Bad request after publish auditlog event

[yelisap]

Hi colleagues,

We have entities definition as follow. We can see the ServiceProvider from StockTransferTransportSettings entity is an optional fields.

After we adopt "@cap-js/audit-logging", when we create/update/delete this entity it will publish data.modification auditlog automatic.

But if ServiceProvider does not provider, It will send an auditlog event without data_subject.id. Then auditlog API will report 400 Bad Request.

Is it possible not send auditlog event in this case to avoid this issue?

@PersonalData: {
    EntitySemantics: 'DataSubject',
    DataSubjectRole: 'BusinessPartners'
}
entity Carriers : cuid {
    @PersonalData.FieldSemantics
    ID                    : String;
    @PersonalData.IsPotentiallyPersonal
    identifier        : String(60);
    @PersonalData.IsPotentiallyPersonal
    name              : String;
}

@PersonalData: {EntitySemantics: 'Other'}
entity StockTransferTransportSettings {
  ...
  @PersonalData                       : {
    FieldSemantics       : 'DataSubjectID',
    IsPotentiallyPersonal: true
  }
  ServiceProvider                : Association to one Carriers;
}

{
  "data_subject": {
    "role": "BusinessPartners",
    "type": "com.sap.sfm.erptransport.settings.TransportSettingService.ServiceProvider"
  },
  "object": {
    "type": "com.sap.sfm.erptransport.settings.TransportSettingService.StockTransferTransportSettings",
    "id": { "ID": "6adc5fea-d2aa-434e-88cd-56ea3ac09c80" }
  },
  "attributes": [
    { "name": "validityPeriod_validFrom", "new": "2033-03-20" },
    { "name": "validityPeriod_validTo", "new": "2033-03-20" },
    { "name": "mainModeOfTransport_code", "new": "AIR" },
    { "name": "comment", "new": "123" }
  ],
  "uuid": "e41db853-e2ac-48fe-8638-68c25aef1f47",
  "tenant": "$SUBSCRIBER",
  "user": "...",
  "time": "2025-09-05T01:51:35.155Z"
}

{
  "subject.id": "'data_subject.id' property cannot be null or empty"
}

[PDT42]

Hi @yelisap, I was able to reproduce the scenario that you outlined in a test. It is important to point out that for the plugin to try to write a log for an entity that has not filled the data subject id field, there needs to be at least one field annotated with either 'IsPotentiallyPersonal' or 'IsPotentiallySensitive', otherwise the modification will not contain an attribute and the emit logic will not proceed.

A possible fix for the issue you encountered could be to simply extend the filtering during emit by the condition that a data_subject.id is defined. However, I am not quite sure what this would mean for the logging:

Essentially, it would allow a user to interact with potentially personal or sensitive data, unaudited, as long as no data subject is referenced. Similarly, the reference could be temporarily broken and the data be changed (unaudited), before the reference is restored. IMO, instead of fixing this issue it may be more advisable to enforce something like @assert.integrity: true for association to one fields with @PersonalData.FieldSemantics: 'DataSubjectID'.

After briefly discussing this with my colleagues, there seems to be a tentative agreement that we should not change the current behavior. The data subject id for personal or sensitive data should be set from the start and should probably not be changed.

[sjvans]

hi @yelisap

could you please explain your scenario? when is it legal to have a StockTransferTransportSettings without a ServiceProvider?

best,
sebastian

[yelisap]

Hi @sjvans ,

In our use case, ServiceProvider is optional for StockTransferTransportSettings. Not sure this situation is a invalid use case or not?

Abut business purpose of this situation, I will check about it.

Best Regards
Ye Li