fix: scope ledger hashes by organization

Author: miyaontherelay

packages/server/src/__tests__/attestations.test.ts

@@ -175,7 +175,7 @@ test("ledger chains are independent for each organization", async (t) => {
   const independent = await app.storage.attestations.appendAttestationLedgerEntry({
     orgId: "org_chain_b",
     entryType: "checkpoint",
-    payload: { event: "first", org: "org_chain_b" },
+    payload: { event: "first" },
     jws: "test-jws-b1",
     createdAt: "2000-01-01T00:00:00.000Z",
   });

packages/server/src/db/migrations/0007_attestation_ledger.sql

@@ -37,7 +37,7 @@ CREATE TABLE IF NOT EXISTS attestation_ledger (
   entry_hash TEXT NOT NULL CHECK (length(entry_hash) = 64),
   created_at TEXT NOT NULL,
   UNIQUE (org_id, org_seq),
-  UNIQUE (entry_hash)
+  UNIQUE (org_id, entry_hash)
 );
 
 CREATE INDEX IF NOT EXISTS idx_attestation_ledger_org_seq

packages/server/src/storage/sqlite.ts

@@ -478,7 +478,7 @@ const SELECT_ATTESTATION_LEDGER_ENTRY_BY_HASH_SQL = `
     seq, org_id, org_seq, entry_type, jti, commit_sha, repo, agent_id,
     sponsor_id, payload_json, jws, prev_hash, entry_hash, created_at
   FROM attestation_ledger
-  WHERE entry_hash = ?
+  WHERE org_id = ? AND entry_hash = ?
   LIMIT 1
 `;
 
@@ -2455,7 +2455,7 @@ class SqliteAttestationStorage implements AttestationStorage {
     const stored = hydrateAttestationLedgerEntry(
       db
         .prepare<AttestationLedgerRow>(SELECT_ATTESTATION_LEDGER_ENTRY_BY_HASH_SQL)
-        .get(entry.entryHash),
+        .get(entry.orgId, entry.entryHash),
     );
     if (!stored) {
       throw new Error("attestation ledger insert did not return a row");