PD-40 — Plan d'Implémentation¶

interface KeyRecord {
  keyId: string;           // UUID v4, immuable
  algorithm: 'Ed25519';
  createdAt: Date;
  status: 'CANDIDATE' | 'ACTIVE' | 'ARCHIVED' | 'DISCARDED';
  rotationId?: string;     // UUID associé à la rotation
  archivedAt?: Date;
}

interface RotationSession {
  rotationId: string;       // UUID v4
  rotationStartTime: Date;
  trigger: 'MANUAL' | 'SECURITY_INCIDENT' | 'COMPLIANCE';
  initiator: Identity;
  oldKeyId: string;
  newKeyId: string;
  status: 'INITIATED' | 'KEY_GENERATED' | 'EVENTS_SELECTED' | 
          'RESIGNING' | 'PROMOTION_READY' | 'SUCCESS' | 'FAILED';
  eligibleCount: number;
  processedCount: number;
  failureReason?: string;
}

async selectEligibleEvents(rotationStartTime: Date): Promise<Event[]> {
  const ΔT = 24 * 60 * 60 * 1000; // 24 heures en ms
  const windowStart = new Date(rotationStartTime.getTime() - ΔT);

  const eligibleTypes = [
    'CREATE',
    'UPDATE_METADATA',
    'ACCESS_LOG',
    'PRE_DELEGATION',
    'REKEY',
  ];

  const events = await eventRepository.find({
    where: {
      timestamp: Between(windowStart, rotationStartTime),
      type: In(eligibleTypes),
      status: 'FINALIZED',
    },
    order: {
      timestamp: 'ASC',
      event_id: 'ASC',
    },
    take: 100001, // N_max + 1 pour détecter dépassement
  });

  if (events.length > 100000) {
    throw new RotationError(
      'ELIGIBLE_SET_TOO_LARGE',
      `Eligible set size ${events.length} exceeds N_max=100000`
    );
  }

  return events;
}

async resignEvents(
  events: Event[],
  newKeyId: string,
  rotationId: string
): Promise<ResigningResult> {
  const processedEventIds: string[] = [];
  const errors: ResigningError[] = [];

  for (const event of events) {
    try {
      // 1. Construire EventToSign selon §4.3
      const eventToSign: EventToSign = {
        event_id: event.event_id,
        timestamp: event.timestamp.toISOString(),
        type: event.type,
        payload_hash: event.payload_hash,
      };

      // 2. Canonicaliser selon RFC 8785
      const canonicalJson = canonicalize(eventToSign);
      const payloadBuffer = Buffer.from(canonicalJson, 'utf-8');

      // 3. Signer via HSM
      const signatureBytes = await hsmKeyManager.sign(newKeyId, payloadBuffer);
      const signatureBase64 = signatureBytes.toString('base64');

      // 4. Créer SignatureEntry avec state=CANDIDATE
      const signatureEntry: SignatureEntry = {
        keyId: newKeyId,
        algorithm: 'Ed25519',
        signature: signatureBase64,
        signed_at: new Date().toISOString(),
        rotation_id: rotationId,
        state: 'CANDIDATE',
      };

      // 5. Append à event.signatures[] (append-only)
      await eventRepository.appendSignature(event.event_id, signatureEntry);

      processedEventIds.push(event.event_id);
    } catch (error) {
      errors.push({
        event_id: event.event_id,
        error: error.message,
      });
      // Échec immédiat : arrêter la boucle
      break;
    }
  }

  return {
    success: errors.length === 0,
    processedCount: processedEventIds.length,
    processedEventIds,
    errors,
  };
}

async promoteSignatures(rotationId: string): Promise<PromotionResult> {
  // Transaction de base de données
  await dataSource.transaction(async (transactionalEntityManager) => {
    // 1. Vérifier que TOUTES les signatures CANDIDATE existent
    const candidateSignatures = await transactionalEntityManager
      .createQueryBuilder()
      .select('COUNT(*)')
      .from('event_signatures', 'sig')
      .where('sig.rotation_id = :rotationId', { rotationId })
      .andWhere('sig.state = :state', { state: 'CANDIDATE' })
      .getCount();

    const expectedCount = await getExpectedSignatureCount(rotationId);

    if (candidateSignatures !== expectedCount) {
      throw new PromotionError(
        'INCOMPLETE_CANDIDATE_SET',
        `Expected ${expectedCount} signatures, found ${candidateSignatures}`
      );
    }

    // 2. Promouvoir ATOMIQUEMENT toutes les signatures
    await transactionalEntityManager
      .createQueryBuilder()
      .update('event_signatures')
      .set({ state: 'ACTIVE' })
      .where('rotation_id = :rotationId', { rotationId })
      .andWhere('state = :state', { state: 'CANDIDATE' })
      .execute();

    // 3. Récupérer oldKeyId et newKeyId
    const rotation = await rotationRepository.findOne(rotationId);
    const { oldKeyId, newKeyId } = rotation;

    // 4. Marquer nouvelle clé ACTIVE
    await transactionalEntityManager
      .getRepository(KeyRecord)
      .update({ keyId: newKeyId }, { status: 'ACTIVE' });

    // 5. Marquer ancienne clé ARCHIVED
    await transactionalEntityManager
      .getRepository(KeyRecord)
      .update({ keyId: oldKeyId }, { status: 'ARCHIVED', archivedAt: new Date() });

    // Transaction committed si pas d'exception
  });

  return { success: true };
}

@Entity('events')
export class Event {
  @PrimaryColumn('uuid')
  event_id: string;

  @Column('timestamp')
  timestamp: Date;

  @Column('varchar')
  type: string;

  @Column('char', { length: 64 })
  payload_hash: string; // SHA3-256 hex

  @Column('varchar')
  status: 'PENDING' | 'FINALIZED' | 'FAILED' | 'CANCELLED';

  @Column('jsonb')
  signatures: SignatureEntry[];

  @CreateDateColumn()
  created_at: Date;

  @UpdateDateColumn()
  updated_at: Date;

  @Index()
  @Column('timestamp')
  @Check(`status != 'FINALIZED' OR (event_id IS NOT NULL AND payload_hash IS NOT NULL)`)
  finalized_timestamp?: Date;
}

async appendSignature(
  event_id: string,
  signature: SignatureEntry
): Promise<void> {
  // Vérification append-only
  const event = await this.findOne({ where: { event_id } });

  if (!event) {
    throw new Error(`Event ${event_id} not found`);
  }

  // Append sans modification des signatures existantes
  const updatedSignatures = [...event.signatures, signature];

  await this.update(
    { event_id },
    { signatures: updatedSignatures }
  );
}

interface SignatureEntry {
  keyId: string;
  algorithm: 'Ed25519';
  signature: string;        // base64
  signed_at: string;        // ISO-8601
  rotation_id: string;
  state: 'CANDIDATE' | 'ACTIVE';
}

@Entity('rotation_audit_logs')
export class RotationAuditLog {
  @PrimaryColumn('uuid')
  rotation_id: string;

  @Column('timestamp')
  rotation_start_time: Date;

  @Column('timestamp')
  rotation_end_time: Date;

  @Column('varchar')
  trigger: 'MANUAL' | 'SECURITY_INCIDENT' | 'COMPLIANCE';

  @Column('jsonb')
  initiator: Identity;

  @Column('uuid')
  old_keyId: string;

  @Column('uuid')
  new_keyId: string;

  @Column('varchar')
  algorithm: 'Ed25519';

  @Column('int')
  eligible_count: number;

  @Column('jsonb')
  event_ids: string[]; // ou hash si > 100k

  @Column('varchar')
  final_status: 'SUCCESS' | 'ROTATION_FAILED';

  @Column('text', { nullable: true })
  failure_reason?: string;

  @CreateDateColumn()
  created_at: Date;
}

async logRotation(session: RotationSession, result: RotationResult): Promise<void> {
  const log = new RotationAuditLog();
  log.rotation_id = session.rotationId;
  log.rotation_start_time = session.rotationStartTime;
  log.rotation_end_time = new Date();
  log.trigger = session.trigger;
  log.initiator = session.initiator;
  log.old_keyId = session.oldKeyId;
  log.new_keyId = session.newKeyId;
  log.algorithm = 'Ed25519';
  log.eligible_count = session.eligibleCount;
  log.event_ids = result.processedEventIds;
  log.final_status = result.success ? 'SUCCESS' : 'ROTATION_FAILED';
  log.failure_reason = result.failureReason;

  await this.save(log);
}

import canonicalize from 'canonicalize'; // RFC 8785 deterministic JSON

async exportRotationLogs(
  startDate: Date,
  endDate: Date,
  format: 'NDJSON' | 'JSON_CANONICAL'
): Promise<string> {
  const logs = await this.find({
    where: {
      rotation_start_time: Between(startDate, endDate),
    },
    order: { rotation_start_time: 'ASC' },
  });

  if (format === 'NDJSON') {
    // NDJSON : une ligne JSON par log (stringify standard)
    return logs.map(log => JSON.stringify(log)).join('\n');
  }

  if (format === 'JSON_CANONICAL') {
    // RFC 8785 : canonicalisation déterministe (clés triées, pas d'espaces)
    // Garantit hash reproductible pour vérification d'intégrité
    return logs.map(log => {
      const plainObject = {
        rotation_id: log.rotation_id,
        rotation_start_time: log.rotation_start_time.toISOString(),
        rotation_end_time: log.rotation_end_time.toISOString(),
        trigger: log.trigger,
        initiator: log.initiator,
        old_keyId: log.old_keyId,
        new_keyId: log.new_keyId,
        algorithm: log.algorithm,
        eligible_count: log.eligible_count,
        event_ids: log.event_ids,
        final_status: log.final_status,
        failure_reason: log.failure_reason,
        created_at: log.created_at.toISOString(),
      };

      // canonicalize() applique RFC 8785 : tri des clés, encodage Unicode normalisé
      return canonicalize(plainObject);
    }).join('\n');
  }

  throw new Error(`Unsupported export format: ${format}`);
}

async cleanupOrphanedCandidates(): Promise<void> {
  const sevenDaysAgo = new Date(Date.now() - 7 * 24 * 60 * 60 * 1000);

  // Identifier rotations CANDIDATE anciennes
  const orphanedRotations = await rotationRepository.find({
    where: {
      final_status: IsNull(),
      rotation_start_time: LessThan(sevenDaysAgo),
    },
  });

  for (const rotation of orphanedRotations) {
    // Marquer rotation comme FAILED
    await rotationRepository.update(rotation.rotation_id, {
      final_status: 'ROTATION_FAILED',
      failure_reason: 'Cleanup: orphaned CANDIDATE signatures',
    });

    // Les signatures CANDIDATE restent (append-only) mais sont ignorées
    // Optionnel : supprimer clé CANDIDATE du HSM
    await hsmKeyManager.deleteKey(rotation.new_keyId);
  }
}

async verifyRotationSuccess(rotationId: string): Promise<VerificationResult> {
  const rotation = await rotationRepository.findOne(rotationId);
  const { newKeyId, eligibleCount } = rotation;

  // 1. Vérifier count signatures ACTIVE ajoutées
  const activeSignatures = await eventRepository
    .createQueryBuilder('e')
    .where(`signatures @> '[{"rotation_id": "${rotationId}", "state": "ACTIVE"}]'::jsonb`)
    .getCount();

  if (activeSignatures !== eligibleCount) {
    return {
      success: false,
      error: `Expected ${eligibleCount} ACTIVE signatures, found ${activeSignatures}`,
    };
  }

  // 2. Vérifier unicité clé ACTIVE
  const activeKeys = await keyRepository.count({ where: { status: 'ACTIVE' } });
  if (activeKeys !== 1) {
    return {
      success: false,
      error: `Expected 1 ACTIVE key, found ${activeKeys}`,
    };
  }

  // 3. Vérifier ancienne clé ARCHIVED
  const oldKey = await keyRepository.findOne(rotation.oldKeyId);
  if (oldKey.status !== 'ARCHIVED') {
    return {
      success: false,
      error: `Old key ${oldKey.keyId} not ARCHIVED (status: ${oldKey.status})`,
    };
  }

  return { success: true };
}

describe('PD-40 Acceptance Criteria', () => {
  it('CA1: Unicité clé active', async () => {
    const activeKeys = await keyRepository.find({ status: 'ACTIVE' });
    expect(activeKeys).toHaveLength(1);
  });

  it('CA5: Tous événements E ont signature ACTIVE supplémentaire', async () => {
    const rotationId = await executeRotation();
    const eligibleEvents = await selectEligibleEvents(rotation.start_time);

    for (const event of eligibleEvents) {
      const activeSignaturesForNewKey = event.signatures.filter(
        sig => sig.rotation_id === rotationId && sig.state === 'ACTIVE'
      );
      expect(activeSignaturesForNewKey).toHaveLength(1);
    }
  });

  it('CA6: Échec = aucune signature ACTIVE supplémentaire', async () => {
    // Simuler échec HSM
    jest.spyOn(hsmKeyManager, 'sign').mockRejectedValue(new Error('HSM timeout'));

    const result = await executeRotation();
    expect(result.success).toBe(false);

    // Vérifier aucune signature ACTIVE ajoutée
    const activeSignaturesAdded = await countActiveSignaturesForRotation(result.rotationId);
    expect(activeSignaturesAdded).toBe(0);
  });

  it('CA8: Atomicité promotion', async () => {
    // Vérifier que promotion est tout-ou-rien
    const rotationId = await startRotation();
    await resignAllEvents(rotationId);

    // Simuler échec au milieu de la promotion
    jest.spyOn(keyRepository, 'update').mockImplementationOnce(() => {
      throw new Error('DB error');
    });

    await expect(promoteSignatures(rotationId)).rejects.toThrow();

    // Vérifier rollback : aucune signature promue
    const promotedCount = await countPromotedSignatures(rotationId);
    expect(promotedCount).toBe(0);
  });
});