@cap-js/audit-logging 1.1.0 → 1.2.0

package/cds-plugin.js

@@ -1,69 +1,85 @@
-const cds = require('@sap/cds')
+const cds = require("@sap/cds");
 
-const { auditAccess } = require('./lib/access')
-const { addDiffToCtx, calcModLogs4Before, calcModLogs4After, emitModLogs } = require('./lib/modification')
-const { hasPersonalData } = require('./lib/utils')
+const { auditAccess } = require("./lib/access");
+const {
+  addDiffToCtx,
+  calcModLogs4Before,
+  calcModLogs4After,
+  emitModLogs,
+} = require("./lib/modification");
+const { hasPersonalData } = require("./lib/utils");
 
-const WRITE = ['CREATE', 'UPDATE', 'DELETE']
+const WRITE = ["CREATE", "UPDATE", "DELETE"];
 
 /*
  * Add generic audit logging handlers
  */
-cds.on('served', services => {
-  const db = cds.db
+cds.on("served", (services) => {
+  const db = cds.db;
 
   for (const service of services) {
-    if (!(service instanceof cds.ApplicationService)) continue
+    if (!(service instanceof cds.ApplicationService)) continue;
 
-    const relevantEntities = []
-    for (const entity of service.entities) if (hasPersonalData(entity)) relevantEntities.push(entity)
-    if (!relevantEntities.length) continue
+    const relevantEntities = [];
+    for (const entity of service.entities)
+      if (hasPersonalData(entity)) relevantEntities.push(entity);
+    if (!relevantEntities.length) continue;
 
     // automatically promote entities that are associated with data subjects
     for (const entity of relevantEntities) {
-      if (entity['@PersonalData.EntitySemantics'] !== 'DataSubject') continue
+      if (entity["@PersonalData.EntitySemantics"] !== "DataSubject") continue;
       for (const e of service.entities) {
         for (const k in e.associations) {
-          if (e.associations[k].target === entity.name && k !== 'SiblingEntity') {
-            e['@PersonalData.EntitySemantics'] ??= 'Other'
-            e.associations[k]['@PersonalData.FieldSemantics'] ??= 'DataSubjectID'
-            if (!relevantEntities.includes(e)) relevantEntities.push(e)
+          if (
+            e.associations[k].target === entity.name &&
+            k !== "SiblingEntity"
+          ) {
+            e["@PersonalData.EntitySemantics"] ??= "Other";
+            e.associations[k]["@PersonalData.FieldSemantics"] ??=
+              "DataSubjectID";
+            if (!relevantEntities.includes(e)) relevantEntities.push(e);
           }
         }
       }
     }
+  }
+  for (const service of services) {
+    if (!(service instanceof cds.ApplicationService)) continue;
+    service.after("READ", async (res, req) => {
+      // Checking for req.target._service to make sure only entities within services are considered
+      if (!req.target._service || !hasPersonalData(req.target)) return;
+      await auditAccess.call(service, res, req);
+    });
 
-    for (const entity of relevantEntities) {
-      /*
-       * data access
-       */
-      service.after('READ', entity, auditAccess)
-
-      /*
-       * data modification
-       */
-      // common
-      db.before(WRITE, entity, addDiffToCtx)
-      service.after(WRITE, entity, emitModLogs)
-      /*
-       * for new or modified data, modifications are calculated in after phase
-       * for deleted data, modifications are calculated in before phase
-       * deep updates can contain new, modified and deleted data -> both phases
-       */
-      // create
-      db.after('CREATE', entity, calcModLogs4After)
-      // update
-      db.before('UPDATE', entity, calcModLogs4Before)
-      db.after('UPDATE', entity, calcModLogs4After)
-      // delete
-      db.before('DELETE', entity, calcModLogs4Before)
-    }
+    service.after(WRITE, async (res, req) => {
+      if (!req.target._service || !hasPersonalData(req.target)) return;
+      await emitModLogs.call(service, res, req);
+    });
   }
-})
+
+  db.before("CREATE", async (req) => {
+    if (!req.target._service || !hasPersonalData(req.target)) return;
+    await addDiffToCtx.call(db, req);
+  });
+  /*
+   * for new or modified data, modifications are calculated in after phase
+   * for deleted data, modifications are calculated in before phase
+   * deep updates can contain new, modified and deleted data -> both phases
+   */
+  db.after(["CREATE", "UPDATE"], async (res, req) => {
+    if (!req.target._service || !hasPersonalData(req.target)) return;
+    await calcModLogs4After.call(db, res, req);
+  });
+  db.before(["DELETE", "UPDATE"], async (req) => {
+    if (!req.target._service || !hasPersonalData(req.target)) return;
+    await addDiffToCtx.call(db, req);
+    await calcModLogs4Before.call(db, req);
+  });
+});
 
 /*
  * Export base class for extending in custom implementations
  */
 module.exports = {
-  AuditLogService: require('./srv/service')
-}
+  AuditLogService: require("./srv/service"),
+};

package/lib/utils.js

@@ -108,7 +108,11 @@ const _keyColumns = (keys, alias) => {
     .map(key => ({ ref: [alias, key.name] }))
 }
 
-const _alias = entity => entity.name.replace(`${entity._service.name}.`, '').replace('.', '_')
+const _alias = entity => {
+  // REVISIT: we should not rely on entity._service (but I don't want to break existing behavior right now)
+  if (!entity._service) return `${entity}`
+  return entity.name.replace(`${entity._service.name}.`, '').replace(/\./g, '_')
+}
 
 const _buildSubSelect = (model, { entity, relative, element, next }, row, previousCqn) => {
   // relative is a parent or an entity itself
@@ -282,6 +286,36 @@ const resolveDataSubjects = (logs, req) => {
   })
 }
 
+const getAppMetadata = () => {
+  const appMetadata = cds.env.app;
+
+  if (appMetadata) {
+    return {
+      appID: appMetadata.id,
+      appName: appMetadata.name,
+      appURL: appMetadata.url,
+      organization_name: appMetadata.organization_name,
+      space_name: appMetadata.space_name,
+    };
+  }
+
+  // fallback: if the app metadata is undefined, then extract the metadata from the underlying environment (CF/Kyma/...)
+  const vcapApplication =
+    process.env.VCAP_APPLICATION && JSON.parse(process.env.VCAP_APPLICATION);
+
+  return {
+    appID: vcapApplication && vcapApplication.application_id,
+    appName: vcapApplication && vcapApplication.application_name,
+    organization_name: vcapApplication && vcapApplication.organization_name,
+    space_name: vcapApplication && vcapApplication.space_name,
+    appURL:
+      vcapApplication &&
+      vcapApplication.application_uris &&
+      vcapApplication.application_uris[0] &&
+      `https://${vcapApplication.application_uris[0].replace(/^https?:\/\//, "")}`,
+  };
+};
+
 module.exports = {
   hasPersonalData,
   getMapKeyForCurrentRequest,
@@ -291,5 +325,6 @@ module.exports = {
   addObjectID,
   addDataSubject,
   addDataSubjectForDetailsEntity,
-  resolveDataSubjects
-}
+  resolveDataSubjects,
+  appMetadata: getAppMetadata(),
+};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cap-js/audit-logging",
-  "version": "1.1.0",
+  "version": "1.2.0",
   "description": "CDS plugin providing integration to the SAP Audit Log service as well as out-of-the-box personal data-related audit logging based on annotations.",
   "repository": "cap-js/audit-logging",
   "author": "SAP SE (https://www.sap.com)",
@@ -22,10 +22,11 @@
     "@cap-js/audit-logging": "file:.",
     "@cap-js/cds-test": ">=0",
     "@cap-js/sqlite": ">=1",
+    "@sap/cds-mtxs": "^3.7.1",
     "axios": "^1",
     "eslint": "^9",
     "express": "^4",
-    "jest": "^29",
+    "jest": "^30",
     "pretty-quick": "^4.2.2",
     "simple-git-hooks": "^2.13.1"
   },
@@ -48,12 +49,12 @@
         }
       },
       "kinds": {
-        "audit-log-to-console": {
-          "impl": "@cap-js/audit-logging/srv/log2console"
-        },
         "audit-log-to-als": {
           "impl": "@cap-js/audit-logging/srv/log2als"
         },
+        "audit-log-to-console": {
+          "impl": "@cap-js/audit-logging/srv/log2console"
+        },
         "audit-log-to-restv2": {
           "impl": "@cap-js/audit-logging/srv/log2restv2",
           "vcap": {
@@ -61,7 +62,10 @@
           }
         },
         "audit-log-to-alsng": {
-          "impl": "@cap-js/audit-logging/srv/log2alsng"
+          "impl": "@cap-js/audit-logging/srv/log2alsng",
+          "vcap": {
+            "name": "auditlog-ng"
+          }
         }
       }
     }

package/srv/log2als.js

@@ -1,4 +1,6 @@
-const credentials = JSON.parse(process.env.VCAP_SERVICES) || {}
-const isV3 = credentials['user-provided']?.some(obj => obj.tags.includes('auditlog-ng'))
+const cds = require("@sap/cds");
 
-module.exports = isV3 ? require('./log2alsng') : require('./log2restv2')
+module.exports =
+  cds.env.requires["audit-log"].vcap.name === "auditlog-ng"
+    ? require("./log2alsng")
+    : require("./log2restv2");

package/srv/log2alsng.js

@@ -1,6 +1,6 @@
 const cds = require('@sap/cds')
 const LOG = cds.log('audit-log')
-
+const { appMetadata } = require("../lib/utils");
 const https = require('https')
 
 const AuditLogService = require('./service')
@@ -8,10 +8,8 @@ const AuditLogService = require('./service')
 module.exports = class AuditLog2ALSNG extends AuditLogService {
   constructor() {
     super()
-    this._vcap = JSON.parse(process.env.VCAP_SERVICES || '{}')
-    this._userProvided = this._vcap['user-provided']?.find(obj => obj.tags.includes('auditlog-ng')) || {}
-    if (!this._userProvided.credentials) throw new Error('No credentials found for SAP Audit Log Service NG')
-    this._vcapApplication = JSON.parse(process.env.VCAP_APPLICATION || '{}')
+    if (!cds.env.requires['audit-log']?.credentials)
+      throw new Error('No credentials found for SAP Audit Log Service NG')
   }
 
   async init() {
@@ -115,13 +113,13 @@ module.exports = class AuditLog2ALSNG extends AuditLogService {
     const eventData = {
       id: cds.utils.uuid(),
       specversion: 1,
-      source: `/${this._userProvided.credentials?.region}/${this._userProvided.credentials?.namespace}/${tenant}`,
+      source: `/${cds.env.requires["audit-log"].credentials?.region}/${cds.env.requires["audit-log"].credentials?.namespace}/${tenant}`,
       type: event,
       time: timestamp,
       data: {
         metadata: {
           ts: timestamp,
-          appId: this._vcapApplication.application_id || 'default app',
+          appId: appMetadata.appID || "default app",
           infrastructure: {
             other: {
               runtimeType: 'Node.js'
@@ -162,8 +160,13 @@ module.exports = class AuditLog2ALSNG extends AuditLogService {
   }
 
   logEvent(event, data) {
-    const passphrase = this._userProvided.credentials?.keyPassphrase
-    const url = new URL(`${this._userProvided.credentials?.url}/ingestion/v1/events`)
+    const credentials = cds.env.requires["audit-log"].credentials;
+    if (!credentials) {
+      throw new Error("No credentials found for SAP Audit Log Service NG");
+    }
+
+    const passphrase = credentials.keyPassphrase
+    const url = new URL(`${credentials.url}/ingestion/v1/events`)
     const eventData = this.formatEventData(event, data)
 
     const options = {
@@ -172,8 +175,8 @@ module.exports = class AuditLog2ALSNG extends AuditLogService {
         'Content-Type': 'application/json',
         'Content-Length': Buffer.byteLength(eventData)
       },
-      key: this._userProvided.credentials?.key,
-      cert: this._userProvided.credentials?.cert,
+      key: credentials.key,
+      cert: credentials.cert,
       ...(passphrase !== undefined && { passphrase })
     }
 

package/srv/log2restv2.js

@@ -1,126 +1,160 @@
-const cds = require('@sap/cds')
+const cds = require("@sap/cds");
+const { appMetadata } = require("../lib/utils");
 
-const LOG = cds.log('audit-log')
+const LOG = cds.log("audit-log");
 
-const AuditLogService = require('./service')
+const AuditLogService = require("./service");
 
 module.exports = class AuditLog2RESTv2 extends AuditLogService {
   async init() {
     // credentials stuff
-    const { credentials } = this.options
-    if (!credentials) throw new Error('No or malformed credentials for "audit-log"')
+    const { credentials } = this.options;
+    if (!credentials)
+      throw new Error('No or malformed credentials for "audit-log"');
     if (!credentials.uaa) {
-      this._plan = 'standard'
-      this._auth = 'Basic ' + Buffer.from(credentials.user + ':' + credentials.password).toString('base64')
+      this._plan = "standard";
+      this._auth =
+        "Basic " +
+        Buffer.from(credentials.user + ":" + credentials.password).toString(
+          "base64",
+        );
     } else {
-      this._plan = credentials.url.match(/6081/) ? 'premium' : 'oauth2'
-      this._tokens = new Map()
-      this._provider = credentials.uaa.tenantid
+      this._plan = credentials.url.match(/6081/) ? "premium" : "oauth2";
+      this._tokens = new Map();
+      this._provider = credentials.uaa.tenantid;
     }
-    this._vcap = process.env.VCAP_APPLICATION ? JSON.parse(process.env.VCAP_APPLICATION) : null
 
-    this.on('*', function (req) {
-      const { event, data } = req
+    this.on("*", function (req) {
+      const { event, data } = req;
 
       // event.match() is used to support the old event names
-      if (event === 'SensitiveDataRead' || event.match(/^dataAccess/i)) {
-        return this._handle(data, 'DATA_ACCESS')
+      if (event === "SensitiveDataRead" || event.match(/^dataAccess/i)) {
+        return this._handle(data, "DATA_ACCESS");
       }
-      if (event === 'PersonalDataModified' || event.match(/^dataModification/i)) {
-        data.success = true
-        return this._handle(data, 'DATA_MODIFICATION')
+      if (
+        event === "PersonalDataModified" ||
+        event.match(/^dataModification/i)
+      ) {
+        data.success = true;
+        return this._handle(data, "DATA_MODIFICATION");
       }
-      if (event === 'ConfigurationModified' || event.match(/^configChange/i)) {
-        data.success = true
-        return this._handle(data, 'CONFIGURATION_CHANGE')
+      if (event === "ConfigurationModified" || event.match(/^configChange/i)) {
+        data.success = true;
+        return this._handle(data, "CONFIGURATION_CHANGE");
       }
-      if (event === 'SecurityEvent' || event.match(/^security/i)) {
-        if (typeof data.data === 'object') data.data = JSON.stringify(data.data)
-        return this._handle(data, 'SECURITY_EVENT')
+      if (event === "SecurityEvent" || event.match(/^security/i)) {
+        if (typeof data.data === "object")
+          data.data = JSON.stringify(data.data);
+        return this._handle(data, "SECURITY_EVENT");
       }
 
-      LOG._warn && LOG.warn(`Event "${event}" is not implemented`)
-    })
+      LOG._warn && LOG.warn(`Event "${event}" is not implemented`);
+    });
 
     // call AuditLogService's init
-    await super.init()
+    await super.init();
   }
 
   async _getToken(tenant) {
-    const { _tokens: tokens } = this
-    if (tokens.has(tenant)) return tokens.get(tenant)
-
-    const { uaa } = this.options.credentials
-    const url = (uaa.certurl || uaa.url) + '/oauth/token'
-    const data = { grant_type: 'client_credentials', response_type: 'token', client_id: uaa.clientid }
-    const options = { headers: { 'content-type': 'application/x-www-form-urlencoded' } }
-    if (tenant !== this._provider) options.headers['x-zid'] = tenant
+    const { _tokens: tokens } = this;
+    if (tokens.has(tenant)) return tokens.get(tenant);
+
+    const { uaa } = this.options.credentials;
+    const url = (uaa.certurl || uaa.url) + "/oauth/token";
+    const data = {
+      grant_type: "client_credentials",
+      response_type: "token",
+      client_id: uaa.clientid,
+    };
+    const options = {
+      headers: { "content-type": "application/x-www-form-urlencoded" },
+    };
+    if (tenant !== this._provider) options.headers["x-zid"] = tenant;
+
     // certificate or secret?
-    if (uaa['credential-type'] === 'x509') {
-      options.agent = new https.Agent({ cert: uaa.certificate, key: uaa.key })
+    if (uaa["credential-type"] === "x509") {
+      options.agent = new https.Agent({ cert: uaa.certificate, key: uaa.key });
     } else {
-      data.client_secret = uaa.clientsecret
+      data.client_secret = uaa.clientsecret;
     }
     const urlencoded = Object.keys(data).reduce((acc, cur) => {
-      acc += (acc ? '&' : '') + cur + '=' + data[cur]
-      return acc
-    }, '')
+      acc += (acc ? "&" : "") + cur + "=" + data[cur];
+      return acc;
+    }, "");
     try {
-      const { access_token, expires_in } = await _post(url, urlencoded, options)
-      tokens.set(tenant, access_token)
+      const { access_token, expires_in } = await _post(
+        url,
+        urlencoded,
+        options,
+      );
+      tokens.set(tenant, access_token);
       // remove token from cache 60 seconds before it expires
-      setTimeout(() => tokens.delete(tenant), (expires_in - 60) * 1000)
-      return access_token
+      setTimeout(() => tokens.delete(tenant), (expires_in - 60) * 1000);
+      return access_token;
     } catch (err) {
-      LOG._trace && LOG.trace('error during token fetch:', err)
+      LOG._trace && LOG.trace("error during token fetch:", err);
       // 401 could also mean x-zid is not valid
-      if (String(err.response?.statusCode).match(/^4\d\d$/)) err.unrecoverable = true
-      throw err
+      if (String(err.response?.statusCode).match(/^4\d\d$/))
+        err.unrecoverable = true;
+      throw err;
     }
   }
 
   async _send(data, path) {
-    const headers = { 'content-type': 'application/json;charset=utf-8' }
-    if (this._vcap) {
-      headers.XS_AUDIT_ORG = this._vcap.organization_name
-      headers.XS_AUDIT_SPACE = this._vcap.space_name
-      headers.XS_AUDIT_APP = this._vcap.application_name
+    const headers = { "content-type": "application/json;charset=utf-8" };
+
+    if (appMetadata.appName) {
+      headers.XS_AUDIT_ORG = appMetadata.organization_name;
+      headers.XS_AUDIT_SPACE = appMetadata.space_name;
+      headers.XS_AUDIT_APP = appMetadata.appName;
     }
-    let url
-    if (this._plan === 'standard') {
-      url = this.options.credentials.url + PATHS.STANDARD[path]
-      headers.authorization = this._auth
+
+    let url;
+    if (this._plan === "standard") {
+      url = this.options.credentials.url + PATHS.STANDARD[path];
+      headers.authorization = this._auth;
     } else {
-      url = this.options.credentials.url + PATHS.OAUTH2[path]
-      data.tenant ??= this._provider //> if request has no tenant, stay in provider account
-      if (data.tenant === '$PROVIDER') data.tenant = this._provider
-      headers.authorization = 'Bearer ' + (await this._getToken(data.tenant))
-      data.tenant = data.tenant === this._provider ? '$PROVIDER' : '$SUBSCRIBER'
+      url = this.options.credentials.url + PATHS.OAUTH2[path];
+      data.tenant ??= this._provider; //> if request has no tenant, stay in provider account
+      if (data.tenant === "$PROVIDER") data.tenant = this._provider;
+      headers.authorization = "Bearer " + (await this._getToken(data.tenant));
+      data.tenant =
+        data.tenant === this._provider ? "$PROVIDER" : "$SUBSCRIBER";
     }
     if (LOG._debug) {
-      const _headers = Object.assign({}, headers, { authorization: headers.authorization.split(' ')[0] + ' ***' })
-      LOG.debug(`sending audit log to ${url} with tenant "${data.tenant}", user "${data.user}", and headers`, _headers)
+      const _headers = Object.assign({}, headers, {
+        authorization: headers.authorization.split(" ")[0] + " ***",
+      });
+      LOG.debug(
+        `sending audit log to ${url} with tenant "${data.tenant}", user "${data.user}", and headers`,
+        _headers,
+      );
     }
     try {
-      await _post(url, data, { headers })
+      await _post(url, data, { headers });
     } catch (err) {
-      LOG._trace && LOG.trace('error during log send:', err)
+      LOG._trace && LOG.trace("error during log send:", err);
       // 429 (rate limit) is not unrecoverable
-      if (String(err.response?.statusCode).match(/^4\d\d$/) && err.response?.statusCode !== 429)
-        err.unrecoverable = true
-      throw err
+      if (
+        String(err.response?.statusCode).match(/^4\d\d$/) &&
+        err.response?.statusCode !== 429
+      )
+        err.unrecoverable = true;
+      throw err;
     }
   }
 
   async _handle(logs, path) {
-    if (!Array.isArray(logs)) logs = [logs]
+    if (!Array.isArray(logs)) logs = [logs];
 
     // write the logs
-    const errors = []
-    await Promise.all(logs.map(log => this._send(log, path).catch(err => errors.push(err))))
-    if (errors.length) throw _getErrorToThrow(errors)
+    const errors = [];
+    await Promise.all(
+      logs.map((log) => this._send(log, path).catch((err) => errors.push(err))),
+    );
+    if (errors.length) throw _getErrorToThrow(errors);
   }
-}
+};
 
 /*
  * consts
@@ -128,58 +162,70 @@ module.exports = class AuditLog2RESTv2 extends AuditLogService {
 
 const PATHS = {
   STANDARD: {
-    DATA_ACCESS: '/audit-log/v2/data-accesses',
-    DATA_MODIFICATION: '/audit-log/v2/data-modifications',
-    CONFIGURATION_CHANGE: '/audit-log/v2/configuration-changes',
-    SECURITY_EVENT: '/audit-log/v2/security-events'
+    DATA_ACCESS: "/audit-log/v2/data-accesses",
+    DATA_MODIFICATION: "/audit-log/v2/data-modifications",
+    CONFIGURATION_CHANGE: "/audit-log/v2/configuration-changes",
+    SECURITY_EVENT: "/audit-log/v2/security-events",
   },
   OAUTH2: {
-    DATA_ACCESS: '/audit-log/oauth2/v2/data-accesses',
-    DATA_MODIFICATION: '/audit-log/oauth2/v2/data-modifications',
-    CONFIGURATION_CHANGE: '/audit-log/oauth2/v2/configuration-changes',
-    SECURITY_EVENT: '/audit-log/oauth2/v2/security-events'
-  }
-}
+    DATA_ACCESS: "/audit-log/oauth2/v2/data-accesses",
+    DATA_MODIFICATION: "/audit-log/oauth2/v2/data-modifications",
+    CONFIGURATION_CHANGE: "/audit-log/oauth2/v2/configuration-changes",
+    SECURITY_EVENT: "/audit-log/oauth2/v2/security-events",
+  },
+};
 
 /*
  * utils
  */
 
-const https = require('https')
+const https = require("https");
 
 async function _post(url, data, options) {
-  options.method ??= 'POST'
+  options.method ??= "POST";
   return new Promise((resolve, reject) => {
-    const req = https.request(url, options, res => {
-      const chunks = []
-      res.on('data', chunk => chunks.push(chunk))
-      res.on('end', () => {
-        const { statusCode, statusMessage } = res
-        let body = Buffer.concat(chunks).toString()
-        if (res.headers['content-type']?.match(/json/)) body = JSON.parse(body)
+    const req = https.request(url, options, (res) => {
+      const chunks = [];
+      res.on("data", (chunk) => chunks.push(chunk));
+      res.on("end", () => {
+        const { statusCode } = res;
+        let body = Buffer.concat(chunks).toString();
+        if (res.headers["content-type"]?.match(/json/)) body = JSON.parse(body);
         if (res.statusCode >= 400) {
-          // prettier-ignore
-          const err = new Error(`Request failed with${statusMessage ? `: ${statusCode} - ${statusMessage}` : ` status ${statusCode}`}`)
-          err.request = { method: options.method, url, headers: options.headers, body: data }
+          const message =
+            body && typeof body === "object" && !Array.isArray(body)
+              ? Object.values(body).join(" - ")
+              : "";
+          LOG._trace && LOG.trace(`Request body of failed audit-log: `, data);
+          const err = new Error(
+            `Request failed with${message ? `: ${statusCode} - ${message}` : ` status ${statusCode}`}`,
+          );
+          err.request = {
+            method: options.method,
+            url,
+            headers: options.headers,
+            body: data,
+          };
           if (err.request.headers.authorization)
-            err.request.headers.authorization = err.request.headers.authorization.split(' ')[0] + ' ***'
-          err.response = { statusCode, statusMessage, headers: res.headers, body }
-          reject(err)
+            err.request.headers.authorization =
+              err.request.headers.authorization.split(" ")[0] + " ***";
+          err.response = { statusCode, headers: res.headers, body };
+          reject(err);
         } else {
-          resolve(body)
+          resolve(body);
         }
-      })
-    })
-    req.on('error', reject)
-    req.write(typeof data === 'object' ? JSON.stringify(data) : data)
-    req.end()
-  })
+      });
+    });
+    req.on("error", reject);
+    req.write(typeof data === "object" ? JSON.stringify(data) : data);
+    req.end();
+  });
 }
 
 function _getErrorToThrow(errors) {
-  if (errors.length === 1) return errors[0]
-  const error = new cds.error('MULTIPLE_ERRORS')
-  error.details = errors
-  if (errors.some(e => e.unrecoverable)) error.unrecoverable = true
-  return error
+  if (errors.length === 1) return errors[0];
+  const error = new cds.error("MULTIPLE_ERRORS");
+  error.details = errors;
+  if (errors.some((e) => e.unrecoverable)) error.unrecoverable = true;
+  return error;
 }

package/srv/service.js

@@ -6,7 +6,8 @@ module.exports = class AuditLogService extends cds.Service {
     this.before('*', req => {
       const { tenant, user, timestamp } = cds.context
       req.data.uuid ??= cds.utils.uuid()
-      // allows to specify undefined tenant in order to log to provider in multi-tenant scenarios
+      // allows to specify null as tenant in order to log to provider in multi-tenant scenarios
+      // NOTE: tenant: null is not a public API!
       if (!('tenant' in req.data)) req.data.tenant = tenant
       req.data.user ??= user.id
       req.data.time ??= timestamp