@cap-js/audit-logging 1.2.1 → 1.3.0

package/README.md

@@ -122,9 +122,9 @@ See the audit logs in the server's console output:
 
 The end-to-end out-of-the-box functionality provided by this plugin requires a paid-for instance of the [SAP Audit Log service for customers](https://help.sap.com/docs/btp/sap-business-technology-platform/audit-log-write-api-for-customers?locale=en-US). However, it is possible to provide an own implementation that writes the audit logs to a custom store.
 
-[_Learn more about using the SAP Audit Log service._](https://cap.cloud.sap/docs/guides/data-privacy/audit-logging#use-sap-audit-log-service)
+[_Learn more about using the SAP Audit Log service._](https://cap.cloud.sap/docs/guides/security/dpp-audit-logging#use-sap-audit-log-service)
 
-[_Learn more about custom audit logging._](https://cap.cloud.sap/docs/guides/data-privacy/audit-logging#custom-audit-logging)
+[_Learn more about custom audit logging._](https://cap.cloud.sap/docs/guides/security/dpp-audit-logging#custom-audit-logging)
 
 ## Support, Feedback, Contributing
 

package/lib/utils.js

@@ -1,4 +1,5 @@
 const cds = require("@sap/cds");
+const LOG = cds.log("audit-log");
 
 const { Relation, exposeRelation, relationHandler } = require("./_relation");
 
@@ -24,7 +25,7 @@ const hasPersonalData = (entity) => {
       const hasPersonalData = !!Object.values(entity.elements).some(element =>
         element['@PersonalData.IsPotentiallyPersonal'] ||
         element['@PersonalData.IsPotentiallySensitive'] ||
-        (element['@PersonalData.FieldSemantics'] && element['@PersonalData.FieldSemantics'] === 'DataSubjectID'))
+        (element['@PersonalData.FieldSemantics'] && element['@PersonalData.FieldSemantics'] === 'DataSubjectID'));
       entity.set($hasPersonalData, hasPersonalData);
     }
   }
@@ -212,6 +213,10 @@ const _getDataSubjectUp = (root, model, entity, prev, next, result) => {
     } else {
       // dfs is a must here
       result = _getDataSubjectUp(root, model, element.parent, me, next || me, result);
+      // If upward traversal dead-ends, try finding the DataSubject downward from the parent entity.
+      // This handles composition targets whose parent reaches a DataSubject via a sibling association
+      // (e.g., Attachments → up to Things → down via owner to Users).
+      if (!result) result = _getDataSubjectDown(root, element.parent, me, next || me);
     }
   }
   return result;
@@ -246,9 +251,9 @@ const getDataSubject = (entity, model) => {
     // be always below or always above 'DataSubject' entity in CSN tree
     let dataSubjectInfo = _getDataSubjectUp(entity.name, model, entity);
     if (!dataSubjectInfo) dataSubjectInfo = _getDataSubjectDown(entity.name, entity);
-    entity.set($dataSubject, dataSubjectInfo);
+    entity.set($dataSubject, dataSubjectInfo || false);
   }
-  return entity.own($dataSubject);
+  return entity.own($dataSubject) || undefined;
 };
 
 const _getDataSubjectsMap = (req) => {
@@ -261,6 +266,14 @@ const _getDataSubjectsMap = (req) => {
 
 const addDataSubjectForDetailsEntity = (row, log, req, entity, model) => {
   const dataSubjectInfo = getDataSubject(entity, model);
+  if (!dataSubjectInfo) {
+    LOG.warn(
+      `No DataSubject entity reachable from '${entity.name}' annotated with @PersonalData.EntitySemantics: '${entity["@PersonalData.EntitySemantics"]}'. ` +
+        `Skipping data-subject enrichment for this entity. ` +
+        `Ensure a path to an entity annotated with @PersonalData.EntitySemantics: 'DataSubject' exists via associations.`
+    );
+    return;
+  }
   const role = dataSubjectInfo.dataSubjectEntity["@PersonalData.DataSubjectRole"];
   log.data_subject.role ??= role;
   log.data_subject.type = dataSubjectInfo.dataSubjectEntity.name;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cap-js/audit-logging",
-  "version": "1.2.1",
+  "version": "1.3.0",
   "description": "CDS plugin providing integration to the SAP Audit Log service as well as out-of-the-box personal data-related audit logging based on annotations.",
   "repository": "cap-js/audit-logging",
   "author": "SAP SE (https://www.sap.com)",
@@ -18,15 +18,15 @@
     "test": "npx jest --silent --testPathIgnorePatterns=integration"
   },
   "peerDependencies": {
-    "@sap/cds": ">=8"
+    "@sap/cds": ">=9"
   },
   "devDependencies": {
     "@cap-js/audit-logging": "file:.",
-    "@cap-js/cds-test": ">=0",
-    "@cap-js/sqlite": ">=1",
-    "@sap/cds-lsp": "^9.9.0",
-    "@sap/cds-mtxs": "^3.7.1",
-    "express": "^4",
+    "@cap-js/cds-test": "^1",
+    "@cap-js/sqlite": "^3",
+    "@sap/cds-lsp": "^10",
+    "@sap/cds-mtxs": "^4",
+    "express": "^5",
     "jest": "^30"
   },
   "cds": {

package/srv/log2alsng.js

@@ -195,7 +195,7 @@ module.exports = class AuditLog2ALSNG extends AuditLogService {
           if (res.headers["content-type"]?.match(/json/)) body = JSON.parse(body);
           if (res.statusCode >= 400) {
             // prettier-ignore
-            const err = new Error(`Request failed with${statusMessage ? `: ${statusCode} - ${statusMessage}` : ` status ${statusCode}`}`)
+            const err = new Error(`Request failed with${statusMessage ? `: ${statusCode} - ${statusMessage}` : ` status ${statusCode}`}`);
             err.request = { method: options.method, url, headers: options.headers, body: data };
             if (err.request.headers.authorization)
               err.request.headers.authorization =

package/srv/log2restv2.js

@@ -69,12 +69,9 @@ module.exports = class AuditLog2RESTv2 extends AuditLogService {
     } else {
       data.client_secret = uaa.clientsecret;
     }
-    const urlencoded = Object.keys(data).reduce((acc, cur) => {
-      acc += (acc ? "&" : "") + cur + "=" + data[cur];
-      return acc;
-    }, "");
+    const encodedParams = new URLSearchParams(data).toString();
     try {
-      const { access_token, expires_in } = await _post(url, urlencoded, options);
+      const { access_token, expires_in } = await _post(url, encodedParams, options);
       tokens.set(tenant, access_token);
       // remove token from cache 60 seconds before it expires
       setTimeout(() => tokens.delete(tenant), (expires_in - 60) * 1000);