@sap/cds-dk 10.0.6 → 10.1.0

package/node_modules/@sap/cds/libx/_runtime/messaging/common-utils/authorizedRequest.js

@@ -22,9 +22,10 @@ const authorizedRequest = ({ method, uri, path, oa2, tenant, dataObj, headers, t
           method
         }
 
+        // EMIS management API requires a body for write requests, even if empty
         let data
-        if (dataObj) {
-          data = JSON.stringify(dataObj)
+        if (dataObj || method === 'PUT' || method === 'POST') {
+          data = JSON.stringify(dataObj ?? {})
           httpOptions.headers['Content-Type'] = 'application/json'
           httpOptions.headers['Content-Length'] = Buffer.byteLength(data)
         }

package/node_modules/@sap/cds/libx/_runtime/messaging/enterprise-messaging-utils/registerEndpoints.js

@@ -20,16 +20,18 @@ class EndpointRegistry {
     this.webhookCallbacks = new Map()
     this.deployCallbacks = new Map()
 
-    const _IS_SECURED = !!(
+    const _HAS_APP_AUTH = !!(
       cds.env.requires.auth &&
       (cds.env.requires.auth.impl || !(cds.env.requires.auth.kind in { mocked: 1, 'mocked-auth': 1 }))
     )
+    const _HAS_MESSAGING_XSUAA = !!cds.env.requires.messaging?.xsuaa
+    const _IS_SECURED = _HAS_APP_AUTH || _HAS_MESSAGING_XSUAA
     const _IS_PRODUCTION = process.env.NODE_ENV === 'production'
 
     cds.app.use(basePath, cds.middlewares.context())
     if (_IS_SECURED) {
       // unofficial XSUAA fallback
-      if (cds.env.requires.messaging?.xsuaa) {
+      if (_HAS_MESSAGING_XSUAA) {
         cds.app.use(basePath, _xsuaa_fallback())
       } else {
         cds.app.use(basePath, cds.middlewares.auth())
@@ -38,7 +40,11 @@ class EndpointRegistry {
       cds.app.use(basePath, (_req, _res, next) => {
         next(cds.context.user._is_anonymous ? 401 : undefined)
       })
-    } else if (_IS_PRODUCTION) LOG.warn('Messaging endpoints not secured')
+    } else if (_IS_PRODUCTION) {
+      throw new Error(
+        'Messaging endpoints require authentication in production. Configure cds.requires.auth or cds.requires.messaging.xsuaa.'
+      )
+    }
 
     cds.app.use(basePath, express.json({ type: 'application/*+json' }))
     cds.app.use(basePath, express.json())

package/node_modules/@sap/cds/libx/_runtime/remote/Service.js

@@ -1,10 +1,5 @@
 const cds = require('../cds')
-const {
-  getCloudSdk,
-  getCloudSdkConnectivity,
-  getCloudSdkResilience,
-  shouldUseCloudSdk
-} = require('./utils/cloudSdkProvider')
+const { getCloudSdk, getCloudSdkResilience, shouldUseCloudSdk } = require('./utils/cloudSdkProvider')
 const { run } = require('./utils/client')
 const { extractRequestConfig } = require('./utils/query')
 const { hasAliasedColumns } = require('./utils/data')
@@ -171,13 +166,6 @@ const _isSelectWithAliasedColumns = q => q?.SELECT && !q._transitions && q.SELEC
 
 const resolvedTargetOfQuery = q => q?._transitions?.at(-1)?.target
 
-const _resolveSelectionStrategy = selectionStrategy => {
-  const { DestinationSelectionStrategies } = getCloudSdkConnectivity()
-  const strategy = DestinationSelectionStrategies[selectionStrategy]
-  if (typeof strategy !== 'function') cds.error`Unsupported destination selection strategy "${selectionStrategy}".`
-  return strategy
-}
-
 const _getKind = options => {
   let kind = options.credentials?.kind ?? options.kind
   if (typeof kind === 'object') {
@@ -206,9 +194,6 @@ class RemoteService extends cds.Service {
       this.datasource = this.options.datasource
 
       this.destinationOptions = this.options.destinationOptions || {}
-      if (typeof this.destinationOptions.selectionStrategy === 'string') {
-        this.destinationOptions.selectionStrategy = _resolveSelectionStrategy(this.destinationOptions.selectionStrategy)
-      }
 
       if (this.options.credentials.destination) this.destination = this.options.credentials.destination
       else this.destination = _getDestination(this.definition?.name ?? this.datasource, this.options.credentials)
@@ -223,7 +208,7 @@ class RemoteService extends cds.Service {
 
       // This is required for BAS creating remote services only for events
       // Middlewares are created at time of the first request, on the fly
-      if (shouldUseCloudSdk(this.destination)) {
+      if (shouldUseCloudSdk()) {
         this.middlewares = {
           timeout: getCloudSdkResilience().timeout(this.requestTimeout),
           csrf: this.csrf && getCloudSdk().csrf(this.csrf)
@@ -249,7 +234,7 @@ class RemoteService extends cds.Service {
       if (typeof this.destination === 'object' && !this.destination.url)
         cds.error`"url" or "destination" property must be configured in "credentials" of "${this.name}".`
 
-      const requestConfig = extractRequestConfig(req, query, this)
+      const requestConfig = extractRequestConfig(req, this)
       requestConfig.headers = _getHeaders(requestConfig.headers, req)
 
       if (this.kind === 'hcql' && req.iterator && !req.objectMode)
@@ -284,7 +269,7 @@ class RemoteService extends cds.Service {
       if (jwt) additionalOptions.jwt = jwt
 
       const csrfConfig = requestConfig._autoBatchedGet ? this.csrfInBatch : this.csrf
-      if (shouldUseCloudSdk(this.destination)) {
+      if (shouldUseCloudSdk()) {
         // Mount resilience and csrf middlewares for SAP Cloud SDK
         requestConfig.middleware = [this.middlewares.timeout]
         if (csrfConfig && this.middlewares.csrf) requestConfig.middleware.push(this.middlewares.csrf)

package/node_modules/@sap/cds/libx/_runtime/remote/utils/LruCache.js

@@ -0,0 +1,42 @@
+/**
+ * LRU cache backed by Map insertion order.
+ * On get/set the entry is moved to the MRU end; the LRU entry (first key) is
+ * evicted when the map is full. `maxSize = 0` means unlimited.
+ */
+class LruCache {
+  /** @param {number} [maxSize=0] Maximum number of entries; 0 = unlimited. */
+  constructor(maxSize = 0) {
+    this._map = new Map()
+    this._maxSize = maxSize
+  }
+
+  /** @param {*} key Cache key. */
+  get(key) {
+    const value = this._map.get(key)
+    if (value !== undefined) {
+      this._map.delete(key)
+      this._map.set(key, value)
+    }
+    return value
+  }
+
+  /**
+   * @param {*} key Cache key. `null` and `undefined` are ignored.
+   * @param {*} value Value to store.
+   * @param {number} [ttl] Time-to-live in milliseconds. Entry is auto-deleted after this duration.
+   */
+  set(key, value, ttl) {
+    if (key == null) return
+    this._map.delete(key)
+    if (this._maxSize > 0 && this._map.size >= this._maxSize) this._map.delete(this._map.keys().next().value)
+    this._map.set(key, value)
+    if (ttl > 0) setTimeout(() => this._map.delete(key), ttl).unref()
+  }
+
+  /** @param {*} key Cache key. */
+  delete(key) {
+    this._map.delete(key)
+  }
+}
+
+module.exports = { LruCache }

package/node_modules/@sap/cds/libx/_runtime/remote/utils/client.js

@@ -1,7 +1,7 @@
 const cds = require('../../cds')
 const LOG = cds.log('remote')
 
-const { getCloudSdk, shouldUseCloudSdk } = require('./cloudSdkProvider')
+const { getCloudSdk, getCloudSdkConnectivity, shouldUseCloudSdk } = require('./cloudSdkProvider')
 const { executeHttpRequest: fetchExecuteHttpRequest } = require('./fetchClient')
 
 const SANITIZE_VALUES = process.env.NODE_ENV === 'production' && cds.env.log.sanitize_values !== false
@@ -27,7 +27,6 @@ const _sanitizeHeaders = headers => {
 }
 
 const _executeHttpRequest = async ({ requestConfig, destination, destinationOptions, jwt }) => {
-  const useCloudSdk = shouldUseCloudSdk(destination)
   if (typeof destination === 'string') {
     destination = { destinationName: destination, ...destinationOptions }
     if (destination.jwt === undefined) destination.jwt = jwt
@@ -48,7 +47,7 @@ const _executeHttpRequest = async ({ requestConfig, destination, destinationOpti
   const maxBodyLength = cds.env?.remote?.max_body_length
   if (maxBodyLength) requestConfig.maxBodyLength = maxBodyLength
 
-  if (useCloudSdk) {
+  if (shouldUseCloudSdk()) {
     const { executeHttpRequestWithOrigin } = getCloudSdk()
     // cloud sdk requires a new mechanism to differentiate the priority of headers
     // "custom" keeps the highest priority as before
@@ -56,6 +55,15 @@ const _executeHttpRequest = async ({ requestConfig, destination, destinationOpti
       ...requestConfig,
       headers: { custom: { ...requestConfig.headers } }
     }
+    // selectionStrategy is kept as a plain string in destinationOptions;
+    // Cloud SDK needs the corresponding function — resolve it lazily here
+    if (typeof destination.selectionStrategy === 'string') {
+      const { DestinationSelectionStrategies } = getCloudSdkConnectivity()
+      const strategy = DestinationSelectionStrategies[destination.selectionStrategy]
+      if (typeof strategy !== 'function')
+        cds.error`Unsupported destination selection strategy "${destination.selectionStrategy}".`
+      destination = { ...destination, selectionStrategy: strategy }
+    }
     if (LOG._debug) LOG.debug('Executing via @sap-cloud-sdk/http-client.')
     return executeHttpRequestWithOrigin(destination, sdkConfig, { fetchCsrfToken: false })
   }
@@ -270,8 +278,10 @@ module.exports.run = async (requestConfig, options) => {
 
   if (kind === 'hcql') {
     if (response.headers?.['content-type']?.includes('application/octet-stream')) return response.data
-    let { data = [], affected } = response.data
+    let { data = [], affected, $count } = response.data
     if (affected !== undefined) data.affected = affected
+    if ($count == null && response.headers['x-total-count']) $count = Number(response.headers['x-total-count'])
+    if ($count !== undefined) data.$count = $count
     return data
   }
 

package/node_modules/@sap/cds/libx/_runtime/remote/utils/cloudSdkProvider.js

@@ -1,5 +1,4 @@
 const cds = require('../../cds')
-const { findLocalDestinations } = require('./fetchClient')
 
 const _require = module => {
   try {
@@ -39,14 +38,8 @@ const isCloudSdkInstalled = () => {
   return _cloudSdkInstalled
 }
 
-const shouldUseCloudSdk = destination => {
-  // Native node fetch for named destinations is supported only if locally resolvable via process.env.destinations
-  const _destination = typeof destination === 'string' ? findLocalDestinations(destination)[0] : destination
-  if (!_destination?.url) return true
-  if (_destination.authentication && !(_destination.authentication in { NoAuthentication: 1, BasicAuthentication: 1 }))
-    return true
-  // here, it would be _possible_ to use native fetch
-  // explicit config?
+const shouldUseCloudSdk = () => {
+  // Explicit config takes priority
   if (cds.env.remote?.native_fetch != null) return !cds.env.remote.native_fetch
   // if cloud sdk is there, use it
   return isCloudSdkInstalled()

package/node_modules/@sap/cds/libx/_runtime/remote/utils/destinationClient.js

@@ -0,0 +1,150 @@
+const cds = require('../../cds')
+const { getToken } = require('./token')
+const { LruCache } = require('./LruCache')
+const { isTimeoutError, getTimeoutError } = require('./error')
+
+const LOG = cds.log('remote')
+
+const _destinationCache = new LruCache(cds.env.remote.cache_size)
+
+let BUFFER_MS
+
+const SUPPORTED_AUTH_TYPES = { NoAuthentication: 1, BasicAuthentication: 1, OAuth2ClientCredentials: 1 }
+
+const HEADERS_PREFIX = 'URL.headers.'
+const QUERIES_PREFIX = 'URL.queries.'
+
+const _decodeJwt = jwt => {
+  try {
+    const payload = JSON.parse(Buffer.from(jwt.split('.')[1], 'base64url').toString())
+    const { zid, app_tid, zone_uuid, user_id, user_uuid } = payload
+    return { tenant: zid || app_tid || zone_uuid, user: user_id || user_uuid }
+  } catch {
+    LOG.warn('Failed to decode JWT payload')
+    return {}
+  }
+}
+
+const _identity = jwt => {
+  const { tenant, user } = (jwt ? _decodeJwt(jwt) : cds.context) ?? {}
+  return { tenant, user: user?.id ?? user }
+}
+
+const _fetchDestination = async (uri, name, token, userJwt) => {
+  const headers = { authorization: `Bearer ${token}` }
+  // Note: Cloud SDK only sends x-user-token for OAuth2UserTokenExchange/OAuth2SAMLBearerAssertion
+  if (userJwt) headers['x-user-token'] = userJwt
+  LOG._debug && LOG.debug(`Fetching destination '${name}'`)
+
+  const { timeout } = cds.env.remote
+  const signal = AbortSignal.timeout(cds.utils.ms4(timeout))
+  let res
+  try {
+    res = await fetch(`${uri}/destination-configuration/v1/destinations/${encodeURIComponent(name)}`, {
+      headers,
+      signal
+    })
+  } catch (e) {
+    if (isTimeoutError(e)) throw getTimeoutError(e, `Fetching destination '${name}'`, timeout)
+    throw e
+  }
+
+  if (res.status === 404) return null
+  if (!res.ok) throw new Error(`Fetching destination '${name}' failed with status ${res.status}.`)
+  return res.json()
+}
+
+const _processResponse = ({ destinationConfiguration: dc, authTokens }) => {
+  if (!(dc.Authentication in SUPPORTED_AUTH_TYPES))
+    LOG.warn(`Auth type ${dc.Authentication} is not yet supported. Falling back to best-effort.`)
+
+  const authToken = authTokens?.[0]
+  const headers = {}
+  if (authToken?.error != null) throw new Error(`Destination returned auth token error: ${authToken.error}`)
+  if (authToken?.http_header) headers[authToken.http_header.key.toLowerCase()] = authToken.http_header.value
+  if (dc['sap-client']) headers['sap-client'] = dc['sap-client']
+
+  const queryParameters = {}
+  for (const [k, v] of Object.entries(dc)) {
+    if (k.startsWith(HEADERS_PREFIX)) headers[k.slice(HEADERS_PREFIX.length).toLowerCase()] = v
+    else if (k.startsWith(QUERIES_PREFIX)) queryParameters[k.slice(QUERIES_PREFIX.length)] = v
+  }
+
+  const expiresIn = authToken?.expiresIn && Number(authToken.expiresIn)
+
+  return {
+    url: dc.URL,
+    authentication: dc.Authentication,
+    expiresIn,
+    ...(Object.keys(headers).length && { headers }),
+    ...(Object.keys(queryParameters).length && { queryParameters })
+  }
+}
+
+const _lookup = async (creds, destinationName, tenant, jwt) => {
+  if (tenant) {
+    const subscriberToken = await getToken(creds, tenant)
+    const subscriberResult = await _fetchDestination(creds.uri, destinationName, subscriberToken, jwt)
+    if (subscriberResult) {
+      LOG._debug && LOG.debug(`Destination '${destinationName}' resolved for subscriber tenant '${tenant}'`)
+      return _processResponse(subscriberResult)
+    }
+    LOG._debug &&
+      LOG.debug(
+        `Destination '${destinationName}' not found for subscriber tenant '${tenant}', falling back to provider`
+      )
+  }
+
+  const providerToken = await getToken(creds)
+  const providerResult = await _fetchDestination(creds.uri, destinationName, providerToken)
+  if (providerResult) {
+    LOG._debug && LOG.debug(`Destination '${destinationName}' resolved for provider tenant`)
+    return _processResponse(providerResult)
+  }
+
+  throw new Error(`Destination '${destinationName}' not found.`)
+}
+
+const getDestination = async (destinationName, { jwt } = {}) => {
+  const creds = cds.env.requires?.destinations?.credentials
+  if (!creds?.uri || !creds?.clientid) {
+    LOG._debug && LOG.debug('No Destination Service credentials found')
+    return null
+  }
+
+  LOG._debug && LOG.debug(`Resolving destination '${destinationName}'`)
+
+  const { tenant, user } = _identity(jwt)
+  // JWT present but no tenant claim — skip cache to avoid cross-tenant pollution
+  const cacheKey = jwt && !tenant ? undefined : [destinationName, tenant, user].filter(Boolean).join(':')
+  if (!cacheKey) LOG._debug && LOG.debug(`Destination '${destinationName}': JWT has no tenant claim, skipping cache`)
+
+  const cached = _destinationCache.get(cacheKey)
+  if (cached) {
+    LOG._debug && LOG.debug(`Destination '${destinationName}' served from cache`)
+    return cached
+  }
+
+  const promise = _lookup(creds, destinationName, tenant, jwt)
+    .then(resolved => {
+      if (!resolved) return null
+      const { expiresIn = 60 * 60, ...destination } = resolved
+      const expiresInMs = expiresIn * 1000
+      BUFFER_MS ??= cds.utils.ms4(cds.env.remote.cache_expiry_buffer)
+      const ttl = Math.max(0, expiresInMs - BUFFER_MS)
+      LOG._debug && LOG.debug(`Destination for '${cacheKey}' cached for ${ttl}ms`)
+      _destinationCache.set(cacheKey, destination, ttl)
+      return destination
+    })
+    .catch(err => {
+      LOG.warn(`Failed to resolve destination '${destinationName}':`, err.message)
+      _destinationCache.delete(cacheKey)
+      throw err
+    })
+
+  // cache promise immediately to deduplicate concurrent in-flight requests
+  _destinationCache.set(cacheKey, promise)
+  return promise
+}
+
+module.exports = { getDestination }

package/node_modules/@sap/cds/libx/_runtime/remote/utils/error.js

@@ -0,0 +1,13 @@
+const isTimeoutError = e => e.name === 'TimeoutError'
+
+/**
+ * @param {Error} cause
+ * @param {string} prefix
+ * @param {number|string} timeout
+ */
+const getTimeoutError = (cause, prefix, timeout) =>
+  Object.assign(new Error(`${prefix} exceeded timeout of ${typeof timeout === 'number' ? `${timeout}ms` : timeout}.`), {
+    cause
+  })
+
+module.exports = { isTimeoutError, getTimeoutError }

package/node_modules/@sap/cds/libx/_runtime/remote/utils/fetchClient.js

@@ -2,6 +2,8 @@ const cds = require('../../cds')
 const LOG = cds.log('remote')
 
 const { Readable } = require('stream')
+const { getDestination } = require('./destinationClient')
+const { isTimeoutError, getTimeoutError } = require('./error')
 
 // process.env.destinations — CloudSDK convention for local destination resolution:
 // a JSON array of { name, url, ... } objects, e.g. for local development or testing.
@@ -23,7 +25,7 @@ const _normalizeAuthentication = destination => {
   return { ...destination, authentication }
 }
 
-const _resolveDestination = destination => {
+const _resolveDestination = async destination => {
   if (destination.url) return _normalizeAuthentication(destination)
 
   const matches = findLocalDestinations(destination.destinationName)
@@ -38,7 +40,8 @@ const _resolveDestination = destination => {
     return _normalizeAuthentication({ ...destination, ...found })
   }
 
-  // REVISIT: resolve named destination via BTP Destination Service
+  const fetched = await getDestination(destination.destinationName, { jwt: destination.jwt })
+  if (fetched) return _normalizeAuthentication({ ...destination, ...fetched })
 
   throw new Error(`Cannot resolve destination '${destination.destinationName}'.`)
 }
@@ -109,11 +112,19 @@ const _readBody = async (response, responseType) => {
  */
 const executeHttpRequest = async (destination, requestConfig) => {
   // Resolve destination
-  destination = _resolveDestination(destination)
+  destination = await _resolveDestination(destination)
   const baseUrl = (destination.url || '').replace(/\/$/, '')
 
-  const { method = 'GET', url = '', data, responseType, maxBodyLength, timeout, csrf } = requestConfig
-  const signal = timeout ? AbortSignal.timeout(timeout) : undefined // eslint-disable-line no-undef
+  const {
+    method = 'GET',
+    url = '',
+    data,
+    responseType,
+    maxBodyLength,
+    timeout = cds.env.remote.timeout,
+    csrf
+  } = requestConfig
+  const signal = timeout && AbortSignal.timeout(cds.utils.ms4(timeout))
 
   // Assemble headers
   const headers = { ...destination.headers, ...requestConfig.headers }
@@ -122,10 +133,16 @@ const executeHttpRequest = async (destination, requestConfig) => {
     headers.authorization = 'Basic ' + Buffer.from(`${username}:${password}`).toString('base64')
   }
 
-  const urlWithoutQuery = baseUrl + (url && !url.startsWith('/') ? `/${url}` : url)
+  // Build full URL
+  let fullUrl = baseUrl + (url && !url.startsWith('/') ? `/${url}` : url)
+  const queryParameters = { ...destination.queryParameters, ...requestConfig.params }
+  if (Object.keys(queryParameters).length) {
+    const qs = new URLSearchParams(Object.entries(queryParameters).map(([k, v]) => [k, String(v)])).toString()
+    fullUrl += (fullUrl.includes('?') ? '&' : '?') + qs
+  }
 
   if (csrf && method !== 'GET' && method !== 'HEAD') {
-    const result = await _fetchCsrfToken(urlWithoutQuery, headers, csrf, signal)
+    const result = await _fetchCsrfToken(fullUrl.split('?')[0], headers, csrf, signal)
     if (result?.token) headers['x-csrf-token'] = result.token
     if (result?.cookie) headers.cookie = headers.cookie ? `${headers.cookie};${result.cookie}` : result.cookie
   }
@@ -143,14 +160,6 @@ const executeHttpRequest = async (destination, requestConfig) => {
       throw new Error(`Request body length ${len} exceeds configured max_body_length ${maxBodyLength}.`)
   }
 
-  // Build full URL
-  const { queryParameters } = destination
-  let fullUrl = urlWithoutQuery
-  if (queryParameters && Object.keys(queryParameters).length) {
-    const qs = new URLSearchParams(Object.entries(queryParameters).map(([k, v]) => [k, String(v)])).toString()
-    fullUrl += (fullUrl.includes('?') ? '&' : '?') + qs
-  }
-
   if (LOG._debug) LOG.debug(`${method} ${fullUrl}`)
 
   // Execute request
@@ -158,9 +167,8 @@ const executeHttpRequest = async (destination, requestConfig) => {
   try {
     response = await fetch(fullUrl, { method, headers, body, signal })
   } catch (e) {
-    const timedOut = e.name === 'TimeoutError'
-    const msg = timedOut ? `Exceeded timeout of ${timeout}ms.` : e.message
-    throw Object.assign(new Error(msg), { cause: e })
+    if (isTimeoutError(e)) throw getTimeoutError(e, 'Remote request', timeout)
+    throw e
   }
 
   // Parse response

package/node_modules/@sap/cds/libx/_runtime/remote/utils/query.js

@@ -25,38 +25,39 @@ const _cqnWithPublicEntries = query => {
   return Object.fromEntries(Object.entries(query).filter(([key]) => !key.startsWith('_')))
 }
 
-const _cqnToHcqlRequestConfig = cqn => {
+const _extractHcqlRequestConfig = cqn => {
+  if (cqn.flat) cqn.flat()
+
   if (cqn.SELECT && cqn.SELECT.from) return { method: 'POST', data: { SELECT: _cqnWithPublicEntries(cqn.SELECT) } }
   if (cqn.INSERT && cqn.INSERT.into) return { method: 'POST', data: { INSERT: _cqnWithPublicEntries(cqn.INSERT) } }
   if (cqn.UPDATE && cqn.UPDATE.entity) return { method: 'POST', data: { UPDATE: _cqnWithPublicEntries(cqn.UPDATE) } }
   if (cqn.UPSERT && cqn.UPSERT.into) return { method: 'POST', data: { UPSERT: _cqnWithPublicEntries(cqn.UPSERT) } }
   if (cqn.DELETE && cqn.DELETE.from) return { method: 'POST', data: { DELETE: _cqnWithPublicEntries(cqn.DELETE) } }
 
-  cds.error(400, 'Invalid CQN object can not be processed.', JSON.stringify(cqn), _cqnToHcqlRequestConfig)
+  cds.error(400, 'Invalid CQN object can not be processed.', JSON.stringify(cqn), _extractHcqlRequestConfig)
 }
 
-const _cqnToRequestConfig = (query, service, req) => {
-  const { kind, model } = service
+const _extractODataRequestConfig = (req, srv) => {
+  if (req.query.UPDATE?.where) cds.error(400, 'Filtering is not supported to specify the subject of UPDATE requests')
+  if (req.query.DELETE?.where) cds.error(400, 'Filtering is not supported to specify the subject of DELETE requests')
 
-  const queryObject = cds.odata.urlify(query, { kind, model, method: req.method })
+  const queryObject = cds.odata.urlify(req, srv)
 
   const requestConfig = {
     method: queryObject.method,
-    url: queryObject.path
-      // REVISIT: remove when we can assume that number of remote services running Okra is negligible
-      // ugly workaround for Okra not allowing spaces in ( x eq 1 )
-      .replace(/\( /g, '(')
-      .replace(/ \)/g, ')')
+    // REVISIT: remove when we can assume that number of remote services running Okra is negligible
+    // ugly workaround for Okra not allowing spaces in ( x eq 1 )
+    url: queryObject.path.replace(/\( /g, '(').replace(/ \)/g, ')')
   }
 
   if (queryObject.method !== 'GET' && queryObject.method !== 'HEAD') {
-    requestConfig.data = kind === 'odata-v2' ? convertV2PayloadData(queryObject.body, req.target) : queryObject.body
+    requestConfig.data = srv.kind === 'odata-v2' ? convertV2PayloadData(queryObject.body, req.target) : queryObject.body
   }
 
   return requestConfig
 }
 
-const _stringToRequestConfig = (query, data, target) => {
+const _createODataRequestConfig = (query, data, target, srvKind) => {
   const cleanQuery = query.trim()
   const blankIndex = cleanQuery.substring(0, 8).indexOf(' ')
 
@@ -66,13 +67,13 @@ const _stringToRequestConfig = (query, data, target) => {
   }
 
   if (data && requestConfig.method !== 'GET' && requestConfig.method !== 'HEAD') {
-    requestConfig.data = this.kind === 'odata-v2' ? Object.assign({}, convertV2PayloadData(data, target)) : data
+    requestConfig.data = srvKind === 'odata-v2' ? Object.assign({}, convertV2PayloadData(data, target)) : data
   }
 
   return requestConfig
 }
 
-const _pathToRequestConfig = (method, path, data, target, srvName) => {
+const _pathToRequestConfig = (method, path, data, target, srvName, srvKind) => {
   let url = path
 
   if (!url.startsWith('/')) {
@@ -88,7 +89,7 @@ const _pathToRequestConfig = (method, path, data, target, srvName) => {
 
   const requestConfig = { method, url }
   if (data && requestConfig.method !== 'GET' && requestConfig.method !== 'HEAD') {
-    requestConfig.data = this.kind === 'odata-v2' ? Object.assign({}, convertV2PayloadData(data, target)) : data
+    requestConfig.data = srvKind === 'odata-v2' ? Object.assign({}, convertV2PayloadData(data, target)) : data
   }
 
   return requestConfig
@@ -101,12 +102,22 @@ const _hasHeader = (headers, header) =>
 
 const KINDS_SUPPORTING_BATCH = { odata: true, 'odata-v2': true, 'odata-v4': true }
 
-const _extractRequestConfig = (req, query, service) => {
-  if (service.kind === 'hcql' && typeof query === 'object') return _cqnToHcqlRequestConfig(query)
-  if (typeof query === 'object') return _cqnToRequestConfig(query, service, req)
-  if (typeof query === 'string') return _stringToRequestConfig(query, req.data, req.target)
-  //> no model, no service.definition
-  return _pathToRequestConfig(req.method, req.path, req.data, req.target, service.definition?.name || service.namespace)
+const _extractRequestConfig = (req, srv) => {
+  // REVISIT: Split off the other 'kind's here? odata / odata-v4, odata-v2, rest ...
+
+  if (srv.kind === 'hcql' && typeof req.query === 'object') return _extractHcqlRequestConfig(req.query)
+  if (typeof req.query === 'object') return _extractODataRequestConfig(req, srv)
+  if (typeof req.query === 'string') return _createODataRequestConfig(req.query, req.data, req.target, srv.kind)
+
+  // > no model, no service.definition
+  return _pathToRequestConfig(
+    req.method,
+    req.path,
+    req.data,
+    req.target,
+    srv.definition?.name || srv.namespace,
+    srv.kind
+  )
 }
 
 const _batchEnvelope = (requestConfig, maxGetUrlLength) => {
@@ -137,8 +148,8 @@ const _batchEnvelope = (requestConfig, maxGetUrlLength) => {
   requestConfig.data = batchedRequest
 }
 
-module.exports.extractRequestConfig = (req, query, service) => {
-  const requestConfig = _extractRequestConfig(req, query, service)
+module.exports.extractRequestConfig = (req, service) => {
+  const requestConfig = _extractRequestConfig(req, service)
 
   if (service.kind === 'odata-v2' && req.event === 'READ' && requestConfig.url?.match(/(\/any\()|(\/all\()/)) {
     req.reject(501, 'Lambda expressions are not supported in OData v2')