Add audit logging for sec events

[schiwekM]

Adding audit logging for sec events in case @cap-js/audit-logging is a dependency.

Depends on #404

[hyperspace-insights]

The PR introduces audit logging for security events (download rejected, size exceeded, upload rejected) by emitting named events from the attachments service and registering a handler that forwards them to @cap-js/audit-logging when present. The overall approach is sound, but there are a few correctness issues: a no-op ?? undefined that fails to suppress falsy-but-non-nullish IP values, a missing return after req.reject that could cause fall-through in non-throwing mock contexts, and a partial fake req object passed to validateAttachmentMimeType that may throw if _attachments is absent on the entity definition.

PR Bot Information

Version: 1.19.1 | 📖 Documentation | 🚨 Create Incident | 💬 Feedback

• Event Trigger: pull_request.opened
• LLM: anthropic--claude-4.6-sonnet
• Correlation ID: 31682370-2763-11f1-925e-15752cecceb9

[hyperspace-insights]

Summary

The following content is AI-generated and provides a summary of the pull request:

---

Add Audit Logging for Security Events

New Feature

✨ Introduces automatic audit logging for attachment security events when @cap-js/audit-logging is a dependency. Three new security events are now emitted and optionally forwarded to the audit log service: AttachmentDownloadRejected, AttachmentSizeExceeded, and AttachmentUploadRejected. Events are dispatched via cds.spawn to ensure they survive request transaction rollbacks.

Changes

• README.md: Added documentation for the new audit logging feature, describing the three security events and how to register custom handlers for them.
• lib/generic-handlers.js: Emits AttachmentDownloadRejected, AttachmentSizeExceeded, and AttachmentUploadRejected events (via cds.spawn) at the appropriate rejection points. Also converted validateAttachmentMimeType to an async function to support the new event emission.
• lib/helper.js: Added hasAuditLogging() utility function that safely checks whether @cap-js/audit-logging is available at runtime, and exported it.
• lib/plugin.js: Updated call to validateAttachmentMimeType to properly await the now-async function.
• srv/basic.js: Registers handlers for the three security events on the AttachmentsService when @cap-js/audit-logging is present, forwarding them as SecurityEvent entries to the audit log service.
• tests/incidents-app/package.json: Added @cap-js/audit-logging as a test dependency.
• tests/unit/auditLogging.test.js: New test suite verifying that security events are correctly logged as SecurityEvent entries when audit logging is enabled, and that no handlers are registered when the dependency is absent.
• tests/unit/rejectionEvents.test.js: New test suite covering emission of all three rejection events, error resilience, and the cds.spawn transaction isolation behavior.
• tests/unit/validateAttachmentMimeType.test.js: Updated unit tests to properly await the now-async validateAttachmentMimeType function.

---

• 🔄 Regenerate and Update Summary
• ✏️ Insert as PR Description (deletes this comment)
• 🗑️ Delete comment

PR Bot Information

Version: 1.19.1 | 📖 Documentation | 🚨 Create Incident | 💬 Feedback

• GithubContextProvider: feat: rejection events #404
• Output Template: Default Template
• Correlation ID: 5362aad0-2778-11f1-98c7-e76801f9f4e4
• Summary Prompt: Default Prompt
• LLM: anthropic--claude-4.6-sonnet
• Event Trigger: pull_request.ready_for_review

---

💌 Have ideas or want to contribute? Create an issue and share your thoughts with us!
📑 Check out the documentation for more information.
📬 Subscribe to the Hyperspace PR Bot DL to get the latest announcements and pilot features!

Made with ❤️ by Hyperspace.

[hyperspace-insights]

The PR introduces useful audit logging for security events but has several correctness issues: the hasAuditLogging() check is fragile and should use cds.env.requires["audit-log"] instead, msg.data is mutated in-place risking corruption for downstream handlers, and the IP address is captured lazily inside cds.spawn callbacks where the socket may already be closed — it should be snapshotted synchronously before the spawn in all three event-emitting paths. The README code example also omits await on cds.connect.to.

PR Bot Information

Version: 1.19.1 | 📖 Documentation | 🚨 Create Incident | 💬 Feedback

• Correlation ID: 5362aad0-2778-11f1-98c7-e76801f9f4e4
• LLM: anthropic--claude-4.6-sonnet
• Event Trigger: pull_request.ready_for_review