@oneuptime/common 13.0.5 → 13.0.6

package/Server/Services/AuditLogService.ts

@@ -1,7 +1,12 @@
 import ClickhouseDatabase from "../Infrastructure/ClickhouseDatabase";
 import AnalyticsDatabaseService from "./AnalyticsDatabaseService";
+import DatabaseService from "./DatabaseService";
 import ProjectService from "./ProjectService";
 import { IsBillingEnabled, IsEnterpriseEdition } from "../EnvironmentConfig";
+import Query from "../Types/Database/Query";
+import QueryHelper from "../Types/Database/QueryHelper";
+import Select from "../Types/Database/Select";
+import RelationValueUtil from "../Utils/Database/RelationValueUtil";
 import logger from "../Utils/Logger";
 import AuditLog from "../../Models/AnalyticsModels/AuditLog";
 import BaseModel from "../../Models/DatabaseModels/DatabaseBaseModel/DatabaseBaseModel";
@@ -9,8 +14,11 @@ import Project from "../../Models/DatabaseModels/Project";
 import User from "../../Models/DatabaseModels/User";
 import AuditLogAction from "../../Types/AuditLog/AuditLogAction";
 import DatabaseCommonInteractionProps from "../../Types/BaseDatabase/DatabaseCommonInteractionProps";
+import { AuditLogRootResource } from "../../Types/BaseDatabase/EnableAuditLogOn";
 import { PlanType } from "../../Types/Billing/SubscriptionPlan";
 import { getColumnAccessControlForAllColumns } from "../../Types/Database/AccessControl/ColumnAccessControl";
+import { TableColumnMetadata } from "../../Types/Database/TableColumn";
+import TableColumnType from "../../Types/Database/TableColumnType";
 import { JSONArray, JSONObject } from "../../Types/JSON";
 import ObjectID from "../../Types/ObjectID";
 import UserType from "../../Types/UserType";
@@ -20,6 +28,12 @@ import OneUptimeDate from "../../Types/Date";
 const PROJECT_SETTINGS_CACHE_TTL_MS: number = 60 * 1000;
 const USER_CACHE_TTL_MS: number = 5 * 60 * 1000;
 
+/*
+ * Upper bound on the related rows one audit entry looks up to name. An entry
+ * that references more is still recorded in full; the rest keep their ids.
+ */
+const MAX_RELATION_NAME_LOOKUPS: number = 100;
+
 const SKIPPED_FIELDS: ReadonlySet<string> = new Set<string>([
   "_id",
   "id",
@@ -36,6 +50,8 @@ const NAME_CANDIDATE_FIELDS: ReadonlyArray<string> = [
   "displayName",
 ];
 
+type RelatedModelType = { new (): BaseModel };
+
 interface CachedProjectSettings {
   enableAuditLogs: boolean;
   retentionInDays: number;
@@ -50,9 +66,28 @@ interface CachedUser {
   expiresAt: number;
 }
 
+interface RootResourcePointer {
+  rootResourceType: string | null;
+  rootResourceId: ObjectID | null;
+}
+
+/*
+ * Relation references still waiting for a name, grouped by the model they
+ * point at so each model is queried once per entry.
+ */
+interface PendingRelationNames {
+  modelType: RelatedModelType;
+  ids: Set<string>;
+  references: Array<JSONObject>;
+}
+
 export class AuditLogService extends AnalyticsDatabaseService<AuditLog> {
   private projectSettingsCache: Map<string, CachedProjectSettings> = new Map();
   private userCache: Map<string, CachedUser> = new Map();
+  private relatedModelServices: Map<
+    RelatedModelType,
+    DatabaseService<BaseModel>
+  > = new Map();
 
   public constructor(clickhouseDatabase?: ClickhouseDatabase | undefined) {
     super({ modelType: AuditLog, database: clickhouseDatabase });
@@ -85,18 +120,23 @@ export class AuditLogService extends AnalyticsDatabaseService<AuditLog> {
         return;
       }
 
-      const redactedFields: Set<string> = this.getRedactedFields(data.model);
       const changes: JSONArray = this.buildSnapshotChanges({
-        model: data.createdItem,
-        redactedFields,
+        model: data.model,
+        item: data.createdItem,
         valueKey: "newValue",
       });
 
+      await this.addRelationNames({
+        model: data.model,
+        changes,
+        projectId,
+      });
+
       await this.insert({
         projectId,
-        resourceType: this.getResourceType(data.model),
+        model: data.model,
+        item: data.createdItem,
         resourceId: data.createdItem.id ?? null,
-        resourceName: this.getResourceName(data.createdItem),
         action: AuditLogAction.Create,
         changes,
         props: data.props,
@@ -116,6 +156,22 @@ export class AuditLogService extends AnalyticsDatabaseService<AuditLog> {
     props: DatabaseCommonInteractionProps;
   }): Promise<void> {
     try {
+      /*
+       * The diff comes first because it needs no I/O: an update that changed
+       * nothing the audit trail tracks - an evaluation tick that rewrote only
+       * ignored columns, several times an hour per SLO - should not cost a
+       * settings lookup.
+       */
+      const changes: JSONArray = this.buildUpdateDiff({
+        model: data.model,
+        before: data.before,
+        updatedFields: data.updatedFields,
+      });
+
+      if (changes.length === 0) {
+        return;
+      }
+
       const projectId: ObjectID | undefined = this.resolveProjectId(
         data.model,
         data.before,
@@ -133,22 +189,17 @@ export class AuditLogService extends AnalyticsDatabaseService<AuditLog> {
         return;
       }
 
-      const redactedFields: Set<string> = this.getRedactedFields(data.model);
-      const changes: JSONArray = this.buildUpdateDiff({
-        before: data.before,
-        updatedFields: data.updatedFields,
-        redactedFields,
+      await this.addRelationNames({
+        model: data.model,
+        changes,
+        projectId,
       });
 
-      if (changes.length === 0) {
-        return;
-      }
-
       await this.insert({
         projectId,
-        resourceType: this.getResourceType(data.model),
+        model: data.model,
+        item: data.before,
         resourceId: data.itemId,
-        resourceName: this.getResourceName(data.before),
         action: AuditLogAction.Update,
         changes,
         props: data.props,
@@ -184,18 +235,23 @@ export class AuditLogService extends AnalyticsDatabaseService<AuditLog> {
         return;
       }
 
-      const redactedFields: Set<string> = this.getRedactedFields(data.model);
       const changes: JSONArray = this.buildSnapshotChanges({
-        model: data.deletedItem,
-        redactedFields,
+        model: data.model,
+        item: data.deletedItem,
         valueKey: "oldValue",
       });
 
+      await this.addRelationNames({
+        model: data.model,
+        changes,
+        projectId,
+      });
+
       await this.insert({
         projectId,
-        resourceType: this.getResourceType(data.model),
+        model: data.model,
+        item: data.deletedItem,
         resourceId: data.itemId,
-        resourceName: this.getResourceName(data.deletedItem),
         action: AuditLogAction.Delete,
         changes,
         props: data.props,
@@ -207,24 +263,44 @@ export class AuditLogService extends AnalyticsDatabaseService<AuditLog> {
     }
   }
 
-  private async insert(params: {
+  private async insert<TModel extends BaseModel>(params: {
     projectId: ObjectID;
-    resourceType: string;
+    model: TModel;
+    // The row as recorded: the created row, the row before the update, or the deleted row.
+    item: TModel;
     resourceId: ObjectID | null;
-    resourceName: string | null;
     action: AuditLogAction;
     changes: JSONArray;
     props: DatabaseCommonInteractionProps;
     retentionInDays: number;
   }): Promise<void> {
+    const resourceType: string = this.getResourceType(params.model);
+
+    const resourceName: string | null = await this.resolveResourceName({
+      model: params.model,
+      item: params.item,
+      projectId: params.projectId,
+    });
+
+    const rootResource: RootResourcePointer = this.getRootResource({
+      model: params.model,
+      item: params.item,
+      resourceType,
+      resourceId: params.resourceId,
+    });
+
     const auditLog: AuditLog = new AuditLog();
     auditLog.projectId = params.projectId;
-    auditLog.resourceType = params.resourceType;
+    auditLog.resourceType = resourceType;
     if (params.resourceId) {
       auditLog.resourceId = params.resourceId;
     }
-    if (params.resourceName) {
-      auditLog.resourceName = params.resourceName;
+    if (resourceName) {
+      auditLog.resourceName = resourceName;
+    }
+    if (rootResource.rootResourceType && rootResource.rootResourceId) {
+      auditLog.rootResourceType = rootResource.rootResourceType;
+      auditLog.rootResourceId = rootResource.rootResourceId;
     }
     auditLog.action = params.action;
 
@@ -433,6 +509,67 @@ export class AuditLogService extends AnalyticsDatabaseService<AuditLog> {
     return value ?? undefined;
   }
 
+  /*
+   * Where this entry rolls up to (see EnableAuditLogOn.rootResource). A
+   * top-level resource points at itself; a child points at the parent id it
+   * carries in its configured column.
+   */
+  private getRootResource<TModel extends BaseModel>(data: {
+    model: TModel;
+    item: TModel;
+    resourceType: string;
+    resourceId: ObjectID | null;
+  }): RootResourcePointer {
+    const rootResource: AuditLogRootResource | undefined =
+      data.model.enableAuditLogOn?.rootResource;
+
+    if (!rootResource) {
+      return {
+        rootResourceType: data.resourceType,
+        rootResourceId: data.resourceId,
+      };
+    }
+
+    const rootResourceId: string | null = RelationValueUtil.getRelationId(
+      (data.item as unknown as Record<string, unknown>)[rootResource.column],
+    );
+
+    if (!rootResourceId) {
+      /*
+       * A child row that cannot name its parent. Filing it under itself would
+       * give it a root type it is not, so it gets no pointer: the entry still
+       * shows in the project-wide audit log, just not on a resource's page.
+       */
+      return { rootResourceType: null, rootResourceId: null };
+    }
+
+    return {
+      rootResourceType: rootResource.resourceType,
+      rootResourceId: new ObjectID(rootResourceId),
+    };
+  }
+
+  /*
+   * Everything an entry leaves out: bookkeeping fields, columns nobody may read
+   * (read ACL `[]`, so recording them would leak them to audit readers), and
+   * the model's ignored columns.
+   */
+  private getExcludedFields<TModel extends BaseModel>(
+    model: TModel,
+  ): Set<string> {
+    const excluded: Set<string> = new Set<string>(SKIPPED_FIELDS);
+
+    for (const field of this.getRedactedFields(model)) {
+      excluded.add(field);
+    }
+
+    for (const field of model.enableAuditLogOn?.ignoreColumns || []) {
+      excluded.add(field);
+    }
+
+    return excluded;
+  }
+
   private getRedactedFields<TModel extends BaseModel>(
     model: TModel,
   ): Set<string> {
@@ -454,24 +591,23 @@ export class AuditLogService extends AnalyticsDatabaseService<AuditLog> {
 
   private buildSnapshotChanges<TModel extends BaseModel>(data: {
     model: TModel;
-    redactedFields: Set<string>;
+    item: TModel;
     valueKey: "oldValue" | "newValue";
   }): JSONArray {
     const changes: JSONArray = [];
+    const excludedFields: Set<string> = this.getExcludedFields(data.model);
     const columns: Array<string> = data.model.getTableColumns().columns;
+    const itemRecord: Record<string, unknown> = data.item as unknown as Record<
+      string,
+      unknown
+    >;
 
     for (const column of columns) {
-      if (SKIPPED_FIELDS.has(column)) {
+      if (excludedFields.has(column)) {
         continue;
       }
 
-      if (data.redactedFields.has(column)) {
-        continue;
-      }
-
-      const value: unknown = (data.model as unknown as Record<string, unknown>)[
-        column
-      ];
+      const value: unknown = itemRecord[column];
 
       if (value === undefined) {
         continue;
@@ -479,7 +615,7 @@ export class AuditLogService extends AnalyticsDatabaseService<AuditLog> {
 
       changes.push({
         field: column,
-        [data.valueKey]: this.serializeValue(value),
+        [data.valueKey]: this.serializeValue(data.model, column, value),
       } as JSONObject);
     }
 
@@ -487,41 +623,53 @@ export class AuditLogService extends AnalyticsDatabaseService<AuditLog> {
   }
 
   private buildUpdateDiff<TModel extends BaseModel>(data: {
+    model: TModel;
     before: TModel;
     updatedFields: JSONObject;
-    redactedFields: Set<string>;
   }): JSONArray {
     const changes: JSONArray = [];
+    const excludedFields: Set<string> = this.getExcludedFields(data.model);
+    const beforeRecord: Record<string, unknown> =
+      data.before as unknown as Record<string, unknown>;
 
     for (const field of Object.keys(data.updatedFields)) {
-      if (SKIPPED_FIELDS.has(field)) {
-        continue;
-      }
-
-      if (data.redactedFields.has(field)) {
+      if (excludedFields.has(field)) {
         continue;
       }
 
       const newValue: unknown = data.updatedFields[field];
-      const oldValue: unknown = (
-        data.before as unknown as Record<string, unknown>
-      )[field];
-
-      if (this.areValuesEqual(oldValue, newValue)) {
+      const oldValue: unknown = beforeRecord[field];
+
+      if (
+        this.areValuesEqual({
+          model: data.model,
+          field,
+          oldValue,
+          newValue,
+        })
+      ) {
         continue;
       }
 
       changes.push({
         field,
-        oldValue: this.serializeValue(oldValue),
-        newValue: this.serializeValue(newValue),
+        oldValue: this.serializeValue(data.model, field, oldValue),
+        newValue: this.serializeValue(data.model, field, newValue),
       } as JSONObject);
     }
 
     return changes;
   }
 
-  private areValuesEqual(a: unknown, b: unknown): boolean {
+  private areValuesEqual<TModel extends BaseModel>(data: {
+    model: TModel;
+    field: string;
+    oldValue: unknown;
+    newValue: unknown;
+  }): boolean {
+    const a: unknown = data.oldValue;
+    const b: unknown = data.newValue;
+
     if (a === b) {
       return true;
     }
@@ -531,6 +679,22 @@ export class AuditLogService extends AnalyticsDatabaseService<AuditLog> {
     if (b === null || b === undefined) {
       return false;
     }
+
+    /*
+     * A relation is the set of rows it references. Its JSON also carries
+     * whatever else happened to be loaded - the before-row's names, the
+     * payload's bare ids, the order the join returned - so an unchanged
+     * relation would otherwise read as changed.
+     */
+    if (this.getRelationMetadata(data.model, data.field)) {
+      const sameRelationIds: boolean | null =
+        RelationValueUtil.haveSameRelationIds(a, b);
+
+      if (sameRelationIds !== null) {
+        return sameRelationIds;
+      }
+    }
+
     try {
       return JSON.stringify(a) === JSON.stringify(b);
     } catch {
@@ -538,7 +702,81 @@ export class AuditLogService extends AnalyticsDatabaseService<AuditLog> {
     }
   }
 
-  private serializeValue(value: unknown): unknown {
+  // The column's metadata when it is a relation (Entity / EntityArray), else null.
+  private getRelationMetadata<TModel extends BaseModel>(
+    model: TModel,
+    field: string,
+  ): TableColumnMetadata | null {
+    if (!model.isTableColumn(field)) {
+      return null;
+    }
+
+    const metadata: TableColumnMetadata | undefined =
+      model.getTableColumnMetadata(field);
+
+    if (
+      !metadata ||
+      !metadata.modelType ||
+      (metadata.type !== TableColumnType.Entity &&
+        metadata.type !== TableColumnType.EntityArray)
+    ) {
+      return null;
+    }
+
+    return metadata;
+  }
+
+  private serializeValue<TModel extends BaseModel>(
+    model: TModel,
+    field: string,
+    value: unknown,
+  ): unknown {
+    if (value === null || value === undefined) {
+      return null;
+    }
+
+    /*
+     * A related row is recorded as `{ _id, name }`. Serialized as it arrives
+     * it would be a model instance's JSON: a bare `{ _id }` from a payload, or
+     * whatever columns the read happened to load.
+     */
+    if (this.getRelationMetadata(model, field)) {
+      if (Array.isArray(value)) {
+        return value.map((element: unknown): unknown => {
+          return this.serializeRelationReference(element);
+        });
+      }
+
+      return this.serializeRelationReference(value);
+    }
+
+    return this.serializePlainValue(value);
+  }
+
+  private serializeRelationReference(value: unknown): unknown {
+    const id: string | null = RelationValueUtil.getRelationId(value);
+
+    // Not a reference at all: record it as it is rather than drop it.
+    if (!id) {
+      return this.serializePlainValue(value);
+    }
+
+    const reference: JSONObject = { _id: id };
+
+    if (value && typeof value === "object") {
+      const name: string | null = this.toDisplayString(
+        (value as Record<string, unknown>)["name"],
+      );
+
+      if (name) {
+        reference["name"] = name;
+      }
+    }
+
+    return reference;
+  }
+
+  private serializePlainValue(value: unknown): unknown {
     if (value === null || value === undefined) {
       return null;
     }
@@ -562,6 +800,230 @@ export class AuditLogService extends AnalyticsDatabaseService<AuditLog> {
     }
   }
 
+  /*
+   * Relation references are recorded with names so an entry reads
+   * "Production -> Staging" rather than as two ids. An update's before-row
+   * already carries the old names (DatabaseService selects them), but a
+   * payload usually carries ids only - so an unnamed reference first borrows
+   * the name of another reference to the same row in the same change, and
+   * whatever is still unnamed is looked up. Best effort: a failed lookup leaves
+   * the ids, and never costs the entry.
+   */
+  private async addRelationNames<TModel extends BaseModel>(data: {
+    model: TModel;
+    changes: JSONArray;
+    projectId: ObjectID;
+  }): Promise<void> {
+    const pendingByModel: Map<RelatedModelType, PendingRelationNames> =
+      new Map();
+
+    for (const change of data.changes) {
+      const entry: JSONObject = change as JSONObject;
+      const metadata: TableColumnMetadata | null = this.getRelationMetadata(
+        data.model,
+        String(entry["field"]),
+      );
+
+      if (!metadata || !metadata.modelType) {
+        continue;
+      }
+
+      const references: Array<JSONObject> = [
+        ...this.getRelationReferences(entry["oldValue"]),
+        ...this.getRelationReferences(entry["newValue"]),
+      ];
+
+      const knownNames: Map<string, string> = new Map<string, string>();
+
+      for (const reference of references) {
+        const name: unknown = reference["name"];
+
+        if (typeof name === "string" && name.length > 0) {
+          knownNames.set(String(reference["_id"]).toLowerCase(), name);
+        }
+      }
+
+      for (const reference of references) {
+        if (reference["name"]) {
+          continue;
+        }
+
+        const id: string = String(reference["_id"]).toLowerCase();
+        const knownName: string | undefined = knownNames.get(id);
+
+        if (knownName) {
+          reference["name"] = knownName;
+          continue;
+        }
+
+        let pending: PendingRelationNames | undefined = pendingByModel.get(
+          metadata.modelType,
+        );
+
+        if (!pending) {
+          pending = {
+            modelType: metadata.modelType,
+            ids: new Set<string>(),
+            references: [],
+          };
+          pendingByModel.set(metadata.modelType, pending);
+        }
+
+        pending.ids.add(id);
+        pending.references.push(reference);
+      }
+    }
+
+    let remainingLookups: number = MAX_RELATION_NAME_LOOKUPS;
+
+    for (const pending of pendingByModel.values()) {
+      if (remainingLookups <= 0) {
+        break;
+      }
+
+      const ids: Array<string> = Array.from(pending.ids).slice(
+        0,
+        remainingLookups,
+      );
+      remainingLookups -= ids.length;
+
+      try {
+        const names: Map<string, string> = await this.findRelationNames({
+          modelType: pending.modelType,
+          ids,
+          projectId: data.projectId,
+        });
+
+        for (const reference of pending.references) {
+          const name: string | undefined = names.get(
+            String(reference["_id"]).toLowerCase(),
+          );
+
+          if (name) {
+            reference["name"] = name;
+          }
+        }
+      } catch (err) {
+        logger.warn(
+          "AuditLog: could not resolve the names of related resources; recording their ids only",
+        );
+        logger.warn(err);
+      }
+    }
+  }
+
+  private getRelationReferences(value: unknown): Array<JSONObject> {
+    const candidates: Array<unknown> = Array.isArray(value) ? value : [value];
+
+    return candidates.filter((candidate: unknown): candidate is JSONObject => {
+      return (
+        candidate !== null &&
+        typeof candidate === "object" &&
+        !Array.isArray(candidate) &&
+        typeof (candidate as JSONObject)["_id"] === "string"
+      );
+    });
+  }
+
+  /*
+   * Display names for related rows, keyed by lower-cased id.
+   *
+   * A user is named by their name, else their email, through the same cache
+   * the actor lookup uses. Any other model is named by its `name` column, and
+   * only rows inside the audited project are read: the ids come from the
+   * caller's payload, and naming a row that belongs to another project would
+   * copy that project's data into this project's audit trail. A model with no
+   * tenant column or no name column resolves nothing.
+   */
+  private async findRelationNames(data: {
+    modelType: RelatedModelType;
+    ids: Array<string>;
+    projectId: ObjectID;
+  }): Promise<Map<string, string>> {
+    const names: Map<string, string> = new Map<string, string>();
+    const ids: Array<string> = Array.from(
+      new Set<string>(
+        data.ids.map((id: string): string => {
+          return id.toLowerCase();
+        }),
+      ),
+    );
+
+    if (ids.length === 0) {
+      return names;
+    }
+
+    const relatedModel: BaseModel = new data.modelType();
+
+    if (relatedModel instanceof User) {
+      for (const id of ids) {
+        const user: { name: string | null; email: string | null } | null =
+          await this.getUserInfo(new ObjectID(id));
+        const name: string | null = user?.name || user?.email || null;
+
+        if (name) {
+          names.set(id, name);
+        }
+      }
+
+      return names;
+    }
+
+    const tenantColumn: string | null = relatedModel.getTenantColumn();
+
+    if (!tenantColumn || !relatedModel.isTableColumn("name")) {
+      return names;
+    }
+
+    const rows: Array<BaseModel> = await this.getRelatedModelService(
+      data.modelType,
+    ).findBy({
+      query: {
+        _id: QueryHelper.any(
+          ids.map((id: string): ObjectID => {
+            return new ObjectID(id);
+          }),
+        ),
+        [tenantColumn]: data.projectId,
+      } as Query<BaseModel>,
+      select: { _id: true, name: true } as Select<BaseModel>,
+      skip: 0,
+      limit: ids.length,
+      props: { isRoot: true, ignoreHooks: true },
+    });
+
+    for (const row of rows) {
+      const name: string | null = this.toDisplayString(
+        (row as unknown as Record<string, unknown>)["name"],
+      );
+
+      if (row._id && name) {
+        names.set(row._id.toString().toLowerCase(), name);
+      }
+    }
+
+    return names;
+  }
+
+  /*
+   * A plain DatabaseService reads the related rows: the lookup needs no
+   * service hooks (it runs as root with hooks off), and going through a
+   * registry of concrete services would import every service into this one.
+   */
+  private getRelatedModelService(
+    modelType: RelatedModelType,
+  ): DatabaseService<BaseModel> {
+    let service: DatabaseService<BaseModel> | undefined =
+      this.relatedModelServices.get(modelType);
+
+    if (!service) {
+      service = new DatabaseService<BaseModel>(modelType);
+      this.relatedModelServices.set(modelType, service);
+    }
+
+    return service;
+  }
+
   private getResourceType<TModel extends BaseModel>(model: TModel): string {
     if (model.singularName) {
       return model.singularName;
@@ -573,18 +1035,109 @@ export class AuditLogService extends AnalyticsDatabaseService<AuditLog> {
   private getResourceName<TModel extends BaseModel>(
     item: TModel,
   ): string | null {
+    const itemRecord: Record<string, unknown> = item as unknown as Record<
+      string,
+      unknown
+    >;
+
     for (const field of NAME_CANDIDATE_FIELDS) {
-      const columns: Array<string> = item.getTableColumns().columns;
-      if (!columns.includes(field)) {
+      if (!item.isTableColumn(field)) {
         continue;
       }
-      const value: unknown = (item as unknown as Record<string, unknown>)[
-        field
-      ];
-      if (typeof value === "string" && value.length > 0) {
-        return value;
+
+      const name: string | null = this.toDisplayString(itemRecord[field]);
+
+      if (name) {
+        return name;
       }
     }
+
+    return null;
+  }
+
+  /*
+   * The name a row has, or failing that the name of the row its
+   * resourceNameRelation points at - an SLO owner row is named after its user
+   * or team. Best effort: an entry is never lost for want of a name.
+   */
+  private async resolveResourceName<TModel extends BaseModel>(data: {
+    model: TModel;
+    item: TModel;
+    projectId: ObjectID;
+  }): Promise<string | null> {
+    const ownName: string | null = this.getResourceName(data.item);
+
+    if (ownName) {
+      return ownName;
+    }
+
+    const relation: string | undefined =
+      data.model.enableAuditLogOn?.resourceNameRelation;
+
+    if (!relation) {
+      return null;
+    }
+
+    const metadata: TableColumnMetadata | null = this.getRelationMetadata(
+      data.model,
+      relation,
+    );
+
+    if (
+      !metadata ||
+      !metadata.modelType ||
+      metadata.type !== TableColumnType.Entity ||
+      !metadata.manyToOneRelationColumn
+    ) {
+      return null;
+    }
+
+    const relatedId: string | null = RelationValueUtil.getRelationId(
+      (data.item as unknown as Record<string, unknown>)[
+        metadata.manyToOneRelationColumn
+      ],
+    );
+
+    if (!relatedId) {
+      return null;
+    }
+
+    try {
+      const names: Map<string, string> = await this.findRelationNames({
+        modelType: metadata.modelType,
+        ids: [relatedId],
+        projectId: data.projectId,
+      });
+
+      return names.get(relatedId.toLowerCase()) ?? null;
+    } catch (err) {
+      logger.warn(
+        "AuditLog: could not resolve the resource name; recording the entry without one",
+      );
+      logger.warn(err);
+      return null;
+    }
+  }
+
+  /*
+   * A non-empty display string for a stored value: a string as it is, and a
+   * value object (Name, Email) through its own toString. Anything else - a
+   * plain object stringifying to "[object Object]" - is not a name.
+   */
+  private toDisplayString(value: unknown): string | null {
+    if (typeof value === "string") {
+      return value.trim().length > 0 ? value : null;
+    }
+
+    if (value instanceof ObjectID || value === null || value === undefined) {
+      return null;
+    }
+
+    if (typeof value === "object") {
+      const text: string = String(value);
+      return text.trim().length > 0 && text !== "[object Object]" ? text : null;
+    }
+
     return null;
   }
 }