Struct HashChainAuditor 

pub struct HashChainAuditor { /* private fields */ }

Auditor with a hash chain: all logs are linked by SHA-256 chained hashes, supporting tamper detection.

Tamper-Evidence Mechanism

1. Each record’s current_hash = SHA256(prev_hash || sql || user || timestamp)
2. The prev_hash of the next record equals the current_hash of the previous record
3. Any modification to a historical record changes current_hash, which then mismatches the prev_hash of the next record
4. Deleting a middle record breaks the chain; inserting a record changes all subsequent hashes

Example

use sz_orm_audit::{HashChainAuditor, SqlAuditContext};

let mut auditor = HashChainAuditor::new();
auditor.log(&SqlAuditContext {
    sql: "SELECT * FROM users".to_string(),
    user: "admin".to_string(),
    timestamp: 1000,
});
// Verify chain integrity
assert!(auditor.verify().is_ok());

Implementations

impl HashChainAuditor

pub fn new() -> Self

Create an empty hash chain auditor

pub fn log(&self, ctx: &SqlAuditContext)

Append an audit log to the end of the hash chain.

• If the chain is empty, uses GENESIS_HASH as prev_hash
• Otherwise uses the current_hash of the last record as prev_hash

The SQL is first masked by mask_sensitive before being written to the chain, ensuring that the stored audit logs contain no sensitive information.

pub fn get_entries(&self) -> Vec<HashChainEntry>

Return a snapshot (clone) of all log entries

pub fn len(&self) -> usize

Return the number of log entries

pub fn is_empty(&self) -> bool

Whether the auditor is empty

pub fn verify(&self) -> Result<(), String>

Verify the integrity of the hash chain.

Checks performed:

1. The prev_hash of the first record equals GENESIS_HASH
2. The current_hash of each record equals compute_hash(prev_hash, entry)
3. The prev_hash of each adjacent record equals the current_hash of the previous record

Return value

• Ok(()): the chain is intact and has not been tampered with
• Err(reason): the chain has been tampered with; reason describes the location and type of the first anomaly

pub fn flush(&self, path: &str) -> Result<usize, String>

Persist the hash chain to a JSONL file (one JSON per line).

Returns the number of entries written.

Trait Implementations

impl Default for HashChainAuditor

fn default() -> Self

Returns the “default value” for a type.