| name | audit-verify |
| description | Verify the integrity of ActiveCAMT's append-only audit-log hash chain (tamper evidence) by running AuditService.verifyChainIntegrity — via the existing GET /api/admin/audit-verify route or a local script. Use before a deploy/migration that touches audit_logs or users, periodically, or on any suspicion of tampering. Read-only; a broken chain is a security incident, never "repaired". |
Audit Verify (ActiveCAMT)
audit_logs is an append-only SHA256 hash chain: each row's rowHash folds in the
previous row's hash (prevHash), serialized by an advisory lock so concurrent appends
can't fork it. Any insert, delete, modification, or reorder of a historical row breaks
the chain and is detectable. AuditService.verifyChainIntegrity()
(src/modules/audit/audit.service.ts) walks the chain and reports the first break.
Today it's only run by hand — this skill operationalizes it.
How to run
- Preferred: there's already an endpoint —
GET /api/admin/audit-verify (src/app/api/admin/audit-verify/route.ts). Hit it authenticated as super_admin/admin and read the ChainVerifyResult (ok, and if not, the first offending row).
- Local / CI: run
verifyChainIntegrity() against the target DB via a small tsx script. Rehearse against the local DB (.env.local, see /db-local); only point at prod read-only and deliberately.
When to run
- Before/after a migration or deploy that touches
audit_logs or users (user deletion interacts with the dropped audit FKs — migration step 27).
- Periodically as a tamper check, and immediately on any suspicion of tampering.
- Note: it can't be a
/schedule cron easily if it requires an authenticated session — drive it via the route in an interactive/CI context.
Hard rules
- Read-only. This only verifies; it never writes.
- Never "fix" a broken chain. Rewriting or back-filling
audit_logs to make it validate defeats the entire tamper-evidence guarantee. A break = treat as a security incident: capture the first offending row id, stop, and surface it to the user. Do not mutate audit rows.
- Do not export or include audit-log contents in any data export (see
/pdpa-export).
Output
ok: true, or ok: false with the first broken row id and the surrounding context, plus an explicit "treat as a security incident — not auto-repairing" note when broken.
