【安全加密】日志防篡改：哈希链与异地备份

---哈希链：每笔日志咬住上一笔
AuditChain.lastHash = AuditChain.lastHash or "GENESIS"

function AuditChain.append(entry)
    local payload = table.concat({
        tostring(entry.at), entry.operator,
        entry.action, entry.uid,
    }, "|")
    -- 新哈希 = 哈希(上笔哈希 + 本笔内容)
    local h = Cipher.hash(AuditChain.lastHash .. payload)
    entry.hash = h
    entry.prev = AuditChain.lastHash
    AuditChain.lastHash = h
    AuditChain.buffer[#AuditChain.buffer + 1] = entry
    return h
end

---链条的验证：逐笔回放比对
function AuditChain.verify(entries)
    local prev = "GENESIS"
    for _, e in ipairs(entries) do
        local payload = table.concat({
            tostring(e.at), e.operator,
            e.action, e.uid,
        }, "|")
        if Cipher.hash(prev .. payload) ~= e.hash
            or e.prev ~= prev then
            return false, e   -- 断裂点即被篡改的条目
        end
        prev = e.hash
    end
    return true
end

---链条的锚点：每小时固化到异地
setontimerex(114, 3600)
function AuditChain.anchor()
    local h = AuditChain.lastHash
    -- 异地存储当前的链尾哈希
    RemoteAnchor.store(h, os.time())
end

---锚点的校验：本地链与异地锚点比对
function AuditChain.verifyAnchor()
    local localHash = AuditChain.lastHash
    local remote = RemoteAnchor.latest()
    if remote.hash ~= localHash then
        Ops.alert("日志链异常：本地与异地锚点不符")
        return false
    end
    return true
end