Audit Logging — Implementing Immutable Audit Trails

// Audit log entry schema
const auditSchema = {
  version: '1.0',
  eventId: uuidv4(),
  timestamp: new Date().toISOString(),
  type: 'scan.initiated',
  actor: {
    id: 'user_123',
    type: 'user', // user, service, system
    ip: '203.0.113.42',
    sessionId: 'sess_abc'
  },
  action: {
    name: 'scan.create',
    resource: { type: 'scan', id: 'scan_456' },
    details: { fileSize: 1048576, scanType: 'deep' }
  },
  result: 'success',  // success, failure, denied
  reason: null,
  context: {
    correlationId: 'corr_xyz',
    tenantId: 'tenant_789'
  }
};

// Tamper-evident audit chain
class AuditLogger {
  constructor(storage) {
    this.storage = storage;
    this.lastHash = null;
  }

  async log(event) {
    const entry = {
      ...event,
      previousHash: this.lastHash,
      hash: this.calculateHash(event, this.lastHash)
    };

    await this.storage.append(entry);
    this.lastHash = entry.hash;

    // Also write to separate audit index
    await this.storage.index('audit', entry.eventId, entry);

    return entry;
  }

  calculateHash(event, previousHash) {
    const data = JSON.stringify({ event, previousHash });
    return crypto.createHash('sha256').update(data).digest('hex');
  }

  async verifyIntegrity() {
    const entries = await this.storage.getAll();
    let previousHash = null;

    for (const entry of entries) {
      const expectedHash = this.calculateHash(entry, previousHash);
      if (entry.hash !== expectedHash) {
        return { valid: false, brokenAt: entry.eventId };
      }
      previousHash = entry.hash;
    }

    return { valid: true, count: entries.length };
  }
}