Welcome to @cap-js/audit-logging
About this project
@cap-js/audit-logging
is a CDS plugin providing integration to the SAP BTP Audit Logging Service as well as out-of-the-box personal data-related audit logging based on annotations.
Documentation can be found at cap.cloud.sap.
Requirements
See Getting Started on how to jumpstart your development and grow as you go with SAP Cloud Application Programming Model.
The end-to-end out-of-the-box functionality provided by this plugin requires a paid-for instance of the SAP Audit Logging Service for SAP BTP. However, it is possible to provide an own implementation that writes the audit logs to a custom store.
Support, Feedback, Contributing
This project is open to feature requests/suggestions, bug reports etc. via GitHub issues. Contribution and feedback are encouraged and always welcome. For more information about how to contribute, the project structure, as well as additional contribution information, see our Contribution Guidelines.
Code of Conduct
We as members, contributors, and leaders pledge to make participation in our community a harassment-free experience for everyone. By participating in this project, you agree to abide by its Code of Conduct at all times.
Licensing
Copyright 2023 SAP SE or an SAP affiliate company and contributors. Please see our LICENSE for copyright and license information. Detailed information including third-party components and their licensing/copyright information is available via the REUSE tool.
Version 0.1.0 - 2023-08-18
Added
- New API:
await audit.log('<event>', <data>)
for asynchronous logs (cf. emit
)
await audit.logSync('<event>', <data>)
for synchronous logs (cf. send
)
- New REST API-based schema with auto-filled
LogEntry
aspect
- New events
SensitiveDataRead
, PersonalDataModified
, ConfigurationModified
, and SecurityEvent
- Full support for OAuth2 plan of SAP Audit Log Service
Changed
- Whether reading sensitive data and modifying personal data is logged is determined by
cds.requires['audit-log'].handle: [...]
.
Possible values in the array are READ
and/ or WRITE
, with WRITE
as the sole default entry.
Hence, accessing sensitive data is not logged by default.
- Integration with SAP Audit Log Service via REST API instead of client library (
@sap/audit-logging
)
Fixed
- Various glitches in log calculation
Removed
- Old events
dataAccessLog
, dataModificationLog
, configChangeLog
, and securityLog
@AuditLog.Operation
annotations are ignored. Having the plugin as dependency signals the intent to audit log.
cds.features.audit_personal_data: true
is no longer necessary. Instead, simply add the plugin as a dependency.