As a Product Owner
I want documentation and compliance review for the audit log solution
So that we meet regulatory and business requirements.
As a Compliance Officer
I want changes to Quotes (Header and Items) to be audited, including old and new values
So that we can track the history of changes during the sales process.
As a Master Data Steward
I want changes to Customers and Locations to be audited
So that we can track manual edits versus S/4 synchronizations.
As a Security Admin
I want changes to User Configuration and Sales Area Access to be audited
So that we can detect unauthorized access changes or configuration drifts.
#### 25Q4-E10-11: Audit Logging for AI Assistant Configuration (Prompts & Personalities)
Priority: High
Story Points: 3
Status: Done (2026/01/09)
As a Product Owner
I want changes to AI Assistant Prompts and Configuration to be audited
So that I can track experiments with different personalities and system prompts.
As a Compliance Officer
I want to browse and view the Audit Logs in a user-friendly UI
So that I can inspect changes and their details (Old vs New values).
Acceptance Criteria
- Technical and user documentation is updated.
- Compliance team reviews and signs off on audit log implementation.
---
#### 25Q4-E10-07: Audit Logging for Transactional Data (Quote Updates)
Priority: Must Have
Story Points: 3
Status: Done (2026/01/09)
- `UPDATE` operations on `Quote` (Quotes app) trigger an audit log entry.
- Active Records Only: Changes to `*.drafts` are IGNORED. Only activation (Save) or direct updates to active entities are logged.
- Diff Logging: The `ChangeSummary` JSON includes a diff of changed fields (Old Value vs New Value).
- Custom Actions: Key actions like `calculateAIPrices` are logged if they modify data.
- Deletions: Deleting a Quote or Item is logged with `ActionType='DELETION'`.
#### 25Q4-E10-08: Audit Logging for Master Data (Customers & Locations)
Priority: Must Have
Story Points: 3
Status: Done (2026/01/09)
- `UPDATE` (and Creation/Deletion where applicable) on `Customers` and `Locations` are logged.
- Active Records Only: Ignore drafts.
- S/4 Sync: Updates triggered by "Refresh from S/4" or "Mass Import" must be logged with a clear Description (e.g., "Updated via S/4 Sync").
- Manual Edit: Manual updates via the UI are logged separately.
- Diff Logging: Capture changed fields (e.g., Address change: Old -> New).
#### 25Q4-E10-09: Audit Logging for Security & Configuration
Priority: Critical
Story Points: 3
Status: Done (2026/01/09)
- `UPDATE/CREATE/DELETE` operations on `AIAssistantConfig` and `AIAssistantPrompt` are logged.
- Active Records Only: Ignore drafts.
- Diff Logging: Capture exact changes to the `SharedSystemPrompt` or `Personality` text.
#### 25Q4-E10-10: Visualization of Audit Logs (Fiori App)
Priority: High
Story Points: 3
Status: Done (2026/01/09)
- List Report: View a list of "Audited Entities" (Quote, Customer, etc.).
- Object Page: Drill down into an entity to see its timeline of changes (Audit Details).
- Detail View: See the `ChangeSummary` JSON diff clearly (e.g., in a text area or formatted view).
- Scope: Implemented in `app/auditlogs` Fiori Elements app.
- `UPDATE`, `CREATE`, `DELETE` on `UserConfigurations` and `UserSalesAreaAccess` are logged.
- Active Records Only: Ignore drafts.
- Specifics: Log when a user is assigned a new Sales Area or a Default Sales Area is changed.
- Diff Logging: Complete "Before/After" snapshot in `ChangeSummary` is preferred for security configs.
---
Technical Implementation Notes:
- Entities:
- `AuditLogHeader`: `AuditLogID` (UUID), `EntityName`, `EntityID`.
- `AuditLogDetail`: `AuditLogDetailID` (UUID), `PerformedBy` (User), `PerformedAt` (Timestamp), `ActionType` (UPDATE, DELETE, SYNC, SECURITY_CHANGE), `Description`, `ChangeSummary` (LargeString/JSON).
- Diff Logic: Use a shared helper `auditLogUtils.computeDiff(oldData, newData)` to generate standard JSON: `{ "field": { "old": "X", "new": "Y" } }`.
- Active Only: Handlers must verify `req.entity.endsWith('.drafts') === false`.
- Handler Strategy: In `before('UPDATE')`, read the current DB state. Compare with `req.data`. If changed, write to Audit Log (or buffer to write in `after` if transaction success is required).
---