# GetChangeDetails

## Overview

GetChangeDetails retrieves all field-level change detail records linked to a specific audit entry. Returns a list of ChangeDetail records containing the fieldName, oldValue, and newValue for each field that changed, enabling precise before/after comparison at the field level.

This query requires the `viewAuditHistory` permission at the appropriate scope.

## Business Rules

- Lookup by `auditEntryId` returns all ChangeDetail records for that audit entry
- Returns an empty list if the audit entry has no change details
- Returns an error if the referenced audit entry does not exist
- Authorization is checked against the parent AuditEntry's scope: if the entry is company-scoped, the caller must hold `viewAuditHistory` for that company; if the entry is global, the caller must hold global-scoped `viewAuditHistory`
- A caller with company-scoped permission can only retrieve change details for entries belonging to their assigned companies
- A caller with global-scoped permission can retrieve change details for global (company-unscoped) entries
- ChangeDetail records reflect sensitivity mode processing applied at write time (values may be masked, hashed, or excluded)
- Caller must hold `viewAuditHistory` permission at the appropriate scope

## Process Flow

```mermaid
flowchart TD
    A[Receive query request] --> B{Caller has viewAuditHistory?}
    B -->|No| C[Return error: INSUFFICIENT_PERMISSION]
    B -->|Yes| D{AuditEntry exists?}
    D -->|No| E[Return error: AUDIT_ENTRY_NOT_FOUND]
    D -->|Yes| F{Caller authorized for entry's scope?}
    F -->|No| F2[Return error: UNAUTHORIZED]
    F -->|Yes| G[Query ChangeDetails by auditEntryId]
    G --> H[Return list of change details]
```

## External Dependencies

- None

## Error Scenarios

- **INSUFFICIENT_PERMISSION**: Caller lacks the required permission for this operation
- **UNAUTHORIZED**: Caller's permission scope does not cover the target resource
- **AUDIT_ENTRY_NOT_FOUND**: Referenced audit entry does not exist

## Test Cases

- returns all change details for an audit entry
- returns empty list when audit entry has no change details
- returns change details with masked values for MASK sensitivity mode
- returns change details with hashed values for HASH sensitivity mode
- returns change details with null values for EXCLUDE sensitivity mode
- returns change details with raw values for CAPTURE sensitivity mode
- returns change details for company-scoped entry when caller has matching company permission
- returns change details for global entry when caller has global-scoped permission
- rejects when caller lacks permission for entry's company scope
- returns error when audit entry does not exist
- rejects when caller lacks viewAuditHistory permission
