Tamper-evident document audit trail

<?php

namespace App\Audit;

use Illuminate\Http\Request;
use Illuminate\Support\Facades\DB;

final class AuditTrail
{
    /** Append one event. The row lock keeps the chain linear under concurrent writers. */
    public static function record(int $documentId, string $action, array $meta = [], ?Request $request = null): void
    {
        DB::transaction(function () use ($documentId, $action, $meta, $request) {
            $prev = DB::table('audit_events')->where('document_id', $documentId)
                ->orderByDesc('id')->lockForUpdate()->value('hash');

            $row = [
                'document_id' => $documentId,
                'action' => $action,
                'meta' => $meta ? json_encode($meta, JSON_UNESCAPED_SLASHES) : null,
                'ip' => $request?->ip(),
                'user_agent' => $request ? mb_substr((string) $request->userAgent(), 0, 255) : null,
                'prev_hash' => $prev,
                'created_at' => now()->format('Y-m-d H:i:s.u'),
            ];
            $row['hash'] = self::digest($row);

            DB::table('audit_events')->insert($row);
        });
    }

    /** Returns the id of the first broken row, or null when the whole chain is intact. */
    public static function verify(int $documentId): ?int
    {
        $prev = null;

        foreach (DB::table('audit_events')->where('document_id', $documentId)->orderBy('id')->cursor() as $e) {
            $row = (array) $e;
            $stored = $row['hash'];
            unset($row['id'], $row['hash']);

            if ($row['prev_hash'] !== $prev || ! hash_equals($stored, self::digest($row))) {
                return $e->id;
            }
            $prev = $stored;
        }

        return null;
    }

    private static function digest(array $row): string
    {
        ksort($row);
        unset($row['hash']);

        return hash('sha256', json_encode($row));
    }
}

<?php

use Illuminate\Database\Migrations\Migration;
use Illuminate\Database\Schema\Blueprint;
use Illuminate\Support\Facades\Schema;

return new class extends Migration
{
    public function up(): void
    {
        Schema::create('audit_events', function (Blueprint $t) {
            $t->id();
            $t->unsignedBigInteger('document_id')->index();
            $t->string('action', 40);               // viewed, signed, declined ...
            $t->json('meta')->nullable();
            $t->string('ip', 45)->nullable();
            $t->string('user_agent', 255)->nullable();
            $t->char('prev_hash', 64)->nullable();  // hash of the previous row
            $t->char('hash', 64);                   // sha256 of this row + prev_hash
            $t->timestamp('created_at', 6);
        });
    }
};