@cap-js/audit-logging 0.8.0 → 0.8.2

package/CHANGELOG.md

@@ -4,6 +4,21 @@ All notable changes to this project will be documented in this file.
 This project adheres to [Semantic Versioning](http://semver.org/).
 The format is based on [Keep a Changelog](http://keepachangelog.com/).
 
+## Version 0.8.2 - 2024-11-27
+
+### Fixed
+
+- Erroneous modification log for non-updated key properties
+- Error during non-modifying queries on database level
+- Specify charset UTF-8 for requests to SAP Audit Log Service
+
+## Version 0.8.1 - 2024-09-13
+
+### Fixed
+
+- Support for @sap/cds^8.2
+- Reduce clutter in error raised for outbound requests
+
 ## Version 0.8.0 - 2024-05-24
 
 ### Added

package/README.md

@@ -1,4 +1,5 @@
 # Welcome to @cap-js/audit-logging
+
 [![REUSE status](https://api.reuse.software/badge/github.com/cap-js/audit-logging)](https://api.reuse.software/info/github.com/cap-js/audit-logging)
 
 `@cap-js/audit-logging` is a CDS plugin providing integration to the SAP Audit Log service as well as out-of-the-box personal data-related audit logging based on annotations.
@@ -19,18 +20,22 @@ cd incidents-app
 npm i
 ```
 
+
 ## Setup
+
 To enable audit logging, simply add this self-configuring plugin package to your project:
 
 ```sh
 npm add @cap-js/audit-logging
 ```
 
+
 ## Annotate Personal Data
+
 Identify entities and elements (potentially) holding personal data using `@PersonalData` annotations. Create a `db/data-privacy.cds` file and add the following:
 
 ```cds
-using { sap.capire.incidents as my } from '../db/extensions';
+using { sap.capire.incidents as my } from './schema';
 
 annotate my.Customers with @PersonalData : {
   DataSubjectRole : 'Customer',
@@ -69,6 +74,7 @@ Learn more about the annotations in capire:
 
 
 ## Test-Drive Locally
+
 You've prepared everything to log personal data-related events. Let's see that in action.
 
 Start the server as usual:
@@ -78,36 +84,36 @@ cds watch
 
 Send an update request that changes personal data:
 ```http
-PATCH http://localhost:4004/admin/Customers(8e2f2640-6866-4dcf-8f4d-3027aa831cad) HTTP/1.1
+PATCH http://localhost:4004/odata/v4/admin/Customers('1004155')
 Authorization: Basic alice:in-wonderland
 Content-Type: application/json
 
 {
-  "firstName": "Johnny",
-  "lastName": "Doey"
+  "firstName": "Danny",
+  "lastName": "Joules"
 }
 ```
 
 See the audit logs in the server's console output:
 ```sh
-{
+[audit-log] - PersonalDataModified: {
   data_subject: {
-    type: 'AdminService.Customers',
-    id: { ID: '8e2f2640-6866-4dcf-8f4d-3027aa831cad' },
+    id: { ID: '1004155' },
     role: 'Customer',
+    type: 'AdminService.Customers'
   },
   object: {
    type: 'AdminService.Customers',
-   id: { ID: '8e2f2640-6866-4dcf-8f4d-3027aa831cad' }
+   id: { ID: '1004155' }
   },
   attributes: [
-    { name: 'firstName', old: 'John', new: 'Johnny' },
-    { name: 'lastName', old: 'Doe', new: 'Doey' }
+    { name: 'firstName', old: 'Daniel', new: 'Danny' },
+    { name: 'lastName', old: 'Watts', new: 'Joules' }
   ],
-  user: 'alice',
+  uuid: '71fa93d9-c993-405f-ba1b-a9ef42668199',
   tenant: 't1',
-  uuid: '1391A703E2CBE52E817269EC7527368C',
-  time: '2023-02-26T08:13:48.287Z'
+  user: 'alice',
+  time: 2023-02-26T08:13:48.287Z
 }
 ```
 
@@ -120,14 +126,17 @@ The end-to-end out-of-the-box functionality provided by this plugin requires a p
 
 [_Learn more about custom audit logging._](https://cap.cloud.sap/docs/guides/data-privacy/audit-logging#custom-audit-logging)
 
+
 ## Support, Feedback, Contributing
 
 This project is open to feature requests/suggestions, bug reports etc. via [GitHub issues](https://github.com/cap-js/audit-logging/issues). Contribution and feedback are encouraged and always welcome. For more information about how to contribute, the project structure, as well as additional contribution information, see our [Contribution Guidelines](CONTRIBUTING.md).
 
+
 ## Code of Conduct
 
 We as members, contributors, and leaders pledge to make participation in our community a harassment-free experience for everyone. By participating in this project, you agree to abide by its [Code of Conduct](CODE_OF_CONDUCT.md) at all times.
 
+
 ## Licensing
 
 Copyright 2023 SAP SE or an SAP affiliate company and contributors. Please see our [LICENSE](LICENSE) for copyright and license information. Detailed information including third-party components and their licensing/copyright information is available [via the REUSE tool](https://api.reuse.software/info/github.com/cap-js/audit-logging).

package/lib/access.js

@@ -2,7 +2,6 @@ const cds = require('@sap/cds')
 
 // REVISIT: don't require internal stuff
 const getTemplate = require('@sap/cds/libx/_runtime/common/utils/template')
-const templateProcessor = require('@sap/cds/libx/_runtime/common/utils/templateProcessor')
 
 const {
   getRootEntity,
@@ -56,8 +55,16 @@ const auditAccess = async function (data, req) {
   if (!template.elements.size) return
 
   const accessLogs = {}
-  const _data = Array.isArray(data) ? data : [data]
-  _data.forEach(row => templateProcessor({ processFn: _processorFnAccess(accessLogs, this.model, req), row, template }))
+  const processFn = _processorFnAccess(accessLogs, this.model, req)
+  // cds internal templating mechanism api changed in 8.2.0 -> polyfill
+  if (!template.process) {
+    module.exports._templateProcessor ??= require('@sap/cds/libx/_runtime/common/utils/templateProcessor')
+    template.process = (data, processFn) => {
+      const _data = Array.isArray(data) ? data : [data]
+      _data.forEach(row => module.exports._templateProcessor({ processFn, row, template }))
+    }
+  }
+  template.process(data, processFn)
 
   for (const each of Object.keys(accessLogs)) if (!accessLogs[each].attributes.length) delete accessLogs[each]
   if (!Object.keys(accessLogs).length) return

package/lib/modification.js

@@ -2,7 +2,6 @@ const cds = require('@sap/cds')
 
 // REVISIT: don't require internal stuff
 const getTemplate = require('@sap/cds/libx/_runtime/common/utils/template')
-const templateProcessor = require('@sap/cds/libx/_runtime/common/utils/templateProcessor')
 
 const {
   getMapKeyForCurrentRequest,
@@ -77,7 +76,7 @@ const addDiffToCtx = async function (req) {
   if (!_audit.diffs) _audit.diffs = new Map()
 
   // get diff
-  let diff = await req.diff()
+  let diff = (await req.diff()) || {}
   diff = _getDataWithAppliedTransitions(diff, req)
 
   // add keys, if necessary
@@ -89,9 +88,9 @@ const addDiffToCtx = async function (req) {
 }
 addDiffToCtx._initial = true
 
-const _getOldAndNew = (action, row, key) => {
+const _getOldAndNew = (action, row, key, entity) => {
   let oldValue = action === 'Create' ? null : row._old && row._old[key]
-  if (oldValue === undefined) oldValue = null
+  if (oldValue === undefined) oldValue = action === 'Update' && key in entity.keys ? row[key] : null
   else if (Array.isArray(oldValue)) oldValue = JSON.stringify(oldValue)
   let newValue = action === 'Delete' ? null : row[key]
   if (newValue === undefined) newValue = null
@@ -99,9 +98,9 @@ const _getOldAndNew = (action, row, key) => {
   return { oldValue, newValue }
 }
 
-const _addAttribute = (log, action, row, key) => {
+const _addAttribute = (log, action, row, key, entity) => {
   if (!log.attributes.find(ele => ele.name === key)) {
-    const { oldValue, newValue } = _getOldAndNew(action, row, key)
+    const { oldValue, newValue } = _getOldAndNew(action, row, key, entity)
     if (oldValue !== newValue) {
       const attr = { name: key }
       if (action !== 'Create') attr.old = oldValue
@@ -140,7 +139,7 @@ const _processorFnModification = (modificationLogs, model, req, beforeWrite) =>
     } else if (category === 'DataSubjectID') {
       addDataSubject(modificationLog, row, key, entity)
     } else if (category === 'IsPotentiallyPersonal' || category === 'IsPotentiallySensitive') {
-      _addAttribute(modificationLog, action, row, key)
+      _addAttribute(modificationLog, action, row, key, entity)
       // do not log the value of a sensitive attribute
       if (element['@PersonalData.IsPotentiallySensitive']) _maskAttribute(modificationLog.attributes, key)
     }
@@ -166,7 +165,14 @@ const _getDataModificationLogs = (req, tx, diff, beforeWrite) => {
 
   const modificationLogs = {}
   const processFn = _processorFnModification(modificationLogs, tx.model, req, beforeWrite)
-  templateProcessor({ processFn, row: diff, template })
+  // cds internal templating mechanism api changed in 8.2.0 -> polyfill
+  if (!template.process) {
+    module.exports._templateProcessor ??= require('@sap/cds/libx/_runtime/common/utils/templateProcessor')
+    template.process = (data, processFn) => {
+      module.exports._templateProcessor({ processFn, row: data, template })
+    }
+  }
+  template.process(diff, processFn)
 
   return modificationLogs
 }

package/lib/utils.js

@@ -1,3 +1,5 @@
+const cds = require('@sap/cds')
+
 const WRITE = { CREATE: 1, UPDATE: 1, DELETE: 1 }
 
 const $hasPersonalData = Symbol('@cap-js/audit-logging:hasPersonalData')
@@ -7,7 +9,7 @@ const $visitedUp = Symbol('@cap-js/audit-logging:visitedUp')
 const $visitedDown = Symbol('@cap-js/audit-logging:visitedDown')
 
 const hasPersonalData = entity => {
-  if (!entity.own($hasPersonalData)) {
+  if (entity.own($hasPersonalData) == null) {
     if (!entity['@PersonalData.EntitySemantics']) entity.set($hasPersonalData, false)
     else {
       // default role to entity name
@@ -119,7 +121,17 @@ const _buildSubSelect = (model, { entity, relative, element, next }, row, previo
   const targetAlias = _alias(element._target)
   const relativeAlias = _alias(relative)
 
-  childCqn.where(relative._relations[element.name].join(targetAlias, relativeAlias))
+  let w = relative._relations[element.name].join(targetAlias, relativeAlias)
+
+  // REVISIT: rewrite to path expression, if alias for relative is already used in subselect to avoid sql error
+  if (previousCqn?._aliases.has(relativeAlias)) {
+    let t
+    for (const a in entity.associations) if (entity.associations[a].target === relative.name) t = entity.associations[a]
+    if (t && w[0]?.xpr) for (const ele of w[0].xpr) if (ele.ref?.[0] === relativeAlias) ele.ref.splice(0, 1, as, t.name)
+  }
+  childCqn._aliases = new Set(previousCqn ? [...previousCqn._aliases.values(), as] : [as])
+
+  childCqn.where(w)
 
   if (previousCqn) childCqn.where('exists', previousCqn)
   else childCqn.where(_addKeysToWhere(keys, row, as))
@@ -145,22 +157,24 @@ const _getDataSubjectIdQuery = ({ dataSubjectEntity, subs }, row, model) => {
 }
 
 const _getUps = (entity, model) => {
-  if (entity.own($parents)) return entity[$parents]
-  const ups = []
-  for (const def of Object.values(model.definitions)) {
-    if (def.kind !== 'entity' || !def.associations) continue
-    for (const element of Object.values(def.associations)) {
-      if (element.target !== entity.name || element._isBacklink || element.name === 'SiblingEntity') continue
-      ups.push(element)
+  if (entity.own($parents) == null) {
+    const ups = []
+    for (const def of Object.values(model.definitions)) {
+      if (def.kind !== 'entity' || !def.associations) continue
+      for (const element of Object.values(def.associations)) {
+        if (element.target !== entity.name || element._isBacklink || element.name === 'SiblingEntity') continue
+        ups.push(element)
+      }
     }
+    entity.set($parents, ups)
   }
-  return entity.set($parents, ups)
+  return entity.own($parents)
 }
 
 const _getDataSubjectUp = (root, model, entity, prev, next, result) => {
   for (const element of _getUps(entity, model)) {
     // cycle detection
-    if (!element.own($visitedUp)) element.set($visitedUp, new Set())
+    if (element.own($visitedUp) == null) element.set($visitedUp, new Set())
     if (element.own($visitedUp).has(root)) continue
     element.own($visitedUp).add(root)
 
@@ -190,7 +204,7 @@ const _getDataSubjectDown = (root, entity, prev, next) => {
   }
   for (const element of associations) {
     // cycle detection
-    if (!element.own($visitedDown)) element.set($visitedDown, new Set())
+    if (element.own($visitedDown) == null) element.set($visitedDown, new Set())
     if (element.own($visitedDown).has(root)) continue
     element.own($visitedDown).add(root)
 
@@ -202,12 +216,14 @@ const _getDataSubjectDown = (root, entity, prev, next) => {
 }
 
 const getDataSubject = (entity, model) => {
-  if (entity.own($dataSubject)) return entity[$dataSubject]
-  // entities with EntitySemantics 'DataSubjectDetails' or 'Other' must not necessarily
-  // be always below or always above 'DataSubject' entity in CSN tree
-  let dataSubjectInfo = _getDataSubjectUp(entity.name, model, entity)
-  if (!dataSubjectInfo) dataSubjectInfo = _getDataSubjectDown(entity.name, entity)
-  return entity.set($dataSubject, dataSubjectInfo)
+  if (entity.own($dataSubject) == null) {
+    // entities with EntitySemantics 'DataSubjectDetails' or 'Other' must not necessarily
+    // be always below or always above 'DataSubject' entity in CSN tree
+    let dataSubjectInfo = _getDataSubjectUp(entity.name, model, entity)
+    if (!dataSubjectInfo) dataSubjectInfo = _getDataSubjectDown(entity.name, entity)
+    entity.set($dataSubject, dataSubjectInfo)
+  }
+  return entity.own($dataSubject)
 }
 
 const _getDataSubjectsMap = req => {
@@ -233,20 +249,29 @@ const addDataSubjectForDetailsEntity = (row, log, req, entity, model) => {
   else map.set(role, _getDataSubjectIdQuery(dataSubjectInfo, row, model))
 }
 
-const resolveDataSubjects = async (logs, req) => {
+const resolveDataSubjects = (logs, req) => {
+  const ps = []
+
   const map = _getDataSubjectsMap(req)
+
   for (const each of Object.values(logs)) {
     if (each.data_subject.id instanceof cds.ql.Query) {
       const q = each.data_subject.id
-      if (map.has(q)) {
-        each.data_subject.id = map.get(q)
-      } else {
-        const res = await q
-        map.set(q, res)
-        each.data_subject.id = res
+      if (!map.has(q)) {
+        const p = cds.run(q).then(res => map.set(q, res))
+        map.set(q, p)
+        ps.push(p)
       }
     }
   }
+
+  return Promise.all(ps).then(() => {
+    for (const each of Object.values(logs)) {
+      if (each.data_subject.id instanceof cds.ql.Query) {
+        each.data_subject.id = map.get(each.data_subject.id)
+      }
+    }
+  })
 }
 
 module.exports = {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cap-js/audit-logging",
-  "version": "0.8.0",
+  "version": "0.8.2",
   "description": "CDS plugin providing integration to the SAP Audit Log service as well as out-of-the-box personal data-related audit logging based on annotations.",
   "repository": "cap-js/audit-logging",
   "author": "SAP SE (https://www.sap.com)",
@@ -16,16 +16,16 @@
     "lint": "npx eslint .",
     "test": "npm run test-new-db && npm run test-old-db",
     "test-new-db": "CDS_ENV='better-sqlite' npx jest --silent",
-    "test-old-db": "npx jest --silent"
+    "test-old-db": "CDS_ENV='legacy-sqlite' npx jest --silent"
   },
   "peerDependencies": {
-    "@sap/cds": ">=7 || ^8.0.0-beta"
+    "@sap/cds": ">=7"
   },
   "devDependencies": {
     "@cap-js/audit-logging": "file:.",
     "@cap-js/sqlite": "^1",
     "axios": "^1",
-    "eslint": "^8",
+    "eslint": "^9",
     "express": "^4",
     "jest": "^29",
     "sqlite3": "^5.1.6"

package/srv/log2console.js

@@ -5,6 +5,7 @@ module.exports = class AuditLog2Console extends AuditLogService {
     this.on('*', function (req) {
       const { event, data } = req
 
+      // eslint-disable-next-line no-console
       console.log(`[audit-log] - ${event}:`, data)
     })
 

package/srv/log2restv2.js

@@ -80,7 +80,7 @@ module.exports = class AuditLog2RESTv2 extends AuditLogService {
   }
 
   async _send(data, path) {
-    const headers = { 'content-type': 'application/json' }
+    const headers = { 'content-type': 'application/json;charset=utf-8' }
     if (this._vcap) {
       headers.XS_AUDIT_ORG = this._vcap.organization_name
       headers.XS_AUDIT_SPACE = this._vcap.space_name
@@ -154,12 +154,16 @@ async function _post(url, data, options) {
       const chunks = []
       res.on('data', chunk => chunks.push(chunk))
       res.on('end', () => {
+        const { statusCode, statusMessage } = res
         let body = Buffer.concat(chunks).toString()
         if (res.headers['content-type']?.match(/json/)) body = JSON.parse(body)
         if (res.statusCode >= 400) {
-          const err = new Error(res.statusMessage)
-          err.response = res
-          err.body = body
+          // prettier-ignore
+          const err = new Error(`Request failed with${statusMessage ? `: ${statusCode} - ${statusMessage}` : ` status ${statusCode}`}`)
+          err.request = { method: options.method, url, headers: options.headers, body: data }
+          if (err.request.headers.authorization)
+            err.request.headers.authorization = err.request.headers.authorization.split(' ')[0] + ' ***'
+          err.response = { statusCode, statusMessage, headers: res.headers, body }
           reject(err)
         } else {
           resolve(body)