Compliance Logging — Meeting Regulatory Requirements with Logs

// Compliance log manager
class ComplianceLogManager {
  constructor() {
    this.retention = {
      gdpr: { duration: '365d', anonymizeAfter: '180d' },
      soc2: { duration: '365d', immutable: true },
      hipaa: { duration: '6years', immutable: true, encrypt: true },
      pci:  { duration: '365d', immutable: true }
    };
  }

  async logComplianceEvent(event) {
    const enriched = {
      ...event,
      complianceId: uuidv4(),
      loggedAt: new Date().toISOString(),
      environment: config.environment,
      retention: this.getRetentionFor(event.regulation)
    };

    if (enriched.retention.immutable) {
      enriched.hash = this.calculateHash(enriched);
    }

    if (enriched.retention.encrypt) {
      enriched.data = await this.encryptField(enriched.data);
    }

    await this.writeToImmutableStorage(enriched);
    return enriched.complianceId;
  }

  calculateHash(entry) {
    const relevant = {
      complianceId: entry.complianceId,
      type: entry.type,
      actor: entry.actor,
      action: entry.action,
      timestamp: entry.timestamp
    };
    return crypto.createHash('sha256').update(JSON.stringify(relevant)).digest('hex');
  }

  async writeToImmutableStorage(entry) {
    // Write to append-only storage (e.g., AWS S3 Object Lock)
    const key = `compliance/${entry.regulation}/${entry.loggedAt.slice(0, 10)}/${entry.complianceId}.json`;
    await s3.putObject({
      Bucket: 'scanapp-compliance-logs',
      Key: key,
      Body: JSON.stringify(entry),
      ObjectLockMode: 'COMPLIANCE',
      ObjectLockRetainUntilDate: this.calculateRetainUntil(entry.retention.duration)
    });
    return key;
  }

  async generateComplianceReport(regulation, startDate, endDate) {
    const prefix = `compliance/${regulation}/`;
    const objects = await s3.listObjects({ Bucket: 'scanapp-compliance-logs', Prefix: prefix });
    const logs = [];

    for (const obj of objects.Contents || []) {
      if (obj.Key >= `${prefix}${startDate}` && obj.Key <= `${prefix}${endDate}`) {
        const data = await s3.getObject({ Bucket: 'scanapp-compliance-logs', Key: obj.Key });
        logs.push(JSON.parse(data.Body.toString()));
      }
    }

    return {
      regulation,
      period: { startDate, endDate },
      totalEvents: logs.length,
      events: logs,
      generatedAt: new Date().toISOString()
    };
  }
}