@cap-js/audit-logging 1.2.0 → 1.2.2

package/srv/log2alsng.js

@@ -1,114 +1,116 @@
-const cds = require('@sap/cds')
-const LOG = cds.log('audit-log')
+const cds = require("@sap/cds");
+const LOG = cds.log("audit-log");
 const { appMetadata } = require("../lib/utils");
-const https = require('https')
+const https = require("https");
 
-const AuditLogService = require('./service')
+const AuditLogService = require("./service");
 
 module.exports = class AuditLog2ALSNG extends AuditLogService {
   constructor() {
-    super()
-    if (!cds.env.requires['audit-log']?.credentials)
-      throw new Error('No credentials found for SAP Audit Log Service NG')
+    super();
+    if (!cds.env.requires["audit-log"]?.credentials)
+      throw new Error("No credentials found for SAP Audit Log Service NG");
   }
 
   async init() {
-    this.on('*', function (req) {
-      const { event, data } = req
-      return this.eventMapper(event, data)
-    })
-    await super.init()
+    this.on("*", function (req) {
+      const { event, data } = req;
+      return this.eventMapper(event, data);
+    });
+    await super.init();
   }
 
   eventMapper(event, data) {
     const known = {
-      PersonalDataModified: () => this.logEvent('dppDataModification', data),
-      SensitiveDataRead: () => this.logEvent('dppDataAccess', data),
-      ConfigurationModified: () => this.logEvent('configurationChange', data),
-      SecurityEvent: () => this.logEvent('legacySecurityWrapper', data)
-    }
-    const dfault = () => this.logEvent(event, data)
-    return (known[event] ?? dfault)()
+      PersonalDataModified: () => this.logEvent("dppDataModification", data),
+      SensitiveDataRead: () => this.logEvent("dppDataAccess", data),
+      ConfigurationModified: () => this.logEvent("configurationChange", data),
+      SecurityEvent: () => this.logEvent("legacySecurityWrapper", data)
+    };
+    const dfault = () => this.logEvent(event, data);
+    return (known[event] ?? dfault)();
   }
 
   flattenAndSortIdObject(id) {
-    if (!id || !Object.keys(id).length) return 'not provided'
+    if (!id || !Object.keys(id).length) return "not provided";
 
-    let s = ''
-    for (const k of Object.keys(id).sort()) s += `${k}:${id[k]} `
-    return s.trim()
+    let s = "";
+    for (const k of Object.keys(id).sort()) s += `${k}:${id[k]} `;
+    return s.trim();
   }
 
   eventDataPayload(event, data) {
-    const object = data['object'] || { type: 'not provided', id: { ID: 'not provided' } }
-    const channel = data['channel'] || { type: 'not specified', id: 'not specified' }
-    const subject = data['data_subject'] || { type: 'not provided', id: { ID: 'not provided' } }
-    const attributes = data['attributes'] || [{ name: 'not provided', old: 'not provided', new: 'not provided' }]
-    const objectId = this.flattenAndSortIdObject(object['id'])
-    const oldValue = attributes[0]['old'] ?? ''
-    const newValue = attributes[0]['new'] ?? ''
-    const dataSubjectId = this.flattenAndSortIdObject(subject['id'])
+    const object = data["object"] || { type: "not provided", id: { ID: "not provided" } };
+    const channel = data["channel"] || { type: "not specified", id: "not specified" };
+    const subject = data["data_subject"] || { type: "not provided", id: { ID: "not provided" } };
+    const attributes = data["attributes"] || [
+      { name: "not provided", old: "not provided", new: "not provided" }
+    ];
+    const objectId = this.flattenAndSortIdObject(object["id"]);
+    const oldValue = attributes[0]["old"] ?? "";
+    const newValue = attributes[0]["new"] ?? "";
+    const dataSubjectId = this.flattenAndSortIdObject(subject["id"]);
 
     const known = {
       dppDataModification: {
-        objectType: object['type'],
+        objectType: object["type"],
         objectId: objectId,
-        attribute: attributes[0]['name'],
+        attribute: attributes[0]["name"],
         oldValue: oldValue,
         newValue: newValue,
-        dataSubjectType: subject['type'],
+        dataSubjectType: subject["type"],
         dataSubjectId: dataSubjectId
       },
       dppDataAccess: {
-        channelType: channel['type'],
-        channelId: channel['id'],
-        dataSubjectType: subject['type'],
+        channelType: channel["type"],
+        channelId: channel["id"],
+        dataSubjectType: subject["type"],
         dataSubjectId: dataSubjectId,
-        objectType: object['type'],
+        objectType: object["type"],
         objectId: objectId,
-        attribute: attributes[0]['name']
+        attribute: attributes[0]["name"]
       },
       configurationChange: {
-        propertyName: attributes[0]['name'],
+        propertyName: attributes[0]["name"],
         oldValue: oldValue,
         newValue: newValue,
-        objectType: object['type'],
+        objectType: object["type"],
         objectId: objectId
       },
       legacySecurityWrapper: {
         origEvent: JSON.stringify({
           ...data,
           data:
-            typeof data.data === 'object' && data.data !== null && !Array.isArray(data.data)
+            typeof data.data === "object" && data.data !== null && !Array.isArray(data.data)
               ? JSON.stringify(data.data)
               : data.data
         })
       }
-    }
-    if (event in known) return known[event]
+    };
+    if (event in known) return known[event];
 
     // For unknown events, remove common audit log entry fields from the event payload
-    if (typeof data === 'object' && data !== null) {
-      const rest = this.removeCommonAuditLogFields(data)
-      return rest
+    if (typeof data === "object" && data !== null) {
+      const rest = this.removeCommonAuditLogFields(data);
+      return rest;
     }
 
-    return data
+    return data;
   }
 
   removeCommonAuditLogFields(obj) {
-    if (typeof obj !== 'object' || obj === null) return obj
-    const { ...rest } = obj
-    delete rest.uuid
-    delete rest.user
-    delete rest.time
-    delete rest.tenant
-    return rest
+    if (typeof obj !== "object" || obj === null) return obj;
+    const { ...rest } = obj;
+    delete rest.uuid;
+    delete rest.user;
+    delete rest.time;
+    delete rest.tenant;
+    return rest;
   }
 
   eventPayload(event, data) {
-    const tenant = cds.context?.tenant || null
-    const timestamp = new Date().toISOString()
+    const tenant = cds.context?.tenant || null;
+    const timestamp = new Date().toISOString();
 
     const eventData = {
       id: cds.utils.uuid(),
@@ -122,12 +124,12 @@ module.exports = class AuditLog2ALSNG extends AuditLogService {
           appId: appMetadata.appID || "default app",
           infrastructure: {
             other: {
-              runtimeType: 'Node.js'
+              runtimeType: "Node.js"
             }
           },
           platform: {
             other: {
-              platformName: 'CAP'
+              platformName: "CAP"
             }
           }
         },
@@ -135,28 +137,28 @@ module.exports = class AuditLog2ALSNG extends AuditLogService {
           [event]: this.eventDataPayload(event, data)
         }
       }
-    }
+    };
 
-    return eventData
+    return eventData;
   }
 
   formatEventData(event, data) {
-    if (event === 'legacySecurityWrapper') {
-      return JSON.stringify([this.eventPayload(event, data)])
+    if (event === "legacySecurityWrapper") {
+      return JSON.stringify([this.eventPayload(event, data)]);
     }
 
     if (event in { dppDataModification: 1, dppDataAccess: 1, configurationChange: 1 }) {
-      const eventData = data['attributes']?.map(attr => {
+      const eventData = data["attributes"]?.map((attr) => {
         return this.eventPayload(event, {
           ...data,
           attributes: [attr]
-        })
-      })
-      return JSON.stringify(eventData || [])
+        });
+      });
+      return JSON.stringify(eventData || []);
     }
 
     // Always wrap event in an envelope for custom events
-    return JSON.stringify([this.eventPayload(event, data)])
+    return JSON.stringify([this.eventPayload(event, data)]);
   }
 
   logEvent(event, data) {
@@ -165,53 +167,54 @@ module.exports = class AuditLog2ALSNG extends AuditLogService {
       throw new Error("No credentials found for SAP Audit Log Service NG");
     }
 
-    const passphrase = credentials.keyPassphrase
-    const url = new URL(`${credentials.url}/ingestion/v1/events`)
-    const eventData = this.formatEventData(event, data)
+    const passphrase = credentials.keyPassphrase;
+    const url = new URL(`${credentials.url}/ingestion/v1/events`);
+    const eventData = this.formatEventData(event, data);
 
     const options = {
-      method: 'POST',
+      method: "POST",
       headers: {
-        'Content-Type': 'application/json',
-        'Content-Length': Buffer.byteLength(eventData)
+        "Content-Type": "application/json",
+        "Content-Length": Buffer.byteLength(eventData)
       },
       key: credentials.key,
       cert: credentials.cert,
       ...(passphrase !== undefined && { passphrase })
-    }
+    };
 
     return new Promise((resolve, reject) => {
-      const req = https.request(url, options, res => {
-        LOG.trace('🛰️ Status Code:', res.statusCode)
+      const req = https.request(url, options, (res) => {
+        LOG.trace("🛰️ Status Code:", res.statusCode);
 
-        const chunks = []
-        res.on('data', chunk => chunks.push(chunk))
+        const chunks = [];
+        res.on("data", (chunk) => chunks.push(chunk));
 
-        res.on('end', () => {
-          const { statusCode, statusMessage } = res
-          let body = Buffer.concat(chunks).toString()
-          if (res.headers['content-type']?.match(/json/)) body = JSON.parse(body)
+        res.on("end", () => {
+          const { statusCode, statusMessage } = res;
+          let body = Buffer.concat(chunks).toString();
+          if (res.headers["content-type"]?.match(/json/)) body = JSON.parse(body);
           if (res.statusCode >= 400) {
             // prettier-ignore
             const err = new Error(`Request failed with${statusMessage ? `: ${statusCode} - ${statusMessage}` : ` status ${statusCode}`}`)
-            err.request = { method: options.method, url, headers: options.headers, body: data }
+            err.request = { method: options.method, url, headers: options.headers, body: data };
             if (err.request.headers.authorization)
-              err.request.headers.authorization = err.request.headers.authorization.split(' ')[0] + ' ***'
-            err.response = { statusCode, statusMessage, headers: res.headers, body }
-            reject(err)
+              err.request.headers.authorization =
+                err.request.headers.authorization.split(" ")[0] + " ***";
+            err.response = { statusCode, statusMessage, headers: res.headers, body };
+            reject(err);
           } else {
-            resolve(body)
+            resolve(body);
           }
-        })
-      })
+        });
+      });
 
-      req.on('error', e => {
-        reject(e.message)
-        LOG.trace(`Problem with request: ${e.message}`)
-      })
+      req.on("error", (e) => {
+        reject(e.message);
+        LOG.trace(`Problem with request: ${e.message}`);
+      });
 
-      req.write(eventData)
-      req.end()
-    })
+      req.write(eventData);
+      req.end();
+    });
   }
-}
+};

package/srv/log2console.js

@@ -1,15 +1,15 @@
-const AuditLogService = require('./service')
+const AuditLogService = require("./service");
 
 module.exports = class AuditLog2Console extends AuditLogService {
   async init() {
-    this.on('*', function (req) {
-      const { event, data } = req
+    this.on("*", function (req) {
+      const { event, data } = req;
 
       // eslint-disable-next-line no-console
-      console.log(`[audit-log] - ${event}:`, data)
-    })
+      console.log(`[audit-log] - ${event}:`, data);
+    });
 
     // call AuditLogService's init
-    await super.init()
+    await super.init();
   }
-}
+};

package/srv/log2restv2.js

@@ -9,17 +9,13 @@ module.exports = class AuditLog2RESTv2 extends AuditLogService {
   async init() {
     // credentials stuff
     const { credentials } = this.options;
-    if (!credentials)
-      throw new Error('No or malformed credentials for "audit-log"');
+    if (!credentials) throw new Error('No or malformed credentials for "audit-log"');
     if (!credentials.uaa) {
       this._plan = "standard";
       this._auth =
-        "Basic " +
-        Buffer.from(credentials.user + ":" + credentials.password).toString(
-          "base64",
-        );
+        "Basic " + Buffer.from(credentials.user + ":" + credentials.password).toString("base64");
     } else {
-      this._plan = credentials.url.match(/6081/) ? "premium" : "oauth2";
+      this._plan = credentials.url.match(/6081|\/premium/) ? "premium" : "oauth2";
       this._tokens = new Map();
       this._provider = credentials.uaa.tenantid;
     }
@@ -31,10 +27,7 @@ module.exports = class AuditLog2RESTv2 extends AuditLogService {
       if (event === "SensitiveDataRead" || event.match(/^dataAccess/i)) {
         return this._handle(data, "DATA_ACCESS");
       }
-      if (
-        event === "PersonalDataModified" ||
-        event.match(/^dataModification/i)
-      ) {
+      if (event === "PersonalDataModified" || event.match(/^dataModification/i)) {
         data.success = true;
         return this._handle(data, "DATA_MODIFICATION");
       }
@@ -43,8 +36,7 @@ module.exports = class AuditLog2RESTv2 extends AuditLogService {
         return this._handle(data, "CONFIGURATION_CHANGE");
       }
       if (event === "SecurityEvent" || event.match(/^security/i)) {
-        if (typeof data.data === "object")
-          data.data = JSON.stringify(data.data);
+        if (typeof data.data === "object") data.data = JSON.stringify(data.data);
         return this._handle(data, "SECURITY_EVENT");
       }
 
@@ -64,10 +56,10 @@ module.exports = class AuditLog2RESTv2 extends AuditLogService {
     const data = {
       grant_type: "client_credentials",
       response_type: "token",
-      client_id: uaa.clientid,
+      client_id: uaa.clientid
     };
     const options = {
-      headers: { "content-type": "application/x-www-form-urlencoded" },
+      headers: { "content-type": "application/x-www-form-urlencoded" }
     };
     if (tenant !== this._provider) options.headers["x-zid"] = tenant;
 
@@ -77,16 +69,9 @@ module.exports = class AuditLog2RESTv2 extends AuditLogService {
     } else {
       data.client_secret = uaa.clientsecret;
     }
-    const urlencoded = Object.keys(data).reduce((acc, cur) => {
-      acc += (acc ? "&" : "") + cur + "=" + data[cur];
-      return acc;
-    }, "");
+    const encodedParams = new URLSearchParams(data).toString();
     try {
-      const { access_token, expires_in } = await _post(
-        url,
-        urlencoded,
-        options,
-      );
+      const { access_token, expires_in } = await _post(url, encodedParams, options);
       tokens.set(tenant, access_token);
       // remove token from cache 60 seconds before it expires
       setTimeout(() => tokens.delete(tenant), (expires_in - 60) * 1000);
@@ -94,8 +79,7 @@ module.exports = class AuditLog2RESTv2 extends AuditLogService {
     } catch (err) {
       LOG._trace && LOG.trace("error during token fetch:", err);
       // 401 could also mean x-zid is not valid
-      if (String(err.response?.statusCode).match(/^4\d\d$/))
-        err.unrecoverable = true;
+      if (String(err.response?.statusCode).match(/^4\d\d$/)) err.unrecoverable = true;
       throw err;
     }
   }
@@ -118,16 +102,15 @@ module.exports = class AuditLog2RESTv2 extends AuditLogService {
       data.tenant ??= this._provider; //> if request has no tenant, stay in provider account
       if (data.tenant === "$PROVIDER") data.tenant = this._provider;
       headers.authorization = "Bearer " + (await this._getToken(data.tenant));
-      data.tenant =
-        data.tenant === this._provider ? "$PROVIDER" : "$SUBSCRIBER";
+      data.tenant = data.tenant === this._provider ? "$PROVIDER" : "$SUBSCRIBER";
     }
     if (LOG._debug) {
       const _headers = Object.assign({}, headers, {
-        authorization: headers.authorization.split(" ")[0] + " ***",
+        authorization: headers.authorization.split(" ")[0] + " ***"
       });
       LOG.debug(
         `sending audit log to ${url} with tenant "${data.tenant}", user "${data.user}", and headers`,
-        _headers,
+        _headers
       );
     }
     try {
@@ -135,10 +118,7 @@ module.exports = class AuditLog2RESTv2 extends AuditLogService {
     } catch (err) {
       LOG._trace && LOG.trace("error during log send:", err);
       // 429 (rate limit) is not unrecoverable
-      if (
-        String(err.response?.statusCode).match(/^4\d\d$/) &&
-        err.response?.statusCode !== 429
-      )
+      if (String(err.response?.statusCode).match(/^4\d\d$/) && err.response?.statusCode !== 429)
         err.unrecoverable = true;
       throw err;
     }
@@ -149,9 +129,7 @@ module.exports = class AuditLog2RESTv2 extends AuditLogService {
 
     // write the logs
     const errors = [];
-    await Promise.all(
-      logs.map((log) => this._send(log, path).catch((err) => errors.push(err))),
-    );
+    await Promise.all(logs.map((log) => this._send(log, path).catch((err) => errors.push(err))));
     if (errors.length) throw _getErrorToThrow(errors);
   }
 };
@@ -165,14 +143,14 @@ const PATHS = {
     DATA_ACCESS: "/audit-log/v2/data-accesses",
     DATA_MODIFICATION: "/audit-log/v2/data-modifications",
     CONFIGURATION_CHANGE: "/audit-log/v2/configuration-changes",
-    SECURITY_EVENT: "/audit-log/v2/security-events",
+    SECURITY_EVENT: "/audit-log/v2/security-events"
   },
   OAUTH2: {
     DATA_ACCESS: "/audit-log/oauth2/v2/data-accesses",
     DATA_MODIFICATION: "/audit-log/oauth2/v2/data-modifications",
     CONFIGURATION_CHANGE: "/audit-log/oauth2/v2/configuration-changes",
-    SECURITY_EVENT: "/audit-log/oauth2/v2/security-events",
-  },
+    SECURITY_EVENT: "/audit-log/oauth2/v2/security-events"
+  }
 };
 
 /*
@@ -198,13 +176,13 @@ async function _post(url, data, options) {
               : "";
           LOG._trace && LOG.trace(`Request body of failed audit-log: `, data);
           const err = new Error(
-            `Request failed with${message ? `: ${statusCode} - ${message}` : ` status ${statusCode}`}`,
+            `Request failed with${message ? `: ${statusCode} - ${message}` : ` status ${statusCode}`}`
           );
           err.request = {
             method: options.method,
             url,
             headers: options.headers,
-            body: data,
+            body: data
           };
           if (err.request.headers.authorization)
             err.request.headers.authorization =

package/srv/service.js

@@ -1,28 +1,28 @@
-const cds = require('@sap/cds')
+const cds = require("@sap/cds");
 
 module.exports = class AuditLogService extends cds.Service {
   async init() {
     // add common audit log entry fields
-    this.before('*', req => {
-      const { tenant, user, timestamp } = cds.context
-      req.data.uuid ??= cds.utils.uuid()
+    this.before("*", (req) => {
+      const { tenant, user, timestamp } = cds.context;
+      req.data.uuid ??= cds.utils.uuid();
       // allows to specify null as tenant in order to log to provider in multi-tenant scenarios
       // NOTE: tenant: null is not a public API!
-      if (!('tenant' in req.data)) req.data.tenant = tenant
-      req.data.user ??= user.id
-      req.data.time ??= timestamp
-    })
+      if (!("tenant" in req.data)) req.data.tenant = tenant;
+      req.data.user ??= user.id;
+      req.data.time ??= timestamp;
+    });
 
     // call OutboxService's init
-    await super.init()
+    await super.init();
 
     // add self-explanatory api (await audit.log/logSync(event, data))
-    this.log = this.emit
+    this.log = this.emit;
     // NOTE: logSync is not a public API!
     this.logSync = (...args) => {
-      if (cds.unboxed) return cds.unboxed(this).send(...args) //> cds >= 7.5
-      if (this.immediate instanceof cds.Service) return this.immediate.send(...args) //> cds ~ 7.4
-      return this.send(...args) //> cds <= 7.3
-    }
+      if (cds.unboxed) return cds.unboxed(this).send(...args); //> cds >= 7.5
+      if (this.immediate instanceof cds.Service) return this.immediate.send(...args); //> cds ~ 7.4
+      return this.send(...args); //> cds <= 7.3
+    };
   }
-}
+};