vti-common 0.57.0

Shared server-side infrastructure for VTA and VTC services
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78

//! Audit log infrastructure — versioned envelope with HMAC-hashed
//! actor / target identifiers and an in-store key history that
//! survives right-to-be-forgotten rotations.
//!
//! See spec §11 of `docs/05-design-notes/vtc-mvp.md` for the design
//! rationale.
//!
//! ## Module layout
//!
//! - [`event`] — the tagged [`AuditEvent`] enum and its per-variant
//!   data structs. Ships the Phase-0 vocabulary
//!   (`CommunityInstalled`, `EmergencyBootstrapInvoked`,
//!   `AdminPasskey{Registered,Revoked}`, `Config{Changed,Reloaded}`,
//!   `RestartRequested`, `CommunityProfileUpdated`,
//!   `AuditKeyRotated`). Phase-1+ variants land alongside their
//!   owning features.
//! - [`envelope`] — the [`AuditEnvelope`] wire shape (event id,
//!   version, timestamps, HMAC-hashed + plaintext identifier pairs).
//! - [`key_store`] — the [`AuditKeyStore`] managing per-community
//!   `audit_key` history: HKDF-derived initial, fresh-random
//!   rotations, indefinite retention so pre-rotation hashes stay
//!   verifiable during compliance investigations.
//! - [`writer`] — [`AuditWriter`] takes events + identifiers, hashes
//!   the identifiers with the active key, and persists the envelope
//!   into an `audit` keyspace.

pub mod checkpoint;
pub mod envelope;
pub mod event;
pub mod key_store;
pub mod writer;

pub use checkpoint::{
    AuditCheckpoint, CheckpointAudit, CheckpointBreak, CheckpointClaim, genesis_claim,
    verify_checkpoints,
};
pub use envelope::{
    AuditEnvelope, ChainBreak, ChainVerifier, EVENT_VERSION, GENESIS_HASH, SCHEMA_VERSION,
    verify_chain,
};
pub use event::{
    AclChangeData, AclKeyRotatedData, AclMigratedData, AclRevokedData, AdminActionBurstData,
    AdminActionEffectData, AdminConsoleKeyData, AdminInviteData, AdminPasskeyData,
    AdminPromotedData, AdminRoleChangeData, AdminUiServedData, AuditEvent, AuditKeyRotatedData,
    AuditSeverity, AuthSteppedUpData, AuthorityReducedUnopposedData, BackupData, BoardChangedData,
    BreakGlassAclData, CapabilityModuleChangedData, CommunityBrandingUpdatedData,
    CommunityDidLogInstalledData, CommunityInstalledData, CommunityJoinDiscoveryUpdatedData,
    CommunityProfileUpdatedData, CommunityRequestedAttributesUpdatedData, CommunityRoleSetData,
    CommunityRoomChangedData, CommunityThemeUpdatedData, ConfigChange, ConfigChangedData,
    ConfigReloadedData, ConfigSource, CredentialIssuedData, CrossCommunitySessionMintedData,
    CustomEndorsementIssuedData, CustomEndorsementRevokedData, DidRotatedData, DidRotationReason,
    DirectoryCardChangedData, DirectoryCardPublicationData, DirectoryExportedData,
    DirectoryFieldChangedData, DirectoryImageStoredData, DirectoryNoteAccessData,
    ElectionChangedData, ElectionTicketIssuedData, EmergencyBootstrapData,
    EndorsementTypeDeletedData, EndorsementTypeRegisteredData, FieldChange, GitNsBreakGlassData,
    GitNsOperationData, GroupChangedData, GroupGrantsChangedData, GroupMembershipChangedData,
    HiddenVetterBindingResetData, HiddenVetterEnrolledData, HiddenVetterReboundData,
    HiddenVetterReissuedData, HiddenVetterResetCancelledData, HiddenVetterTokensIssuedData,
    HiddenVettingChangedData, InvitationDeliveredData, InvitationIssuedData, InvitationRevokedData,
    JoinRequestData, JoinRequestRejectedData, JoinRequestSupplementedData,
    JoinRequestWithdrawnData, MemberAddedData, MemberAdmittedDirectlyData,
    MemberCredentialsReadData, MemberPasskeyData, MemberPortalKeyUsedData, MemberRemovedData,
    MemberUpdatedData, MemberWalletSignInData, MembershipReciprocatedData, MembershipRenewedData,
    NetworkMembershipChangedData, NotificationRelayDecidedData, OperationStepUpApprovedData,
    OperationStepUpData, PersonhoodAssertedData, PersonhoodRevokedData, PolicyActivatedData,
    PolicyUploadedData, REDACTED_MARKER, RegistryRecordPolicyOverrideData,
    RegistryStatusChangedData, RegistrySyncOutcomeData, RestartRequestedData, RoleChangedData,
    RoomLimitsChangedData, RoomOperationData, RoomRetentionData, RoomStorageChangedData,
    SchemaChangeData, SessionRevocationRefusedData, SessionRevokedData, SignedOutData,
    SingleAdminModeData, StatusListFlippedData, StepUpApproverData, StepUpEvidence,
    StepUpPasskeyData, TaskConsentData, VetterAutoGrantConfiguredData, VetterAutoGrantSweptData,
    VetterGrantResentData, VetterGrantedData, VetterProfileDeletedData, VetterProfileUpdatedData,
    VettingStatementRevokedData, VpcAnnotationData, VrcLifecycleData, VrcPublishedData,
    VrcRevokedData, VrcSupersededData, WebsiteBundleDeployedData, WebsiteFileDeletedData,
    WebsiteFileWrittenData, WebsiteGenerationRolledBackData,
};
pub use key_store::{AuditKey, AuditKeyStore, KeyId, RotationReason};
pub use writer::AuditWriter;