8.26-bob: Audit log va faoliyat tarixi

  ODDIY LOG 5.12-bob:                    AUDIT LOG:
  Texnik (debug, xato, so'rov)         Biznes hodisalari (kim nima qildi)
  Vaqtincha (rotatsiya, o'chadi)       Doimiy (o'zgarmas, saqlanadi)
  Dasturchi uchun (debug)              Audit/huquq/biznes uchun (dalil)
  Format erkin                          Tuzilgan (kim/nima/qachon — 2.3)
  console/fayl/ELK                      DB (qidiriladigan, o'zgarmas)

   Oddiy log — "nima ishladi"; audit log — "kim nima qildi" (dalil)

  AUDIT LOG GA YOZILADI (muhim biznes harakatlari):
   O'zgartirish (yaratish/yangilash/o'chirish — ma'lumot)
   Auth hodisalari (login, logout, parol o'zgarishi, muvaffaqiyatsiz kirish)
   Ruxsat o'zgarishi (rol berish, admin qilish — 8.7)
   Moliyaviy (to'lov, refund, narx o'zgarishi — 8.19)
   Maxfiy ma'lumot ko'rish (mijoz ma'lumoti, hisobot)
   Eksport/import (ma'lumot yuklash — 8.21)

   Har o'qish (GET — ko'p, ahamiyatsiz — faqat maxfiy)
   Sirlar (parol qiymati, token — log'ga emas! 14)

  AUDIT LOG yozuvi (kim/nima/qachon/qayerdan):
  ┌──────────────┬──────────────────────────────────────┐
  │ id           │ yozuv ID                              │
  │ userId       │ KIM (qaysi foydalanuvchi)            │
  │ action       │ NIMA ("user.delete", "order.update") │
  │ resource     │ qaysi obyekt ("User", "Order")       │
  │ resourceId   │ qaysi yozuv (5-mijoz)                 │
  │ oldValue     │ ESKI qiymat (o'zgarishdan oldin)     │
  │ newValue     │ YANGI qiymat (keyin)                 │
  │ ip           │ QAYERDAN (IP manzil)                 │
  │ userAgent    │ qurilma/brauzer                      │
  │ tenantId     │ qaysi tenant (SaaS — 8.25)           │
  │ createdAt    │ QACHON (vaqt — o'zgarmas)            │
  └──────────────┴──────────────────────────────────────┘

// Qo'lda audit yozish — unutiladi. Avtomatik (interceptor — 8.6)
@Injectable()
export class AuditInterceptor implements NestInterceptor {
  constructor(private auditService: AuditService, private reflector: Reflector) {}

  intercept(context: ExecutionContext, next: CallHandler): Observable<any> {
    const audit = this.reflector.get("audit", context.getHandler());   // @Audit metadata
    if (!audit) return next.handle();                 // belgilanmagan  o'tkazib yubor

    const req = context.switchToHttp().getRequest();
    return next.handle().pipe(
      tap((natija) => {                               // muvaffaqiyatdan keyin (8.6)
        this.auditService.yoz({
          userId: req.user?.id, action: audit.action,
          resourceId: req.params.id, ip: req.ip,
          newValue: natija, tenantId: req.tenantId,   // (8.25)
        });
      }),
    );
  }
}
// @Audit({ action: "user.delete" }) @Delete(":id") ochir() {}

// Yangilashda — eski va yangi qiymat (nima o'zgardi)
async yangila(id: string, dto: UpdateOrderDto, userId: string) {
  const eski = await this.repo.findOneBy({ id });     // o'zgarishdan OLDIN
  const yangi = await this.repo.save({ ...eski, ...dto });

  await this.auditService.yoz({
    userId, action: "order.update", resource: "Order", resourceId: id,
    oldValue: this.diff(eski, dto),                   // faqat o'zgargan maydonlar
    newValue: this.diff(yangi, dto),
  });
  return yangi;
}

// Faqat o'zgargan maydonlarni ajratish (diff)
private diff(obj: any, changes: any) {
  return Object.keys(changes).reduce((acc, k) => ({ ...acc, [k]: obj[k] }), {});
}

   AUDIT LOG O'ZGARMAS bo'lishi kerak (dalil bo'lishi uchun):
  - Faqat INSERT (yozish) — UPDATE/DELETE yo'q
  - Hatto admin ham o'zgartira/o'chira olmaydi
  - DB darajasida himoya (faqat insert ruxsati, RLS)
  - Yoki: append-only saqlash (alohida DB, WORM)
  - Hash zanjiri (blockchain ruhida — har yozuv oldingisi hash'i bilan)

   O'zgartiriladigan audit log = DALIL EMAS (manipulyatsiya mumkin)

// Audit log'ni ko'rish/qidirish (admin — tergov)
async qidir(filter: AuditFilterDto) {
  const qb = this.repo.createQueryBuilder("a");
  if (filter.userId) qb.andWhere("a.userId = :u", { u: filter.userId });   // kim
  if (filter.action) qb.andWhere("a.action = :a", { a: filter.action });   // nima
  if (filter.resource) qb.andWhere("a.resource = :r", { r: filter.resource });
  if (filter.from) qb.andWhere("a.createdAt >= :from", { from: filter.from });   // qachon
  if (filter.to) qb.andWhere("a.createdAt <= :to", { to: filter.to });
  return qb.orderBy("a.createdAt", "DESC").limit(filter.limit || 50).getMany();
}
// Admin: "Ali oxirgi hafta nima qildi?", "5-mijozni kim o'zgartirdi?"

  AUDIT LOG hajmi tez o'sadi (har harakat — yozuv):
  - Indeks (tez qidiruv — userId/action/createdAt — 6.10)
  - Partitioning (sana bo'yicha — eski oylar alohida — 6.10)
  - Arxivlash (eski yozuvlar  cold storage / S3 — arzon)
  - Saqlash muddati (compliance: bank 5 yil, GDPR cheklov)
  - Alohida DB/jadval (asosiy DB'ni sekinlatmasin)

   Audit log = ko'p yoziladi (insert-heavy) — optimizatsiya kerak

   tenantId har yozuvda (SaaS — kim qaysi tenant'da — 8.25)
   Audit log o'zi himoyalangan (faqat admin ko'radi — 8.7)
   Sirlarni yozma (parol/token qiymati — 14, 2.2)
   O'zgarmas (immutable — 2.6)
   Auth hodisalari (muvaffaqiyatsiz kirish — buzilish belgisi)
   IP/userAgent (qayerdan — tergov — 2.3)
   Audit log ko'rilishi ham loglanadi (kim audit'ni ko'rdi)

  MUAMMO: subscriber DB darajasida ishlaydi 2.4-bob — u yerda
  "req.user" YO'Q (HTTP so'rov konteksti emas). Kim o'zgartirdi?

  YECHIM: request context (so'rov davomida saqlanadigan xotira):
  - AsyncLocalStorage (Node yadrosi) — async oqim bo'ylab kontekst
  - nestjs-cls (CLS — Continuation Local Storage — NestJS o'ramasi)
  - Middleware/guard so'rov boshida userId/tenantId/ip'ni "store"ga qo'yadi
  - Subscriber/service ISTALGAN chuqurlikda cls.get("userId") oladi

   Aktyorni parametr sifatida har joyga uzatish shart emas (toza)

  MUAMMO: audit yozuvi (DB insert) asosiy so'rovni sekinlatadi
  (foydalanuvchi audit yozilishini kutmasligi kerak).

  YECHIM 1 — @nestjs/event-emitter (jarayon ichida async):
  eventEmitter.emit("audit", data)  listener alohida yozadi
  (asosiy oqim davom etadi; audit "fon"da)

  YECHIM 2 — queue (BullMQ — 8.18) — ishonchli, alohida jarayon:
  auditQueue.add("write", data)  worker DB'ga yozadi
  (Redis'da navbat; worker qulasa — qayta urinish; yo'qolmaydi)

   Muvozanat: event — oddiy, tez (lekin jarayon qulasa yo'qoladi);
     queue — ishonchli (Redis'da saqlanadi) — muhim audit uchun

  IMMUTABLE 2.6-bob yetarli emas bo'lishi mumkin — DB'ga to'g'ridan
  kirgan kishi yozuvni o'zgartirishi/o'chirishi mumkin. Aniqlash?

  HASH ZANJIRI (blockchain ruhi — tamper-evident):
  - Har yozuv: hash = SHA256(oldingi_hash + shu_yozuv_maydonlari)
  - Yozuvlar zanjir bo'lib bog'lanadi (bloknot: har varaq oldingisiga)
  - Bittasini o'zgartirish  uning va KEYINGI barcha hash buziladi
  - Davriy tekshiruv: zanjirni qayta hisoblab, mos kelishini tekshirish

   O'zgartirishni to'sib bo'lmasa ham, ANIQLASH mumkin (dalil buzildi)

  AUDIT LOG QAYERDA saqlanadi (har birining bahosi):
  - Asosiy DB, alohida jadval  — oddiy, tranzaksion; katta hajmda og'ir
  - Alohida audit DB           — asosiy DB'ni bloklmaydi; boshqaruv qo'shimcha
  - Elasticsearch / OpenSearch — kuchli qidiruv/agregatsiya; tranzaksiya yo'q
  - Fayl (append-only, WORM)   — arzon, o'zgarmas; qidirish qiyin
  - Bulut (S3 + Glacier)       — arxiv uchun eng arzon; tez qidiruv yo'q

   Tanlov: hajm, qidiruv talabi, compliance, harajat bo'yicha

  QANCHA SAQLASH — ikki qarama-qarshi talab:
  - Compliance: MINIMUM muddat saqlash (bank 5-7 yil, soliq talabi)
  - GDPR: ortiqcha shaxsiy ma'lumot saqlamaslik (data minimization)

  YECHIM:
  - Retention muddati (masalan 2 yil "issiq", keyin arxiv/o'chirish)
  - Shaxsiy ma'lumotni MINIMAL (userId — havola; ism/email emas)
  - "Unutilish huquqi": foydalanuvchi o'chsa — audit'da userId
    anonimlashtiriladi/pseudonim (yozuv qoladi, shaxs bog'lanmaydi)

   Audit = dalil (saqlash kerak) VS GDPR (shaxsiy — o'chirish) muvozanati

  SOFT-DELETE (deletedAt — yozuv o'chmaydi, belgilanadi):
  - "o'chirish" aslida UPDATE (deletedAt = now) — subscriber ko'radi
  - Audit: action = "user.delete" (hodisa), lekin ma'lumot qoladi
  - Restore (tiklash) ham audit'ga yoziladi
  - Audit + soft-delete = to'liq tarix (o'chirilgan ham, tiklangan ham)

   Audit LOG o'zi soft-delete EMAS — hech qachon o'chmaydi (2.6)

   Audit log ≠ oddiy log (biznes hodisa, doimiy — 2.1)
   Muhim harakatlar (CRUD, auth, moliyaviy, ruxsat — 2.2)
   To'liq kontekst (kim/nima/qachon/qayerdan/eski-yangi — 2.3)
   Avtomatik (interceptor/subscriber — qo'lga ishonma — 2.4)
   Diff (eskiyangi — o'zgargan maydonlar — 2.5)
   O'zgarmas (immutable — faqat insert — 2.6)
   Qidiriladigan (indeks, admin panel — 2.7)
   Hajm boshqaruvi (partitioning, arxiv, muddat — 2.8)
   Sirlarni yozma; tenant; o'zi himoyalangan (14, 8.25 — 2.9)
   Aktyorni request context'dan (cls/AsyncLocalStorage — 2.10)
   Async (event/queue — asosiy oqim bloklanmasin — 2.11)
   Tamper-evident (hash zanjiri — buzilishni aniqlash — 2.12)
   Saqlash joyi ongli (DB/ES/arxiv — hajm/qidiruv — 2.13)
   Retention + GDPR (muddat, anonimlashtirish — 2.14)

// Audit yozuvi 2.3-bob: { userId, action, resource, resourceId, oldValue, newValue, ip, tenantId, createdAt }
// Avtomatik 2.4-bob: @Audit({ action }) + AuditInterceptor (tap)
// Diff 2.5-bob: eski vs yangi (o'zgargan maydonlar)
// O'zgarmas 2.6-bob: faqat INSERT (UPDATE/DELETE yo'q)
// Qidirish 2.7-bob: filter (userId, action, resource, sana oralig'i)

@Entity("audit_logs")
@Index(["userId", "createdAt"])                       // tez qidiruv (2.7, 6.10)
@Index(["resource", "resourceId"])
export class AuditLog {
  @PrimaryGeneratedColumn("uuid") id: string;

  @Column({ nullable: true }) userId: string;         // KIM
  @Column() action: string;                           // NIMA ("order.update")
  @Column() resource: string;                         // qaysi obyekt
  @Column({ nullable: true }) resourceId: string;     // qaysi yozuv

  @Column("jsonb", { nullable: true }) oldValue: any; // ESKI (2.5)
  @Column("jsonb", { nullable: true }) newValue: any; // YANGI

  @Column({ nullable: true }) ip: string;             // QAYERDAN
  @Column({ nullable: true }) userAgent: string;
  @Column({ nullable: true }) tenantId: string;       // SaaS (8.25)

  @CreateDateColumn() createdAt: Date;                // QACHON
  //  updatedAt YO'Q (o'zgarmas — 2.6)
}

@Injectable()
export class AuditService {
  constructor(@InjectRepository(AuditLog) private repo: Repository<AuditLog>) {}

  // FAQAT yozish (o'qish va yozish — UPDATE/DELETE metod YO'Q — immutable 2.6)
  async yoz(data: Partial<AuditLog>): Promise<void> {
    await this.repo.insert({                          // insert (save emas — o'zgartirmaslik)
      ...data,
      oldValue: this.sirlarTozala(data.oldValue),     // sirlarni tozalash (2.9, 14)
      newValue: this.sirlarTozala(data.newValue),
    });
  }

  private sirlarTozala(obj: any) {
    if (!obj) return obj;
    const { parol, token, refreshToken, ...toza } = obj;   // sirlarni olib tashlash (14)
    return toza;
  }

  async qidir(filter: AuditFilterDto) { /* Misol 5 */ }
}

// @Audit dekorator (metadata)
export const Audit = (action: string, resource: string) =>
  SetMetadata("audit", { action, resource });

@Injectable()
export class AuditInterceptor implements NestInterceptor {
  constructor(private auditService: AuditService, private reflector: Reflector) {}

  intercept(context: ExecutionContext, next: CallHandler): Observable<any> {
    const meta = this.reflector.get<{ action: string; resource: string }>("audit", context.getHandler());
    if (!meta) return next.handle();

    const req = context.switchToHttp().getRequest();
    return next.handle().pipe(
      tap((natija) => {                               // muvaffaqiyatdan keyin (8.6)
        this.auditService.yoz({
          userId: req.user?.id,
          action: meta.action, resource: meta.resource,
          resourceId: req.params?.id || natija?.id,
          newValue: natija,
          ip: req.ip, userAgent: req.headers["user-agent"],
          tenantId: req.tenantId,                     // (8.25)
        });
      }),
    );
  }
}

// Ishlatish
@Audit("user.delete", "User")
@Delete(":id")
@UseGuards(JwtAuthGuard, RolesGuard) @Roles(Rol.ADMIN)   // (8.7)
ochir(@Param("id") id: string) { return this.service.ochir(id); }

// DB o'zgarishlarini avtomatik audit (subscriber — 8.13, 8.25)
@EventSubscriber()
export class AuditSubscriber implements EntitySubscriberInterface {
  constructor(dataSource: DataSource, private context: RequestContext) {
    dataSource.subscribers.push(this);
  }

  afterUpdate(event: UpdateEvent<any>) {
    if (this.auditlanadimi(event.metadata.tableName)) {
      this.audit({
        action: `${event.metadata.tableName}.update`,
        resourceId: event.entity?.id,
        oldValue: event.databaseEntity,               // ESKI (2.5)
        newValue: event.entity,                       // YANGI
        userId: this.context.userId,
      });
    }
  }
  afterInsert(event: InsertEvent<any>) { /* yaratish */ }
  afterRemove(event: RemoveEvent<any>) { /* o'chirish */ }

  private auditlanadimi(table: string) {
    return ["orders", "users", "payments"].includes(table);   // muhim jadvallar (2.2)
  }
}

@Controller("admin/audit")
@UseGuards(JwtAuthGuard, RolesGuard)
@Roles(Rol.ADMIN)                                     // faqat admin (8.7, 2.9)
export class AuditController {
  constructor(private auditService: AuditService) {}

  @Get()
  async qidir(@Query() filter: AuditFilterDto, @Req() req) {
    //  Audit ko'rilishi ham loglanadi (2.9)
    await this.auditService.yoz({ userId: req.user.id, action: "audit.view", resource: "AuditLog" });
    return this.auditService.qidir(filter);
  }

  @Get("resource/:resource/:id")                      // bir obyekt tarixi
  tarix(@Param("resource") resource: string, @Param("id") id: string) {
    return this.auditService.obyektTarixi(resource, id);   // 5-mijoz barcha o'zgarishlari
  }
}

class AuditFilterDto {
  @IsOptional() userId?: string;
  @IsOptional() action?: string;
  @IsOptional() resource?: string;
  @IsOptional() @IsDateString() from?: string;
  @IsOptional() @IsDateString() to?: string;
  @Type(() => Number) @IsOptional() limit?: number = 50;
}

// Auth — muhim audit (login, parol, muvaffaqiyatsiz kirish — buzilish belgisi)
@Injectable()
export class AuthService {
  async login(email: string, parol: string, ip: string, userAgent: string) {
    const user = await this.validateUser(email, parol);   // (8.9)
    if (!user) {
      await this.auditService.yoz({                   // MUVAFFAQIYATSIZ kirish (14 — buzilish?)
        action: "auth.login.failed", resource: "Auth",
        newValue: { email }, ip, userAgent,           // parol YOQ (14)
      });
      throw new UnauthorizedException("Email yoki parol noto'g'ri");
    }
    await this.auditService.yoz({
      userId: user.id, action: "auth.login.success", resource: "Auth", ip, userAgent,
    });
    return this.tokenlarBer(user);
  }

  async parolOzgartir(userId: string, ip: string) {
    // parol qiymati YOZILMAYDI (14) — faqat hodisa
    await this.auditService.yoz({ userId, action: "auth.password.changed", resource: "Auth", ip });
  }
}

// Bir obyektning barcha o'zgarishlari (tarix — kim, qachon, nima)
async obyektTarixi(resource: string, resourceId: string) {
  const yozuvlar = await this.repo.find({
    where: { resource, resourceId },
    order: { createdAt: "ASC" },                      // vaqt tartibida (eskiyangi)
  });
  return yozuvlar.map((y) => ({
    sana: y.createdAt,
    kim: y.userId,
    amal: y.action,
    ozgarish: this.ozgarishlar(y.oldValue, y.newValue),   // nima o'zgardi (diff — 2.5)
  }));
}

private ozgarishlar(eski: any, yangi: any) {
  if (!eski || !yangi) return null;
  const farqlar: any = {};
  for (const k of Object.keys(yangi)) {
    if (eski[k] !== yangi[k]) farqlar[k] = { eski: eski[k], yangi: yangi[k] };   // "narx: 50000  30000"
  }
  return farqlar;
}

-- DB darajasida — audit_logs faqat INSERT (UPDATE/DELETE bloklangan)
REVOKE UPDATE, DELETE ON audit_logs FROM app_user;   -- app faqat insert/select
GRANT INSERT, SELECT ON audit_logs TO app_user;

-- Yoki trigger (UPDATE/DELETE'ni bloklash)
CREATE OR REPLACE FUNCTION audit_immutable() RETURNS trigger AS $$
BEGIN RAISE EXCEPTION 'Audit log o''zgartirilmaydi'; END;
$$ LANGUAGE plpgsql;
CREATE TRIGGER no_update BEFORE UPDATE OR DELETE ON audit_logs
  FOR EACH ROW EXECUTE FUNCTION audit_immutable();

// Eski audit yozuvlarni arxivlash (cron — 8.18)
@Injectable()
export class AuditArchiveService {
  @Cron(CronExpression.EVERY_WEEK)
  async arxivla() {
    // 1 yildan eski yozuvlar  S3 (arzon saqlash — compliance)
    const eski = await this.repo.find({
      where: { createdAt: LessThan(new Date(Date.now() - 365 * 24 * 3600 * 1000)) },
    });
    if (eski.length) {
      await this.s3.yukla(Buffer.from(JSON.stringify(eski)), `audit-archive/${Date.now()}.json`);
      //  Compliance muddatigacha saqlash (bank 5 yil) — keyin o'chirish (2.8)
    }
  }
}
// Partitioning (PostgreSQL — sana bo'yicha) — migration'da (6.10, 6.14)

  src/audit/
  ├── audit.entity.ts            (o'zgarmas — Misol 1)
  ├── audit.service.ts           (faqat insert — Misol 2)
  ├── audit.interceptor.ts       (avtomatik — Misol 3)
  ├── audit.subscriber.ts        (DB avtomatik — Misol 4)
  ├── audit.controller.ts        (admin qidirish — Misol 5)
  ├── audit.decorator.ts         (@Audit)
  └── audit-archive.service.ts   (hajm — Misol 9)

  Oqim:
  - @Audit endpoint  AuditInterceptor  yozuv (avtomatik)
  - DB o'zgarish  AuditSubscriber  yozuv (avtomatik)
  - Auth  AuthService  audit (login/parol — Misol 6)
  - Admin  qidirish/tarix (Misol 5, 7)
  - Cron  arxivlash (Misol 9)

   O'zgarmas (DB himoya — Misol 8); sirlar tozalangan (14)

// Middleware — so'rov boshida userId/tenantId/ip'ni CLS store'ga qo'yadi
@Injectable()
export class AuditContextMiddleware implements NestMiddleware {
  constructor(private cls: ClsService) {}
  use(req: any, _res: any, next: () => void) {
    this.cls.set("userId", req.user?.id);               // KIM (2.10)
    this.cls.set("tenantId", req.tenantId);             // qaysi tenant (8.25)
    this.cls.set("ip", req.ip);                         // QAYERDAN
    this.cls.set("userAgent", req.headers["user-agent"]);
    next();
  }
}

// Subscriber (DB darajasida — req.user YO'Q) endi CLS'dan oladi
@EventSubscriber()
export class AuditSubscriber implements EntitySubscriberInterface {
  constructor(dataSource: DataSource, private cls: ClsService) {
    dataSource.subscribers.push(this);
  }
  afterUpdate(event: UpdateEvent<any>) {
    if (!this.auditlanadimi(event.metadata.tableName)) return;
    this.auditService.yoz({
      userId: this.cls.get("userId"),                   //  chuqurlikda kontekst (2.10)
      tenantId: this.cls.get("tenantId"),
      ip: this.cls.get("ip"),
      action: `${event.metadata.tableName}.update`,
      resource: event.metadata.tableName,
      resourceId: event.entity?.id,
      oldValue: event.databaseEntity, newValue: event.entity,
    });
  }
  private auditlanadimi(t: string) { return ["orders", "users"].includes(t); }
}

// Interceptor: audit'ni EMIT qiladi (kutmaydi — asosiy javob tez)
return next.handle().pipe(
  tap((natija) => {
    this.eventEmitter.emit("audit.event", {            // fon vazifasi (2.11)
      userId: req.user?.id, action: meta.action, resource: meta.resource,
      resourceId: req.params?.id ?? natija?.id, newValue: natija,
      ip: req.ip, userAgent: req.headers["user-agent"], tenantId: req.tenantId,
    });
  }),
);

// Listener — alohida yozadi (asosiy so'rov allaqachon javob qaytargan)
@Injectable()
export class AuditListener {
  constructor(private auditService: AuditService) {}

  @OnEvent("audit.event", { async: true })             // async — bloklamaydi (2.11)
  async yoz(data: Partial<AuditLog>) {
    await this.auditService.yoz(data);                 // xato bo'lsa — asosiy oqimga ta'sir yo'q
  }
}

//  Muhim/compliance audit uchun — BullMQ queue (ishonchli — yo'qolmaydi):
// this.auditQueue.add("write", data)   worker DB'ga yozadi (Redis, retry — 8.18)

// Har yozuvga oldingi yozuv hash'iga bog'langan hash qo'shiladi
async yoz(data: Partial<AuditLog>): Promise<void> {
  const oxirgi = await this.repo.findOne({             // zanjirdagi oxirgi yozuv
    where: {}, order: { createdAt: "DESC" },
  });
  const prevHash = oxirgi?.hash ?? "GENESIS";          // birinchi yozuv — boshlang'ich

  const toza = { ...data, oldValue: this.sirlarTozala(data.oldValue),
                          newValue: this.sirlarTozala(data.newValue) };
  const hash = createHash("sha256")                    // SHA256(oldingi + shu yozuv)
    .update(prevHash + JSON.stringify(toza))
    .digest("hex");

  await this.repo.insert({ ...toza, prevHash, hash }); // zanjir bog'lanadi (2.12)
}

// Davriy tekshiruv — zanjir buzilganini aniqlash
async zanjirTekshir(): Promise<{ butun: boolean; buzilgan?: string }> {
  const barcha = await this.repo.find({ order: { createdAt: "ASC" } });
  let prev = "GENESIS";
  for (const y of barcha) {
    const { id, hash, prevHash, createdAt, ...maydonlar } = y;
    const kutilgan = createHash("sha256").update(prev + JSON.stringify(maydonlar)).digest("hex");
    if (y.hash !== kutilgan || y.prevHash !== prev) {
      return { butun: false, buzilgan: y.id };         //  shu yozuv o'zgartirilgan!
    }
    prev = y.hash;
  }
  return { butun: true };                              // zanjir buzilmagan (dalil toza)
}

// Chuqur (ichma-ich) diff — faqat haqiqatan o'zgargan maydonlar
function chuqurDiff(eski: any, yangi: any): Record<string, { eski: any; yangi: any }> {
  const farq: any = {};
  const kalitlar = new Set([...Object.keys(eski ?? {}), ...Object.keys(yangi ?? {})]);
  for (const k of kalitlar) {
    const e = eski?.[k], y = yangi?.[k];
    if (JSON.stringify(e) !== JSON.stringify(y)) {     // qiymat farq qilsa (obyekt ham)
      farq[k] = { eski: e, yangi: y };                 // "narx: 50000  30000"
    }
  }
  return farq;
}

// Maxfiy maydonlarni yashirish (rekursiv — ichki obyektlar ham — 2.9, 14)
const SIRLAR = ["parol", "password", "token", "refreshToken", "secret", "cardNumber"];
function sirYashir(obj: any): any {
  if (Array.isArray(obj)) return obj.map(sirYashir);
  if (obj && typeof obj === "object") {
    return Object.fromEntries(Object.entries(obj).map(([k, v]) =>
      SIRLAR.includes(k) ? [k, "***REDACTED***"] : [k, sirYashir(v)],   // yashirilgan (14)
    ));
  }
  return obj;
}
//  Diff'da ham, saqlashda ham sir chiqmasligi kerak (hatto ichki obyektda)

 qo'lda yozish (unutiladi — 2.4)
 avtomatik (interceptor/subscriber)

 UPDATE/DELETE mumkin (dalil emas — 2.6)
 immutable (faqat insert)

 parol/token qiymati (14, 2.9)
 tozalash (faqat hodisa)

 nima o'zgargani noma'lum (2.5)
 eskiyangi (diff)

 rotatsiya/o'chish (dalil yo'qoladi — 2.1)
 doimiy DB (compliance muddatigacha)

 sinxron insert (foydalanuvchi sekinlashuvni sezadi — 2.11)
 async (event/queue — fon vazifasi)

 req.user yo'q (DB darajasi)  userId null (kim noma'lum — 2.10)
 request context (cls/AsyncLocalStorage) — userId topiladi

 audit yozuvini o'chirish (dalil yo'qoladi — 2.6)
 userId anonimlashtiriladi (yozuv qoladi, shaxs emas — 2.14)