Skip to content
Search

    Platform Services

    CAP Node.js provides dedicated client library support for common platform services.

    Audit Logging

    class cds.AuditLogService extends cds.MessagingService

    The cds.AuditLogService allows you to track security- and data privacy-relevant events in the SAP BTP Audit Log Service.

    You can connect to the cds.AuditLogService like to any other service using cds.connect. It is a subclass of cds.MessagingService as it shares the asynchronous vs. synchronous processing paradigm using .emit() and .send(), respectively.

    Example:

    const AuditLogService = await cds.connect.to('audit-log')
// .emit: log sent after tx committed
await AuditLogService.emit('<event>', { <data> })
// .send: log sent immediately (for example, if rollback on error required)
await AuditLogService.send('<event>', { <data> })

    The out of the box implementation uses cds.AuditLogService.emit().

    The messages are sent once the transaction is successful. See Messaging Outbox for more details.

    AuditLogService

    The following AuditLogService defines the supported events and their respective payloads. The supported events are dataAccessLog, dataModificationLog, configChangeLog, and securityLog.

    service AuditLogService {

  // Log read access to sensitive personal data
  event dataAccessLog {
    accesses         : array of Access;
  };

  // Log changes to personal data
  event dataModificationLog : {
    modifications : array of DataModification;
  };

  // Log config change
  event configChangeLog : {
    action         : String @assert.range enum { Create; Update; Delete };
    configurations : array of ConfigChange;
  };

  // Log security message
  event securityLog : {
    action : String;
    data   : String;
  };

}

// types

define type KeyValuePair {
  keyName : String;
  value   : String;
};

define type DataObject {
  type : String;
  id   : array of KeyValuePair;
};

define type DataSubject {
  type : String;
  id   : array of KeyValuePair;
  role : String;
};

define type Attribute {
  name : String;
};

define type Attachment {
  id   : String;
  name : String;
};

define type Access {
  dataObject  : DataObject;
  dataSubject : DataSubject;
  attributes  : array of Attribute;
  attachments : array of Attachment;
};

define type ChangedAttribute {
  name     : String;
  oldValue : String;
  newValue : String;
};

define type DataModification {
  dataObject  : DataObject;
  dataSubject : DataSubject;
  action      : String @assert.range enum { Create; Update; Delete; };
  attributes  : array of ChangedAttribute;
}

define type ConfigChange {
  dataObject : DataObject;
  attributes : array of ChangedAttribute;
};

    Currently, the model is not loaded at runtime, but merely serves as documentation of events and their respective payload. In the future, however, we plan to validate the payload passed to the respective events.

    All audit logging events except securityLog require user and tenant information. Hence, authentication must be enabled. If user or tenant information is not available, the default value anonymous is used. However, this defaulting is only meant to ease development.

    Out of the Box Audit Logging

    The Node.js runtime offers out of the box audit logging for personal data. That is, based on data privacy annotations, modifications of personal data and accesses to sensitive personal data are automatically emitted. Next to the fully annotated model, you have to set feature flag cds.env.features.audit_personal_data = true.

    ✉