@oneuptime/common 13.0.8 → 14.0.0

package/build/dist/Server/Services/AuditLogService.js

@@ -1,778 +1,109 @@
 import AnalyticsDatabaseService from "./AnalyticsDatabaseService";
-import DatabaseService from "./DatabaseService";
-import ProjectService from "./ProjectService";
-import { IsBillingEnabled, IsEnterpriseEdition } from "../EnvironmentConfig";
-import QueryHelper from "../Types/Database/QueryHelper";
-import RelationValueUtil from "../Utils/Database/RelationValueUtil";
+import EnterpriseEdition from "../Enterprise/EnterpriseEdition";
 import logger from "../Utils/Logger";
 import AuditLog from "../../Models/AnalyticsModels/AuditLog";
-import User from "../../Models/DatabaseModels/User";
-import AuditLogAction from "../../Types/AuditLog/AuditLogAction";
-import { PlanType } from "../../Types/Billing/SubscriptionPlan";
-import { getColumnAccessControlForAllColumns } from "../../Types/Database/AccessControl/ColumnAccessControl";
-import TableColumnType from "../../Types/Database/TableColumnType";
-import ObjectID from "../../Types/ObjectID";
-import UserType from "../../Types/UserType";
-import UserService from "./UserService";
-import OneUptimeDate from "../../Types/Date";
-const PROJECT_SETTINGS_CACHE_TTL_MS = 60 * 1000;
-const USER_CACHE_TTL_MS = 5 * 60 * 1000;
+import NotAuthorizedException from "../../Types/Exception/NotAuthorizedException";
+// Why a create that is not the recorder's is refused.
+export const AUDIT_LOG_CREATE_REFUSED_MESSAGE = "Audit log entries are recorded by OneUptime and cannot be created directly.";
 /*
- * Upper bound on the related rows one audit entry looks up to name. An entry
- * that references more is still recorded in full; the rest keep their ids.
+ * The audit log's ClickHouse table (reads, retention, migrations) and the four
+ * entry points every audited write calls.
+ *
+ * RECORDING is an Enterprise Edition feature and lives in ee/
+ * (ee/Server/AuditLog/AuditLogRecorder.ts): which changes are recorded, the
+ * diff, redaction, relation names, the actor and the project-settings cache.
+ * recordCreate / recordUpdate / recordDelete / invalidateProjectSettings stay
+ * here as thin delegates to the recorder the enterprise module registered, so
+ * DatabaseService, ProjectService and the user-notification services call
+ * exactly what they always called.
+ *
+ * On the Community Edition there is no recorder: every call is a no-op, and no
+ * entry is ever written.
+ *
+ * The recorder is looked up on EVERY call, never cached at import: the
+ * enterprise module registers after core's modules have loaded.
+ *
+ * An audited write must never fail because of its audit entry, so a delegate
+ * never throws - even when a recorder breaks its own promise not to.
+ *
+ * Entries are written ONLY by the recorder, as root. Any other create is
+ * refused (see createMany), so nobody can forge the audit trail.
  */
-const MAX_RELATION_NAME_LOOKUPS = 100;
-const SKIPPED_FIELDS = new Set([
-    "_id",
-    "id",
-    "createdAt",
-    "updatedAt",
-    "deletedAt",
-    "version",
-    "slug",
-]);
-const NAME_CANDIDATE_FIELDS = [
-    "name",
-    "title",
-    "displayName",
-];
 export class AuditLogService extends AnalyticsDatabaseService {
     constructor(clickhouseDatabase) {
         super({ modelType: AuditLog, database: clickhouseDatabase });
-        this.projectSettingsCache = new Map();
-        this.userCache = new Map();
-        this.relatedModelServices = new Map();
     }
-    invalidateProjectSettings(projectId) {
-        this.projectSettingsCache.delete(projectId.toString());
-    }
-    async recordCreate(data) {
-        var _a;
-        try {
-            const projectId = this.resolveProjectId(data.model, data.createdItem, data.props);
-            if (!projectId) {
-                return;
-            }
-            const settings = await this.getProjectSettings(projectId);
-            if (!this.isEligible(settings, data.props)) {
-                return;
-            }
-            const changes = this.buildSnapshotChanges({
-                model: data.model,
-                item: data.createdItem,
-                valueKey: "newValue",
-            });
-            await this.addRelationNames({
-                model: data.model,
-                changes,
-                projectId,
-            });
-            await this.insert({
-                projectId,
-                model: data.model,
-                item: data.createdItem,
-                resourceId: (_a = data.createdItem.id) !== null && _a !== void 0 ? _a : null,
-                action: AuditLogAction.Create,
-                changes,
-                props: data.props,
-                retentionInDays: settings.retentionInDays,
-            });
-        }
-        catch (err) {
-            logger.warn("AuditLog: failed to record create event");
-            logger.warn(err);
+    /*
+     * Refuses every create that is not root. The recorder writes as root
+     * (EnterpriseEdition.getAuditLogRecorder()); anyone else - a project owner
+     * or admin through POST /audit-log, a master admin, an API key - would be
+     * forging entries. The model's create permissions are empty as well, but
+     * master admins pass those, so this is the rule that holds for everyone.
+     * Checked here rather than in onBeforeCreate: every create goes through
+     * this method (create() delegates to it), and hooks can be skipped with
+     * props.ignoreHooks.
+     */
+    async createMany(createBy) {
+        if (!createBy.props.isRoot) {
+            throw new NotAuthorizedException(AUDIT_LOG_CREATE_REFUSED_MESSAGE);
         }
+        return await super.createMany(createBy);
     }
-    async recordUpdate(data) {
-        try {
-            /*
-             * The diff comes first because it needs no I/O: an update that changed
-             * nothing the audit trail tracks - an evaluation tick that rewrote only
-             * ignored columns, several times an hour per SLO - should not cost a
-             * settings lookup.
-             */
-            const changes = this.buildUpdateDiff({
-                model: data.model,
-                before: data.before,
-                updatedFields: data.updatedFields,
-            });
-            if (changes.length === 0) {
-                return;
-            }
-            const projectId = this.resolveProjectId(data.model, data.before, data.props);
-            if (!projectId) {
-                return;
-            }
-            const settings = await this.getProjectSettings(projectId);
-            if (!this.isEligible(settings, data.props)) {
-                return;
-            }
-            await this.addRelationNames({
-                model: data.model,
-                changes,
-                projectId,
-            });
-            await this.insert({
-                projectId,
-                model: data.model,
-                item: data.before,
-                resourceId: data.itemId,
-                action: AuditLogAction.Update,
-                changes,
-                props: data.props,
-                retentionInDays: settings.retentionInDays,
-            });
-        }
-        catch (err) {
-            logger.warn("AuditLog: failed to record update event");
-            logger.warn(err);
+    invalidateProjectSettings(projectId) {
+        const recorder = this.getRecorder();
+        if (!recorder) {
+            return;
         }
-    }
-    async recordDelete(data) {
         try {
-            const projectId = this.resolveProjectId(data.model, data.deletedItem, data.props);
-            if (!projectId) {
-                return;
-            }
-            const settings = await this.getProjectSettings(projectId);
-            if (!this.isEligible(settings, data.props)) {
-                return;
-            }
-            const changes = this.buildSnapshotChanges({
-                model: data.model,
-                item: data.deletedItem,
-                valueKey: "oldValue",
-            });
-            await this.addRelationNames({
-                model: data.model,
-                changes,
-                projectId,
-            });
-            await this.insert({
-                projectId,
-                model: data.model,
-                item: data.deletedItem,
-                resourceId: data.itemId,
-                action: AuditLogAction.Delete,
-                changes,
-                props: data.props,
-                retentionInDays: settings.retentionInDays,
-            });
+            recorder.invalidateProjectSettings(projectId);
         }
         catch (err) {
-            logger.warn("AuditLog: failed to record delete event");
+            logger.warn("AuditLog: failed to invalidate the cached project audit settings");
             logger.warn(err);
         }
     }
-    async insert(params) {
-        const resourceType = this.getResourceType(params.model);
-        const resourceName = await this.resolveResourceName({
-            model: params.model,
-            item: params.item,
-            projectId: params.projectId,
-        });
-        const rootResource = this.getRootResource({
-            model: params.model,
-            item: params.item,
-            resourceType,
-            resourceId: params.resourceId,
-        });
-        const auditLog = new AuditLog();
-        auditLog.projectId = params.projectId;
-        auditLog.resourceType = resourceType;
-        if (params.resourceId) {
-            auditLog.resourceId = params.resourceId;
-        }
-        if (resourceName) {
-            auditLog.resourceName = resourceName;
-        }
-        if (rootResource.rootResourceType && rootResource.rootResourceId) {
-            auditLog.rootResourceType = rootResource.rootResourceType;
-            auditLog.rootResourceId = rootResource.rootResourceId;
-        }
-        auditLog.action = params.action;
-        const actor = await this.resolveActor(params.props);
-        if (actor.userId) {
-            auditLog.userId = actor.userId;
-        }
-        if (actor.userName) {
-            auditLog.userName = actor.userName;
-        }
-        if (actor.userEmail) {
-            auditLog.userEmail = actor.userEmail;
-        }
-        if (actor.userType) {
-            auditLog.userType = actor.userType;
-        }
-        auditLog.changes = params.changes;
-        auditLog.retentionDate = this.computeRetentionDate(params.retentionInDays);
-        await this.create({
-            data: auditLog,
-            props: { isRoot: true },
-        });
-    }
-    computeRetentionDate(retentionInDays) {
-        const days = Math.max(1, Math.min(retentionInDays || 7, 180));
-        return OneUptimeDate.addRemoveDays(OneUptimeDate.getCurrentDate(), days);
-    }
-    isEligible(settings, props) {
-        if (!settings) {
-            return false;
-        }
-        if (!settings.enableAuditLogs) {
-            return false;
-        }
-        if (!settings.storeSystemEventsInAuditLogs && this.isSystemEvent(props)) {
-            return false;
-        }
-        if (IsEnterpriseEdition) {
-            return true;
-        }
-        if (IsBillingEnabled) {
-            return settings.planName === PlanType.Enterprise;
-        }
-        /*
-         * Neither enterprise edition nor billing is enabled — audit logs are not
-         * available on the free self-hosted build.
-         */
-        return false;
-    }
-    isSystemEvent(props) {
-        /*
-         * A system event is one not initiated by a user — no userType is set and
-         * the operation is running with root privileges (e.g. background jobs,
-         * internal cleanup tasks).
-         */
-        return !props.userType && Boolean(props.isRoot);
-    }
-    async getProjectSettings(projectId) {
-        var _a;
-        const key = projectId.toString();
-        const now = Date.now();
-        const cached = this.projectSettingsCache.get(key);
-        if (cached && cached.expiresAt > now) {
-            return cached;
-        }
-        const project = await ProjectService.findOneById({
-            id: projectId,
-            select: {
-                _id: true,
-                enableAuditLogs: true,
-                auditLogsRetentionInDays: true,
-                storeSystemEventsInAuditLogs: true,
-                planName: true,
-            },
-            props: { isRoot: true },
-        });
-        if (!project) {
-            return null;
-        }
-        const settings = {
-            enableAuditLogs: Boolean(project.enableAuditLogs),
-            retentionInDays: (_a = project.auditLogsRetentionInDays) !== null && _a !== void 0 ? _a : 7,
-            storeSystemEventsInAuditLogs: Boolean(project.storeSystemEventsInAuditLogs),
-            planName: project.planName,
-            expiresAt: now + PROJECT_SETTINGS_CACHE_TTL_MS,
-        };
-        this.projectSettingsCache.set(key, settings);
-        return settings;
-    }
-    async resolveActor(props) {
-        var _a, _b;
-        const userType = props.userType
-            ? String(props.userType)
-            : props.isRoot
-                ? "System"
-                : null;
-        if (!props.userId) {
-            return {
-                userId: null,
-                userName: null,
-                userEmail: null,
-                userType,
-            };
-        }
-        // API-key actions don't have a user record to look up.
-        if (props.userType === UserType.API) {
-            return {
-                userId: props.userId,
-                userName: null,
-                userEmail: null,
-                userType,
-            };
-        }
-        const cached = await this.getUserInfo(props.userId);
-        return {
-            userId: props.userId,
-            userName: (_a = cached === null || cached === void 0 ? void 0 : cached.name) !== null && _a !== void 0 ? _a : null,
-            userEmail: (_b = cached === null || cached === void 0 ? void 0 : cached.email) !== null && _b !== void 0 ? _b : null,
-            userType,
-        };
-    }
-    async getUserInfo(userId) {
-        var _a, _b, _c, _d;
-        const key = userId.toString();
-        const now = Date.now();
-        const cached = this.userCache.get(key);
-        if (cached && cached.expiresAt > now) {
-            return { name: cached.name, email: cached.email };
-        }
-        const user = await UserService.findOneById({
-            id: userId,
-            select: { _id: true, name: true, email: true },
-            props: { isRoot: true },
-        });
-        const name = (_b = (_a = user === null || user === void 0 ? void 0 : user.name) === null || _a === void 0 ? void 0 : _a.toString()) !== null && _b !== void 0 ? _b : null;
-        const email = (_d = (_c = user === null || user === void 0 ? void 0 : user.email) === null || _c === void 0 ? void 0 : _c.toString()) !== null && _d !== void 0 ? _d : null;
-        this.userCache.set(key, {
-            name,
-            email,
-            expiresAt: now + USER_CACHE_TTL_MS,
-        });
-        return { name, email };
-    }
-    resolveProjectId(model, item, props) {
-        if (props.tenantId) {
-            return props.tenantId;
-        }
-        const tenantColumn = model.getTenantColumn();
-        if (!tenantColumn) {
-            return undefined;
-        }
-        const value = item.getValue(tenantColumn);
-        return value !== null && value !== void 0 ? value : undefined;
-    }
-    /*
-     * Where this entry rolls up to (see EnableAuditLogOn.rootResource). A
-     * top-level resource points at itself; a child points at the parent id it
-     * carries in its configured column.
-     */
-    getRootResource(data) {
-        var _a;
-        const rootResource = (_a = data.model.enableAuditLogOn) === null || _a === void 0 ? void 0 : _a.rootResource;
-        if (!rootResource) {
-            return {
-                rootResourceType: data.resourceType,
-                rootResourceId: data.resourceId,
-            };
-        }
-        const rootResourceId = RelationValueUtil.getRelationId(data.item[rootResource.column]);
-        if (!rootResourceId) {
-            /*
-             * A child row that cannot name its parent. Filing it under itself would
-             * give it a root type it is not, so it gets no pointer: the entry still
-             * shows in the project-wide audit log, just not on a resource's page.
-             */
-            return { rootResourceType: null, rootResourceId: null };
-        }
-        return {
-            rootResourceType: rootResource.resourceType,
-            rootResourceId: new ObjectID(rootResourceId),
-        };
-    }
-    /*
-     * Everything an entry leaves out: bookkeeping fields, columns nobody may read
-     * (read ACL `[]`, so recording them would leak them to audit readers), and
-     * the model's ignored columns.
-     */
-    getExcludedFields(model) {
-        var _a;
-        const excluded = new Set(SKIPPED_FIELDS);
-        for (const field of this.getRedactedFields(model)) {
-            excluded.add(field);
-        }
-        for (const field of ((_a = model.enableAuditLogOn) === null || _a === void 0 ? void 0 : _a.ignoreColumns) || []) {
-            excluded.add(field);
-        }
-        return excluded;
-    }
-    getRedactedFields(model) {
-        const redacted = new Set();
-        const allAccessControl = getColumnAccessControlForAllColumns(model);
-        for (const key of Object.keys(allAccessControl)) {
-            const ac = allAccessControl[key];
-            if (ac && Array.isArray(ac.read) && ac.read.length === 0) {
-                redacted.add(key);
-            }
-        }
-        return redacted;
-    }
-    buildSnapshotChanges(data) {
-        const changes = [];
-        const excludedFields = this.getExcludedFields(data.model);
-        const columns = data.model.getTableColumns().columns;
-        const itemRecord = data.item;
-        for (const column of columns) {
-            if (excludedFields.has(column)) {
-                continue;
-            }
-            const value = itemRecord[column];
-            if (value === undefined) {
-                continue;
-            }
-            changes.push({
-                field: column,
-                [data.valueKey]: this.serializeValue(data.model, column, value),
-            });
-        }
-        return changes;
-    }
-    buildUpdateDiff(data) {
-        const changes = [];
-        const excludedFields = this.getExcludedFields(data.model);
-        const beforeRecord = data.before;
-        for (const field of Object.keys(data.updatedFields)) {
-            if (excludedFields.has(field)) {
-                continue;
-            }
-            const newValue = data.updatedFields[field];
-            const oldValue = beforeRecord[field];
-            if (this.areValuesEqual({
-                model: data.model,
-                field,
-                oldValue,
-                newValue,
-            })) {
-                continue;
-            }
-            changes.push({
-                field,
-                oldValue: this.serializeValue(data.model, field, oldValue),
-                newValue: this.serializeValue(data.model, field, newValue),
-            });
-        }
-        return changes;
-    }
-    areValuesEqual(data) {
-        const a = data.oldValue;
-        const b = data.newValue;
-        if (a === b) {
-            return true;
-        }
-        if (a === null || a === undefined) {
-            return b === null || b === undefined;
-        }
-        if (b === null || b === undefined) {
-            return false;
-        }
-        /*
-         * A relation is the set of rows it references. Its JSON also carries
-         * whatever else happened to be loaded - the before-row's names, the
-         * payload's bare ids, the order the join returned - so an unchanged
-         * relation would otherwise read as changed.
-         */
-        if (this.getRelationMetadata(data.model, data.field)) {
-            const sameRelationIds = RelationValueUtil.haveSameRelationIds(a, b);
-            if (sameRelationIds !== null) {
-                return sameRelationIds;
-            }
+    async recordCreate(data) {
+        const recorder = this.getRecorder();
+        if (!recorder) {
+            return;
         }
         try {
-            return JSON.stringify(a) === JSON.stringify(b);
-        }
-        catch (_a) {
-            return false;
-        }
-    }
-    // The column's metadata when it is a relation (Entity / EntityArray), else null.
-    getRelationMetadata(model, field) {
-        if (!model.isTableColumn(field)) {
-            return null;
-        }
-        const metadata = model.getTableColumnMetadata(field);
-        if (!metadata ||
-            !metadata.modelType ||
-            (metadata.type !== TableColumnType.Entity &&
-                metadata.type !== TableColumnType.EntityArray)) {
-            return null;
-        }
-        return metadata;
-    }
-    serializeValue(model, field, value) {
-        if (value === null || value === undefined) {
-            return null;
-        }
-        /*
-         * A related row is recorded as `{ _id, name }`. Serialized as it arrives
-         * it would be a model instance's JSON: a bare `{ _id }` from a payload, or
-         * whatever columns the read happened to load.
-         */
-        if (this.getRelationMetadata(model, field)) {
-            if (Array.isArray(value)) {
-                return value.map((element) => {
-                    return this.serializeRelationReference(element);
-                });
-            }
-            return this.serializeRelationReference(value);
-        }
-        return this.serializePlainValue(value);
-    }
-    serializeRelationReference(value) {
-        const id = RelationValueUtil.getRelationId(value);
-        // Not a reference at all: record it as it is rather than drop it.
-        if (!id) {
-            return this.serializePlainValue(value);
+            await recorder.recordCreate(data);
         }
-        const reference = { _id: id };
-        if (value && typeof value === "object") {
-            const name = this.toDisplayString(value["name"]);
-            if (name) {
-                reference["name"] = name;
-            }
+        catch (err) {
+            logger.warn("AuditLog: failed to record create event");
+            logger.warn(err);
         }
-        return reference;
     }
-    serializePlainValue(value) {
-        if (value === null || value === undefined) {
-            return null;
-        }
-        if (value instanceof ObjectID) {
-            return value.toString();
-        }
-        if (value instanceof Date) {
-            return value.toISOString();
-        }
-        if (typeof value === "string" ||
-            typeof value === "number" ||
-            typeof value === "boolean") {
-            return value;
+    async recordUpdate(data) {
+        const recorder = this.getRecorder();
+        if (!recorder) {
+            return;
         }
         try {
-            return JSON.parse(JSON.stringify(value));
+            await recorder.recordUpdate(data);
         }
-        catch (_a) {
-            return String(value);
-        }
-    }
-    /*
-     * Relation references are recorded with names so an entry reads
-     * "Production -> Staging" rather than as two ids. An update's before-row
-     * already carries the old names (DatabaseService selects them), but a
-     * payload usually carries ids only - so an unnamed reference first borrows
-     * the name of another reference to the same row in the same change, and
-     * whatever is still unnamed is looked up. Best effort: a failed lookup leaves
-     * the ids, and never costs the entry.
-     */
-    async addRelationNames(data) {
-        const pendingByModel = new Map();
-        for (const change of data.changes) {
-            const entry = change;
-            const metadata = this.getRelationMetadata(data.model, String(entry["field"]));
-            if (!metadata || !metadata.modelType) {
-                continue;
-            }
-            const references = [
-                ...this.getRelationReferences(entry["oldValue"]),
-                ...this.getRelationReferences(entry["newValue"]),
-            ];
-            const knownNames = new Map();
-            for (const reference of references) {
-                const name = reference["name"];
-                if (typeof name === "string" && name.length > 0) {
-                    knownNames.set(String(reference["_id"]).toLowerCase(), name);
-                }
-            }
-            for (const reference of references) {
-                if (reference["name"]) {
-                    continue;
-                }
-                const id = String(reference["_id"]).toLowerCase();
-                const knownName = knownNames.get(id);
-                if (knownName) {
-                    reference["name"] = knownName;
-                    continue;
-                }
-                let pending = pendingByModel.get(metadata.modelType);
-                if (!pending) {
-                    pending = {
-                        modelType: metadata.modelType,
-                        ids: new Set(),
-                        references: [],
-                    };
-                    pendingByModel.set(metadata.modelType, pending);
-                }
-                pending.ids.add(id);
-                pending.references.push(reference);
-            }
-        }
-        let remainingLookups = MAX_RELATION_NAME_LOOKUPS;
-        for (const pending of pendingByModel.values()) {
-            if (remainingLookups <= 0) {
-                break;
-            }
-            const ids = Array.from(pending.ids).slice(0, remainingLookups);
-            remainingLookups -= ids.length;
-            try {
-                const names = await this.findRelationNames({
-                    modelType: pending.modelType,
-                    ids,
-                    projectId: data.projectId,
-                });
-                for (const reference of pending.references) {
-                    const name = names.get(String(reference["_id"]).toLowerCase());
-                    if (name) {
-                        reference["name"] = name;
-                    }
-                }
-            }
-            catch (err) {
-                logger.warn("AuditLog: could not resolve the names of related resources; recording their ids only");
-                logger.warn(err);
-            }
-        }
-    }
-    getRelationReferences(value) {
-        const candidates = Array.isArray(value) ? value : [value];
-        return candidates.filter((candidate) => {
-            return (candidate !== null &&
-                typeof candidate === "object" &&
-                !Array.isArray(candidate) &&
-                typeof candidate["_id"] === "string");
-        });
-    }
-    /*
-     * Display names for related rows, keyed by lower-cased id.
-     *
-     * A user is named by their name, else their email, through the same cache
-     * the actor lookup uses. Any other model is named by its `name` column, and
-     * only rows inside the audited project are read: the ids come from the
-     * caller's payload, and naming a row that belongs to another project would
-     * copy that project's data into this project's audit trail. A model with no
-     * tenant column or no name column resolves nothing.
-     */
-    async findRelationNames(data) {
-        const names = new Map();
-        const ids = Array.from(new Set(data.ids.map((id) => {
-            return id.toLowerCase();
-        })));
-        if (ids.length === 0) {
-            return names;
-        }
-        const relatedModel = new data.modelType();
-        if (relatedModel instanceof User) {
-            for (const id of ids) {
-                const user = await this.getUserInfo(new ObjectID(id));
-                const name = (user === null || user === void 0 ? void 0 : user.name) || (user === null || user === void 0 ? void 0 : user.email) || null;
-                if (name) {
-                    names.set(id, name);
-                }
-            }
-            return names;
-        }
-        const tenantColumn = relatedModel.getTenantColumn();
-        if (!tenantColumn || !relatedModel.isTableColumn("name")) {
-            return names;
-        }
-        const rows = await this.getRelatedModelService(data.modelType).findBy({
-            query: {
-                _id: QueryHelper.any(ids.map((id) => {
-                    return new ObjectID(id);
-                })),
-                [tenantColumn]: data.projectId,
-            },
-            select: { _id: true, name: true },
-            skip: 0,
-            limit: ids.length,
-            props: { isRoot: true, ignoreHooks: true },
-        });
-        for (const row of rows) {
-            const name = this.toDisplayString(row["name"]);
-            if (row._id && name) {
-                names.set(row._id.toString().toLowerCase(), name);
-            }
-        }
-        return names;
-    }
-    /*
-     * A plain DatabaseService reads the related rows: the lookup needs no
-     * service hooks (it runs as root with hooks off), and going through a
-     * registry of concrete services would import every service into this one.
-     */
-    getRelatedModelService(modelType) {
-        let service = this.relatedModelServices.get(modelType);
-        if (!service) {
-            service = new DatabaseService(modelType);
-            this.relatedModelServices.set(modelType, service);
-        }
-        return service;
-    }
-    getResourceType(model) {
-        if (model.singularName) {
-            return model.singularName;
-        }
-        return model.constructor
-            .name;
-    }
-    getResourceName(item) {
-        const itemRecord = item;
-        for (const field of NAME_CANDIDATE_FIELDS) {
-            if (!item.isTableColumn(field)) {
-                continue;
-            }
-            const name = this.toDisplayString(itemRecord[field]);
-            if (name) {
-                return name;
-            }
+        catch (err) {
+            logger.warn("AuditLog: failed to record update event");
+            logger.warn(err);
         }
-        return null;
     }
-    /*
-     * The name a row has, or failing that the name of the row its
-     * resourceNameRelation points at - an SLO owner row is named after its user
-     * or team. Best effort: an entry is never lost for want of a name.
-     */
-    async resolveResourceName(data) {
-        var _a, _b;
-        const ownName = this.getResourceName(data.item);
-        if (ownName) {
-            return ownName;
-        }
-        const relation = (_a = data.model.enableAuditLogOn) === null || _a === void 0 ? void 0 : _a.resourceNameRelation;
-        if (!relation) {
-            return null;
-        }
-        const metadata = this.getRelationMetadata(data.model, relation);
-        if (!metadata ||
-            !metadata.modelType ||
-            metadata.type !== TableColumnType.Entity ||
-            !metadata.manyToOneRelationColumn) {
-            return null;
-        }
-        const relatedId = RelationValueUtil.getRelationId(data.item[metadata.manyToOneRelationColumn]);
-        if (!relatedId) {
-            return null;
+    async recordDelete(data) {
+        const recorder = this.getRecorder();
+        if (!recorder) {
+            return;
         }
         try {
-            const names = await this.findRelationNames({
-                modelType: metadata.modelType,
-                ids: [relatedId],
-                projectId: data.projectId,
-            });
-            return (_b = names.get(relatedId.toLowerCase())) !== null && _b !== void 0 ? _b : null;
+            await recorder.recordDelete(data);
         }
         catch (err) {
-            logger.warn("AuditLog: could not resolve the resource name; recording the entry without one");
+            logger.warn("AuditLog: failed to record delete event");
             logger.warn(err);
-            return null;
         }
     }
-    /*
-     * A non-empty display string for a stored value: a string as it is, and a
-     * value object (Name, Email) through its own toString. Anything else - a
-     * plain object stringifying to "[object Object]" - is not a name.
-     */
-    toDisplayString(value) {
-        if (typeof value === "string") {
-            return value.trim().length > 0 ? value : null;
-        }
-        if (value instanceof ObjectID || value === null || value === undefined) {
-            return null;
-        }
-        if (typeof value === "object") {
-            const text = String(value);
-            return text.trim().length > 0 && text !== "[object Object]" ? text : null;
-        }
-        return null;
+    // Null on the Community Edition (the facade also swallows a module's errors).
+    getRecorder() {
+        return EnterpriseEdition.getAuditLogRecorder();
     }
 }
 export default new AuditLogService();