feat: implement sensitive operation audit retention (TASK-WP6-04)

tests/integration/wp5-05-sticker-release.test.ts

@@ -1,15 +1,19 @@
 import { createHash, randomUUID } from "node:crypto";
 import { existsSync, mkdirSync, mkdtempSync, readdirSync, rmSync, writeFileSync } from "node:fs";
+import { createRequire } from "node:module";
 import { tmpdir } from "node:os";
 import { join, resolve } from "node:path";
 import { Readable } from "node:stream";
 
+import type BetterSqlite3 from "better-sqlite3";
 import { afterEach, describe, expect, it } from "vitest";
 
 import { HARD_LIMIT_BYTES, ManagedStorage, StorageCapacityError, StorageUnavailableError } from "../../apps/api/src/managed-storage.js";
 import { StickerReleaseService } from "../../apps/api/src/sticker-releases.js";
 
 const now = Date.parse("2026-08-03T12:00:00.000Z");
+const require = createRequire(resolve("apps/api/package.json"));
+const Database = require("better-sqlite3") as typeof BetterSqlite3;
 const png = Buffer.from("iVBORw0KGgoAAAANSUhEUgAAAAQAAAADCAYAAAC09K7GAAAACXBIWXMAAAPoAAAD6AG1e1JrAAAAEklEQVQImWO4E6XxHxkzEBQAANIxHF3ECQOzAAAAAElFTkSuQmCC", "base64");
 const webp = Buffer.from("UklGRjoAAABXRUJQVlA4IC4AAADQAQCdASoGAAUAAUAmJaACdLoB+AADsAD+9IiH/pNnibPE2fJI/+Uq8Fjc3wAA", "base64");
 const roots: string[] = [];
@@ -38,7 +42,7 @@ function fixture() {
   const storage = new ManagedStorage({ dataRoot, databasePath });
   const stickers = new StickerReleaseService({ clock: () => now, databasePath, storage });
   closeables.push(stickers, storage);
-  return { dataRoot, stickers, storage };
+  return { dataRoot, databasePath, stickers, storage };
 }
 
 async function upload(stickers: StickerReleaseService, stableId: string, order: number, bytes = png, mimeType: "image/png" | "image/webp" = "image/png") {
@@ -82,6 +86,26 @@ describe("TDD-WP5-UPL-001 upload metering", () => {
     expect(test.stickers.listPublic(published.release_version).items).toHaveLength(1);
     expect(test.stickers.readPublicAsset(published.release_version, "STK1408", "original")?.bytes).toEqual(png);
     expect(test.stickers.readPublicAsset(disabled.release_version, "STK1408", "original")).toBeUndefined();
+    const audit = new Database(test.databasePath, { readonly: true });
+    expect(audit.prepare(`
+      SELECT operation_type, target_ref, result FROM admin_operation_logs
+      WHERE operation_type IN ('sticker_release_publish', 'sticker_release_update')
+      ORDER BY occurred_at
+    `).all()).toEqual([
+      { operation_type: "sticker_release_publish", result: "succeeded", target_ref: published.release_version },
+      { operation_type: "sticker_release_update", result: "succeeded", target_ref: disabled.release_version },
+    ]);
+    audit.close();
+    const auditFailure = new Database(test.databasePath);
+    auditFailure.exec(`
+      CREATE TRIGGER force_sticker_release_audit_failure BEFORE INSERT ON admin_operation_logs
+      WHEN NEW.operation_type = 'sticker_release_update'
+      BEGIN SELECT RAISE(ABORT, 'forced_audit_failure'); END;
+    `);
+    expect(() => test.stickers.update({ actorId: randomUUID(), enabled: true, stableId: "STK1408" }))
+      .toThrow("forced_audit_failure");
+    expect(test.stickers.adminView()).toMatchObject({ release_version: disabled.release_version, items: [{ enabled: false }] });
+    auditFailure.close();
 
     evidence("fs-before.json", before);
     evidence("fs-after.json", { files: filesBelow(join(test.dataRoot, "managed-assets")), state: test.storage.getState() });