Pervaxis.Core.Security 1.6.0

Pervaxis.Core.Security

Security services including a tamper-evident SHA-256 hash-chained audit trail, encryption abstractions, and token validation. Implements Section 19 of the Pervaxis Platform Spec.

Installation

dotnet add package Pervaxis.Core.Security

Immutable Audit Trail (Section 19)

The audit trail is append-only with hash chaining — tampering with any historical entry invalidates all subsequent hashes, making modifications detectable.

Registration

// Register ImmutableAuditLogger as IAuditLogger
builder.Services.AddSingleton<ImmutableAuditTrail>();
builder.Services.AddSingleton<IAuditLogger, ImmutableAuditLogger>();

Recording Audit Events

public class TenantService(IAuditLogger auditLogger)
{
    public async Task DeleteTenantAsync(TenantId tenantId, UserId actorId, CorrelationId correlationId)
    {
        await auditLogger.LogAsync(new AuditEntry(
            AuditId: Guid.NewGuid(),
            Action: "TenantDeleted",
            ResourceType: "Tenant",
            ResourceId: tenantId.Value,
            ActorId: actorId,
            TenantId: tenantId,
            CorrelationId: correlationId,
            OccurredAt: DateTime.UtcNow,
            Metadata: new Dictionary<string, string>
            {
                ["reason"] = "Customer offboarding request"
            }));
    }
}

Compliance Verification

// Verify the entire chain — O(n), use for periodic compliance checks
var logger = serviceProvider.GetRequiredService<ImmutableAuditLogger>();
var isIntact = logger.Trail.Verify();

if (!isIntact)
    throw new InvalidOperationException("Audit trail integrity check failed.");

// Retrieve all entries
var allEntries = logger.Trail.GetAll();

// Retrieve last N entries
var recent = logger.Trail.GetRecent(100);

Hash Chain

Each audit trail entry contains:

EntryHash = SHA-256(
    AuditId | Action | ResourceType | ResourceId |
    ActorId | TenantId | CorrelationId | OccurredAt |
    SequenceNumber | RecordedAt | PreviousHash
)

The first entry uses PreviousHash = "0000...0000" (64 zeros — genesis hash).

Production Considerations

The ImmutableAuditTrail is in-memory and suitable for:

• Testing and compliance verification within a service lifetime.
• Accumulating audit events before flush to persistent storage.

For production persistence, implement IAuditLogger backed by:

• AWS DynamoDB — for serverless, globally distributed audit storage.
• AWS CloudTrail — for infrastructure-level immutable audit.
• PostgreSQL append-only table — with Supabase RLS for tenant isolation.

AWS CloudTrail Integration

AWS CloudTrail provides immutable infrastructure-level audit logging. Enable it for all management events across all AWS accounts in all regions.

Pervaxis Platform · Clarivex Technologies · https://clarivex.tech