@cap-js/audit-logging 0.3.1 → 0.4.0

package/CHANGELOG.md

@@ -0,0 +1,85 @@
+# Change Log
+
+All notable changes to this project will be documented in this file.
+This project adheres to [Semantic Versioning](http://semver.org/).
+The format is based on [Keep a Changelog](http://keepachangelog.com/).
+
+## Version 0.4.0 - 2023-10-24
+
+### Added
+
+- Support for Premium plan of SAP Audit Log Service
+- Support for XSUAA credential type `x509`
+- Support for generic outbox
+
+### Changed
+
+- Always use outbox (as configured in project)
+
+### Fixed
+
+- Avoid dangling `SELECT`s to resolve data subject IDs, which resulted in "Transaction already closed" errors
+
+## Version 0.3.2 - 2023-10-11
+
+### Fixed
+
+- If the request has no tenant (e.g., Unauthorized), the audit log shall be sent to the provider account
+
+## Version 0.3.1 - 2023-09-25
+
+### Fixed
+
+- Defaulting of `@PersonalData.DataSubjectRole` to entity name
+- Overriding service configuration
+
+## Version 0.3.0 - 2023-09-05
+
+### Changed
+
+- Default value for `cds.requires['audit-log'].handle` changed to `['READ', 'WRITE']`, i.e., accessing sensitive data is now logged by default.
+
+## Version 0.2.0 - 2023-09-01
+
+### Added
+
+- Export class `AuditLogService` for extending in custom implementations as follows:
+  ```js
+  const { AuditLogService } = require('@cap-js/audit-logging')
+  class MyAuditLogService extends AuditLogService {
+    async init() {
+      [...]
+      // call AuditLogService's init
+      await super.init()
+    }
+  }
+  module.exports = MyAuditLogService
+  ```
+
+## Version 0.1.0 - 2023-08-18
+
+### Added
+
+- New API:
+  - `await audit.log('<event>', <data>)` for asynchronous logs (cf. `emit`)
+  - `await audit.logSync('<event>', <data>)` for synchronous logs (cf. `send`)
+- New REST API-based schema with auto-filled `LogEntry` aspect
+- New events `SensitiveDataRead`, `PersonalDataModified`, `ConfigurationModified`, and `SecurityEvent`
+- Full support for OAuth2 plan of SAP Audit Log Service
+
+### Changed
+
+- Whether reading sensitive data and modifying personal data is logged is determined by `cds.requires['audit-log'].handle: [...]`.
+  Possible values in the array are `READ` and/ or `WRITE`, with `WRITE` as the sole default entry.
+  Hence, accessing sensitive data is not logged by default.
+- Integration with SAP Audit Log Service via REST API instead of client library (`@sap/audit-logging`)
+
+### Fixed
+
+- Various glitches in log calculation
+
+### Removed
+
+- Old events `dataAccessLog`, `dataModificationLog`, `configChangeLog`, and `securityLog`
+- `@AuditLog.Operation` annotations are ignored. Having the plugin as dependency signals the intent to audit log.
+- `cds.features.audit_personal_data: true` is no longer necessary. Instead, simply add the plugin as a dependency.

package/README.md

@@ -3,7 +3,7 @@
 
 ## About this project
 
-`@cap-js/audit-logging` is a CDS plugin providing integration to the SAP BTP Audit Logging Service as well as out-of-the-box personal data-related audit logging based on annotations.
+`@cap-js/audit-logging` is a CDS plugin providing integration to the SAP Audit Log service as well as out-of-the-box personal data-related audit logging based on annotations.
 
 Documentation can be found at [cap.cloud.sap](https://cap.cloud.sap/docs/guides/data-privacy).
 

package/lib/access.js

@@ -11,7 +11,7 @@ const {
   addObjectID,
   addDataSubject,
   addDataSubjectForDetailsEntity,
-  resolveDataSubjectPromises
+  resolveDataSubjects
 } = require('./utils')
 
 let audit
@@ -59,7 +59,11 @@ const auditAccess = async function (data, req) {
   const _data = Array.isArray(data) ? data : [data]
   _data.forEach(row => templateProcessor({ processFn: _processorFnAccess(accessLogs, this.model, req), row, template }))
 
-  const accesses = (await resolveDataSubjectPromises(accessLogs)).filter(ele => ele.attributes.length)
+  for (const each of Object.keys(accessLogs)) if (!accessLogs[each].attributes.length) delete accessLogs[each]
+  if (!Object.keys(accessLogs).length) return
+
+  await resolveDataSubjects(accessLogs, req)
+  const accesses = Object.values(accessLogs).filter(ele => ele.attributes.length)
   if (!accesses.length) return
 
   audit = audit || (await cds.connect.to('audit-log'))

package/lib/modification.js

@@ -12,7 +12,7 @@ const {
   addObjectID,
   addDataSubject,
   addDataSubjectForDetailsEntity,
-  resolveDataSubjectPromises
+  resolveDataSubjects
 } = require('./utils')
 
 let audit
@@ -152,7 +152,7 @@ const _calcModificationLogsHandler = async function (req, beforeWrite, that) {
 
   // execute the data subject promises before going along to on phase
   // guarantees that the reads are executed before the data is modified
-  await resolveDataSubjectPromises(modificationLogs)
+  await resolveDataSubjects(modificationLogs, req)
 }
 
 const calcModLogs4Before = function (req) {

package/lib/utils.js

@@ -5,12 +5,14 @@ const hasPersonalData = entity => {
   // default role to entity name
   if (entity['@PersonalData.EntitySemantics'] === 'DataSubject' && !entity['@PersonalData.DataSubjectRole'])
     entity['@PersonalData.DataSubjectRole'] = entity.name.match(/\w+/g).pop()
-  return !!Object.values(entity.elements).some(
-    element =>
-      element['@PersonalData.IsPotentiallyPersonal'] ||
-      element['@PersonalData.IsPotentiallySensitive'] ||
-      (element['@PersonalData.FieldSemantics'] && element['@PersonalData.FieldSemantics'] === 'DataSubjectID')
-  )
+  // prettier-ignore
+  const hasPersonalData = !!Object.values(entity.elements).some(element =>
+    element['@PersonalData.IsPotentiallyPersonal'] ||
+    element['@PersonalData.IsPotentiallySensitive'] ||
+    (element['@PersonalData.FieldSemantics'] && element['@PersonalData.FieldSemantics'] === 'DataSubjectID'))
+  // cache result
+  entity.own('_hasPersonalData', () => hasPersonalData)
+  return hasPersonalData
 }
 
 const getMapKeyForCurrentRequest = req => {
@@ -118,22 +120,19 @@ const _buildSubSelect = (model, { entity, relative, element, next }, row, previo
   return childCqn
 }
 
-const _getDataSubjectIdPromise = ({ dataSubjectEntity, subs }, row, model) => {
+const _getDataSubjectIdQuery = ({ dataSubjectEntity, subs }, row, model) => {
   const keys = Object.values(dataSubjectEntity.keys)
   const as = _alias(dataSubjectEntity)
 
-  const cqn = SELECT.from({ ref: [dataSubjectEntity.name], as })
+  const cqn = SELECT.one
+    .from({ ref: [dataSubjectEntity.name], as })
     .columns(_keyColumns(keys, as))
     .where(['exists', _buildSubSelect(model, subs[0], row)])
 
   // entity reused in different branches => must check all
   for (let i = 1; i < subs.length; i++) cqn.or(['exists', _buildSubSelect(model, subs[i], row)])
 
-  return cqn.then(res => {
-    const id = {}
-    for (const k in res[0]) id[k] = res[0][k]
-    return id
-  })
+  return cqn
 }
 
 const _getUps = (entity, model) => {
@@ -194,6 +193,14 @@ const getDataSubject = (entity, model) => {
   return entity.set(hash, dataSubjectInfo)
 }
 
+const _getDataSubjectsMap = req => {
+  const mapKey = getMapKeyForCurrentRequest(req)
+  const _audit = (req.context._audit ??= {})
+  if (!_audit.dataSubjects) _audit.dataSubjects = new Map()
+  if (!_audit.dataSubjects.has(mapKey)) _audit.dataSubjects.set(mapKey, new Map())
+  return _audit.dataSubjects.get(mapKey)
+}
+
 const addDataSubjectForDetailsEntity = (row, log, req, entity, model) => {
   const dataSubjectInfo = getDataSubject(entity, model)
   const role = dataSubjectInfo.dataSubjectEntity['@PersonalData.DataSubjectRole']
@@ -203,24 +210,26 @@ const addDataSubjectForDetailsEntity = (row, log, req, entity, model) => {
    * for each req (cf. $batch with atomicity) and data subject role (e.g., customer vs supplier),
    * store (in audit data structure at context) and reuse a single promise to look up the respective data subject
    */
-  const mapKey = getMapKeyForCurrentRequest(req)
-  const _audit = (req.context._audit ??= {})
-  if (!_audit.dataSubjects) _audit.dataSubjects = new Map()
-  if (!_audit.dataSubjects.has(mapKey)) _audit.dataSubjects.set(mapKey, new Map())
-  const map = _audit.dataSubjects.get(mapKey)
+  const map = _getDataSubjectsMap(req)
   if (map.has(role)) log.data_subject.id = map.get(role)
   // REVISIT by downward lookups row might already contain ID - some potential to optimize
-  else map.set(role, _getDataSubjectIdPromise(dataSubjectInfo, row, model))
-}
-
-const resolveDataSubjectPromises = log => {
-  const logs = Object.values(log)
-  return Promise.all(logs.map(log => log.data_subject.id)).then(IDs =>
-    logs.map((log, i) => {
-      log.data_subject.id = IDs[i]
-      return log
-    })
-  )
+  else map.set(role, _getDataSubjectIdQuery(dataSubjectInfo, row, model))
+}
+
+const resolveDataSubjects = async (logs, req) => {
+  const map = _getDataSubjectsMap(req)
+  for (const each of Object.values(logs)) {
+    if (each.data_subject.id instanceof cds.ql.Query) {
+      const q = each.data_subject.id
+      if (map.has(q)) {
+        each.data_subject.id = map.get(q)
+      } else {
+        const res = await q
+        map.set(q, res)
+        each.data_subject.id = res
+      }
+    }
+  }
 }
 
 module.exports = {
@@ -232,5 +241,5 @@ module.exports = {
   addObjectID,
   addDataSubject,
   addDataSubjectForDetailsEntity,
-  resolveDataSubjectPromises
+  resolveDataSubjects
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cap-js/audit-logging",
-  "version": "0.3.1",
+  "version": "0.4.0",
   "description": "CDS plugin providing integration to the SAP Audit Log service as well as out-of-the-box personal data-related audit logging based on annotations.",
   "repository": "cap-js/audit-logging",
   "author": "SAP SE (https://www.sap.com)",
@@ -9,7 +9,8 @@
   "main": "cds-plugin.js",
   "files": [
     "lib",
-    "srv"
+    "srv",
+    "CHANGELOG.md"
   ],
   "scripts": {
     "lint": "npx eslint .",
@@ -19,9 +20,9 @@
     "@sap/cds": "^7"
   },
   "devDependencies": {
+    "@cap-js/audit-logging": "file:.",
     "@cap-js/sqlite": "^1",
     "axios": "^1",
-    "better-sqlite3": "8.5.2",
     "eslint": "^8",
     "express": "^4",
     "jest": "^29"
@@ -33,6 +34,7 @@
           "READ",
           "WRITE"
         ],
+        "outbox": true,
         "[development]": {
           "kind": "audit-log-to-console"
         },
@@ -42,15 +44,13 @@
       },
       "kinds": {
         "audit-log-to-console": {
-          "impl": "@cap-js/audit-logging/srv/log2console",
-          "outbox": false
+          "impl": "@cap-js/audit-logging/srv/log2console"
         },
         "audit-log-to-restv2": {
           "impl": "@cap-js/audit-logging/srv/log2restv2",
           "vcap": {
             "label": "auditlog"
-          },
-          "outbox": true
+          }
         }
       }
     }

package/srv/log2restv2.js

@@ -9,12 +9,13 @@ module.exports = class AuditLog2RESTv2 extends AuditLogService {
     // credentials stuff
     const { credentials } = this.options
     if (!credentials) throw new Error('No or malformed credentials for "audit-log"')
-    if (credentials.uaa) {
-      this._oauth2 = true
-      this._tokens = new Map()
-      this._providerTenant = credentials.uaa.tenantid
-    } else {
+    if (!credentials.uaa) {
+      this._plan = 'standard'
       this._auth = 'Basic ' + Buffer.from(credentials.user + ':' + credentials.password).toString('base64')
+    } else {
+      this._plan = credentials.url.match(/6081/) ? 'premium' : 'oauth2'
+      this._tokens = new Map()
+      this._provider = credentials.uaa.tenantid
     }
     this._vcap = process.env.VCAP_APPLICATION ? JSON.parse(process.env.VCAP_APPLICATION) : null
 
@@ -49,26 +50,29 @@ module.exports = class AuditLog2RESTv2 extends AuditLogService {
     const { _tokens: tokens } = this
     if (tokens.has(tenant)) return tokens.get(tenant)
 
-    const url = this.options.credentials.uaa.url + '/oauth/token'
-    const data = {
-      grant_type: 'client_credentials',
-      response_type: 'token',
-      client_id: this.options.credentials.uaa.clientid,
-      client_secret: this.options.credentials.uaa.clientsecret
+    const { uaa } = this.options.credentials
+    const url = (uaa.certurl || uaa.url) + '/oauth/token'
+    const data = { grant_type: 'client_credentials', response_type: 'token', client_id: uaa.clientid }
+    const options = { headers: { 'content-type': 'application/x-www-form-urlencoded' } }
+    if (tenant !== this._provider) options.headers['x-zid'] = tenant
+    // certificate or secret?
+    if (uaa['credential-type'] === 'x509') {
+      options.agent = new https.Agent({ cert: uaa.certificate, key: uaa.key })
+    } else {
+      data.client_secret = uaa.clientsecret
     }
     const urlencoded = Object.keys(data).reduce((acc, cur) => {
       acc += (acc ? '&' : '') + cur + '=' + data[cur]
       return acc
     }, '')
-    const headers = { 'content-type': 'application/x-www-form-urlencoded' }
-    if (tenant !== this._providerTenant) headers['x-zid'] = tenant
     try {
-      const { access_token, expires_in } = await _post(url, urlencoded, headers)
+      const { access_token, expires_in } = await _post(url, urlencoded, options)
       tokens.set(tenant, access_token)
       // remove token from cache 60 seconds before it expires
       setTimeout(() => tokens.delete(tenant), (expires_in - 60) * 1000)
       return access_token
     } catch (err) {
+      LOG._trace && LOG.trace('error during token fetch:', err)
       // 401 could also mean x-zid is not valid
       if (String(err.response?.statusCode).match(/^4\d\d$/)) err.unrecoverable = true
       throw err
@@ -76,25 +80,30 @@ module.exports = class AuditLog2RESTv2 extends AuditLogService {
   }
 
   async _send(data, path) {
-    let url
     const headers = { 'content-type': 'application/json' }
-    // TODO: what are these for?
     if (this._vcap) {
       headers.XS_AUDIT_ORG = this._vcap.organization_name
       headers.XS_AUDIT_SPACE = this._vcap.space_name
       headers.XS_AUDIT_APP = this._vcap.application_name
     }
-    if (this._oauth2) {
-      url = this.options.credentials.url + PATHS.OAUTH2[path]
-      headers.authorization = 'Bearer ' + (await this._getToken(data.tenant))
-      data.tenant = data.tenant === this._providerTenant ? '$PROVIDER' : '$SUBSCRIBER'
-    } else {
+    let url
+    if (this._plan === 'standard') {
       url = this.options.credentials.url + PATHS.STANDARD[path]
       headers.authorization = this._auth
+    } else {
+      url = this.options.credentials.url + PATHS.OAUTH2[path]
+      data.tenant ??= this._provider //> if request has no tenant, stay in provider account
+      headers.authorization = 'Bearer ' + (await this._getToken(data.tenant))
+      data.tenant = data.tenant === this._provider ? '$PROVIDER' : '$SUBSCRIBER'
+    }
+    if (LOG._debug) {
+      const _headers = Object.assign({}, headers, { authorization: headers.authorization.split(' ')[0] + ' ***' })
+      LOG.debug(`sending audit log to ${url} with tenant "${data.tenant}", user "${data.user}", and headers`, _headers)
     }
     try {
-      await _post(url, data, headers)
+      await _post(url, data, { headers })
     } catch (err) {
+      LOG._trace && LOG.trace('error during log send:', err)
       // 429 (rate limit) is not unrecoverable
       if (String(err.response?.statusCode).match(/^4\d\d$/) && err.response?.statusCode !== 429)
         err.unrecoverable = true
@@ -137,9 +146,10 @@ const PATHS = {
 
 const https = require('https')
 
-async function _post(url, data, headers) {
+async function _post(url, data, options) {
+  options.method ??= 'POST'
   return new Promise((resolve, reject) => {
-    const req = https.request(url, { method: 'POST', headers }, res => {
+    const req = https.request(url, options, res => {
       const chunks = []
       res.on('data', chunk => chunks.push(chunk))
       res.on('end', () => {

package/srv/service.js

@@ -1,10 +1,11 @@
 const cds = require('@sap/cds')
 
-// REVISIT: cds.OutboxService or technique to avoid extending OutboxService
-const OutboxService = require('@sap/cds/libx/_runtime/messaging/Outbox')
+const Base = cds.outboxed ? cds.Service : require('@sap/cds/libx/_runtime/messaging/Outbox')
 
-module.exports = class AuditLogService extends OutboxService {
+module.exports = class AuditLogService extends Base {
   async init() {
+    const outboxed = this.immediate instanceof cds.Service
+
     // add common audit log entry fields
     this.before('*', req => {
       const { tenant, user, timestamp: time } = cds.context
@@ -16,6 +17,10 @@ module.exports = class AuditLogService extends OutboxService {
 
     // add self-explanatory api (await audit.log/logSync(event, data))
     this.log = this.emit
-    this.logSync = this.send
+    // NOTE: logSync is not a public API!
+    this.logSync = (...args) => {
+      if (outboxed) return this.immediate.send(...args)
+      return this.send(...args)
+    }
   }
 }