@cap-js/audit-logging 0.5.2 → 0.7.0

package/CHANGELOG.md

@@ -4,6 +4,23 @@ All notable changes to this project will be documented in this file.
 This project adheres to [Semantic Versioning](http://semver.org/).
 The format is based on [Keep a Changelog](http://keepachangelog.com/).
 
+## Version 0.7.0 - tbd
+
+### Added
+
+- Automatically promote entities that are associated with data subjects
+
+## Version 0.6.0 - 2024-02-05
+
+### Added
+
+- Support for @sap/cds^7.5
+
+### Fixed
+
+- Automatic personal data modification logging for data subject details with renamed keys
+- Data subject resolution in circular models
+
 ## Version 0.5.2 - 2023-12-08
 
 ### Fixed

package/cds-plugin.js

@@ -19,6 +19,20 @@ cds.on('served', services => {
     for (const entity of service.entities) if (hasPersonalData(entity)) relevantEntities.push(entity)
     if (!relevantEntities.length) continue
 
+    // automatically promote entities that are associated with data subjects
+    for (const entity of relevantEntities) {
+      if (entity['@PersonalData.EntitySemantics'] !== 'DataSubject') continue
+      for (const e of service.entities) {
+        for (const k in e.associations) {
+          if (e.associations[k].target === entity.name && k !== 'SiblingEntity') {
+            e['@PersonalData.EntitySemantics'] ??= 'Other'
+            e.associations[k]['@PersonalData.FieldSemantics'] ??= 'DataSubjectID'
+            if (!relevantEntities.includes(e)) relevantEntities.push(e)
+          }
+        }
+      }
+    }
+
     for (const entity of relevantEntities) {
       /*
        * data access

package/lib/utils.js

@@ -1,18 +1,27 @@
 const WRITE = { CREATE: 1, UPDATE: 1, DELETE: 1 }
 
+const $hasPersonalData = Symbol('@cap-js/audit-logging:hasPersonalData')
+const $dataSubject = Symbol('@cap-js/audit-logging:dataSubject')
+const $parents = Symbol('@cap-js/audit-logging:parents')
+const $visitedUp = Symbol('@cap-js/audit-logging:visitedUp')
+const $visitedDown = Symbol('@cap-js/audit-logging:visitedDown')
+
 const hasPersonalData = entity => {
-  if (!entity['@PersonalData.EntitySemantics']) return
-  // default role to entity name
-  if (entity['@PersonalData.EntitySemantics'] === 'DataSubject' && !entity['@PersonalData.DataSubjectRole'])
-    entity['@PersonalData.DataSubjectRole'] = entity.name.match(/\w+/g).pop()
-  // prettier-ignore
-  const hasPersonalData = !!Object.values(entity.elements).some(element =>
-    element['@PersonalData.IsPotentiallyPersonal'] ||
-    element['@PersonalData.IsPotentiallySensitive'] ||
-    (element['@PersonalData.FieldSemantics'] && element['@PersonalData.FieldSemantics'] === 'DataSubjectID'))
-  // cache result
-  entity.own('_hasPersonalData', () => hasPersonalData)
-  return hasPersonalData
+  if (!entity.own($hasPersonalData)) {
+    if (!entity['@PersonalData.EntitySemantics']) entity.set($hasPersonalData, false)
+    else {
+      // default role to entity name
+      if (entity['@PersonalData.EntitySemantics'] === 'DataSubject' && !entity['@PersonalData.DataSubjectRole'])
+        entity['@PersonalData.DataSubjectRole'] = entity.name.match(/\w+/g).pop()
+      // prettier-ignore
+      const hasPersonalData = !!Object.values(entity.elements).some(element =>
+        element['@PersonalData.IsPotentiallyPersonal'] ||
+        element['@PersonalData.IsPotentiallySensitive'] ||
+        (element['@PersonalData.FieldSemantics'] && element['@PersonalData.FieldSemantics'] === 'DataSubjectID'))
+      entity.set($hasPersonalData, hasPersonalData)
+    }
+  }
+  return entity.own($hasPersonalData)
 }
 
 const getMapKeyForCurrentRequest = req => {
@@ -84,7 +93,7 @@ const _addKeysToWhere = (keys, row, alias) => {
     .filter(key => !key.isAssociation && key.name !== 'IsActiveEntity')
     .reduce((keys, key) => {
       if (keys.length) keys.push('and')
-      keys.push({ ref: [alias, key.name] }, '=', { val: row[key.name] })
+      keys.push({ ref: [alias, key.name] }, '=', { val: row[key.name] || row._old?.[key.name] })
       return keys
     }, [])
 }
@@ -136,21 +145,25 @@ const _getDataSubjectIdQuery = ({ dataSubjectEntity, subs }, row, model) => {
 }
 
 const _getUps = (entity, model) => {
-  if (entity.own('__parents')) return entity.__parents
+  if (entity.own($parents)) return entity[$parents]
   const ups = []
   for (const def of Object.values(model.definitions)) {
     if (def.kind !== 'entity' || !def.associations) continue
     for (const element of Object.values(def.associations)) {
-      if (element.target !== entity.name || element._isBacklink) continue
-      if (element.name === 'SiblingEntity') continue
+      if (element.target !== entity.name || element._isBacklink || element.name === 'SiblingEntity') continue
       ups.push(element)
     }
   }
-  return entity.set('__parents', ups)
+  return entity.set($parents, ups)
 }
 
-const _getDataSubjectUp = (model, entity, prev, next, result) => {
+const _getDataSubjectUp = (root, model, entity, prev, next, result) => {
   for (const element of _getUps(entity, model)) {
+    // cycle detection
+    if (!element.own($visitedUp)) element.set($visitedUp, new Set())
+    if (element.own($visitedUp).has(root)) continue
+    element.own($visitedUp).add(root)
+
     const me = { entity, relative: element.parent, element }
     if (prev) prev.next = me
     if (element.parent['@PersonalData.EntitySemantics'] === 'DataSubject') {
@@ -159,14 +172,15 @@ const _getDataSubjectUp = (model, entity, prev, next, result) => {
       return result
     } else {
       // dfs is a must here
-      result = _getDataSubjectUp(model, element.parent, me, next || me, result)
+      result = _getDataSubjectUp(root, model, element.parent, me, next || me, result)
     }
   }
   return result
 }
 
-const _getDataSubjectDown = (entity, prev, next) => {
+const _getDataSubjectDown = (root, entity, prev, next) => {
   const associations = Object.values(entity.associations || {}).filter(e => !e._isBacklink)
+  // bfs makes more sense here -> check all own assocs first before going deeper
   for (const element of associations) {
     const me = { entity, relative: entity, element }
     if (element._target['@PersonalData.EntitySemantics'] === 'DataSubject') {
@@ -174,23 +188,26 @@ const _getDataSubjectDown = (entity, prev, next) => {
       return { dataSubjectEntity: element._target, subs: [next || me] }
     }
   }
-  // bfs makes more sense here
   for (const element of associations) {
+    // cycle detection
+    if (!element.own($visitedDown)) element.set($visitedDown, new Set())
+    if (element.own($visitedDown).has(root)) continue
+    element.own($visitedDown).add(root)
+
     const me = { entity, relative: entity, element }
     if (prev) prev.next = me
-    const dataSubject = _getDataSubjectDown(element._target, me, next || me)
+    const dataSubject = _getDataSubjectDown(root, element._target, me, next || me)
     if (dataSubject) return dataSubject
   }
 }
 
 const getDataSubject = (entity, model) => {
-  const hash = '__dataSubject'
-  if (entity.own(hash)) return entity[hash]
+  if (entity.own($dataSubject)) return entity[$dataSubject]
   // entities with EntitySemantics 'DataSubjectDetails' or 'Other' must not necessarily
   // be always below or always above 'DataSubject' entity in CSN tree
-  let dataSubjectInfo = _getDataSubjectUp(model, entity)
-  if (!dataSubjectInfo) dataSubjectInfo = _getDataSubjectDown(entity)
-  return entity.set(hash, dataSubjectInfo)
+  let dataSubjectInfo = _getDataSubjectUp(entity.name, model, entity)
+  if (!dataSubjectInfo) dataSubjectInfo = _getDataSubjectDown(entity.name, entity)
+  return entity.set($dataSubject, dataSubjectInfo)
 }
 
 const _getDataSubjectsMap = req => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cap-js/audit-logging",
-  "version": "0.5.2",
+  "version": "0.7.0",
   "description": "CDS plugin providing integration to the SAP Audit Log service as well as out-of-the-box personal data-related audit logging based on annotations.",
   "repository": "cap-js/audit-logging",
   "author": "SAP SE (https://www.sap.com)",

package/srv/service.js

@@ -4,8 +4,6 @@ const Base = cds.outboxed ? cds.Service : require('@sap/cds/libx/_runtime/messag
 
 module.exports = class AuditLogService extends Base {
   async init() {
-    const outboxed = this.immediate instanceof cds.Service
-
     // add common audit log entry fields
     this.before('*', req => {
       const { tenant, user, timestamp } = cds.context
@@ -22,8 +20,9 @@ module.exports = class AuditLogService extends Base {
     this.log = this.emit
     // NOTE: logSync is not a public API!
     this.logSync = (...args) => {
-      if (outboxed) return this.immediate.send(...args)
-      return this.send(...args)
+      if (cds.unboxed) return cds.unboxed(this).send(...args) //> cds >= 7.5
+      if (this.immediate instanceof cds.Service) return this.immediate.send(...args) //> cds ~ 7.4
+      return this.send(...args) //> cds <= 7.3
     }
   }
 }