university-core 0.1.0__tar.gz

university_core-0.1.0/.gitignore

@@ -0,0 +1,39 @@
+# Python
+__pycache__/
+*.py[cod]
+*.egg-info/
+.eggs/
+build/
+dist/
+.venv/
+venv/
+.nox/
+.tox/
+.pytest_cache/
+.mypy_cache/
+.ruff_cache/
+.coverage
+coverage.xml
+htmlcov/
+
+# Django
+*.sqlite3
+# Local user uploads (never the university.media source package).
+/media/
+/private-media/
+example_project/media/
+example_project/private-media/
+staticfiles/
+
+# Secrets — never commit
+.env
+.env.*
+!.env.example
+*.pem
+*.key
+
+# Editors / OS
+.idea/
+.vscode/
+.DS_Store
+Thumbs.db

university_core-0.1.0/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) [YEAR] [COPYRIGHT HOLDER]
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

university_core-0.1.0/PKG-INFO

@@ -0,0 +1,109 @@
+Metadata-Version: 2.5
+Name: university-core
+Version: 0.1.0
+Summary: University Core: the secure, modular foundation of an African campus platform built on Django REST Framework.
+Project-URL: Homepage, https://github.com/NzeStan/University
+Project-URL: Documentation, https://github.com/NzeStan/University/tree/main/docs
+Project-URL: Source, https://github.com/NzeStan/University
+Project-URL: Changelog, https://github.com/NzeStan/University/blob/main/CHANGELOG.md
+Project-URL: Issues, https://github.com/NzeStan/University/issues
+Author-email: Ifeanyi Stanley <nnamaniifeanyi10@gmail.com>
+License-Expression: MIT
+License-File: LICENSE
+Keywords: africa,campus,django,drf,modular,nigeria,platform,rest,university
+Classifier: Development Status :: 3 - Alpha
+Classifier: Environment :: Web Environment
+Classifier: Framework :: Django
+Classifier: Framework :: Django :: 5.2
+Classifier: Framework :: Django :: 6.0
+Classifier: Framework :: Django :: 6.1
+Classifier: Intended Audience :: Developers
+Classifier: Operating System :: OS Independent
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3 :: Only
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Programming Language :: Python :: 3.14
+Classifier: Topic :: Internet :: WWW/HTTP :: Dynamic Content
+Classifier: Topic :: Security
+Classifier: Typing :: Typed
+Requires-Python: >=3.11
+Requires-Dist: django<6.2,>=5.2
+Requires-Dist: djangorestframework<4,>=3.15
+Requires-Dist: pyjwt<3,>=2.8
+Provides-Extra: all
+Requires-Dist: argon2-cffi>=23.1; extra == 'all'
+Requires-Dist: celery>=5.3; extra == 'all'
+Requires-Dist: django-cors-headers>=4.3; extra == 'all'
+Requires-Dist: drf-spectacular>=0.27; extra == 'all'
+Requires-Dist: pillow>=10.0; extra == 'all'
+Requires-Dist: psycopg[binary]>=3.1; extra == 'all'
+Requires-Dist: pyjwt[crypto]<3,>=2.8; extra == 'all'
+Requires-Dist: redis>=5.0; extra == 'all'
+Provides-Extra: argon2
+Requires-Dist: argon2-cffi>=23.1; extra == 'argon2'
+Provides-Extra: celery
+Requires-Dist: celery>=5.3; extra == 'celery'
+Provides-Extra: cors
+Requires-Dist: django-cors-headers>=4.3; extra == 'cors'
+Provides-Extra: images
+Requires-Dist: pillow>=10.0; extra == 'images'
+Provides-Extra: oidc
+Requires-Dist: pyjwt[crypto]<3,>=2.8; extra == 'oidc'
+Provides-Extra: openapi
+Requires-Dist: drf-spectacular>=0.27; extra == 'openapi'
+Provides-Extra: postgres
+Requires-Dist: psycopg[binary]>=3.1; extra == 'postgres'
+Provides-Extra: redis
+Requires-Dist: redis>=5.0; extra == 'redis'
+Provides-Extra: test
+Requires-Dist: drf-spectacular>=0.27; extra == 'test'
+Requires-Dist: pytest-cov>=5; extra == 'test'
+Requires-Dist: pytest-django>=4.8; extra == 'test'
+Requires-Dist: pytest>=8; extra == 'test'
+Description-Content-Type: text/markdown
+
+# university-core
+
+**The secure, modular foundation of the University platform**: a Django REST Framework
+platform for African campus ecosystems (Nigeria-first, Africa-ready).
+
+`university-core` is the *level one* package. It provides five Django apps that nearly every
+installation needs:
+
+| App | Provides |
+| --- | --- |
+| `university.core` | UUID base models, soft deletion, namespaced settings, module registry and plugins, event bus, hooks, task abstraction, provider adapters (email, SMS, search, anti-spam), distributed rate limiting, idempotency, signed webhooks, secure uploads, health checks, structured logging, versioned API infrastructure, system checks, data retention |
+| `university.users` | Swappable custom user model, accounts, verification, privacy/notification/security settings, consent, data export, soft deletion with anonymisation |
+| `university.security` | JWT access tokens + rotating refresh tokens with reuse detection, sessions/devices, scoped API keys, lockout, suspicious-login alerts, OTP, MFA, passwordless, OIDC |
+| `university.permissions` | Scoped RBAC with hierarchy resolution and privilege-escalation protection |
+| `university.audit` | Append-only, HMAC-signed audit log |
+
+Optional features come from *level two* packages such as
+[`university-institution`](https://pypi.org/project/university-institution/).
+
+## Install
+
+```bash
+pip install "university-core[postgres,redis,celery,openapi,argon2]"
+```
+
+```python
+from university.core import CORE_APPS
+from university.core.settings import recommended_middleware, rest_framework_settings
+
+INSTALLED_APPS = [..., "rest_framework", *CORE_APPS]
+MIDDLEWARE = recommended_middleware()
+REST_FRAMEWORK = rest_framework_settings()
+AUTH_USER_MODEL = "university_users.User"
+AUTHENTICATION_BACKENDS = ["university.users.backends.UniversityAuthBackend"]
+```
+
+```python
+urlpatterns = [path("", include("university.core.urls"))]  # /health/, /api/v1/, /api/docs/
+```
+
+Supported versions: Python 3.11–3.14; Django 5.2, 6.0, 6.1; DRF 3.15+.
+
+Documentation, security policy and source: https://github.com/NzeStan/University

university_core-0.1.0/README.md

@@ -0,0 +1,43 @@
+# university-core
+
+**The secure, modular foundation of the University platform**: a Django REST Framework
+platform for African campus ecosystems (Nigeria-first, Africa-ready).
+
+`university-core` is the *level one* package. It provides five Django apps that nearly every
+installation needs:
+
+| App | Provides |
+| --- | --- |
+| `university.core` | UUID base models, soft deletion, namespaced settings, module registry and plugins, event bus, hooks, task abstraction, provider adapters (email, SMS, search, anti-spam), distributed rate limiting, idempotency, signed webhooks, secure uploads, health checks, structured logging, versioned API infrastructure, system checks, data retention |
+| `university.users` | Swappable custom user model, accounts, verification, privacy/notification/security settings, consent, data export, soft deletion with anonymisation |
+| `university.security` | JWT access tokens + rotating refresh tokens with reuse detection, sessions/devices, scoped API keys, lockout, suspicious-login alerts, OTP, MFA, passwordless, OIDC |
+| `university.permissions` | Scoped RBAC with hierarchy resolution and privilege-escalation protection |
+| `university.audit` | Append-only, HMAC-signed audit log |
+
+Optional features come from *level two* packages such as
+[`university-institution`](https://pypi.org/project/university-institution/).
+
+## Install
+
+```bash
+pip install "university-core[postgres,redis,celery,openapi,argon2]"
+```
+
+```python
+from university.core import CORE_APPS
+from university.core.settings import recommended_middleware, rest_framework_settings
+
+INSTALLED_APPS = [..., "rest_framework", *CORE_APPS]
+MIDDLEWARE = recommended_middleware()
+REST_FRAMEWORK = rest_framework_settings()
+AUTH_USER_MODEL = "university_users.User"
+AUTHENTICATION_BACKENDS = ["university.users.backends.UniversityAuthBackend"]
+```
+
+```python
+urlpatterns = [path("", include("university.core.urls"))]  # /health/, /api/v1/, /api/docs/
+```
+
+Supported versions: Python 3.11–3.14; Django 5.2, 6.0, 6.1; DRF 3.15+.
+
+Documentation, security policy and source: https://github.com/NzeStan/University

university_core-0.1.0/pyproject.toml

@@ -0,0 +1,81 @@
+[build-system]
+requires = ["hatchling>=1.24"]
+build-backend = "hatchling.build"
+
+[project]
+name = "university-core"
+dynamic = ["version"]
+description = "University Core: the secure, modular foundation of an African campus platform built on Django REST Framework."
+readme = "README.md"
+license = "MIT"
+license-files = ["LICENSE"]
+requires-python = ">=3.11"
+authors = [{ name = "Ifeanyi Stanley", email = "nnamaniifeanyi10@gmail.com" }]
+keywords = ["django", "drf", "rest", "platform", "campus", "university", "africa", "nigeria", "modular"]
+classifiers = [
+    "Development Status :: 3 - Alpha",
+    "Environment :: Web Environment",
+    "Framework :: Django",
+    "Framework :: Django :: 5.2",
+    "Framework :: Django :: 6.0",
+    "Framework :: Django :: 6.1",
+    "Intended Audience :: Developers",
+    "Operating System :: OS Independent",
+    "Programming Language :: Python :: 3",
+    "Programming Language :: Python :: 3 :: Only",
+    "Programming Language :: Python :: 3.11",
+    "Programming Language :: Python :: 3.12",
+    "Programming Language :: Python :: 3.13",
+    "Programming Language :: Python :: 3.14",
+    "Topic :: Internet :: WWW/HTTP :: Dynamic Content",
+    "Topic :: Security",
+    "Typing :: Typed",
+]
+dependencies = [
+    "Django>=5.2,<6.2",
+    "djangorestframework>=3.15,<4",
+    "PyJWT>=2.8,<3",
+]
+
+[project.optional-dependencies]
+postgres = ["psycopg[binary]>=3.1"]
+redis = ["redis>=5.0"]
+celery = ["celery>=5.3"]
+openapi = ["drf-spectacular>=0.27"]
+argon2 = ["argon2-cffi>=23.1"]
+oidc = ["PyJWT[crypto]>=2.8,<3"]
+images = ["Pillow>=10.0"]
+cors = ["django-cors-headers>=4.3"]
+all = ["university-core[postgres,redis,celery,openapi,argon2,oidc,images,cors]"]
+test = [
+    "pytest>=8",
+    "pytest-django>=4.8",
+    "pytest-cov>=5",
+    "drf-spectacular>=0.27",
+]
+
+[project.urls]
+Homepage = "https://github.com/NzeStan/University"
+Documentation = "https://github.com/NzeStan/University/tree/main/docs"
+Source = "https://github.com/NzeStan/University"
+Changelog = "https://github.com/NzeStan/University/blob/main/CHANGELOG.md"
+Issues = "https://github.com/NzeStan/University/issues"
+
+[tool.hatch.version]
+path = "src/university/core/__init__.py"
+
+[tool.hatch.build.targets.wheel]
+# PEP 420 namespace package: there is deliberately no src/university/__init__.py
+packages = ["src/university"]
+exclude = ["**/__pycache__"]
+
+[tool.hatch.build.targets.sdist]
+include = ["src/university", "tests", "README.md", "LICENSE", "pyproject.toml"]
+
+[tool.pytest.ini_options]
+DJANGO_SETTINGS_MODULE = "tests.settings"
+pythonpath = ["."]
+testpaths = ["tests"]
+addopts = "-ra --strict-markers"
+markers = ["security: security regression tests", "slow: slow tests"]
+filterwarnings = ["error::RuntimeWarning"]

university_core-0.1.0/src/university/audit/__init__.py

@@ -0,0 +1,9 @@
+"""Append-only, tamper-evident audit logging for security-sensitive actions.
+
+Public API::
+
+    from university.audit.services import record
+    from university.audit.actions import AuditAction
+
+    record(AuditAction.LOGIN_SUCCEEDED, actor=user, target=session)
+"""

university_core-0.1.0/src/university/audit/actions.py

@@ -0,0 +1,80 @@
+"""Audit action names used by University Core.
+
+Modules define their own constants following the same ``<area>.<subject>.<verb>``
+convention (e.g. ``anonymous.identity.revealed``). The first segment is the
+default audit *category*.
+"""
+
+from __future__ import annotations
+
+
+class AuditCategory:
+    AUTH = "auth"
+    SECURITY = "security"
+    ACCOUNT = "account"
+    PRIVACY = "privacy"
+    PERMISSION = "permission"
+    MODERATION = "moderation"
+    ADMIN = "admin"
+    SYSTEM = "system"
+
+
+class AuditOutcome:
+    SUCCESS = "success"
+    FAILURE = "failure"
+    DENIED = "denied"
+
+
+class AuditAction:
+    # Authentication
+    LOGIN_SUCCEEDED = "auth.login.succeeded"
+    LOGIN_FAILED = "auth.login.failed"
+    LOGIN_LOCKED = "auth.login.locked"
+    LOGIN_MFA_CHALLENGED = "auth.login.mfa_challenged"
+    LOGOUT = "auth.logout"
+    TOKEN_REFRESHED = "auth.token.refreshed"
+    SESSION_REVOKED = "auth.session.revoked"
+    SESSIONS_REVOKED = "auth.sessions.revoked"
+    EXTERNAL_IDENTITY_LINKED = "auth.external_identity.linked"
+    EXTERNAL_IDENTITY_UNLINKED = "auth.external_identity.unlinked"
+
+    # Security
+    REFRESH_TOKEN_REUSED = "security.refresh_token.reused"
+    SUSPICIOUS_LOGIN = "security.login.suspicious"
+    API_KEY_CREATED = "security.api_key.created"
+    API_KEY_REVOKED = "security.api_key.revoked"
+    MFA_ENABLED = "security.mfa.enabled"
+    MFA_DISABLED = "security.mfa.disabled"
+    OTP_LOCKED = "security.otp.locked"
+
+    # Account
+    ACCOUNT_REGISTERED = "account.registered"
+    ACCOUNT_REGISTRATION_DUPLICATE = "account.registration.duplicate"
+    EMAIL_VERIFIED = "account.email.verified"
+    EMAIL_CHANGE_REQUESTED = "account.email.change_requested"
+    EMAIL_CHANGED = "account.email.changed"
+    PHONE_VERIFIED = "account.phone.verified"
+    PHONE_REMOVED = "account.phone.removed"
+    PASSWORD_CHANGED = "account.password.changed"
+    PASSWORD_RESET_REQUESTED = "account.password.reset_requested"
+    PASSWORD_RESET_COMPLETED = "account.password.reset_completed"
+    ACCOUNT_SUSPENDED = "account.suspended"
+    ACCOUNT_BANNED = "account.banned"
+    ACCOUNT_REACTIVATED = "account.reactivated"
+    ACCOUNT_DELETED = "account.deleted"
+    ACCOUNT_RESTORED = "account.restored"
+    ACCOUNT_PURGED = "account.purged"
+
+    # Privacy
+    DATA_EXPORTED = "privacy.data.exported"
+    CONSENT_RECORDED = "privacy.consent.recorded"
+
+    # Permissions
+    ROLE_ASSIGNED = "permission.role.assigned"
+    ROLE_REVOKED = "permission.role.revoked"
+    ROLE_CREATED = "permission.role.created"
+    ROLE_UPDATED = "permission.role.updated"
+    PERMISSION_DENIED = "permission.denied"
+
+    # Audit
+    AUDIT_LOG_VIEWED = "security.audit_log.viewed"

university_core-0.1.0/src/university/audit/admin.py

@@ -0,0 +1,39 @@
+from __future__ import annotations
+
+from typing import Any
+
+from django.contrib import admin
+
+from university.audit.models import AuditLog
+
+
+class SecurityCategoryFilter(admin.SimpleListFilter):
+    title = "security events"
+    parameter_name = "security"
+
+    def lookups(self, request: Any, model_admin: Any) -> list[tuple[str, str]]:
+        return [("1", "Security & authentication only")]
+
+    def queryset(self, request: Any, queryset: Any) -> Any:
+        if self.value() == "1":
+            return queryset.filter(category__in=["auth", "security"])
+        return queryset
+
+
+@admin.register(AuditLog)
+class AuditLogAdmin(admin.ModelAdmin):
+    list_display = ("created_at", "action", "outcome", "actor_ref", "target_type", "target_id", "ip_address")
+    list_filter = (SecurityCategoryFilter, "category", "outcome", "action")
+    search_fields = ("action", "actor_ref", "target_id", "request_id")
+    date_hierarchy = "created_at"
+    readonly_fields = [f.name for f in AuditLog._meta.fields]
+    show_full_result_count = False
+
+    def has_add_permission(self, request: Any) -> bool:
+        return False
+
+    def has_change_permission(self, request: Any, obj: Any = None) -> bool:
+        return False
+
+    def has_delete_permission(self, request: Any, obj: Any = None) -> bool:
+        return False

university_core-0.1.0/src/university/audit/api/v1/serializers.py

@@ -0,0 +1,49 @@
+from __future__ import annotations
+
+from rest_framework import serializers
+
+from university.audit.models import AuditLog
+from university.core.api.serializers import StrictModelSerializer
+
+
+class AuditLogSerializer(StrictModelSerializer):
+    class Meta:
+        model = AuditLog
+        fields = (
+            "id",
+            "created_at",
+            "action",
+            "category",
+            "outcome",
+            "actor_ref",
+            "target_type",
+            "target_id",
+            "scope_type",
+            "scope_id",
+            "ip_address",
+            "user_agent",
+            "request_id",
+            "metadata",
+            "entry_hash",
+        )
+        read_only_fields = fields
+
+
+class ActivitySerializer(StrictModelSerializer):
+    """A user's own activity — no internal metadata."""
+
+    class Meta:
+        model = AuditLog
+        fields = ("id", "created_at", "action", "outcome", "ip_address", "user_agent")
+        read_only_fields = fields
+
+
+class AuditFilterSerializer(serializers.Serializer):
+    action = serializers.CharField(required=False)
+    category = serializers.CharField(required=False)
+    outcome = serializers.CharField(required=False)
+    actor = serializers.UUIDField(required=False)
+    target_type = serializers.CharField(required=False)
+    target_id = serializers.CharField(required=False)
+    since = serializers.DateTimeField(required=False)
+    until = serializers.DateTimeField(required=False)

university_core-0.1.0/src/university/audit/api/v1/urls.py

@@ -0,0 +1,12 @@
+from __future__ import annotations
+
+from django.urls import path
+
+from university.audit.api.v1 import views
+
+app_name = "audit"
+
+urlpatterns = [
+    path("audit/logs/", views.AuditLogListView.as_view(), name="log-list"),
+    path("me/activity/", views.MyActivityView.as_view(), name="my-activity"),
+]

university_core-0.1.0/src/university/audit/api/v1/views.py

@@ -0,0 +1,41 @@
+from __future__ import annotations
+
+from typing import Any
+
+from rest_framework import generics, permissions
+
+from university.audit.api.v1.serializers import ActivitySerializer, AuditLogSerializer
+from university.audit.selectors import activity_for_user, filter_audit_log
+from university.core.api.pagination import CursorPagination
+from university.core.api.schema import OpenApiParameter, extend_schema
+from university.permissions.drf import require_permission
+
+
+class AuditLogListView(generics.ListAPIView):
+    """Platform audit log (requires ``audit.view``)."""
+
+    serializer_class = AuditLogSerializer
+    permission_classes = [permissions.IsAuthenticated, require_permission("audit.view")]
+
+    @extend_schema(
+        parameters=[
+            OpenApiParameter(name, str, required=False)
+            for name in ("action", "category", "outcome", "actor", "target_type", "target_id", "since", "until")
+        ]
+    )
+    def get(self, request: Any, *args: Any, **kwargs: Any) -> Any:
+        return super().get(request, *args, **kwargs)
+
+    def get_queryset(self) -> Any:
+        return filter_audit_log(self.request.query_params)
+
+
+class MyActivityView(generics.ListAPIView):
+    """The authenticated user's own security activity."""
+
+    serializer_class = ActivitySerializer
+    permission_classes = [permissions.IsAuthenticated]
+    pagination_class = CursorPagination
+
+    def get_queryset(self) -> Any:
+        return activity_for_user(self.request.user)

university_core-0.1.0/src/university/audit/apps.py

@@ -0,0 +1,76 @@
+from __future__ import annotations
+
+from collections.abc import Iterable
+from typing import Any
+
+from django.utils.translation import gettext_lazy as _
+
+from university.core import __version__
+from university.core.declarations import PermissionDef, RetentionPolicy, RoleDef
+from university.core.hooks import Hook, HookRegistry
+from university.core.modules import UniversityAppConfig
+
+
+class AuditConfig(UniversityAppConfig):
+    name = "university.audit"
+    label = "university_audit"
+    verbose_name = _("University Audit")
+    module_name = "audit"
+    module_version = __version__
+    module_requires = ("core",)
+    api_urlconfs = {"v1": "university.audit.api.v1.urls"}
+
+    def get_permissions(self) -> Iterable[PermissionDef]:
+        return [
+            PermissionDef("audit.view", "View the platform audit log.", sensitive=True),
+            PermissionDef("audit.verify", "Verify audit log integrity."),
+        ]
+
+    def get_roles(self) -> Iterable[RoleDef]:
+        return [
+            RoleDef(
+                key="security_auditor",
+                name="Security auditor",
+                scope_type="platform",
+                permissions=("audit.*",),
+                description="Read-only access to the audit log.",
+            )
+        ]
+
+    def get_retention_policies(self) -> Iterable[RetentionPolicy]:
+        from university.audit.models import AuditLog
+        from university.core.retention import cutoff_days
+
+        def purge(cutoff: Any, dry_run: bool) -> int:
+            qs = AuditLog.objects.filter(created_at__lt=cutoff)
+            return qs.count() if dry_run else qs._purge()
+
+        return [
+            RetentionPolicy(
+                name="audit.log",
+                description="Audit log entries.",
+                setting="RETENTION.AUDIT_LOG_DAYS",
+                cutoff=cutoff_days("AUDIT_LOG_DAYS"),
+                purge=purge,
+            )
+        ]
+
+    def register_hooks(self, hooks: HookRegistry) -> None:
+        hooks.register(Hook.USER_EXPORT_DATA, export_user_activity)
+
+
+def export_user_activity(user: Any) -> dict[str, Any]:
+    from university.audit.selectors import activity_for_user
+
+    return {
+        "security_activity": [
+            {
+                "action": e.action,
+                "outcome": e.outcome,
+                "created_at": e.created_at.isoformat(),
+                "ip_address": e.ip_address,
+                "user_agent": e.user_agent,
+            }
+            for e in activity_for_user(user)[:1000]
+        ]
+    }

university_core-0.1.0/src/university/audit/management/commands/university_verify_audit.py

@@ -0,0 +1,25 @@
+from __future__ import annotations
+
+from typing import Any
+
+from django.core.management.base import BaseCommand, CommandError
+
+from university.audit.services import verify_entries
+
+
+class Command(BaseCommand):
+    help = "Verify the integrity of the audit log (per-entry HMACs and, if enabled, the hash chain)."
+
+    def add_arguments(self, parser: Any) -> None:
+        parser.add_argument("--chain", action="store_true", help="Also verify the hash chain.")
+        parser.add_argument("--limit", type=int, default=50, help="Maximum issues to print.")
+
+    def handle(self, *args: Any, **options: Any) -> None:
+        issues = 0
+        for issue in verify_entries(check_chain=options["chain"] or None):
+            issues += 1
+            if issues <= options["limit"]:
+                self.stderr.write(self.style.ERROR(f"{issue.entry_id}: {issue.problem}"))
+        if issues:
+            raise CommandError(f"Audit log verification failed: {issues} issue(s).")
+        self.stdout.write(self.style.SUCCESS("Audit log verified: no issues found."))