71 lines
2.6 KiB
Python
71 lines
2.6 KiB
Python
"""
|
|
Manipulationssicheres, hash-verkettetes Audit-Log (siehe Konzept 4.7 / 6.1).
|
|
|
|
Jeder Eintrag verkettet sich kryptographisch mit seinem Vorgaenger:
|
|
entry_hash = sha256(prev_hash || ts || event_type || details_json)
|
|
|
|
Nachtraegliches Aendern oder Herausloeschen eines Eintrags bricht die Kette
|
|
ab dieser Stelle - erkennbar durch verify_chain(). Zusaetzlich verhindern
|
|
DB-Trigger (0001_initial.sql) UPDATE/DELETE auf Anwendungsebene.
|
|
"""
|
|
from __future__ import annotations
|
|
|
|
import hashlib
|
|
import json
|
|
from datetime import datetime, timezone
|
|
from typing import Any
|
|
|
|
import aiosqlite
|
|
|
|
GENESIS_HASH = "0" * 64
|
|
|
|
|
|
def _entry_hash(prev_hash: str, ts: str, event_type: str, details_json: str) -> str:
|
|
payload = f"{prev_hash}|{ts}|{event_type}|{details_json}".encode()
|
|
return hashlib.sha256(payload).hexdigest()
|
|
|
|
|
|
async def write_audit_event(
|
|
conn: aiosqlite.Connection,
|
|
*,
|
|
event_type: str,
|
|
user_id: int | None,
|
|
client_ip: str | None,
|
|
details: dict[str, Any],
|
|
) -> None:
|
|
"""Schreibt einen Audit-Eintrag; haengt ihn an die bestehende Hash-Chain an.
|
|
|
|
Muss innerhalb derselben Transaktion wie die fachliche Aktion laufen (oder
|
|
zumindest unmittelbar danach), damit kein Ereignis unauditiert bleibt.
|
|
"""
|
|
cursor = await conn.execute("SELECT entry_hash FROM audit_log ORDER BY id DESC LIMIT 1")
|
|
row = await cursor.fetchone()
|
|
prev_hash = row[0] if row else GENESIS_HASH
|
|
|
|
ts = datetime.now(timezone.utc).strftime("%Y-%m-%dT%H:%M:%S.%fZ")
|
|
details_json = json.dumps(details, sort_keys=True, ensure_ascii=False)
|
|
entry_hash = _entry_hash(prev_hash, ts, event_type, details_json)
|
|
|
|
await conn.execute(
|
|
"INSERT INTO audit_log (ts, user_id, client_ip, event_type, details_json, prev_hash, entry_hash) "
|
|
"VALUES (?, ?, ?, ?, ?, ?, ?)",
|
|
(ts, user_id, client_ip, event_type, details_json, prev_hash, entry_hash),
|
|
)
|
|
|
|
|
|
async def verify_chain(conn: aiosqlite.Connection) -> tuple[bool, int | None]:
|
|
"""Prueft die gesamte Audit-Log-Kette. Rueckgabe: (intakt?, erste kaputte id)."""
|
|
prev_hash = GENESIS_HASH
|
|
cursor = await conn.execute(
|
|
"SELECT id, ts, event_type, details_json, prev_hash, entry_hash FROM audit_log ORDER BY id ASC"
|
|
)
|
|
async for row in cursor:
|
|
entry_id, ts, event_type, details_json, stored_prev, stored_entry = row
|
|
if stored_prev != prev_hash:
|
|
return False, entry_id
|
|
expected = _entry_hash(prev_hash, ts, event_type, details_json)
|
|
if expected != stored_entry:
|
|
return False, entry_id
|
|
prev_hash = stored_entry
|
|
return True, None
|