: entry.contentType,
+      contentTypeDisplayName: entry.contentTypeDisplayName,
+      contentDocumentId: entry.contentDocumentId,
+      contentId: entry.contentId,
+      locale: entry.locale,
+      userId: entry.userId,
+      userEmail: entry.userEmail,
+      userName: entry.userName,
+      changes: config2.storeChanges ? entry.changes : null,
+      before: capSnapshot(config2.storeBefore ? entry.before : null, config2.maxSnapshotBytes, "before"),
+      after: capSnapshot(config2.storeAfter ? entry.after : null, config2.maxSnapshotBytes, "after"),
+      ipAddress: entry.ipAddress,
+      userAgent: entry.userAgent,
+      source: entry.source,
+      requestId: entry.requestId,
+      // A content write only ever reaches the tracker once it has succeeded,
+      // so the default is the honest value rather than a placeholder.
+      outcome: entry.outcome ?? "success",
+      metadata: entry.metadata ?? null,
+      // Set here rather than left to the database's timestamp hook, because it
+      // is part of the hash: a record whose time can be changed without
+      // detection is a record whose place in the story can be changed.
+      createdAt: /* @__PURE__ */ new Date()
+    };
+    const created = await serialised(
+      () => withChainLock(async () => {
+        const [head] = await strapi.db.query(AUDIT_LOG_UID).findMany({
+          select: ["id", "hash"],
+          orderBy: { id: "desc" },
+          limit: 1
+        });
+        data.prevHash = head?.hash ?? null;
+        data.hash = integrity.computeHash(data);
+        return await strapi.db.query(AUDIT_LOG_UID).create({ data });
+      })
+    );
+    if (config2.forwardToLogger) forwardToLogger(entry, config2, created);
   };
-  const forwardToLogger = (entry, config2) => {
+  const forwardToLogger = (entry, config2, created) => {
     try {
       const line = JSON.stringify({
         type: "audit-log",
+        // The row's identity and its place in the chain, so the external copy
+        // can be reconciled against the database — and can prove a row that
+        // has since vanished from it was there.
+        id: created?.id ?? null,
+        hash: created?.hash ?? null,
+        prevHash: created?.prevHash ?? null,
         action: entry.action,
         outcome: entry.outcome ?? "success",
         contentType: entry.contentType,
@@ -773,7 +832,6 @@ const auditService = ({ strapi }) => {
     return { results, pagination };
   };
   const findOne = async (id) => await strapi.db.query(AUDIT_LOG_UID).findOne({ where: { id } });
-  const deleteOne = async (id) => await strapi.db.query(AUDIT_LOG_UID).delete({ where: { id } });
   const deleteOlderThan = async (date) => {
     const { count } = await strapi.db.query(AUDIT_LOG_UID).deleteMany({
       where: { createdAt: { $lt: date.toISOString() } }
@@ -848,7 +906,7 @@ const auditService = ({ strapi }) => {
       contentTypes: registry.contentTypes,
       users: await adminUsers(),
       locales: await configuredLocales(),
-      actions: [...CONTENT_ACTIONS, ...ALL_SECURITY_ACTIONS],
+      actions: [...CONTENT_ACTIONS, ...ALL_SECURITY_ACTIONS, ...ALL_MAINTENANCE_ACTIONS],
       sources: [...ALL_SOURCES],
       outcomes: ["success", "failure"]
     };
@@ -889,8 +947,13 @@ const auditService = ({ strapi }) => {
     sources: [...options.sources].sort(),
     outcomes: [...options.outcomes].sort()
   });
-  const readStoredOptions = async () => {
-    const knex = strapi.db.connection;
+  const readStoredOptions = () => (
+    // Never raw `strapi.db.connection`: from inside an open transaction it takes
+    // a second pooled connection, and `Promise.all` below would take six. On the
+    // transaction's one connection the six queries simply run in turn.
+    strapi.db.transaction(({ trx }) => readStoredOptionsWith(trx))
+  );
+  const readStoredOptionsWith = async (knex) => {
     const metadata = strapi.db.metadata.get(AUDIT_LOG_UID);
     const table = metadata.tableName;
     const column = (attribute) => {
@@ -938,7 +1001,6 @@ const auditService = ({ strapi }) => {
     flush,
     find,
     findOne,
-    deleteOne,
     deleteOlderThan,
     getFilterOptions,
     buildWhere,
@@ -1046,6 +1108,7 @@ const configService = ({ strapi }) => {
       auditSystemOperations: raw.auditSystemOperations !== false,
       securityEvents: Array.isArray(raw.securityEvents) ? raw.securityEvents.map(String) : "*",
       forwardToLogger: raw.forwardToLogger === true,
+      correlationId: raw.correlationId !== false,
       forwardLogLevel: ["debug", "info", "warn", "error"].includes(
         raw.forwardLogLevel
       ) ? raw.forwardLogLevel : "info",
@@ -1104,16 +1167,16 @@ const EMPTY_CONTEXT = {
   userAgent: null,
   requestId: null
 };
-const asString$1 = (value) => {
+const asString$2 = (value) => {
   if (value === null || value === void 0) return null;
   const text = String(value).trim();
   return text.length === 0 ? null : text;
 };
 const resolveUserName = (user) => {
-  const firstname = asString$1(user.firstname);
-  const lastname = asString$1(user.lastname);
+  const firstname = asString$2(user.firstname);
+  const lastname = asString$2(user.lastname);
   if (firstname && lastname) return `${firstname} ${lastname}`;
-  return asString$1(user.username) ?? firstname ?? lastname ?? asString$1(user.email);
+  return asString$2(user.username) ?? firstname ?? lastname ?? asString$2(user.email);
 };
 const contextService = ({ strapi }) => {
   const runAs = (override, callback) => overrideStorage.run(override, callback);
@@ -1125,12 +1188,12 @@ const contextService = ({ strapi }) => {
     }
   };
   const resolveSource = (ctx) => {
-    const declared = asString$1(ctx?.state?.auditSource);
+    const declared = asString$2(ctx?.state?.auditSource);
     if (declared) return declared;
-    const routeType = asString$1(ctx?.state?.route?.info?.type);
+    const routeType = asString$2(ctx?.state?.route?.info?.type);
     if (routeType === "admin") return "admin";
     if (routeType === "content-api") return "api";
-    const strategyName = asString$1(ctx?.state?.auth?.strategy?.name);
+    const strategyName = asString$2(ctx?.state?.auth?.strategy?.name);
     if (strategyName === "admin") return "admin";
     if (strategyName === "api-token" || strategyName === "users-permissions") return "api";
     return ctx ? "unknown" : "system";
@@ -1143,32 +1206,69 @@ const contextService = ({ strapi }) => {
       return {
         ...EMPTY_CONTEXT,
         source: override.source,
-        userId: asString$1(override.userId),
-        userEmail: asString$1(override.userEmail),
-        userName: asString$1(override.userName)
+        userId: asString$2(override.userId),
+        userEmail: asString$2(override.userEmail),
+        userName: asString$2(override.userName)
       };
     }
     const user = ctx.state?.user ?? null;
     const headers = ctx.request?.headers ?? ctx.req?.headers ?? {};
-    const requestId = asString$1(ctx.state?.requestId) ?? REQUEST_ID_HEADERS.map((header) => asString$1(headers[header])).find(Boolean) ?? null;
+    const requestId = asString$2(ctx.state?.requestId) ?? REQUEST_ID_HEADERS.map((header) => asString$2(headers[header])).find(Boolean) ?? null;
     return {
       // An explicit override wins even inside a request: a controller that
       // deliberately labels its work knows more than the route type does.
       source: override?.source ?? resolveSource(ctx),
-      userId: asString$1(override?.userId ?? user?.id),
-      userEmail: asString$1(override?.userEmail ?? user?.email),
-      userName: override?.userName !== void 0 ? asString$1(override.userName) : user ? resolveUserName(user) : null,
+      userId: asString$2(override?.userId ?? user?.id),
+      userEmail: asString$2(override?.userEmail ?? user?.email),
+      userName: override?.userName !== void 0 ? asString$2(override.userName) : user ? resolveUserName(user) : null,
       // `ctx.request.ip` honours Koa's `proxy` setting, so behind a correctly
       // configured load balancer this is the client address rather than the
       // proxy's. With `proxy` off it ignores `X-Forwarded-For` entirely, which
       // is the safe default — a spoofable header is worse than no address.
-      ipAddress: asString$1(ctx.request?.ip ?? ctx.ip),
-      userAgent: asString$1(headers["user-agent"]),
+      ipAddress: asString$2(ctx.request?.ip ?? ctx.ip),
+      userAgent: asString$2(headers["user-agent"]),
       requestId
     };
   };
   return { resolve, runAs };
 };
+const MAX_ID_LENGTH = 128;
+const SAFE_ID = /^[A-Za-z0-9._:-]+$/;
+const asString$1 = (value) => {
+  if (value === null || value === void 0) return null;
+  const text = String(Array.isArray(value) ? value[0] : value).trim();
+  return text.length === 0 ? null : text;
+};
+const correlationService = ({ strapi }) => {
+  let registered = false;
+  const inboundId = (ctx) => {
+    const headers = ctx.request?.headers ?? {};
+    for (const header of REQUEST_ID_HEADERS) {
+      const value = asString$1(headers[header]);
+      if (!value) continue;
+      if (value.length <= MAX_ID_LENGTH && SAFE_ID.test(value)) return value;
+    }
+    return null;
+  };
+  const createMiddleware = () => {
+    return async (ctx, next) => {
+      const id = asString$1(ctx.state?.requestId) ?? inboundId(ctx) ?? randomUUID();
+      ctx.state.requestId = id;
+      try {
+        ctx.set(REQUEST_ID_RESPONSE_HEADER, id);
+      } catch {
+      }
+      await next();
+    };
+  };
+  const register2 = () => {
+    if (registered) return;
+    if (!strapi.plugin("audit-log").service("config").resolve().correlationId) return;
+    strapi.server.use(createMiddleware());
+    registered = true;
+  };
+  return { createMiddleware, register: register2, inboundId };
+};
 const DEFAULT_MAX_DEPTH = 6;
 const DEFAULT_MAX_CHANGES = 500;
 const diffService = ({ strapi }) => {
@@ -1241,13 +1341,13 @@ const diffService = ({ strapi }) => {
   };
   return { buildDiff };
 };
-const FORBIDDEN_ACTIONS = /* @__PURE__ */ new Set(["update", "publish", "unpublish", "discardDraft", "clone"]);
+const FORBIDDEN_ACTIONS = /* @__PURE__ */ new Set(["update", "delete", "publish", "unpublish", "discardDraft", "clone"]);
 const immutabilityService = ({ strapi }) => {
   const createMiddleware = () => {
     return async (ctx, next) => {
       if (ctx.uid === AUDIT_LOG_UID && FORBIDDEN_ACTIONS.has(ctx.action)) {
         throw new Error(
-          `[audit-log] Audit records are immutable: "${ctx.action}" is not permitted on ${AUDIT_LOG_UID}. Audit logs may only be created by the plugin and deleted through the retention job or the DELETE /audit-log/logs/:id route, which requires the plugin::audit-log.delete permission.`
+          `[audit-log] Audit records are immutable: "${ctx.action}" is not permitted on ${AUDIT_LOG_UID}. Audit logs are written by the plugin and removed only by its retention job. There is no route, permission or service that deletes an individual record.`
         );
       }
       return next();
@@ -1258,6 +1358,109 @@ const immutabilityService = ({ strapi }) => {
   };
   return { createMiddleware, register: register2 };
 };
+const HASHED_FIELDS = [
+  "action",
+  "contentType",
+  "contentTypeDisplayName",
+  "contentDocumentId",
+  "contentId",
+  "locale",
+  "userId",
+  "userEmail",
+  "userName",
+  "source",
+  "outcome",
+  "ipAddress",
+  "userAgent",
+  "requestId",
+  "metadata",
+  "changes",
+  "before",
+  "after",
+  "createdAt",
+  "prevHash"
+];
+const PAGE_SIZE = 500;
+const canonicalize = (value) => {
+  if (value === void 0 || value === null) return "null";
+  if (value instanceof Date) return JSON.stringify(value.toISOString());
+  if (Array.isArray(value)) return `[${value.map(canonicalize).join(",")}]`;
+  if (typeof value === "object") {
+    const entries = Object.keys(value).sort().map((key) => `${JSON.stringify(key)}:${canonicalize(value[key])}`);
+    return `{${entries.join(",")}}`;
+  }
+  return JSON.stringify(value);
+};
+const toIso = (value) => {
+  if (value === null || value === void 0) return null;
+  if (value instanceof Date) return value.toISOString();
+  const parsed = new Date(String(value));
+  return Number.isNaN(parsed.getTime()) ? String(value) : parsed.toISOString();
+};
+const integrityService = ({ strapi }) => {
+  const computeHash = (record) => {
+    const material = {};
+    for (const field of HASHED_FIELDS) {
+      const value = record[field];
+      material[field] = field === "createdAt" ? toIso(value) : value ?? null;
+    }
+    return createHash("sha256").update(canonicalize(material)).digest("hex");
+  };
+  const verify = async () => {
+    const report = {
+      ok: true,
+      checked: 0,
+      hashed: 0,
+      legacy: 0,
+      head: null,
+      start: null,
+      verifiedAt: (/* @__PURE__ */ new Date()).toISOString()
+    };
+    let previous = null;
+    let afterId = 0;
+    for (; ; ) {
+      const rows = await strapi.db.query(AUDIT_LOG_UID).findMany({
+        where: { id: { $gt: afterId } },
+        orderBy: { id: "asc" },
+        limit: PAGE_SIZE
+      });
+      if (rows.length === 0) break;
+      for (const row of rows) {
+        report.checked += 1;
+        afterId = row.id;
+        if (!row.hash) {
+          report.legacy += 1;
+          continue;
+        }
+        report.hashed += 1;
+        const expected = computeHash(row);
+        if (expected !== row.hash) {
+          report.ok = false;
+          report.brokenAt = {
+            id: row.id,
+            reason: "stored hash does not match the record content — a hashed field was modified"
+          };
+          return report;
+        }
+        if (previous === null) {
+          report.start = { id: row.id };
+        } else if (row.prevHash !== previous.hash) {
+          report.ok = false;
+          report.brokenAt = {
+            id: row.id,
+            reason: `prevHash does not match the hash of record #${previous.id} — a record between them was removed or inserted`
+          };
+          return report;
+        }
+        previous = { id: row.id, hash: row.hash };
+      }
+      if (rows.length < PAGE_SIZE) break;
+    }
+    report.head = previous;
+    return report;
+  };
+  return { computeHash, canonicalize, verify, HASHED_FIELDS };
+};
 const MS_PER_DAY = 24 * 60 * 60 * 1e3;
 const retentionService = ({ strapi }) => {
   const getConfig = () => strapi.plugin("audit-log").service("config").resolve();
@@ -1266,11 +1469,32 @@ const retentionService = ({ strapi }) => {
     const { retentionDays } = getConfig();
     if (retentionDays <= 0) return 0;
     const cutoff = cutoffDate(retentionDays);
-    const deleted = await strapi.plugin("audit-log").service("audit").deleteOlderThan(cutoff);
+    const audit = strapi.plugin("audit-log").service("audit");
+    const deleted = await audit.deleteOlderThan(cutoff);
     if (deleted > 0) {
       strapi.log.info(
         `[audit-log] retention removed ${deleted} record(s) created before ${cutoff.toISOString()}.`
       );
+      await audit.record({
+        action: "retention.purge",
+        contentType: SUBJECTS.auditLog,
+        contentTypeDisplayName: SUBJECT_DISPLAY_NAMES[SUBJECTS.auditLog] ?? "Audit log",
+        contentDocumentId: null,
+        contentId: null,
+        locale: null,
+        changes: null,
+        before: null,
+        after: null,
+        outcome: "success",
+        metadata: { deletedCount: deleted, cutoff: cutoff.toISOString(), retentionDays },
+        source: "cron",
+        userId: null,
+        userEmail: null,
+        userName: null,
+        ipAddress: null,
+        userAgent: null,
+        requestId: null
+      });
     }
     return deleted;
   };
@@ -1826,8 +2050,10 @@ const services = {
   audit: auditService,
   config: configService,
   context: contextService,
+  correlation: correlationService,
   diff: diffService,
   immutability: immutabilityService,
+  integrity: integrityService,
   retention: retentionService,
   security: securityService,
   snapshot: snapshotService,
@@ -1844,6 +2070,7 @@ const index = {
   services
 };
 export {
+  ALL_MAINTENANCE_ACTIONS,
   ALL_SECURITY_ACTIONS,
   AUDIT_LOG_UID,
   CONTENT_ACTIONS,