PD-279 — Revue Sécurité (7c)¶

// Ordre des gardes §5.3 :
// 1. Auth (JwtAuthGuard)
// 2. document_id format (ParseUUIDPipe)
// 3. Existence → 404
// 4. Ownership → 403
// 5. État SEALED → 409 INVALID_SOURCE_STATE
// 6. Idempotence : déjà RESTITUTED → 200
// 7. legal_lock=false → 409 DOCUMENT_UNDER_LEGAL_LOCK
// 8. geo_copy_count >= 2 → 409 INSUFFICIENT_GEO_COPIES

// SELECT FOR UPDATE pour sérialiser les accès concurrents
const rows = await queryRunner.query(
  `SELECT d.id, d.status, d.user_id, d.legal_lock, d.geo_copy_count, ...
   FROM vault_secure.documents d WHERE d.id = $1 FOR UPDATE`,
  [documentId],
);

// Ownership check
if (userId !== actorId) { throw ForbiddenException; }

// Transaction ACID : UPDATE + INSERT lifecycle_log
await queryRunner.query(`UPDATE ... SET status = $1 ... WHERE id = $4 AND status = $5`, [...]);
await this.appendJournalEntryInTransaction(queryRunner, ...);
await queryRunner.commitTransaction();

// Post-commit audit (non-bloquant)
await this.auditLogService.logAsync({ ... });

@UseGuards(JwtAuthGuard, AuthorizationGuard)
@Roles('user')
export class RestitutionController {
  @Post(':id/restitute')
  @HttpCode(HttpStatus.OK)
  async restitute(
    @Param('id', ParseUUIDPipe) id: string,
    @CurrentUser() user: { sub: string; security_level?: string },
  ): Promise<DocumentSecure> {
    const securityLevel = user.security_level ?? 'standard';
    return this.restitutionService.restitute(id, user.sub, securityLevel);
  }
}

private async appendJournalEntryInTransaction(
  queryRunner: QueryRunner,
  archiveId: string,
  eventType: JournalEventType,
  payload: Record<string, unknown>,
): Promise<void> {
  const canonicalPayload: string = canonicalize(payload) ?? '{}';
  const payloadDigest = createHash('sha3-256').update(canonicalPayload).digest('hex');

  await queryRunner.query(
    `INSERT INTO vault_integrity.integrity_journal_entries
     (archive_id, event_type, payload, payload_digest, timestamp)
     VALUES ($1, $2, $3::jsonb, $4, NOW())`,
    [archiveId, eventType, JSON.stringify(payload), payloadDigest],
  );
}

private async emitEventIfNotExists(
  documentId: string, eventType: JournalEventType,
  idempotencyKey: string, payload: Record<string, unknown>,
): Promise<boolean> {
  const keyedPayload = { ...payload, _idempotency_key: idempotencyKey };
  const canonicalPayload: string = canonicalize(keyedPayload) ?? '{}';
  const digest = createHash('sha3-256').update(canonicalPayload).digest('hex');

  const existing: unknown[] = await this.dataSource.query(
    `SELECT 1 FROM vault_integrity.integrity_journal_entries
     WHERE archive_id = $1 AND payload_digest = $2 LIMIT 1`,
    [documentId, digest],
  );

  if (Array.isArray(existing) && existing.length > 0) return false;

  await this.integrityJournalService.appendEntry(documentId, eventType, keyedPayload);
  return true;
}

// PD-279 INV-279-10: Explicit rejection of RESTITUTED documents
if (status === (DocumentStatus.RESTITUTED as string)) {
  return { eligible: false, reason: ExclusionReason.STATUS_RESTITUTED };
}