strapi-cms-audit-log 1.1.0 → 1.2.1

package/dist/server/src/config/index.d.ts

@@ -39,6 +39,7 @@ declare const _default: {
         securityEvents: null;
         forwardToLogger: boolean;
         forwardLogLevel: string;
+        correlationId: boolean;
     };
     /**
      * Runs once at boot, before anything else touches the config. Throwing here

package/dist/server/src/constants.d.ts

@@ -1,4 +1,4 @@
-import { AuditAction, AuditSecurityAction } from './types';
+import { AuditAction, AuditMaintenanceAction, AuditSecurityAction } from './types';
 /** Plugin id. Must match `strapi.name` in package.json — it namespaces routes, permissions and config. */
 export declare const PLUGIN_ID = "audit-log";
 /** UID of the plugin's own collection type. */
@@ -7,7 +7,6 @@ export declare const ALL_ACTIONS: AuditAction[];
 /** RBAC action uids, as they appear once namespaced by the admin permission provider. */
 export declare const PERMISSIONS: {
     readonly read: "plugin::audit-log.read";
-    readonly delete: "plugin::audit-log.delete";
     readonly settings: "plugin::audit-log.settings";
 };
 /**
@@ -47,6 +46,21 @@ export declare const DEFAULT_IGNORED_CHANGE_FIELDS: string[];
  * contain a field the editor never touched.
  */
 export declare const SKIPPED_ATTRIBUTES: Set<string>;
+/**
+ * Response header the correlation middleware echoes the request id in.
+ *
+ * Echoed so the id a client (or a proxy access log) sees is the same one the
+ * audit record carries — otherwise correlation only works from the inside.
+ */
+export declare const REQUEST_ID_RESPONSE_HEADER = "X-Request-Id";
+/**
+ * Advisory-lock key for serialising hash-chain writes on PostgreSQL.
+ *
+ * Any constant works; this one is the CRC-32 of "strapi-audit-log-chain", chosen
+ * so it is stable across processes and unlikely to collide with a lock some
+ * other component picked by the same method.
+ */
+export declare const CHAIN_LOCK_KEY = 1874206233;
 /** Headers checked, in order, for a correlation id. */
 export declare const REQUEST_ID_HEADERS: string[];
 /** Name under which the retention job is registered with `strapi.cron`. */
@@ -72,6 +86,12 @@ export declare const CONTENT_ACTIONS: AuditAction[];
  * available in Strapi **Community Edition** — none needs an Enterprise licence.
  */
 export declare const ALL_SECURITY_ACTIONS: AuditSecurityAction[];
+/**
+ * Operations the plugin performs on its own table. Always recorded; there is no
+ * option to switch them off, because a retention purge that left no trace would
+ * be indistinguishable from someone deleting rows.
+ */
+export declare const ALL_MAINTENANCE_ACTIONS: AuditMaintenanceAction[];
 /**
  * Pseudo content-type uids for events that are not about a content type.
  *
@@ -90,6 +110,8 @@ export declare const SUBJECTS: {
     readonly permission: "admin::permission";
     readonly file: "plugin::upload.file";
     readonly folder: "plugin::upload.folder";
+    /** The audit log itself, for records about its own maintenance. */
+    readonly auditLog: "admin::audit-log";
 };
 /** Human labels for {@link SUBJECTS}, snapshotted into `contentTypeDisplayName`. */
 export declare const SUBJECT_DISPLAY_NAMES: Record<string, string>;

package/dist/server/src/content-types/audit-log/index.d.ts

@@ -76,6 +76,14 @@ declare const _default: {
             requestId: {
                 type: string;
             };
+            hash: {
+                type: string;
+                maxLength: number;
+            };
+            prevHash: {
+                type: string;
+                maxLength: number;
+            };
         };
         indexes: {
             name: string;

package/dist/server/src/content-types/audit-log/schema.d.ts

@@ -121,6 +121,27 @@ declare const schema: {
         requestId: {
             type: string;
         };
+        /**
+         * Hash chain, for tamper-evidence (ASVS V7.3.3).
+         *
+         * `hash` is SHA-256 over this record's content fields plus `prevHash`, and
+         * `prevHash` is the `hash` of the row written immediately before. Editing any
+         * hashed field, or removing a row from the middle, breaks the link that the
+         * next row asserts — and `services/integrity.ts` can say exactly which row.
+         *
+         * Both are nullable: rows written before 1.2.0 have no hash and are never
+         * backfilled. Hashing them now would vouch for content whose integrity in
+         * the interval cannot be known, which is the opposite of what a hash is for.
+         * 64 lowercase hex characters when present.
+         */
+        hash: {
+            type: string;
+            maxLength: number;
+        };
+        prevHash: {
+            type: string;
+            maxLength: number;
+        };
     };
     /**
      * Secondary indexes, declared here so Strapi's schema sync owns them and they

package/dist/server/src/content-types/index.d.ts

@@ -77,6 +77,14 @@ declare const _default: {
                 requestId: {
                     type: string;
                 };
+                hash: {
+                    type: string;
+                    maxLength: number;
+                };
+                prevHash: {
+                    type: string;
+                    maxLength: number;
+                };
             };
             indexes: {
                 name: string;

package/dist/server/src/controllers/audit-log.d.ts

@@ -14,18 +14,20 @@ type KoaContext = {
  * see `routes/admin.ts`. Nothing here re-implements authentication or
  * authorisation; the controller runs only once Strapi's own RBAC has said yes.
  *
- * There is deliberately no create or update handler. Audit records are written
- * by the plugin and read by humans; nothing in between.
+ * There is deliberately no create, update or delete handler. Audit records are
+ * written by the plugin and read by humans; nothing in between. Deletion was
+ * removed in 1.2.0 — see `routes/admin.ts` for why.
  */
 declare const auditLogController: ({ strapi }: {
     strapi: Core.Strapi;
 }) => {
     find(ctx: KoaContext): Promise<void>;
     findOne(ctx: KoaContext): Promise<unknown>;
-    delete(ctx: KoaContext): Promise<unknown>;
     /** Filter dropdown options, derived from the rows that actually exist. */
     filters(ctx: KoaContext): Promise<void>;
     /** The effective configuration, so the UI can hide controls for disabled features. */
     config(ctx: KoaContext): Promise<void>;
+    /** Verifies the hash chain end to end. See `services/integrity.ts`. */
+    integrity(ctx: KoaContext): Promise<void>;
 };
 export default auditLogController;

package/dist/server/src/controllers/index.d.ts

@@ -16,21 +16,21 @@ declare const _default: {
             badRequest: (message: string) => unknown;
             notFound: (message?: string) => unknown;
         }): Promise<unknown>;
-        delete(ctx: {
+        filters(ctx: {
             query: Record<string, unknown>;
             params: Record<string, string>;
             body: unknown;
             badRequest: (message: string) => unknown;
             notFound: (message?: string) => unknown;
-        }): Promise<unknown>;
-        filters(ctx: {
+        }): Promise<void>;
+        config(ctx: {
             query: Record<string, unknown>;
             params: Record<string, string>;
             body: unknown;
             badRequest: (message: string) => unknown;
             notFound: (message?: string) => unknown;
         }): Promise<void>;
-        config(ctx: {
+        integrity(ctx: {
             query: Record<string, unknown>;
             params: Record<string, string>;
             body: unknown;

package/dist/server/src/index.d.ts

@@ -34,6 +34,7 @@ declare const _default: {
             securityEvents: null;
             forwardToLogger: boolean;
             forwardLogLevel: string;
+            correlationId: boolean;
         };
         validator(config: import('./types').AuditUserConfig & {
             enabled?: boolean;
@@ -118,6 +119,14 @@ declare const _default: {
                     requestId: {
                         type: string;
                     };
+                    hash: {
+                        type: string;
+                        maxLength: number;
+                    };
+                    prevHash: {
+                        type: string;
+                        maxLength: number;
+                    };
                 };
                 indexes: {
                     name: string;
@@ -144,21 +153,21 @@ declare const _default: {
                 badRequest: (message: string) => unknown;
                 notFound: (message?: string) => unknown;
             }): Promise<unknown>;
-            delete(ctx: {
+            filters(ctx: {
                 query: Record<string, unknown>;
                 params: Record<string, string>;
                 body: unknown;
                 badRequest: (message: string) => unknown;
                 notFound: (message?: string) => unknown;
-            }): Promise<unknown>;
-            filters(ctx: {
+            }): Promise<void>;
+            config(ctx: {
                 query: Record<string, unknown>;
                 params: Record<string, string>;
                 body: unknown;
                 badRequest: (message: string) => unknown;
                 notFound: (message?: string) => unknown;
             }): Promise<void>;
-            config(ctx: {
+            integrity(ctx: {
                 query: Record<string, unknown>;
                 params: Record<string, string>;
                 body: unknown;
@@ -209,7 +218,6 @@ declare const _default: {
             flush: () => Promise<void>;
             find: (query?: import('./types').AuditLogQuery) => Promise<import('./types').AuditLogListResult>;
             findOne: (id: number) => Promise<import('./types').AuditLog | null>;
-            deleteOne: (id: number) => Promise<import('./types').AuditLog | null>;
             deleteOlderThan: (date: Date) => Promise<number>;
             getFilterOptions: () => Promise<import('./types').AuditFilterOptions>;
             buildWhere: (query: import('./types').AuditLogQuery) => Record<string, unknown>;
@@ -233,6 +241,17 @@ declare const _default: {
             resolve: () => import('./types').AuditContext;
             runAs: <T>(override: import('./services/context').SourceOverride, callback: () => T) => T;
         };
+        correlation: ({ strapi }: {
+            strapi: import('@strapi/types/dist/core').Strapi;
+        }) => {
+            createMiddleware: () => (ctx: {
+                [x: string]: any;
+            }, next: () => Promise<unknown>) => Promise<void>;
+            register: () => void;
+            inboundId: (ctx: {
+                [x: string]: any;
+            }) => string | null;
+        };
         diff: ({ strapi }: {
             strapi: import('@strapi/types/dist/core').Strapi;
         }) => {
@@ -247,6 +266,16 @@ declare const _default: {
             }, next: () => Promise<unknown>) => Promise<unknown>;
             register: () => void;
         };
+        integrity: ({ strapi }: {
+            strapi: import('@strapi/types/dist/core').Strapi;
+        }) => {
+            computeHash: (record: {
+                [x: string]: any;
+            }) => string;
+            canonicalize: (value: unknown) => string;
+            verify: () => Promise<import('./types').IntegrityReport>;
+            HASHED_FIELDS: readonly ["action", "contentType", "contentTypeDisplayName", "contentDocumentId", "contentId", "locale", "userId", "userEmail", "userName", "source", "outcome", "ipAddress", "userAgent", "requestId", "metadata", "changes", "before", "after", "createdAt", "prevHash"];
+        };
         retention: ({ strapi }: {
             strapi: import('@strapi/types/dist/core').Strapi;
         }) => {
@@ -324,5 +353,5 @@ declare const _default: {
 };
 export default _default;
 /** Public type surface — see `server/src/types`. */
-export type { AuditAction, AuditActor, AuditAnyAction, AuditChange, AuditChangeSet, AuditConfig, AuditContext, AuditEntryInput, AuditFilterOptions, AuditLog, AuditLogListResult, AuditLogQuery, AuditLogLevel, AuditMetadata, AuditOutcome, AuditRequestContext, AuditSecurityAction, AuditSource, AuditUserConfig, AuditWriteMode, ContentTypeSelector, SecurityEventSelector, } from './types';
-export { PLUGIN_ID, AUDIT_LOG_UID, PERMISSIONS, DEFAULT_IGNORED_FIELDS, CONTENT_ACTIONS, ALL_SECURITY_ACTIONS, SECURITY_EVENT_MAP, SUBJECTS, } from './constants';
+export type { AuditAction, AuditActor, AuditAnyAction, AuditChange, AuditChangeSet, AuditConfig, AuditContext, AuditEntryInput, AuditFilterOptions, AuditLog, AuditLogListResult, AuditLogQuery, AuditLogLevel, AuditMaintenanceAction, IntegrityReport, AuditMetadata, AuditOutcome, AuditRequestContext, AuditSecurityAction, AuditSource, AuditUserConfig, AuditWriteMode, ContentTypeSelector, SecurityEventSelector, } from './types';
+export { PLUGIN_ID, AUDIT_LOG_UID, PERMISSIONS, DEFAULT_IGNORED_FIELDS, CONTENT_ACTIONS, ALL_SECURITY_ACTIONS, ALL_MAINTENANCE_ACTIONS, SECURITY_EVENT_MAP, SUBJECTS, } from './constants';

package/dist/server/src/register.d.ts

@@ -6,9 +6,13 @@ import { Core } from '@strapi/strapi';
  * the other plugins, and the provider namespaces each `uid` with the plugin name
  * — `read` becomes `plugin::audit-log.read`.
  *
- * Read and delete are separate on purpose: an auditor needs to see the trail, an
- * auditor must not be able to erase it, and collapsing the two into one
- * permission would make that distinction unexpressible.
+ * There is no `delete` action. Until 1.2.0 there was one, kept separate from
+ * `read` so that seeing the trail never implied being able to erase it; the
+ * assessment that followed pointed out, correctly, that a permission which
+ * *can* be granted will eventually be granted, and that a Super Admin holds
+ * every permission implicitly. The only way for no interactive role to be able
+ * to delete evidence is for the action not to exist. Strapi removes the stale
+ * grants from the database at the next boot.
  */
 declare const ACTIONS: {
     section: string;

package/dist/server/src/routes/admin.d.ts

@@ -6,6 +6,14 @@
  * and so on. There is no `type: 'content-api'` route file, and that is the
  * point: audit records are never reachable from the public content API, with or
  * without an API token, because no public route exists to reach them.
+ *
+ * There is no write route of any kind — no create, no update, and since 1.2.0
+ * no delete. An audit log that an administrator can prune is not evidence of
+ * what administrators did; ASVS V7.3.1 puts it plainly as "protected from
+ * unauthorized modification or deletion", and the surest way to have no
+ * unauthorised deletion is to have no deletion. The only thing that removes a
+ * row is the retention job, which runs off the request path, cannot be aimed
+ * at a specific record, and writes its own record of what it removed.
  */
 declare const _default: {
     type: string;

package/dist/server/src/services/audit.d.ts

@@ -16,7 +16,6 @@ declare const auditService: ({ strapi }: {
     flush: () => Promise<void>;
     find: (query?: AuditLogQuery) => Promise<AuditLogListResult>;
     findOne: (id: number) => Promise<AuditLog | null>;
-    deleteOne: (id: number) => Promise<AuditLog | null>;
     deleteOlderThan: (date: Date) => Promise<number>;
     getFilterOptions: () => Promise<AuditFilterOptions>;
     buildWhere: (query: AuditLogQuery) => Record<string, unknown>;

package/dist/server/src/services/correlation.d.ts

@@ -0,0 +1,35 @@
+import { Core } from '@strapi/strapi';
+type KoaContext = Record<string, any>;
+/**
+ * Gives every request a correlation id.
+ *
+ * ASVS V7 wants each log event correlatable with the application and
+ * infrastructure logs around it. The plugin already recorded `requestId` when
+ * one arrived on a header, and the assessment found it null on ~90% of records —
+ * because the admin panel sends no such header, and neither does anything else
+ * unless a proxy in front of Strapi adds one. So nearly every record came in
+ * without.
+ *
+ * This middleware closes that: an inbound id is honoured (a proxy or a tracing
+ * system that already assigns one stays authoritative), and a missing one is
+ * minted. Either way it goes on `ctx.state.requestId`, which is what
+ * `context.ts`, `security.ts` and `access.ts` already read first, and it is
+ * echoed back as `X-Request-Id` so the client — and the proxy's access log —
+ * sees the same id the audit record carries. Correlation that only works from
+ * the inside is not correlation.
+ *
+ * Registered from the plugin's `register` lifecycle, ahead of the access
+ * middleware, for the same reason that one is: only there does it land in front
+ * of the router. See `access.ts` for the boot-order note.
+ *
+ * Records written outside a request — bootstrap, cron, a migration — still have
+ * no request id. There is no request to correlate them with.
+ */
+declare const correlationService: ({ strapi }: {
+    strapi: Core.Strapi;
+}) => {
+    createMiddleware: () => (ctx: KoaContext, next: () => Promise<unknown>) => Promise<void>;
+    register: () => void;
+    inboundId: (ctx: KoaContext) => string | null;
+};
+export default correlationService;

package/dist/server/src/services/immutability.d.ts

@@ -12,11 +12,11 @@ import { Core } from '@strapi/strapi';
  * `strapi.documents('plugin::audit-log.audit-log').update(...)` in a bootstrap
  * would otherwise succeed silently. This middleware makes that a loud failure.
  *
- * Deletion is not blocked here. It is a legitimate operation — retention runs on
- * it — and it is gated where it belongs: the only HTTP route that deletes
- * requires `plugin::audit-log.delete`. The plugin's own writes and deletes go
- * through `strapi.db.query`, below the Document Service, so this guard never
- * needs an escape hatch that an attacker could reach for.
+ * Deletion is blocked here as well since 1.2.0. The one legitimate deletion —
+ * retention — goes through `strapi.db.query`, below the Document Service, as do
+ * the plugin's own writes; so this guard never needs an escape hatch that an
+ * attacker could reach for, and a stray `strapi.documents(uid).delete()` in
+ * server code fails loudly instead of quietly removing evidence.
  */
 declare const immutabilityService: ({ strapi }: {
     strapi: Core.Strapi;

package/dist/server/src/services/index.d.ts

@@ -22,7 +22,6 @@ declare const _default: {
         flush: () => Promise<void>;
         find: (query?: import('..').AuditLogQuery) => Promise<import('..').AuditLogListResult>;
         findOne: (id: number) => Promise<import('..').AuditLog | null>;
-        deleteOne: (id: number) => Promise<import('..').AuditLog | null>;
         deleteOlderThan: (date: Date) => Promise<number>;
         getFilterOptions: () => Promise<import('..').AuditFilterOptions>;
         buildWhere: (query: import('..').AuditLogQuery) => Record<string, unknown>;
@@ -46,6 +45,17 @@ declare const _default: {
         resolve: () => import('..').AuditContext;
         runAs: <T>(override: import('./context').SourceOverride, callback: () => T) => T;
     };
+    correlation: ({ strapi }: {
+        strapi: import('@strapi/types/dist/core').Strapi;
+    }) => {
+        createMiddleware: () => (ctx: {
+            [x: string]: any;
+        }, next: () => Promise<unknown>) => Promise<void>;
+        register: () => void;
+        inboundId: (ctx: {
+            [x: string]: any;
+        }) => string | null;
+    };
     diff: ({ strapi }: {
         strapi: import('@strapi/types/dist/core').Strapi;
     }) => {
@@ -60,6 +70,16 @@ declare const _default: {
         }, next: () => Promise<unknown>) => Promise<unknown>;
         register: () => void;
     };
+    integrity: ({ strapi }: {
+        strapi: import('@strapi/types/dist/core').Strapi;
+    }) => {
+        computeHash: (record: {
+            [x: string]: any;
+        }) => string;
+        canonicalize: (value: unknown) => string;
+        verify: () => Promise<import('..').IntegrityReport>;
+        HASHED_FIELDS: readonly ["action", "contentType", "contentTypeDisplayName", "contentDocumentId", "contentId", "locale", "userId", "userEmail", "userName", "source", "outcome", "ipAddress", "userAgent", "requestId", "metadata", "changes", "before", "after", "createdAt", "prevHash"];
+    };
     retention: ({ strapi }: {
         strapi: import('@strapi/types/dist/core').Strapi;
     }) => {

package/dist/server/src/services/integrity.d.ts

@@ -0,0 +1,69 @@
+import { Core } from '@strapi/strapi';
+import { IntegrityReport } from '../types';
+type Row = Record<string, any>;
+/**
+ * The fields a record's hash covers.
+ *
+ * Everything that carries meaning, and nothing that the database owns. `id` is
+ * left out because it is not known until after the insert and the hash has to
+ * be computed before; `updatedAt` because the row is never updated; `hash`
+ * itself for the obvious reason. `createdAt` *is* included — the plugin sets it
+ * explicitly for exactly this purpose — so that back-dating a record is as
+ * detectable as changing its content.
+ */
+export declare const HASHED_FIELDS: readonly ["action", "contentType", "contentTypeDisplayName", "contentDocumentId", "contentId", "locale", "userId", "userEmail", "userName", "source", "outcome", "ipAddress", "userAgent", "requestId", "metadata", "changes", "before", "after", "createdAt", "prevHash"];
+/**
+ * JSON with keys sorted at every depth.
+ *
+ * A JSON column does not promise to hand back keys in the order they were
+ * written — PostgreSQL's `jsonb` reorders them — so hashing `JSON.stringify` of
+ * a snapshot would produce a digest that changes between the write and the
+ * read-back with nothing having changed. Sorting makes the serialisation a
+ * function of the value alone. `Date` becomes its ISO string for the same
+ * reason: the driver returns one on read, the plugin holds the other on write.
+ * `undefined` and `null` collapse together, since a JSON round-trip cannot tell
+ * them apart either.
+ */
+export declare const canonicalize: (value: unknown) => string;
+/**
+ * Tamper-evidence for the audit table, as a hash chain.
+ *
+ * ## What it proves
+ *
+ * Each record stores `hash = sha256(canonical(fields) + prevHash)` where
+ * `prevHash` is the hash of the record before it. Three things follow:
+ *
+ *  - **Edit** any hashed field of any record and its own digest no longer
+ *    matches: caught at that row.
+ *  - **Delete** a record from the middle and the next record's `prevHash` points
+ *    at a hash that no longer exists: caught at the row after the gap.
+ *  - **Insert** a record into the middle and the same thing happens, from the
+ *    other direction.
+ *
+ * What it does not prove is that the *latest* record was not removed — a chain
+ * has no way to know its own intended length. That is what forwarding to an
+ * external collector is for; the two controls cover each other's blind spot.
+ *
+ * ## The one deletion that is allowed
+ *
+ * Retention removes rows from the *start* of the chain, which leaves the oldest
+ * surviving row pointing at a predecessor that is legitimately gone. The walk
+ * treats that row as the chain's start and does not attempt to check its
+ * `prevHash`; the purge itself writes a `retention.purge` record, so the trail
+ * says when and how much was removed.
+ *
+ * ## Rows from before the chain
+ *
+ * Records written before 1.2.0 have `hash: null`. They are counted, reported as
+ * `legacy`, and never linked — not backfilled, because a hash computed today
+ * over a row written last week vouches for nothing about last week.
+ */
+declare const integrityService: ({ strapi }: {
+    strapi: Core.Strapi;
+}) => {
+    computeHash: (record: Row) => string;
+    canonicalize: (value: unknown) => string;
+    verify: () => Promise<IntegrityReport>;
+    HASHED_FIELDS: readonly ["action", "contentType", "contentTypeDisplayName", "contentDocumentId", "contentId", "locale", "userId", "userEmail", "userName", "source", "outcome", "ipAddress", "userAgent", "requestId", "metadata", "changes", "before", "after", "createdAt", "prevHash"];
+};
+export default integrityService;

package/dist/server/src/types/index.d.ts

@@ -1,11 +1,11 @@
 /**
  * Public type surface of the plugin.
  *
- * Re-exported from `strapi-plugin-audit-log/strapi-server`, so a consuming
+ * Re-exported from `strapi-cms-audit-log/strapi-server`, so a consuming
  * application can type its own code against the same shapes the plugin uses:
  *
  * ```ts
- * import type { AuditLog, AuditConfig } from 'strapi-plugin-audit-log/strapi-server';
+ * import type { AuditLog, AuditConfig } from 'strapi-cms-audit-log/strapi-server';
  * ```
  *
  * The admin panel keeps its own copies of the few shared unions in
@@ -25,8 +25,17 @@ export type AuditAction = 'create' | 'update' | 'delete' | 'publish' | 'unpublis
  * groups the authentication trail without a second column.
  */
 export type AuditSecurityAction = 'login.success' | 'login.failed' | 'logout' | 'access.denied' | 'admin.user.create' | 'admin.user.update' | 'admin.user.delete' | 'admin.role.create' | 'admin.role.update' | 'admin.role.delete' | 'admin.permission.create' | 'admin.permission.update' | 'admin.permission.delete' | 'media.create' | 'media.update' | 'media.delete' | 'media-folder.create' | 'media-folder.update' | 'media-folder.delete';
-/** Every action the plugin can write, across both families. */
-export type AuditAnyAction = AuditAction | AuditSecurityAction;
+/**
+ * Operations the plugin performs on *itself*.
+ *
+ * There is exactly one: the retention job removing expired rows. It is recorded
+ * so that the only deletion the log permits leaves a trace of itself — how many
+ * rows, older than what, when — which is what turns "we have retention" into
+ * something an assessor can check against the row count.
+ */
+export type AuditMaintenanceAction = 'retention.purge';
+/** Every action the plugin can write, across all three families. */
+export type AuditAnyAction = AuditAction | AuditSecurityAction | AuditMaintenanceAction;
 /**
  * Whether the recorded attempt succeeded.
  *
@@ -116,6 +125,15 @@ export interface AuditLog extends AuditContext {
     outcome: AuditOutcome | null;
     /** Action-specific detail — see {@link AuditMetadata}. */
     metadata: AuditMetadata | null;
+    /**
+     * SHA-256 over this record's hashed fields and `prevHash`, as lowercase hex.
+     *
+     * `null` on rows written before 1.2.0, which predate the chain. See
+     * `services/integrity.ts` for what is hashed and why.
+     */
+    hash: string | null;
+    /** The `hash` of the record written immediately before this one. */
+    prevHash: string | null;
     createdAt: string;
     updatedAt: string;
 }
@@ -151,6 +169,38 @@ export interface AuditConfig {
     forwardToLogger: boolean;
     /** Level the mirrored line is written at. */
     forwardLogLevel: AuditLogLevel;
+    /**
+     * Mint a request id for requests that arrive without one, and echo it back as
+     * `X-Request-Id`. Every request-borne record then carries a correlation id.
+     */
+    correlationId: boolean;
+}
+/** Result of walking the hash chain. */
+export interface IntegrityReport {
+    /** True when every hashed record links to its predecessor and matches its own digest. */
+    ok: boolean;
+    /** Rows examined, hashed or not. */
+    checked: number;
+    /** Rows that carry a hash and were verified. */
+    hashed: number;
+    /** Rows written before the chain existed. Counted, never linked. */
+    legacy: number;
+    /** The most recent record, which is where the next write will link from. */
+    head: {
+        id: number;
+        hash: string;
+    } | null;
+    /** The first hashed record — its `prevHash` points at something retention may have removed. */
+    start: {
+        id: number;
+    } | null;
+    /** First record that failed verification, with the reason. Absent when `ok`. */
+    brokenAt?: {
+        id: number;
+        reason: string;
+    };
+    /** When the walk ran, so a report can be dated. */
+    verifiedAt: string;
 }
 /** Levels `strapi.log` exposes that make sense for an audit mirror. */
 export type AuditLogLevel = 'debug' | 'info' | 'warn' | 'error';

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "strapi-cms-audit-log",
-  "version": "1.1.0",
-  "description": "Audit logging for Strapi v5. Content create/update/delete/publish/unpublish with field-level diffs and a per-widget before/after view of dynamic zones, plus logins, failed logins, logouts, denied requests and admin user/role/permission/media changes — all from Strapi Community Edition events. RBAC-protected admin UI, redaction, retention and structured-log forwarding.",
+  "version": "1.2.1",
+  "description": "Tamper-evident audit logging for Strapi v5. Content create/update/delete/publish/unpublish with field-level diffs and a per-widget before/after view, plus logins, failed logins, logouts, denied requests and admin user/role/permission/media changes — all from Community Edition events. Hash-chained, undeletable, correlation ids on every request, RBAC-protected admin UI, redaction, self-audited retention and structured-log forwarding. Built to pass an OWASP ASVS L2 (V7) review.",
   "keywords": [
     "strapi",
     "plugin",
@@ -16,7 +16,11 @@
     "security",
     "login",
     "siem",
-    "vapt"
+    "vapt",
+    "asvs",
+    "tamper-evident",
+    "hash-chain",
+    "integrity"
   ],
   "license": "MIT",
   "author": "Latheefwac",
@@ -96,7 +100,7 @@
     "description": "Automatic audit logging with field-level diffs and an RBAC-protected admin UI."
   },
   "engines": {
-    "node": ">=18.0.0 <=22.x.x"
+    "node": ">=18.0.0"
   },
   "publishConfig": {
     "access": "public"
@@ -106,7 +110,7 @@
     "url": "git+https://github.com/Latheefwac/strapi-cms-audit-logs.git"
   },
   "bugs": {
-    "url": "https://github.com/Latheefwac/strapi-cms-audit-logs.git/issues"
+    "url": "https://github.com/Latheefwac/strapi-cms-audit-logs/issues"
   },
-  "homepage": "https://github.com/Latheefwac/strapi-cms-audit-logs.git#readme"
+  "homepage": "https://github.com/Latheefwac/strapi-cms-audit-logs#readme"
 }