@cap-js/audit-logging 0.8.1 → 0.8.2

package/CHANGELOG.md

@@ -4,6 +4,14 @@ All notable changes to this project will be documented in this file.
 This project adheres to [Semantic Versioning](http://semver.org/).
 The format is based on [Keep a Changelog](http://keepachangelog.com/).
 
+## Version 0.8.2 - 2024-11-27
+
+### Fixed
+
+- Erroneous modification log for non-updated key properties
+- Error during non-modifying queries on database level
+- Specify charset UTF-8 for requests to SAP Audit Log Service
+
 ## Version 0.8.1 - 2024-09-13
 
 ### Fixed

package/lib/modification.js

@@ -76,7 +76,7 @@ const addDiffToCtx = async function (req) {
   if (!_audit.diffs) _audit.diffs = new Map()
 
   // get diff
-  let diff = await req.diff()
+  let diff = (await req.diff()) || {}
   diff = _getDataWithAppliedTransitions(diff, req)
 
   // add keys, if necessary
@@ -88,9 +88,9 @@ const addDiffToCtx = async function (req) {
 }
 addDiffToCtx._initial = true
 
-const _getOldAndNew = (action, row, key) => {
+const _getOldAndNew = (action, row, key, entity) => {
   let oldValue = action === 'Create' ? null : row._old && row._old[key]
-  if (oldValue === undefined) oldValue = null
+  if (oldValue === undefined) oldValue = action === 'Update' && key in entity.keys ? row[key] : null
   else if (Array.isArray(oldValue)) oldValue = JSON.stringify(oldValue)
   let newValue = action === 'Delete' ? null : row[key]
   if (newValue === undefined) newValue = null
@@ -98,9 +98,9 @@ const _getOldAndNew = (action, row, key) => {
   return { oldValue, newValue }
 }
 
-const _addAttribute = (log, action, row, key) => {
+const _addAttribute = (log, action, row, key, entity) => {
   if (!log.attributes.find(ele => ele.name === key)) {
-    const { oldValue, newValue } = _getOldAndNew(action, row, key)
+    const { oldValue, newValue } = _getOldAndNew(action, row, key, entity)
     if (oldValue !== newValue) {
       const attr = { name: key }
       if (action !== 'Create') attr.old = oldValue
@@ -139,7 +139,7 @@ const _processorFnModification = (modificationLogs, model, req, beforeWrite) =>
     } else if (category === 'DataSubjectID') {
       addDataSubject(modificationLog, row, key, entity)
     } else if (category === 'IsPotentiallyPersonal' || category === 'IsPotentiallySensitive') {
-      _addAttribute(modificationLog, action, row, key)
+      _addAttribute(modificationLog, action, row, key, entity)
       // do not log the value of a sensitive attribute
       if (element['@PersonalData.IsPotentiallySensitive']) _maskAttribute(modificationLog.attributes, key)
     }

package/lib/utils.js

@@ -9,7 +9,7 @@ const $visitedUp = Symbol('@cap-js/audit-logging:visitedUp')
 const $visitedDown = Symbol('@cap-js/audit-logging:visitedDown')
 
 const hasPersonalData = entity => {
-  if (!entity.own($hasPersonalData)) {
+  if (entity.own($hasPersonalData) == null) {
     if (!entity['@PersonalData.EntitySemantics']) entity.set($hasPersonalData, false)
     else {
       // default role to entity name
@@ -121,7 +121,17 @@ const _buildSubSelect = (model, { entity, relative, element, next }, row, previo
   const targetAlias = _alias(element._target)
   const relativeAlias = _alias(relative)
 
-  childCqn.where(relative._relations[element.name].join(targetAlias, relativeAlias))
+  let w = relative._relations[element.name].join(targetAlias, relativeAlias)
+
+  // REVISIT: rewrite to path expression, if alias for relative is already used in subselect to avoid sql error
+  if (previousCqn?._aliases.has(relativeAlias)) {
+    let t
+    for (const a in entity.associations) if (entity.associations[a].target === relative.name) t = entity.associations[a]
+    if (t && w[0]?.xpr) for (const ele of w[0].xpr) if (ele.ref?.[0] === relativeAlias) ele.ref.splice(0, 1, as, t.name)
+  }
+  childCqn._aliases = new Set(previousCqn ? [...previousCqn._aliases.values(), as] : [as])
+
+  childCqn.where(w)
 
   if (previousCqn) childCqn.where('exists', previousCqn)
   else childCqn.where(_addKeysToWhere(keys, row, as))
@@ -147,22 +157,24 @@ const _getDataSubjectIdQuery = ({ dataSubjectEntity, subs }, row, model) => {
 }
 
 const _getUps = (entity, model) => {
-  if (entity.own($parents)) return entity[$parents]
-  const ups = []
-  for (const def of Object.values(model.definitions)) {
-    if (def.kind !== 'entity' || !def.associations) continue
-    for (const element of Object.values(def.associations)) {
-      if (element.target !== entity.name || element._isBacklink || element.name === 'SiblingEntity') continue
-      ups.push(element)
+  if (entity.own($parents) == null) {
+    const ups = []
+    for (const def of Object.values(model.definitions)) {
+      if (def.kind !== 'entity' || !def.associations) continue
+      for (const element of Object.values(def.associations)) {
+        if (element.target !== entity.name || element._isBacklink || element.name === 'SiblingEntity') continue
+        ups.push(element)
+      }
     }
+    entity.set($parents, ups)
   }
-  return entity.set($parents, ups)
+  return entity.own($parents)
 }
 
 const _getDataSubjectUp = (root, model, entity, prev, next, result) => {
   for (const element of _getUps(entity, model)) {
     // cycle detection
-    if (!element.own($visitedUp)) element.set($visitedUp, new Set())
+    if (element.own($visitedUp) == null) element.set($visitedUp, new Set())
     if (element.own($visitedUp).has(root)) continue
     element.own($visitedUp).add(root)
 
@@ -192,7 +204,7 @@ const _getDataSubjectDown = (root, entity, prev, next) => {
   }
   for (const element of associations) {
     // cycle detection
-    if (!element.own($visitedDown)) element.set($visitedDown, new Set())
+    if (element.own($visitedDown) == null) element.set($visitedDown, new Set())
     if (element.own($visitedDown).has(root)) continue
     element.own($visitedDown).add(root)
 
@@ -204,12 +216,14 @@ const _getDataSubjectDown = (root, entity, prev, next) => {
 }
 
 const getDataSubject = (entity, model) => {
-  if (entity.own($dataSubject)) return entity[$dataSubject]
-  // entities with EntitySemantics 'DataSubjectDetails' or 'Other' must not necessarily
-  // be always below or always above 'DataSubject' entity in CSN tree
-  let dataSubjectInfo = _getDataSubjectUp(entity.name, model, entity)
-  if (!dataSubjectInfo) dataSubjectInfo = _getDataSubjectDown(entity.name, entity)
-  return entity.set($dataSubject, dataSubjectInfo)
+  if (entity.own($dataSubject) == null) {
+    // entities with EntitySemantics 'DataSubjectDetails' or 'Other' must not necessarily
+    // be always below or always above 'DataSubject' entity in CSN tree
+    let dataSubjectInfo = _getDataSubjectUp(entity.name, model, entity)
+    if (!dataSubjectInfo) dataSubjectInfo = _getDataSubjectDown(entity.name, entity)
+    entity.set($dataSubject, dataSubjectInfo)
+  }
+  return entity.own($dataSubject)
 }
 
 const _getDataSubjectsMap = req => {
@@ -235,20 +249,29 @@ const addDataSubjectForDetailsEntity = (row, log, req, entity, model) => {
   else map.set(role, _getDataSubjectIdQuery(dataSubjectInfo, row, model))
 }
 
-const resolveDataSubjects = async (logs, req) => {
+const resolveDataSubjects = (logs, req) => {
+  const ps = []
+
   const map = _getDataSubjectsMap(req)
+
   for (const each of Object.values(logs)) {
     if (each.data_subject.id instanceof cds.ql.Query) {
       const q = each.data_subject.id
-      if (map.has(q)) {
-        each.data_subject.id = map.get(q)
-      } else {
-        const res = await q
-        map.set(q, res)
-        each.data_subject.id = res
+      if (!map.has(q)) {
+        const p = cds.run(q).then(res => map.set(q, res))
+        map.set(q, p)
+        ps.push(p)
       }
     }
   }
+
+  return Promise.all(ps).then(() => {
+    for (const each of Object.values(logs)) {
+      if (each.data_subject.id instanceof cds.ql.Query) {
+        each.data_subject.id = map.get(each.data_subject.id)
+      }
+    }
+  })
 }
 
 module.exports = {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cap-js/audit-logging",
-  "version": "0.8.1",
+  "version": "0.8.2",
   "description": "CDS plugin providing integration to the SAP Audit Log service as well as out-of-the-box personal data-related audit logging based on annotations.",
   "repository": "cap-js/audit-logging",
   "author": "SAP SE (https://www.sap.com)",

package/srv/log2restv2.js

@@ -80,7 +80,7 @@ module.exports = class AuditLog2RESTv2 extends AuditLogService {
   }
 
   async _send(data, path) {
-    const headers = { 'content-type': 'application/json' }
+    const headers = { 'content-type': 'application/json;charset=utf-8' }
     if (this._vcap) {
       headers.XS_AUDIT_ORG = this._vcap.organization_name
       headers.XS_AUDIT_SPACE = this._vcap.space_name