@cap-js/audit-logging 1.0.0 → 1.1.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cap-js/audit-logging",
-  "version": "1.0.0",
+  "version": "1.1.0",
   "description": "CDS plugin providing integration to the SAP Audit Log service as well as out-of-the-box personal data-related audit logging based on annotations.",
   "repository": "cap-js/audit-logging",
   "author": "SAP SE (https://www.sap.com)",
@@ -9,11 +9,10 @@
   "main": "cds-plugin.js",
   "files": [
     "lib",
-    "srv",
-    "CHANGELOG.md"
+    "srv"
   ],
   "scripts": {
-    "lint": "npx eslint .",
+    "lint": "npx eslint . --max-warnings=0",
     "test": "npx jest --silent"
   },
   "peerDependencies": {
@@ -26,13 +25,12 @@
     "axios": "^1",
     "eslint": "^9",
     "express": "^4",
-    "jest": "^29"
+    "jest": "^29",
+    "pretty-quick": "^4.2.2",
+    "simple-git-hooks": "^2.13.1"
   },
   "cds": {
     "requires": {
-      "[test]": {
-        "outbox": "persistent-outbox"
-      },
       "audit-log": {
         "handle": [
           "READ",

package/srv/log2alsng.js

@@ -1,5 +1,4 @@
 const cds = require('@sap/cds')
-
 const LOG = cds.log('audit-log')
 
 const https = require('https')
@@ -12,7 +11,7 @@ module.exports = class AuditLog2ALSNG extends AuditLogService {
     this._vcap = JSON.parse(process.env.VCAP_SERVICES || '{}')
     this._userProvided = this._vcap['user-provided']?.find(obj => obj.tags.includes('auditlog-ng')) || {}
     if (!this._userProvided.credentials) throw new Error('No credentials found for SAP Audit Log Service NG')
-    this._vcapApplication = this._vcap['VCAP_APPLICATION'] || {}
+    this._vcapApplication = JSON.parse(process.env.VCAP_APPLICATION || '{}')
   }
 
   async init() {
@@ -24,12 +23,22 @@ module.exports = class AuditLog2ALSNG extends AuditLogService {
   }
 
   eventMapper(event, data) {
-    return {
+    const known = {
       PersonalDataModified: () => this.logEvent('dppDataModification', data),
       SensitiveDataRead: () => this.logEvent('dppDataAccess', data),
       ConfigurationModified: () => this.logEvent('configurationChange', data),
       SecurityEvent: () => this.logEvent('legacySecurityWrapper', data)
-    }[event]()
+    }
+    const dfault = () => this.logEvent(event, data)
+    return (known[event] ?? dfault)()
+  }
+
+  flattenAndSortIdObject(id) {
+    if (!id || !Object.keys(id).length) return 'not provided'
+
+    let s = ''
+    for (const k of Object.keys(id).sort()) s += `${k}:${id[k]} `
+    return s.trim()
   }
 
   eventDataPayload(event, data) {
@@ -37,11 +46,12 @@ module.exports = class AuditLog2ALSNG extends AuditLogService {
     const channel = data['channel'] || { type: 'not specified', id: 'not specified' }
     const subject = data['data_subject'] || { type: 'not provided', id: { ID: 'not provided' } }
     const attributes = data['attributes'] || [{ name: 'not provided', old: 'not provided', new: 'not provided' }]
-    const objectId = object['id']?.['ID'] || 'not provided'
+    const objectId = this.flattenAndSortIdObject(object['id'])
     const oldValue = attributes[0]['old'] ?? ''
     const newValue = attributes[0]['new'] ?? ''
-    const dataSubjectId = subject['id']?.['ID'] || 'not provided'
-    return {
+    const dataSubjectId = this.flattenAndSortIdObject(subject['id'])
+
+    const known = {
       dppDataModification: {
         objectType: object['type'],
         objectId: objectId,
@@ -76,7 +86,26 @@ module.exports = class AuditLog2ALSNG extends AuditLogService {
               : data.data
         })
       }
-    }[event]
+    }
+    if (event in known) return known[event]
+
+    // For unknown events, remove common audit log entry fields from the event payload
+    if (typeof data === 'object' && data !== null) {
+      const rest = this.removeCommonAuditLogFields(data)
+      return rest
+    }
+
+    return data
+  }
+
+  removeCommonAuditLogFields(obj) {
+    if (typeof obj !== 'object' || obj === null) return obj
+    const { ...rest } = obj
+    delete rest.uuid
+    delete rest.user
+    delete rest.time
+    delete rest.tenant
+    return rest
   }
 
   eventPayload(event, data) {
@@ -113,23 +142,30 @@ module.exports = class AuditLog2ALSNG extends AuditLogService {
     return eventData
   }
 
-  logEvent(event, data) {
-    const passphrase = this._userProvided.credentials?.keyPassphrase
-    const url = new URL(`${this._userProvided.credentials?.url}/ingestion/v1/events`)
-    let eventData = []
-
+  formatEventData(event, data) {
     if (event === 'legacySecurityWrapper') {
-      eventData = JSON.stringify([this.eventPayload(event, data)])
-    } else {
-      eventData = data['attributes'].map(attr => {
+      return JSON.stringify([this.eventPayload(event, data)])
+    }
+
+    if (event in { dppDataModification: 1, dppDataAccess: 1, configurationChange: 1 }) {
+      const eventData = data['attributes']?.map(attr => {
         return this.eventPayload(event, {
           ...data,
           attributes: [attr]
         })
       })
-      eventData = JSON.stringify(eventData)
+      return JSON.stringify(eventData || [])
     }
 
+    // Always wrap event in an envelope for custom events
+    return JSON.stringify([this.eventPayload(event, data)])
+  }
+
+  logEvent(event, data) {
+    const passphrase = this._userProvided.credentials?.keyPassphrase
+    const url = new URL(`${this._userProvided.credentials?.url}/ingestion/v1/events`)
+    const eventData = this.formatEventData(event, data)
+
     const options = {
       method: 'POST',
       headers: {

package/CHANGELOG.md

@@ -1,164 +0,0 @@
-# Change Log
-
-All notable changes to this project will be documented in this file.
-This project adheres to [Semantic Versioning](http://semver.org/).
-The format is based on [Keep a Changelog](http://keepachangelog.com/).
-
-## Version 1.0.0 - 2025-07-11
-
-### Added
-
-- Beta support for next generation SAP Audit Log Service
-  - Use explicit kind `audit-log-to-alsng` or alpha auto-detect kind `audit-log-to-als`
-
-## Version 0.9.0 - 2025-06-05
-
-### Added
-
-- Support for `@sap/cds^9`
-
-## Version 0.8.3 - 2025-04-09
-
-### Fixed
-
-- Preperation for `@sap/cds^9`
-
-## Version 0.8.2 - 2024-11-27
-
-### Fixed
-
-- Erroneous modification log for non-updated key properties
-- Error during non-modifying queries on database level
-- Specify charset UTF-8 for requests to SAP Audit Log Service
-
-## Version 0.8.1 - 2024-09-13
-
-### Fixed
-
-- Support for `@sap/cds^8.2`
-- Reduce clutter in error raised for outbound requests
-
-## Version 0.8.0 - 2024-05-24
-
-### Added
-
-- Allow to specify undefined tenant in order to log to provider account in multi-tenant scenarios
-
-### Changed
-
-- Use kind `audit-log-to-restv2` in profile `hybrid`
-
-## Version 0.7.0 - 2024-05-15
-
-### Added
-
-- Automatically promote entities that are associated with data subjects
-
-## Version 0.6.0 - 2024-02-05
-
-### Added
-
-- Support for `@sap/cds^7.5`
-
-### Fixed
-
-- Automatic personal data modification logging for data subject details with renamed keys
-- Data subject resolution in circular models
-
-## Version 0.5.2 - 2023-12-08
-
-### Fixed
-
-- Automatic personal data modification logging for deep data structures with renamings
-
-## Version 0.5.1 - 2023-11-30
-
-### Fixed
-
-- Falsy early exit during bootstrapping in case a service does not contain personal data
-
-## Version 0.5.0 - 2023-11-22
-
-### Added
-
-- Common log entry fields `uuid`, `tenant`, `user` and `time` can be provided manually
-
-## Version 0.4.0 - 2023-10-24
-
-### Added
-
-- Support for Premium plan of SAP Audit Log Service
-- Support for XSUAA credential type `x509`
-- Support for generic outbox
-
-### Changed
-
-- Always use outbox (as configured in project)
-
-### Fixed
-
-- Avoid dangling `SELECT`s to resolve data subject IDs, which resulted in "Transaction already closed" errors
-
-## Version 0.3.2 - 2023-10-11
-
-### Fixed
-
-- If the request has no tenant (e.g., Unauthorized), the audit log shall be sent to the provider account
-
-## Version 0.3.1 - 2023-09-25
-
-### Fixed
-
-- Defaulting of `@PersonalData.DataSubjectRole` to entity name
-- Overriding service configuration
-
-## Version 0.3.0 - 2023-09-05
-
-### Changed
-
-- Default value for `cds.requires['audit-log'].handle` changed to `['READ', 'WRITE']`, i.e., accessing sensitive data is now logged by default.
-
-## Version 0.2.0 - 2023-09-01
-
-### Added
-
-- Export class `AuditLogService` for extending in custom implementations as follows:
-  ```js
-  const { AuditLogService } = require('@cap-js/audit-logging')
-  class MyAuditLogService extends AuditLogService {
-    async init() {
-      [...]
-      // call AuditLogService's init
-      await super.init()
-    }
-  }
-  module.exports = MyAuditLogService
-  ```
-
-## Version 0.1.0 - 2023-08-18
-
-### Added
-
-- New API:
-  - `await audit.log('<event>', <data>)` for asynchronous logs (cf. `emit`)
-  - `await audit.logSync('<event>', <data>)` for synchronous logs (cf. `send`)
-- New REST API-based schema with auto-filled `LogEntry` aspect
-- New events `SensitiveDataRead`, `PersonalDataModified`, `ConfigurationModified`, and `SecurityEvent`
-- Full support for OAuth2 plan of SAP Audit Log Service
-
-### Changed
-
-- Whether reading sensitive data and modifying personal data is logged is determined by `cds.requires['audit-log'].handle: [...]`.
-  Possible values in the array are `READ` and/ or `WRITE`, with `WRITE` as the sole default entry.
-  Hence, accessing sensitive data is not logged by default.
-- Integration with SAP Audit Log Service via REST API instead of client library (`@sap/audit-logging`)
-
-### Fixed
-
-- Various glitches in log calculation
-
-### Removed
-
-- Old events `dataAccessLog`, `dataModificationLog`, `configChangeLog`, and `securityLog`
-- `@AuditLog.Operation` annotations are ignored. Having the plugin as dependency signals the intent to audit log.
-- `cds.features.audit_personal_data: true` is no longer necessary. Instead, simply add the plugin as a dependency.