packages/platform/src/audit.ts

@@ -36,7 +36,8 @@ export async function audit(e: AuditInput, conn?: PoolConnection): Promise<void>
   const c = conn ?? (await pool.getConnection());
   try {
     if (own) await c.beginTransaction();
-    await c.query('SELECT GET_LOCK(?, 10)', ['kc_audit_chain']);
+    const [locks] = await c.query<import('mysql2').RowDataPacket[]>('SELECT GET_LOCK(?, 10) AS acquired', ['kc_audit_chain']);
+    if (Number(locks[0]?.acquired) !== 1) throw new Error('Audit lock unavailable');
     const last = await one<{ hash: string } & import('mysql2').RowDataPacket>('SELECT hash FROM audit_events ORDER BY id DESC LIMIT 1', [], c);
     const prev = last?.hash ?? '0'.repeat(64);
     const ts = new Date();

packages/platform/test/audit-lock.test.ts

@@ -0,0 +1,31 @@
+import { describe, expect, it, vi } from 'vitest';
+
+const connection = vi.hoisted(() => ({
+  beginTransaction: vi.fn(),
+  query: vi.fn(),
+  execute: vi.fn(),
+  commit: vi.fn(),
+  rollback: vi.fn(),
+  release: vi.fn(),
+}));
+
+vi.mock('../src/db.js', () => ({
+  pool: { getConnection: vi.fn(async () => connection) },
+  one: vi.fn(),
+  query: vi.fn(),
+}));
+
+import { audit } from '../src/audit.js';
+
+describe('audit advisory lock', () => {
+  it.each([0, null])('does not append an event when GET_LOCK returns %s', async (acquired) => {
+    vi.clearAllMocks();
+    connection.query.mockResolvedValueOnce([[{ acquired }]]).mockResolvedValueOnce([[{ released: null }]]);
+
+    await expect(audit({ actorType: 'system', action: 'test.lock' })).rejects.toThrow('Audit lock unavailable');
+    expect(connection.execute).not.toHaveBeenCalled();
+    expect(connection.commit).not.toHaveBeenCalled();
+    expect(connection.rollback).toHaveBeenCalledOnce();
+    expect(connection.release).toHaveBeenCalledOnce();
+  });
+});