@cap-js/audit-logging 0.3.2 → 0.5.0

package/CHANGELOG.md

@@ -4,6 +4,28 @@ All notable changes to this project will be documented in this file.
 This project adheres to [Semantic Versioning](http://semver.org/).
 The format is based on [Keep a Changelog](http://keepachangelog.com/).
 
+## Version 0.5.0 - 2023-11-22
+
+### Added
+
+- Common log entry fields `uuid`, `tenant`, `user` and `time` can be provided manually
+
+## Version 0.4.0 - 2023-10-24
+
+### Added
+
+- Support for Premium plan of SAP Audit Log Service
+- Support for XSUAA credential type `x509`
+- Support for generic outbox
+
+### Changed
+
+- Always use outbox (as configured in project)
+
+### Fixed
+
+- Avoid dangling `SELECT`s to resolve data subject IDs, which resulted in "Transaction already closed" errors
+
 ## Version 0.3.2 - 2023-10-11
 
 ### Fixed

package/lib/access.js

@@ -11,7 +11,7 @@ const {
   addObjectID,
   addDataSubject,
   addDataSubjectForDetailsEntity,
-  resolveDataSubjectPromises
+  resolveDataSubjects
 } = require('./utils')
 
 let audit
@@ -59,7 +59,11 @@ const auditAccess = async function (data, req) {
   const _data = Array.isArray(data) ? data : [data]
   _data.forEach(row => templateProcessor({ processFn: _processorFnAccess(accessLogs, this.model, req), row, template }))
 
-  const accesses = (await resolveDataSubjectPromises(accessLogs)).filter(ele => ele.attributes.length)
+  for (const each of Object.keys(accessLogs)) if (!accessLogs[each].attributes.length) delete accessLogs[each]
+  if (!Object.keys(accessLogs).length) return
+
+  await resolveDataSubjects(accessLogs, req)
+  const accesses = Object.values(accessLogs).filter(ele => ele.attributes.length)
   if (!accesses.length) return
 
   audit = audit || (await cds.connect.to('audit-log'))

package/lib/modification.js

@@ -12,7 +12,7 @@ const {
   addObjectID,
   addDataSubject,
   addDataSubjectForDetailsEntity,
-  resolveDataSubjectPromises
+  resolveDataSubjects
 } = require('./utils')
 
 let audit
@@ -152,7 +152,7 @@ const _calcModificationLogsHandler = async function (req, beforeWrite, that) {
 
   // execute the data subject promises before going along to on phase
   // guarantees that the reads are executed before the data is modified
-  await resolveDataSubjectPromises(modificationLogs)
+  await resolveDataSubjects(modificationLogs, req)
 }
 
 const calcModLogs4Before = function (req) {

package/lib/utils.js

@@ -5,12 +5,14 @@ const hasPersonalData = entity => {
   // default role to entity name
   if (entity['@PersonalData.EntitySemantics'] === 'DataSubject' && !entity['@PersonalData.DataSubjectRole'])
     entity['@PersonalData.DataSubjectRole'] = entity.name.match(/\w+/g).pop()
-  return !!Object.values(entity.elements).some(
-    element =>
-      element['@PersonalData.IsPotentiallyPersonal'] ||
-      element['@PersonalData.IsPotentiallySensitive'] ||
-      (element['@PersonalData.FieldSemantics'] && element['@PersonalData.FieldSemantics'] === 'DataSubjectID')
-  )
+  // prettier-ignore
+  const hasPersonalData = !!Object.values(entity.elements).some(element =>
+    element['@PersonalData.IsPotentiallyPersonal'] ||
+    element['@PersonalData.IsPotentiallySensitive'] ||
+    (element['@PersonalData.FieldSemantics'] && element['@PersonalData.FieldSemantics'] === 'DataSubjectID'))
+  // cache result
+  entity.own('_hasPersonalData', () => hasPersonalData)
+  return hasPersonalData
 }
 
 const getMapKeyForCurrentRequest = req => {
@@ -118,22 +120,19 @@ const _buildSubSelect = (model, { entity, relative, element, next }, row, previo
   return childCqn
 }
 
-const _getDataSubjectIdPromise = ({ dataSubjectEntity, subs }, row, model) => {
+const _getDataSubjectIdQuery = ({ dataSubjectEntity, subs }, row, model) => {
   const keys = Object.values(dataSubjectEntity.keys)
   const as = _alias(dataSubjectEntity)
 
-  const cqn = SELECT.from({ ref: [dataSubjectEntity.name], as })
+  const cqn = SELECT.one
+    .from({ ref: [dataSubjectEntity.name], as })
     .columns(_keyColumns(keys, as))
     .where(['exists', _buildSubSelect(model, subs[0], row)])
 
   // entity reused in different branches => must check all
   for (let i = 1; i < subs.length; i++) cqn.or(['exists', _buildSubSelect(model, subs[i], row)])
 
-  return cqn.then(res => {
-    const id = {}
-    for (const k in res[0]) id[k] = res[0][k]
-    return id
-  })
+  return cqn
 }
 
 const _getUps = (entity, model) => {
@@ -194,6 +193,14 @@ const getDataSubject = (entity, model) => {
   return entity.set(hash, dataSubjectInfo)
 }
 
+const _getDataSubjectsMap = req => {
+  const mapKey = getMapKeyForCurrentRequest(req)
+  const _audit = (req.context._audit ??= {})
+  if (!_audit.dataSubjects) _audit.dataSubjects = new Map()
+  if (!_audit.dataSubjects.has(mapKey)) _audit.dataSubjects.set(mapKey, new Map())
+  return _audit.dataSubjects.get(mapKey)
+}
+
 const addDataSubjectForDetailsEntity = (row, log, req, entity, model) => {
   const dataSubjectInfo = getDataSubject(entity, model)
   const role = dataSubjectInfo.dataSubjectEntity['@PersonalData.DataSubjectRole']
@@ -203,24 +210,26 @@ const addDataSubjectForDetailsEntity = (row, log, req, entity, model) => {
    * for each req (cf. $batch with atomicity) and data subject role (e.g., customer vs supplier),
    * store (in audit data structure at context) and reuse a single promise to look up the respective data subject
    */
-  const mapKey = getMapKeyForCurrentRequest(req)
-  const _audit = (req.context._audit ??= {})
-  if (!_audit.dataSubjects) _audit.dataSubjects = new Map()
-  if (!_audit.dataSubjects.has(mapKey)) _audit.dataSubjects.set(mapKey, new Map())
-  const map = _audit.dataSubjects.get(mapKey)
+  const map = _getDataSubjectsMap(req)
   if (map.has(role)) log.data_subject.id = map.get(role)
   // REVISIT by downward lookups row might already contain ID - some potential to optimize
-  else map.set(role, _getDataSubjectIdPromise(dataSubjectInfo, row, model))
-}
-
-const resolveDataSubjectPromises = log => {
-  const logs = Object.values(log)
-  return Promise.all(logs.map(log => log.data_subject.id)).then(IDs =>
-    logs.map((log, i) => {
-      log.data_subject.id = IDs[i]
-      return log
-    })
-  )
+  else map.set(role, _getDataSubjectIdQuery(dataSubjectInfo, row, model))
+}
+
+const resolveDataSubjects = async (logs, req) => {
+  const map = _getDataSubjectsMap(req)
+  for (const each of Object.values(logs)) {
+    if (each.data_subject.id instanceof cds.ql.Query) {
+      const q = each.data_subject.id
+      if (map.has(q)) {
+        each.data_subject.id = map.get(q)
+      } else {
+        const res = await q
+        map.set(q, res)
+        each.data_subject.id = res
+      }
+    }
+  }
 }
 
 module.exports = {
@@ -232,5 +241,5 @@ module.exports = {
   addObjectID,
   addDataSubject,
   addDataSubjectForDetailsEntity,
-  resolveDataSubjectPromises
+  resolveDataSubjects
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cap-js/audit-logging",
-  "version": "0.3.2",
+  "version": "0.5.0",
   "description": "CDS plugin providing integration to the SAP Audit Log service as well as out-of-the-box personal data-related audit logging based on annotations.",
   "repository": "cap-js/audit-logging",
   "author": "SAP SE (https://www.sap.com)",
@@ -20,6 +20,7 @@
     "@sap/cds": "^7"
   },
   "devDependencies": {
+    "@cap-js/audit-logging": "file:.",
     "@cap-js/sqlite": "^1",
     "axios": "^1",
     "eslint": "^8",
@@ -33,6 +34,7 @@
           "READ",
           "WRITE"
         ],
+        "outbox": true,
         "[development]": {
           "kind": "audit-log-to-console"
         },
@@ -42,15 +44,13 @@
       },
       "kinds": {
         "audit-log-to-console": {
-          "impl": "@cap-js/audit-logging/srv/log2console",
-          "outbox": false
+          "impl": "@cap-js/audit-logging/srv/log2console"
         },
         "audit-log-to-restv2": {
           "impl": "@cap-js/audit-logging/srv/log2restv2",
           "vcap": {
             "label": "auditlog"
-          },
-          "outbox": true
+          }
         }
       }
     }

package/srv/log2restv2.js

@@ -9,12 +9,13 @@ module.exports = class AuditLog2RESTv2 extends AuditLogService {
     // credentials stuff
     const { credentials } = this.options
     if (!credentials) throw new Error('No or malformed credentials for "audit-log"')
-    if (credentials.uaa) {
-      this._oauth2 = true
-      this._tokens = new Map()
-      this._providerTenant = credentials.uaa.tenantid
-    } else {
+    if (!credentials.uaa) {
+      this._plan = 'standard'
       this._auth = 'Basic ' + Buffer.from(credentials.user + ':' + credentials.password).toString('base64')
+    } else {
+      this._plan = credentials.url.match(/6081/) ? 'premium' : 'oauth2'
+      this._tokens = new Map()
+      this._provider = credentials.uaa.tenantid
     }
     this._vcap = process.env.VCAP_APPLICATION ? JSON.parse(process.env.VCAP_APPLICATION) : null
 
@@ -49,21 +50,23 @@ module.exports = class AuditLog2RESTv2 extends AuditLogService {
     const { _tokens: tokens } = this
     if (tokens.has(tenant)) return tokens.get(tenant)
 
-    const url = this.options.credentials.uaa.url + '/oauth/token'
-    const data = {
-      grant_type: 'client_credentials',
-      response_type: 'token',
-      client_id: this.options.credentials.uaa.clientid,
-      client_secret: this.options.credentials.uaa.clientsecret
+    const { uaa } = this.options.credentials
+    const url = (uaa.certurl || uaa.url) + '/oauth/token'
+    const data = { grant_type: 'client_credentials', response_type: 'token', client_id: uaa.clientid }
+    const options = { headers: { 'content-type': 'application/x-www-form-urlencoded' } }
+    if (tenant !== this._provider) options.headers['x-zid'] = tenant
+    // certificate or secret?
+    if (uaa['credential-type'] === 'x509') {
+      options.agent = new https.Agent({ cert: uaa.certificate, key: uaa.key })
+    } else {
+      data.client_secret = uaa.clientsecret
     }
     const urlencoded = Object.keys(data).reduce((acc, cur) => {
       acc += (acc ? '&' : '') + cur + '=' + data[cur]
       return acc
     }, '')
-    const headers = { 'content-type': 'application/x-www-form-urlencoded' }
-    if (tenant !== this._providerTenant) headers['x-zid'] = tenant
     try {
-      const { access_token, expires_in } = await _post(url, urlencoded, headers)
+      const { access_token, expires_in } = await _post(url, urlencoded, options)
       tokens.set(tenant, access_token)
       // remove token from cache 60 seconds before it expires
       setTimeout(() => tokens.delete(tenant), (expires_in - 60) * 1000)
@@ -84,21 +87,21 @@ module.exports = class AuditLog2RESTv2 extends AuditLogService {
       headers.XS_AUDIT_APP = this._vcap.application_name
     }
     let url
-    if (this._oauth2) {
-      url = this.options.credentials.url + PATHS.OAUTH2[path]
-      data.tenant ??= this._providerTenant //> if request has no tenant, stay in provider account
-      headers.authorization = 'Bearer ' + (await this._getToken(data.tenant))
-      data.tenant = data.tenant === this._providerTenant ? '$PROVIDER' : '$SUBSCRIBER'
-    } else {
+    if (this._plan === 'standard') {
       url = this.options.credentials.url + PATHS.STANDARD[path]
       headers.authorization = this._auth
+    } else {
+      url = this.options.credentials.url + PATHS.OAUTH2[path]
+      data.tenant ??= this._provider //> if request has no tenant, stay in provider account
+      headers.authorization = 'Bearer ' + (await this._getToken(data.tenant))
+      data.tenant = data.tenant === this._provider ? '$PROVIDER' : '$SUBSCRIBER'
     }
     if (LOG._debug) {
       const _headers = Object.assign({}, headers, { authorization: headers.authorization.split(' ')[0] + ' ***' })
       LOG.debug(`sending audit log to ${url} with tenant "${data.tenant}", user "${data.user}", and headers`, _headers)
     }
     try {
-      await _post(url, data, headers)
+      await _post(url, data, { headers })
     } catch (err) {
       LOG._trace && LOG.trace('error during log send:', err)
       // 429 (rate limit) is not unrecoverable
@@ -143,9 +146,10 @@ const PATHS = {
 
 const https = require('https')
 
-async function _post(url, data, headers) {
+async function _post(url, data, options) {
+  options.method ??= 'POST'
   return new Promise((resolve, reject) => {
-    const req = https.request(url, { method: 'POST', headers }, res => {
+    const req = https.request(url, options, res => {
       const chunks = []
       res.on('data', chunk => chunks.push(chunk))
       res.on('end', () => {

package/srv/service.js

@@ -1,14 +1,18 @@
 const cds = require('@sap/cds')
 
-// REVISIT: cds.OutboxService or technique to avoid extending OutboxService
-const OutboxService = require('@sap/cds/libx/_runtime/messaging/Outbox')
+const Base = cds.outboxed ? cds.Service : require('@sap/cds/libx/_runtime/messaging/Outbox')
 
-module.exports = class AuditLogService extends OutboxService {
+module.exports = class AuditLogService extends Base {
   async init() {
+    const outboxed = this.immediate instanceof cds.Service
+
     // add common audit log entry fields
     this.before('*', req => {
-      const { tenant, user, timestamp: time } = cds.context
-      Object.assign(req.data, { uuid: cds.utils.uuid(), tenant, user: user.id, time })
+      const { tenant, user, timestamp } = cds.context
+      req.data.uuid ??= cds.utils.uuid()
+      req.data.tenant ??= tenant
+      req.data.user ??= user.id
+      req.data.time ??= timestamp
     })
 
     // call OutboxService's init
@@ -16,6 +20,10 @@ module.exports = class AuditLogService extends OutboxService {
 
     // add self-explanatory api (await audit.log/logSync(event, data))
     this.log = this.emit
-    this.logSync = this.send
+    // NOTE: logSync is not a public API!
+    this.logSync = (...args) => {
+      if (outboxed) return this.immediate.send(...args)
+      return this.send(...args)
+    }
   }
 }