mirror of
https://github.com/block/buzz.git
synced 2026-08-18 06:50:31 +02:00
tlongwell-blockandDawn
81b064fb19
Convert the audit log from one global hash chain to an independent
per-community chain, conforming to the frozen Lane-0 0001 schema.
- Collapse to one DDL: delete schema.rs / AUDIT_SCHEMA_SQL and their
lib.rs exports. The 0001 migration is the sole owner of audit_log.
- Chain shape: PK (community_id, seq), seq monotonic per-community,
UNIQUE (community_id, hash); hash/prev_hash/actor_pubkey as BYTEA;
object_id TEXT generalizes the old event_id/channel_id; detail JSONB.
- community_id is folded into the SHA-256 (leads the hash) so a row
cannot be lifted out of one community's chain and re-verified in
another. Per-community advisory lock — communities never serialize
each other's audit writes (no throughput bottleneck, no timing oracle).
- verify_chain / get_entries scoped to a CommunityId.
- Error variants carry only per-community seq (meaningless without its
chain) — never community_id, hash values, or raw action strings.
- AUTH-body protection becomes caller discipline + the AuditAction enum
(AuthSuccess/AuthFailure carry outcome metadata, never the token);
the dropped event_kind column is not persisted.
13/13 green (7 unit + 6 Postgres isolation). Adversarial: disabling the
community_id line in compute_hash turns community_id_is_part_of_identity
RED (two communities hash identically); restored to green.
(cherry picked from commit ba11d66636)
Co-authored-by: Dawn <c6237ef84fa537c78dcee78efd2d4e59f728859c7f194da42ac51ededfa0be05@sprout-oss.stage.blox.sqprod.co>
Signed-off-by: tlongwell-block <109685178+tlongwell-block@users.noreply.github.com>