@cap-js/audit-logging 1.2.0 → 1.2.2

package/lib/utils.js

@@ -1,278 +1,304 @@
-const cds = require('@sap/cds')
+const cds = require("@sap/cds");
+const LOG = cds.log("audit-log");
 
-const { Relation, exposeRelation, relationHandler } = require('./_relation')
+const { Relation, exposeRelation, relationHandler } = require("./_relation");
 
-const WRITE = { CREATE: 1, UPDATE: 1, DELETE: 1 }
+const WRITE = { CREATE: 1, UPDATE: 1, DELETE: 1 };
 
-const $hasPersonalData = Symbol('@cap-js/audit-logging:hasPersonalData')
-const $dataSubject = Symbol('@cap-js/audit-logging:dataSubject')
-const $parents = Symbol('@cap-js/audit-logging:parents')
-const $visitedUp = Symbol('@cap-js/audit-logging:visitedUp')
-const $visitedDown = Symbol('@cap-js/audit-logging:visitedDown')
+const $hasPersonalData = Symbol("@cap-js/audit-logging:hasPersonalData");
+const $dataSubject = Symbol("@cap-js/audit-logging:dataSubject");
+const $parents = Symbol("@cap-js/audit-logging:parents");
+const $visitedUp = Symbol("@cap-js/audit-logging:visitedUp");
+const $visitedDown = Symbol("@cap-js/audit-logging:visitedDown");
 
-const hasPersonalData = entity => {
+const hasPersonalData = (entity) => {
   if (entity.own($hasPersonalData) == null) {
-    if (!entity['@PersonalData.EntitySemantics']) entity.set($hasPersonalData, false)
+    if (!entity["@PersonalData.EntitySemantics"]) entity.set($hasPersonalData, false);
     else {
       // default role to entity name
-      if (entity['@PersonalData.EntitySemantics'] === 'DataSubject' && !entity['@PersonalData.DataSubjectRole'])
-        entity['@PersonalData.DataSubjectRole'] = entity.name.match(/\w+/g).pop()
+      if (
+        entity["@PersonalData.EntitySemantics"] === "DataSubject" &&
+        !entity["@PersonalData.DataSubjectRole"]
+      )
+        entity["@PersonalData.DataSubjectRole"] = entity.name.match(/\w+/g).pop();
       // prettier-ignore
       const hasPersonalData = !!Object.values(entity.elements).some(element =>
         element['@PersonalData.IsPotentiallyPersonal'] ||
         element['@PersonalData.IsPotentiallySensitive'] ||
         (element['@PersonalData.FieldSemantics'] && element['@PersonalData.FieldSemantics'] === 'DataSubjectID'))
-      entity.set($hasPersonalData, hasPersonalData)
+      entity.set($hasPersonalData, hasPersonalData);
     }
   }
-  return entity.own($hasPersonalData)
-}
+  return entity.own($hasPersonalData);
+};
 
-const getMapKeyForCurrentRequest = req => {
+const getMapKeyForCurrentRequest = (req) => {
   // running in srv or db layer? -> srv's req.query used as key of diff and logs maps at req.context
   // REVISIT: req._tx should not be used like that!
-  return req.tx.isDatabaseService ? req._.query : req.query
-}
+  return req.tx.isDatabaseService ? req._.query : req.query;
+};
 
-const getRootEntity = element => {
-  let entity = element.parent
-  while (entity.kind !== 'entity') entity = entity.parent
-  return entity
-}
+const getRootEntity = (element) => {
+  let entity = element.parent;
+  while (entity.kind !== "entity") entity = entity.parent;
+  return entity;
+};
 
 const _isDataSubject = (element, target) => {
   return (
     !element.isAssociation &&
-    element['@PersonalData.FieldSemantics'] === 'DataSubjectID' &&
-    target['@PersonalData.EntitySemantics'] === 'DataSubject'
-  )
-}
+    element["@PersonalData.FieldSemantics"] === "DataSubjectID" &&
+    target["@PersonalData.EntitySemantics"] === "DataSubject"
+  );
+};
 
-const getPick = event => {
+const getPick = (event) => {
   return (element, target) => {
-    if (!hasPersonalData(target)) return
-    const categories = []
-    if (!element.isAssociation && element.key) categories.push('ObjectID')
-    if (_isDataSubject(element, target)) categories.push('DataSubjectID')
-    if (event in WRITE && element['@PersonalData.IsPotentiallyPersonal']) categories.push('IsPotentiallyPersonal')
-    if (element['@PersonalData.IsPotentiallySensitive']) categories.push('IsPotentiallySensitive')
-    if (categories.length) return { categories }
-  }
-}
+    if (!hasPersonalData(target)) return;
+    const categories = [];
+    if (!element.isAssociation && element.key) categories.push("ObjectID");
+    if (_isDataSubject(element, target)) categories.push("DataSubjectID");
+    if (event in WRITE && element["@PersonalData.IsPotentiallyPersonal"])
+      categories.push("IsPotentiallyPersonal");
+    if (element["@PersonalData.IsPotentiallySensitive"]) categories.push("IsPotentiallySensitive");
+    if (categories.length) return { categories };
+  };
+};
 
 const _getHash = (entity, row) => {
   return `${entity.name}(${Object.keys(entity.keys)
-    .map(k => `${k}=${row[k]}`)
-    .join(',')})`
-}
+    .map((k) => `${k}=${row[k]}`)
+    .join(",")})`;
+};
 
 const createLogEntry = (logs, entity, row) => {
-  const hash = _getHash(entity, row)
-  let log = logs[hash]
+  const hash = _getHash(entity, row);
+  let log = logs[hash];
   if (!log) {
     logs[hash] = {
-      data_subject: { id: {}, role: entity['@PersonalData.DataSubjectRole'] },
+      data_subject: { id: {}, role: entity["@PersonalData.DataSubjectRole"] },
       object: { type: entity.name, id: {} },
       attributes: []
-    }
-    log = logs[hash]
+    };
+    log = logs[hash];
   }
-  return log
-}
+  return log;
+};
 
 const addObjectID = (log, row, key) => {
-  if (!(key in log.object.id) && key !== 'IsActiveEntity') log.object.id[key] = row[key] || row._old?.[key]
-}
+  if (!(key in log.object.id) && key !== "IsActiveEntity")
+    log.object.id[key] = row[key] || row._old?.[key];
+};
 
 const addDataSubject = (log, row, key, entity) => {
-  if (!log.data_subject.type) log.data_subject.type = entity.name
+  if (!log.data_subject.type) log.data_subject.type = entity.name;
   if (!(key in log.data_subject.id)) {
-    const value = row[key] || row._old?.[key]
-    log.data_subject.id[key] = value
+    const value = row[key] || row._old?.[key];
+    log.data_subject.id[key] = value;
   }
-}
+};
 
 const _addKeysToWhere = (keys, row, alias) => {
   return keys
-    .filter(key => !key.isAssociation && key.name !== 'IsActiveEntity')
+    .filter((key) => !key.isAssociation && key.name !== "IsActiveEntity")
     .reduce((keys, key) => {
-      if (keys.length) keys.push('and')
-      keys.push({ ref: [alias, key.name] }, '=', { val: row[key.name] || row._old?.[key.name] })
-      return keys
-    }, [])
-}
+      if (keys.length) keys.push("and");
+      keys.push({ ref: [alias, key.name] }, "=", { val: row[key.name] || row._old?.[key.name] });
+      return keys;
+    }, []);
+};
 
 const _keyColumns = (keys, alias) => {
   return keys
-    .filter(key => !key.isAssociation && key.name !== 'IsActiveEntity')
-    .map(key => ({ ref: [alias, key.name] }))
-}
+    .filter((key) => !key.isAssociation && key.name !== "IsActiveEntity")
+    .map((key) => ({ ref: [alias, key.name] }));
+};
 
-const _alias = entity => {
+const _alias = (entity) => {
   // REVISIT: we should not rely on entity._service (but I don't want to break existing behavior right now)
-  if (!entity._service) return `${entity}`
-  return entity.name.replace(`${entity._service.name}.`, '').replace(/\./g, '_')
-}
+  if (!entity._service) return `${entity}`;
+  return entity.name.replace(`${entity._service.name}.`, "").replace(/\./g, "_");
+};
 
 const _buildSubSelect = (model, { entity, relative, element, next }, row, previousCqn) => {
   // relative is a parent or an entity itself
 
-  const keys = Object.values(entity.keys)
+  const keys = Object.values(entity.keys);
 
-  const entityName = entity.name
-  const as = _alias(entity)
+  const entityName = entity.name;
+  const as = _alias(entity);
 
-  const childCqn = SELECT.from({ ref: [entityName], as }).columns(_keyColumns(keys, as))
+  const childCqn = SELECT.from({ ref: [entityName], as }).columns(_keyColumns(keys, as));
 
-  const targetAlias = _alias(element._target)
-  const relativeAlias = _alias(relative)
+  const targetAlias = _alias(element._target);
+  const relativeAlias = _alias(relative);
 
   // REVISIT: there seems to be a caching issue in cds^9 when elemets are renamed
-  if (!('_relations' in relative) || !relative._relations[element.name]) {
-    const newRelation = Relation.to(relative)
-    relative._relations = new Proxy(exposeRelation(newRelation), relationHandler(newRelation))
+  if (!("_relations" in relative) || !relative._relations[element.name]) {
+    const newRelation = Relation.to(relative);
+    relative._relations = new Proxy(exposeRelation(newRelation), relationHandler(newRelation));
   }
 
-  let w = relative._relations[element.name].join(targetAlias, relativeAlias)
+  let w = relative._relations[element.name].join(targetAlias, relativeAlias);
 
   // REVISIT: rewrite to path expression, if alias for relative is already used in subselect to avoid sql error
   if (previousCqn?._aliases.has(relativeAlias)) {
-    let t
-    for (const a in entity.associations) if (entity.associations[a].target === relative.name) t = entity.associations[a]
-    if (t && w[0]?.xpr) for (const ele of w[0].xpr) if (ele.ref?.[0] === relativeAlias) ele.ref.splice(0, 1, as, t.name)
+    let t;
+    for (const a in entity.associations)
+      if (entity.associations[a].target === relative.name) t = entity.associations[a];
+    if (t && w[0]?.xpr)
+      for (const ele of w[0].xpr)
+        if (ele.ref?.[0] === relativeAlias) ele.ref.splice(0, 1, as, t.name);
   }
-  childCqn._aliases = new Set(previousCqn ? [...previousCqn._aliases.values(), as] : [as])
+  childCqn._aliases = new Set(previousCqn ? [...previousCqn._aliases.values(), as] : [as]);
 
-  childCqn.where(w)
+  childCqn.where(w);
 
-  if (previousCqn) childCqn.where('exists', previousCqn)
-  else childCqn.where(_addKeysToWhere(keys, row, as))
+  if (previousCqn) childCqn.where("exists", previousCqn);
+  else childCqn.where(_addKeysToWhere(keys, row, as));
 
-  if (next) return _buildSubSelect(model, next, {}, childCqn)
+  if (next) return _buildSubSelect(model, next, {}, childCqn);
 
-  return childCqn
-}
+  return childCqn;
+};
 
 const _getDataSubjectIdQuery = ({ dataSubjectEntity, subs }, row, model) => {
-  const keys = Object.values(dataSubjectEntity.keys)
-  const as = _alias(dataSubjectEntity)
+  const keys = Object.values(dataSubjectEntity.keys);
+  const as = _alias(dataSubjectEntity);
 
   const cqn = SELECT.one
     .from({ ref: [dataSubjectEntity.name], as })
     .columns(_keyColumns(keys, as))
-    .where(['exists', _buildSubSelect(model, subs[0], row)])
+    .where(["exists", _buildSubSelect(model, subs[0], row)]);
 
   // entity reused in different branches => must check all
-  for (let i = 1; i < subs.length; i++) cqn.or(['exists', _buildSubSelect(model, subs[i], row)])
+  for (let i = 1; i < subs.length; i++) cqn.or(["exists", _buildSubSelect(model, subs[i], row)]);
 
-  return cqn
-}
+  return cqn;
+};
 
 const _getUps = (entity, model) => {
   if (entity.own($parents) == null) {
-    const ups = []
+    const ups = [];
     for (const def of Object.values(model.definitions)) {
-      if (def.kind !== 'entity' || !def.associations) continue
+      if (def.kind !== "entity" || !def.associations) continue;
       for (const element of Object.values(def.associations)) {
-        if (element.target !== entity.name || element._isBacklink || element.name === 'SiblingEntity') continue
-        ups.push(element)
+        if (
+          element.target !== entity.name ||
+          element._isBacklink ||
+          element.name === "SiblingEntity"
+        )
+          continue;
+        ups.push(element);
       }
     }
-    entity.set($parents, ups)
+    entity.set($parents, ups);
   }
-  return entity.own($parents)
-}
+  return entity.own($parents);
+};
 
 const _getDataSubjectUp = (root, model, entity, prev, next, result) => {
   for (const element of _getUps(entity, model)) {
     // cycle detection
-    if (element.own($visitedUp) == null) element.set($visitedUp, new Set())
-    if (element.own($visitedUp).has(root)) continue
-    element.own($visitedUp).add(root)
-
-    const me = { entity, relative: element.parent, element }
-    if (prev) prev.next = me
-    if (element.parent['@PersonalData.EntitySemantics'] === 'DataSubject') {
-      if (!result) result = { dataSubjectEntity: element.parent, subs: [] }
-      result.subs.push(next || me)
-      return result
+    if (element.own($visitedUp) == null) element.set($visitedUp, new Set());
+    if (element.own($visitedUp).has(root)) continue;
+    element.own($visitedUp).add(root);
+
+    const me = { entity, relative: element.parent, element };
+    if (prev) prev.next = me;
+    if (element.parent["@PersonalData.EntitySemantics"] === "DataSubject") {
+      if (!result) result = { dataSubjectEntity: element.parent, subs: [] };
+      result.subs.push(next || me);
+      return result;
     } else {
       // dfs is a must here
-      result = _getDataSubjectUp(root, model, element.parent, me, next || me, result)
+      result = _getDataSubjectUp(root, model, element.parent, me, next || me, result);
+      // If upward traversal dead-ends, try finding the DataSubject downward from the parent entity.
+      // This handles composition targets whose parent reaches a DataSubject via a sibling association
+      // (e.g., Attachments → up to Things → down via owner to Users).
+      if (!result) result = _getDataSubjectDown(root, element.parent, me, next || me);
     }
   }
-  return result
-}
+  return result;
+};
 
 const _getDataSubjectDown = (root, entity, prev, next) => {
-  const associations = Object.values(entity.associations || {}).filter(e => !e._isBacklink)
+  const associations = Object.values(entity.associations || {}).filter((e) => !e._isBacklink);
   // bfs makes more sense here -> check all own assocs first before going deeper
   for (const element of associations) {
-    const me = { entity, relative: entity, element }
-    if (element._target['@PersonalData.EntitySemantics'] === 'DataSubject') {
-      if (prev) prev.next = me
-      return { dataSubjectEntity: element._target, subs: [next || me] }
+    const me = { entity, relative: entity, element };
+    if (element._target["@PersonalData.EntitySemantics"] === "DataSubject") {
+      if (prev) prev.next = me;
+      return { dataSubjectEntity: element._target, subs: [next || me] };
     }
   }
   for (const element of associations) {
     // cycle detection
-    if (element.own($visitedDown) == null) element.set($visitedDown, new Set())
-    if (element.own($visitedDown).has(root)) continue
-    element.own($visitedDown).add(root)
-
-    const me = { entity, relative: entity, element }
-    if (prev) prev.next = me
-    const dataSubject = _getDataSubjectDown(root, element._target, me, next || me)
-    if (dataSubject) return dataSubject
+    if (element.own($visitedDown) == null) element.set($visitedDown, new Set());
+    if (element.own($visitedDown).has(root)) continue;
+    element.own($visitedDown).add(root);
+
+    const me = { entity, relative: entity, element };
+    if (prev) prev.next = me;
+    const dataSubject = _getDataSubjectDown(root, element._target, me, next || me);
+    if (dataSubject) return dataSubject;
   }
-}
+};
 
 const getDataSubject = (entity, model) => {
   if (entity.own($dataSubject) == null) {
     // entities with EntitySemantics 'DataSubjectDetails' or 'Other' must not necessarily
     // be always below or always above 'DataSubject' entity in CSN tree
-    let dataSubjectInfo = _getDataSubjectUp(entity.name, model, entity)
-    if (!dataSubjectInfo) dataSubjectInfo = _getDataSubjectDown(entity.name, entity)
-    entity.set($dataSubject, dataSubjectInfo)
+    let dataSubjectInfo = _getDataSubjectUp(entity.name, model, entity);
+    if (!dataSubjectInfo) dataSubjectInfo = _getDataSubjectDown(entity.name, entity);
+    entity.set($dataSubject, dataSubjectInfo || false);
   }
-  return entity.own($dataSubject)
-}
+  return entity.own($dataSubject) || undefined;
+};
 
-const _getDataSubjectsMap = req => {
-  const mapKey = getMapKeyForCurrentRequest(req)
-  const _audit = (req.context._audit ??= {})
-  if (!_audit.dataSubjects) _audit.dataSubjects = new Map()
-  if (!_audit.dataSubjects.has(mapKey)) _audit.dataSubjects.set(mapKey, new Map())
-  return _audit.dataSubjects.get(mapKey)
-}
+const _getDataSubjectsMap = (req) => {
+  const mapKey = getMapKeyForCurrentRequest(req);
+  const _audit = (req.context._audit ??= {});
+  if (!_audit.dataSubjects) _audit.dataSubjects = new Map();
+  if (!_audit.dataSubjects.has(mapKey)) _audit.dataSubjects.set(mapKey, new Map());
+  return _audit.dataSubjects.get(mapKey);
+};
 
 const addDataSubjectForDetailsEntity = (row, log, req, entity, model) => {
-  const dataSubjectInfo = getDataSubject(entity, model)
-  const role = dataSubjectInfo.dataSubjectEntity['@PersonalData.DataSubjectRole']
-  log.data_subject.role ??= role
-  log.data_subject.type = dataSubjectInfo.dataSubjectEntity.name
+  const dataSubjectInfo = getDataSubject(entity, model);
+  if (!dataSubjectInfo) {
+    LOG.warn(
+      `No DataSubject entity reachable from '${entity.name}' annotated with @PersonalData.EntitySemantics: '${entity["@PersonalData.EntitySemantics"]}'. ` +
+        `Skipping data-subject enrichment for this entity. ` +
+        `Ensure a path to an entity annotated with @PersonalData.EntitySemantics: 'DataSubject' exists via associations.`
+    );
+    return;
+  }
+  const role = dataSubjectInfo.dataSubjectEntity["@PersonalData.DataSubjectRole"];
+  log.data_subject.role ??= role;
+  log.data_subject.type = dataSubjectInfo.dataSubjectEntity.name;
   /*
    * for each req (cf. $batch with atomicity) and data subject role (e.g., customer vs supplier),
    * store (in audit data structure at context) and reuse a single promise to look up the respective data subject
    */
-  const map = _getDataSubjectsMap(req)
-  if (map.has(role)) log.data_subject.id = map.get(role)
+  const map = _getDataSubjectsMap(req);
+  if (map.has(role)) log.data_subject.id = map.get(role);
   // REVISIT by downward lookups row might already contain ID - some potential to optimize
-  else map.set(role, _getDataSubjectIdQuery(dataSubjectInfo, row, model))
-}
+  else map.set(role, _getDataSubjectIdQuery(dataSubjectInfo, row, model));
+};
 
 const resolveDataSubjects = (logs, req) => {
-  const ps = []
+  const ps = [];
 
-  const map = _getDataSubjectsMap(req)
+  const map = _getDataSubjectsMap(req);
 
   for (const each of Object.values(logs)) {
     if (each.data_subject.id instanceof cds.ql.Query) {
-      const q = each.data_subject.id
+      const q = each.data_subject.id;
       if (!map.has(q)) {
-        const p = cds.run(q).then(res => map.set(q, res))
-        map.set(q, p)
-        ps.push(p)
+        const p = cds.run(q).then((res) => map.set(q, res));
+        map.set(q, p);
+        ps.push(p);
       }
     }
   }
@@ -280,11 +306,11 @@ const resolveDataSubjects = (logs, req) => {
   return Promise.all(ps).then(() => {
     for (const each of Object.values(logs)) {
       if (each.data_subject.id instanceof cds.ql.Query) {
-        each.data_subject.id = map.get(each.data_subject.id)
+        each.data_subject.id = map.get(each.data_subject.id);
       }
     }
-  })
-}
+  });
+};
 
 const getAppMetadata = () => {
   const appMetadata = cds.env.app;
@@ -295,13 +321,12 @@ const getAppMetadata = () => {
       appName: appMetadata.name,
       appURL: appMetadata.url,
       organization_name: appMetadata.organization_name,
-      space_name: appMetadata.space_name,
+      space_name: appMetadata.space_name
     };
   }
 
   // fallback: if the app metadata is undefined, then extract the metadata from the underlying environment (CF/Kyma/...)
-  const vcapApplication =
-    process.env.VCAP_APPLICATION && JSON.parse(process.env.VCAP_APPLICATION);
+  const vcapApplication = process.env.VCAP_APPLICATION && JSON.parse(process.env.VCAP_APPLICATION);
 
   return {
     appID: vcapApplication && vcapApplication.application_id,
@@ -312,7 +337,7 @@ const getAppMetadata = () => {
       vcapApplication &&
       vcapApplication.application_uris &&
       vcapApplication.application_uris[0] &&
-      `https://${vcapApplication.application_uris[0].replace(/^https?:\/\//, "")}`,
+      `https://${vcapApplication.application_uris[0].replace(/^https?:\/\//, "")}`
   };
 };
 
@@ -326,5 +351,5 @@ module.exports = {
   addDataSubject,
   addDataSubjectForDetailsEntity,
   resolveDataSubjects,
-  appMetadata: getAppMetadata(),
+  appMetadata: getAppMetadata()
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cap-js/audit-logging",
-  "version": "1.2.0",
+  "version": "1.2.2",
   "description": "CDS plugin providing integration to the SAP Audit Log service as well as out-of-the-box personal data-related audit logging based on annotations.",
   "repository": "cap-js/audit-logging",
   "author": "SAP SE (https://www.sap.com)",
@@ -13,7 +13,9 @@
   ],
   "scripts": {
     "lint": "npx eslint . --max-warnings=0",
-    "test": "npx jest --silent"
+    "format": "npx prettier . --write && format-cds -f",
+    "format:check": "npx prettier . --check && format-cds --check",
+    "test": "npx jest --silent --testPathIgnorePatterns=integration"
   },
   "peerDependencies": {
     "@sap/cds": ">=8"
@@ -22,13 +24,10 @@
     "@cap-js/audit-logging": "file:.",
     "@cap-js/cds-test": ">=0",
     "@cap-js/sqlite": ">=1",
+    "@sap/cds-lsp": "^9.9.0",
     "@sap/cds-mtxs": "^3.7.1",
-    "axios": "^1",
-    "eslint": "^9",
-    "express": "^4",
-    "jest": "^30",
-    "pretty-quick": "^4.2.2",
-    "simple-git-hooks": "^2.13.1"
+    "express": "^4 || ^5",
+    "jest": "^30"
   },
   "cds": {
     "requires": {